forgot to build

Wiifit

.gitignore

@@ -33,3 +33,4 @@ server/data/identity.sqlite
 server/data/barcode-games.json
 server/data/identity.sqlite-shm
 server/data/identity.sqlite-wal
+server/src/services/balanceBoardService/native/balance_board_worker

README.md

@@ -4,6 +4,8 @@ A system for controlling create 2 compatible roombas through a webpage.
 You can explore my basement through this project here:
 https://rover.otter.land
 
+*some of this code was created with help from large language models, and some of it was written by me. This project would not have been possible for me to create without it.*
+
 ## This guide is a work in progress, it will cover:
 - Building rovers
 - Installing roverd on a rover's raspberry pi

pi/bin/roverd-self-update.sh

@@ -29,6 +29,15 @@ if [[ "${EUID}" -ne 0 ]]; then
 	exit 1
 fi
 
+if [[ "${ROVERD_SELF_UPDATE_SYSTEMD:-}" != "1" ]] && command -v systemd-run >/dev/null 2>&1; then
+	exec systemd-run \
+		--unit=roverd-self-update \
+		--collect \
+		--property=Type=exec \
+		--setenv=ROVERD_SELF_UPDATE_SYSTEMD=1 \
+		"$0"
+fi
+
 if [[ ! -f "$ENV_FILE" ]]; then
 	echo "Missing $ENV_FILE; run pi/install_roverd.sh once to register the repository path" >&2
 	exit 1
@@ -86,3 +95,4 @@ log "Repository fast-forward pull complete"
 # drift away from the normal manual install path.
 "$ROVERD_REPO_DIR/pi/install_roverd.sh"
 log "Installer completed successfully"
+systemctl reboot

pi/bin/video-publisher.sh

@@ -120,6 +120,7 @@ run_pipeline() {
     --framerate "${ROVERD_VIDEO_FPS}" \
     --bitrate "${ROVERD_VIDEO_BITRATE}" \
     --codec h264 \
+    --intra 120 \
     --profile baseline \
     --denoise auto \
     --nopreview \

pi/roverd/host_stats.go

@@ -3,6 +3,7 @@ package roverd
 import (
 	"bufio"
 	"context"
+	"errors"
 	"fmt"
 	"math"
 	"os"
@@ -14,7 +15,7 @@ import (
 )
 
 const (
-	hostStatsInterval = 5 * time.Second
+	hostStatsInterval = 1 * time.Second
 	rootFilesystem    = "/"
 )
 
@@ -63,7 +64,24 @@ type WiFiStats struct {
 	TXBytes       *uint64  `json:"txBytes,omitempty"`
 	RXPackets     *uint64  `json:"rxPackets,omitempty"`
 	TXPackets     *uint64  `json:"txPackets,omitempty"`
+	DownloadMbps  *float64 `json:"downloadMbps,omitempty"`
+	UploadMbps    *float64 `json:"uploadMbps,omitempty"`
 	InactiveMs    *int     `json:"inactiveMs,omitempty"`
+
+	// networkSampledAt records the instant associated with the kernel byte
+	// counters. Keeping it out of JSON lets the websocket loop calculate rates
+	// with monotonic Go timestamps without expanding the browser contract with
+	// an implementation-only value.
+	networkSampledAt time.Time
+}
+
+// networkRateSample is scoped to one rover websocket connection. A new
+// connection intentionally starts a new baseline so counters from an old boot
+// or network interface lifetime can never create an artificial traffic spike.
+type networkRateSample struct {
+	rxBytes   uint64
+	txBytes   uint64
+	sampledAt time.Time
 }
 
 // CollectHostStats gathers every source independently so one missing kernel
@@ -370,12 +388,81 @@ func collectWiFiStats(ctx context.Context) (*WiFiStats, error) {
 		return nil, err
 	}
 
-	// The interface is used only to ask iw about the active connection. It is
-	// not copied into WiFiStats because the UI does not need to expose it.
-	if err := enrichWiFiWithIW(ctx, iface, stats); err != nil {
-		return stats, err
+	// The interface is used only for local collection. It is not copied into
+	// WiFiStats because the UI does not need to expose Linux device names.
+	iwErr := enrichWiFiWithIW(ctx, iface, stats)
+
+	// Read the kernel counters after iw because iw also provides cumulative
+	// station counters. The kernel interface values deliberately win: they are
+	// the host-traffic source used for both the cumulative display and Mbps math.
+	// Link capacity still comes independently from iw's bitrate fields.
+	counterErr := enrichWiFiWithNetworkCounters(iface, stats)
+	return stats, errors.Join(counterErr, iwErr)
+}
+
+func enrichWiFiWithNetworkCounters(iface string, stats *WiFiStats) error {
+	basePath := "/sys/class/net/" + iface + "/statistics/"
+	rxBytes, err := readUintFile(basePath + "rx_bytes")
+	if err != nil {
+		return fmt.Errorf("read %s receive bytes: %w", iface, err)
 	}
-	return stats, nil
+	txBytes, err := readUintFile(basePath + "tx_bytes")
+	if err != nil {
+		return fmt.Errorf("read %s transmit bytes: %w", iface, err)
+	}
+
+	stats.RXBytes = &rxBytes
+	stats.TXBytes = &txBytes
+	// Capture the timestamp immediately beside the counter reads so unrelated
+	// host-stat collection latency cannot distort the elapsed-time divisor.
+	stats.networkSampledAt = time.Now()
+	return nil
+}
+
+func readUintFile(path string) (uint64, error) {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return 0, err
+	}
+	return strconv.ParseUint(strings.TrimSpace(string(raw)), 10, 64)
+}
+
+func applyNetworkThroughput(stats *WiFiStats, previous *networkRateSample) *networkRateSample {
+	if stats == nil || stats.RXBytes == nil || stats.TXBytes == nil || stats.networkSampledAt.IsZero() {
+		// Do not discard the last valid baseline during a temporary read failure.
+		// The next successful calculation then covers the full elapsed interval and
+		// remains an accurate average for all traffic transferred during the gap.
+		return previous
+	}
+
+	current := &networkRateSample{
+		rxBytes:   *stats.RXBytes,
+		txBytes:   *stats.TXBytes,
+		sampledAt: stats.networkSampledAt,
+	}
+	if previous == nil {
+		return current
+	}
+
+	elapsed := current.sampledAt.Sub(previous.sampledAt).Seconds()
+	// Linux counters can return to zero after an interface reset. Re-baselining
+	// on any decrease prevents unsigned underflow from becoming a huge false
+	// throughput spike in the host-stat card.
+	if elapsed <= 0 || current.rxBytes < previous.rxBytes || current.txBytes < previous.txBytes {
+		return current
+	}
+
+	downloadMbps := bytesToMbps(current.rxBytes-previous.rxBytes, elapsed)
+	uploadMbps := bytesToMbps(current.txBytes-previous.txBytes, elapsed)
+	stats.DownloadMbps = &downloadMbps
+	stats.UploadMbps = &uploadMbps
+	return current
+}
+
+func bytesToMbps(byteDelta uint64, elapsedSeconds float64) float64 {
+	// Mbps uses decimal megabits, matching network equipment and link-rate
+	// conventions: eight bits per byte and 1,000,000 bits per megabit.
+	return roundOneDecimal((float64(byteDelta) * 8) / elapsedSeconds / 1_000_000)
 }
 
 func readWirelessStats() (string, *WiFiStats, error) {

pi/roverd/host_stats_test.go

@@ -0,0 +1,79 @@
+package roverd
+
+import (
+	"testing"
+	"time"
+)
+
+func TestApplyNetworkThroughputCalculatesMbpsFromActualElapsedTime(t *testing.T) {
+	startedAt := time.Unix(100, 0)
+	previous := &networkRateSample{rxBytes: 1_000, txBytes: 2_000, sampledAt: startedAt}
+	rxBytes := uint64(2_001_000)
+	txBytes := uint64(1_002_000)
+	stats := &WiFiStats{
+		RXBytes:          &rxBytes,
+		TXBytes:          &txBytes,
+		networkSampledAt: startedAt.Add(2 * time.Second),
+	}
+
+	next := applyNetworkThroughput(stats, previous)
+
+	if stats.DownloadMbps == nil || *stats.DownloadMbps != 8.0 {
+		t.Fatalf("expected 8.0 Mbps download, got %v", stats.DownloadMbps)
+	}
+	if stats.UploadMbps == nil || *stats.UploadMbps != 4.0 {
+		t.Fatalf("expected 4.0 Mbps upload, got %v", stats.UploadMbps)
+	}
+	if next == nil || next.rxBytes != rxBytes || next.txBytes != txBytes {
+		t.Fatalf("expected current counters to become the next baseline, got %#v", next)
+	}
+}
+
+func TestApplyNetworkThroughputFirstSampleOnlyEstablishesBaseline(t *testing.T) {
+	rxBytes := uint64(100)
+	txBytes := uint64(200)
+	stats := &WiFiStats{RXBytes: &rxBytes, TXBytes: &txBytes, networkSampledAt: time.Unix(100, 0)}
+
+	next := applyNetworkThroughput(stats, nil)
+
+	if stats.DownloadMbps != nil || stats.UploadMbps != nil {
+		t.Fatalf("expected no rates for the first sample, got download=%v upload=%v", stats.DownloadMbps, stats.UploadMbps)
+	}
+	if next == nil {
+		t.Fatal("expected the first valid sample to establish a baseline")
+	}
+}
+
+func TestApplyNetworkThroughputCounterResetEstablishesNewBaseline(t *testing.T) {
+	startedAt := time.Unix(100, 0)
+	previous := &networkRateSample{rxBytes: 10_000, txBytes: 20_000, sampledAt: startedAt}
+	rxBytes := uint64(10)
+	txBytes := uint64(20)
+	stats := &WiFiStats{RXBytes: &rxBytes, TXBytes: &txBytes, networkSampledAt: startedAt.Add(time.Second)}
+
+	next := applyNetworkThroughput(stats, previous)
+
+	if stats.DownloadMbps != nil || stats.UploadMbps != nil {
+		t.Fatalf("expected no rates after a counter reset, got download=%v upload=%v", stats.DownloadMbps, stats.UploadMbps)
+	}
+	if next == nil || next.rxBytes != rxBytes || next.txBytes != txBytes {
+		t.Fatalf("expected reset counters to become the new baseline, got %#v", next)
+	}
+}
+
+func TestApplyNetworkThroughputInvalidElapsedTimeEstablishesNewBaseline(t *testing.T) {
+	sampledAt := time.Unix(100, 0)
+	previous := &networkRateSample{rxBytes: 100, txBytes: 200, sampledAt: sampledAt}
+	rxBytes := uint64(200)
+	txBytes := uint64(300)
+	stats := &WiFiStats{RXBytes: &rxBytes, TXBytes: &txBytes, networkSampledAt: sampledAt}
+
+	next := applyNetworkThroughput(stats, previous)
+
+	if stats.DownloadMbps != nil || stats.UploadMbps != nil {
+		t.Fatalf("expected no rates with zero elapsed time, got download=%v upload=%v", stats.DownloadMbps, stats.UploadMbps)
+	}
+	if next == nil || next.sampledAt != sampledAt {
+		t.Fatalf("expected invalid timing sample to become the new baseline, got %#v", next)
+	}
+}

pi/roverd/wsclient.go

@@ -531,14 +531,21 @@ func (c *WSClient) forwardEvents(ctx context.Context, conn *websocket.Conn) {
 }
 
 func (c *WSClient) forwardHostStats(ctx context.Context, conn *websocket.Conn) {
+	var previousNetworkSample *networkRateSample
+
 	send := func() bool {
 		// Host stats are collected on demand so each outbound message describes
 		// the current Pi state. Collection failures are encoded into the stats
 		// payload, which keeps this telemetry path from closing the rover socket.
+		stats := CollectHostStats(ctx)
+		// Throughput is derived here because this loop owns the ordered, periodic
+		// samples for one connection. CollectHostStats stays independent, while a
+		// reconnect automatically receives a clean counter baseline.
+		previousNetworkSample = applyNetworkThroughput(stats.WiFi, previousNetworkSample)
 		msg := hostStatsMessage{
 			Type:      "hostStats",
 			Timestamp: time.Now().UnixMilli(),
-			Stats:     CollectHostStats(ctx),
+			Stats:     stats,
 		}
 		if err := writeJSON(ctx, conn, msg); err != nil {
 			c.log.Printf("host stats send failed: %v", err)

plans/command system and optional discord feature.md

@@ -0,0 +1,359 @@
+# Command system and optional Discord feature
+
+## Purpose
+
+Commands were originally implemented as part of the Discord bot. Web chat support was later added by adapting site chat messages into Discord-shaped messages and reusing the Discord command router. This leaves an important server capability owned by an optional external integration and creates inconsistent behavior between transports.
+
+The command system should instead be an always-available server capability. Web chat and Discord should both be adapters for the same command system, while Discord itself becomes an optional feature that can be disabled without affecting commands or the rest of the server.
+
+This is an internal architecture change. Existing behavior on the outside must remain unchanged unless this plan explicitly introduces a new command.
+
+## Non-negotiable behavior
+
+- Existing command names and syntax continue to work.
+- Existing permission and lockdown rules continue to work.
+- Existing web-chat command messages and replies continue to look and behave the same.
+- Existing Discord replies and embeds retain the same content, titles, field ordering, colors, timestamps, mention behavior, attachment names, progress updates, and edit behavior.
+- Existing Discord chat bridge, presence, moderation workflows, announcements, and other integrations continue to work when Discord is enabled.
+- Disabling Discord does not disable site-chat commands, replay generation, or unrelated server features.
+- Discord.js types, messages, embeds, guilds, channels, and configuration do not leak into the shared command implementation.
+- Replay hosting requires no new configuration. It must be automatic, conservative, and functional.
+- Backwards compatibility for obsolete internal architecture is not required after migration. Temporary migration adapters should be deleted when the new path is complete.
+
+## Target dependency direction
+
+```text
+Web chat adapter ---------+
+                          |
+                          v
+                 Operator command service ----> Existing server services
+                          ^
+                          |
+Optional Discord adapter -+
+```
+
+The operator command service owns parsing, command discovery, permission policy, execution, and neutral results. It does not know how a web-chat message or Discord message is represented.
+
+The name `operatorCommandService` avoids confusion with the existing rover `commandService`, which sends operational commands to individual rovers.
+
+## Command configuration
+
+Command naming belongs to the command system rather than Discord:
+
+```yaml
+commands:
+  prefix: "rs"
+  timeStatusCommand: "ts"
+```
+
+Both web chat and Discord must read these same values. Prefix matching remains case-insensitive and must match a whole token so a prefix such as `rs` does not treat a word such as `rsvp` as a command.
+
+Discord becomes an explicitly optional feature:
+
+```yaml
+discord:
+  enabled: false
+  token: ""
+```
+
+The existing Discord channel, role, site URL, and other settings stay under `discord`. `discord.enabled` is authoritative: a stored token must not silently enable the feature. If Discord is enabled but required credentials are missing or login fails, the failure is clearly logged and must not prevent the rest of the server from operating.
+
+### Existing server feature system is authoritative
+
+Use `server/src/helpers/features.js` as the single source of truth for whether optional features are configured and enabled. Do not add a command-specific feature registry, duplicate configuration checks inside command handlers, or infer availability independently from individual config fields.
+
+- Add Discord to `buildFeatureFlags()` using the same explicit feature-gating pattern as the other optional server features. Discord is enabled only when `discord.enabled` is explicitly true and the required token is present.
+- Discord service bootstrap, command-adapter registration, integrations, presence, bridge behavior, alerts, and Discord replay delivery all consult the shared Discord feature flag.
+- Command definitions use `requiredFeature` metadata, and the command dispatcher resolves that metadata through `isFeatureEnabled()` or a feature-flags snapshot from the same helper.
+- Help availability and command execution use the same feature result so help cannot advertise a command as available when execution considers it disabled.
+- Lift and Neato availability comes from the existing `lift` and `neato` feature flags. Commands must not reproduce their Home Assistant, switch, device, or enabled-field checks.
+- Configuration-level feature availability is separate from runtime health. For example, an enabled lift may currently be disconnected, and configured Discord may fail login. The shared feature helper answers whether the feature is enabled and configured; the owning service remains authoritative for runtime readiness and returns a clear operational failure.
+- Replay generation and automatic local replay hosting are core server capabilities and are not feature-gated. Only the optional Discord delivery provider depends on the Discord feature flag and live Discord readiness.
+
+When Discord is disabled:
+
+- Do not construct a Discord client.
+- Do not attempt login.
+- Do not register Discord event handlers or event-bus integrations.
+- Do not register Discord chat bridge subscriptions.
+- Do not start Discord presence behavior.
+- Keep the shared command service and all site-chat commands active.
+
+## Neutral command request
+
+Every transport converts its native user/message state into one normalized request:
+
+```js
+{
+  text: 'rs lock alpha',
+  source: 'web-chat',
+  actor: {
+    id: 'stable actor id',
+    label: 'display name',
+    role: 'admin',
+    isAdmin: true,
+    isLockdownAdmin: false,
+  },
+  context: {}
+}
+```
+
+The web adapter derives the actor from the authenticated socket, identity, and role services. The Discord adapter derives it from the Discord user and configured administrator mapping. Command handlers consume the normalized actor and never inspect a socket or `message.author`.
+
+Transport-specific context is allowed only for transport-specific extension commands. For example, the Discord-only bridge command needs guild and channel context, but shared commands must not depend on it.
+
+## Command registry
+
+Replace the large dispatcher switch and scattered help definitions with a command registry. A command definition should contain enough metadata to drive parsing, authorization, availability, and help:
+
+```js
+{
+  name: 'lift',
+  category: 'feature',
+  summary: 'Control the rover lift.',
+  description: 'Show lift state or request upward or downward movement.',
+  usage: ['lift status', 'lift up', 'lift down'],
+  examples: ['rs lift status', 'rs lift down'],
+  access: 'admin',
+  lockdownAccess: 'lockdown-admin',
+  requiredFeature: 'lift',
+  execute,
+}
+```
+
+The dispatcher should be responsible for common authorization. Individual handlers may perform finer-grained checks when subcommands truly require different access, but they should not duplicate the ordinary admin and lockdown gates.
+
+## Command categories
+
+Categories organize registration and help. Existing syntax must not be changed merely to add categories; for example, `rs mode` stays `rs mode` rather than becoming `rs admin mode`.
+
+### System commands
+
+General server information and server-wide user actions:
+
+- `rs help`
+- `rs status`
+- `rs replay`
+- The configured time-status command, currently `ts`
+- Future health, session, or informational commands that do not belong to one optional feature
+
+### Admin commands
+
+Operational, access, and moderation controls:
+
+- `rs lock`
+- `rs unlock`
+- `rs mode`
+- `rs kick`
+- `rs goal`
+- `rs reason`
+- `rs verify`
+- `rs deter`
+- `rs lights`
+
+Existing admin and lockdown-admin policies remain authoritative.
+
+### Feature commands
+
+Commands belonging to optional hardware or server features. Initial additions should include:
+
+- `rs lift status`
+- `rs lift up`
+- `rs lift down`
+- `rs neato status`
+- `rs neato start`
+- `rs neato home`
+- `rs neato locate`
+- `rs neato clear-errors`
+
+Feature command handlers must call the existing feature services. They must not reimplement lift interlocks, cooldowns, connectivity checks, Home Assistant calls, Neato state rules, or other hardware safety logic. The feature service remains the source of truth and the command reports its result.
+
+The dispatcher checks each command's `requiredFeature` against the existing server feature system before execution. The owning feature service then performs runtime availability and safety checks. This deliberately keeps configuration eligibility centralized in `helpers/features.js` while keeping live device state and operational rules inside the service that controls the feature.
+
+Commands for an unavailable or disabled feature return a clear unavailable response rather than throwing or silently doing nothing.
+
+### Discord-only commands
+
+Discord bridge configuration is not a general server command. Keep `bridge` as a Discord extension command registered by the Discord adapter:
+
+- `rs bridge`
+- `rs bridge here`
+- `rs bridge mode`
+- `rs bridge off`
+
+These commands retain their current syntax and Discord behavior but do not appear as available commands in web chat.
+
+## Organized help
+
+Help is generated from registry metadata so command definitions and documentation cannot drift apart.
+
+The default help should be detailed but scannable, grouped into System, Admin, and Features. Discord-only commands can appear in a Discord section when help is requested from Discord. Help should respect the configured prefix and time-status command.
+
+Support focused help:
+
+- `rs help system`
+- `rs help admin`
+- `rs help features`
+- `rs help status`
+- `rs help replay`
+- `rs help lift`
+- `rs help neato`
+- The same pattern for every registered command
+
+Focused command help should include:
+
+- A clear description
+- Required permission level
+- Availability or required feature
+- Accepted usage forms
+- Useful examples
+- Subcommand explanations where applicable
+
+The registry provides neutral help data. Web chat renders readable plain text. Discord uses its own renderer and must preserve the established outward style. Improving organization must not accidentally change unrelated Discord embeds such as rover status and time status.
+
+## Neutral command results and transport rendering
+
+Shared handlers return neutral results instead of calling `message.reply()`:
+
+```js
+{
+  handled: true,
+  ok: true,
+  messages: [
+    {
+      kind: 'text',
+      text: 'Locked Alpha.',
+    },
+  ],
+}
+```
+
+Simple commands should return text results. Structured results should be used only where transports benefit from different faithful presentations, such as rover status, time status, help, administrative lists, or replay progress.
+
+Discord renderers translate neutral results into the same Discord.js reply and embed objects used today. Existing embed builders should be extracted and retained where possible instead of visually rewriting them during this architecture change.
+
+The web adapter translates the same results into the existing `Rover bot` system messages. The current behavior where the user's command remains visible in the chat transcript should remain unchanged.
+
+## Replay architecture
+
+Replay generation and replay delivery are separate responsibilities:
+
+```text
+Replay request
+    |
+    v
+Replay engine builds one completed MP4
+    |
+    v
+Replay delivery coordinator
+    |-- Discord is enabled, ready, and replay channel works
+    |      -> upload MP4 to Discord
+    |      -> use returned Discord attachment URL
+    |
+    `-- Discord unavailable, unconfigured, or upload fails
+           -> store MP4 under the server data directory
+           -> use server-hosted media URL
+    |
+    v
+Publish the playable replay media payload to clients
+```
+
+Discord remains the preferred host when it is configured for replay delivery. A Discord upload failure after a successful replay build must fall back to local hosting instead of failing the replay. The Discord failure should be logged clearly, while clients still receive a working replay.
+
+The common client media payload should remain compatible with the current payload so `/mini`, `/display`, spectator clients, and other replay consumers behave the same. Discord-specific metadata remains present when Discord hosted the media. Locally hosted media supplies the same common playable URL and media fields without pretending to be a Discord attachment.
+
+### Automatic local replay hosting
+
+No replay-hosting configuration is added. Use conservative internal constants chosen after checking typical generated replay sizes.
+
+The local media service should:
+
+- Store completed files in `data/replays/` through the canonical data-directory helper.
+- Use random, non-guessable IDs in public filenames.
+- Expose a deliberate route such as `/media/replays/:id.mp4` rather than placing runtime media in built web assets.
+- Support HTTP range requests so browsers can seek and play MP4 files normally.
+- Set the correct media type and safe cache headers.
+- Write atomically by completing a temporary file and renaming it into place.
+- Never expose or delete a file that is still being written.
+- Remove abandoned temporary files.
+- Delete expired replay files during server startup.
+- Run one lightweight periodic cleanup while the server is running.
+- Stop the cleanup timer during graceful shutdown if the server has a shutdown lifecycle.
+- Enforce both a conservative age limit and a conservative total storage ceiling.
+- Delete the oldest completed files first when the storage ceiling is exceeded.
+- Treat cleanup errors as logged, nonfatal maintenance failures.
+- Prevent path traversal and serve only known replay filenames from the replay directory.
+
+Cleanup must operate only on the hosted replay directory and must not touch replay frame caches, unrelated data files, or active replay builds.
+
+## Optional Discord feature boundary
+
+The Discord feature owns:
+
+- Discord client creation and login
+- Intents and partials
+- Discord message-to-command adaptation
+- Neutral-result-to-Discord rendering
+- Existing embed presentation
+- Discord replay upload delivery
+- Chat bridge and webhook behavior
+- Guild bridge storage and bridge commands
+- Presence
+- Discord announcements and alerts
+- DM verification and private-access moderation workflows
+- Reactions and Discord event handling
+
+Discord must be added to and activated through the existing server feature system. The Discord entrypoint must not maintain a separate interpretation of `discord.enabled` and token availability. Runtime client readiness may still be tracked inside the Discord feature for operations such as replay upload, but that readiness supplements rather than replaces the shared configuration feature flag.
+
+The Discord feature may import the operator command service. The operator command service, replay engine, chat service, and feature command handlers must not import the Discord feature or Discord.js.
+
+## Focused regression protection
+
+The existing implementation is the reference for current command wording and behavior. Read and preserve that behavior while moving each handler; do not first catalogue every reply or build exhaustive snapshots for all commands.
+
+Use focused tests and practical checks at the boundaries most likely to cause meaningful regressions:
+
+- Discord status and time-status embeds retain their existing content, structure, colors, field order, timestamps, and links.
+- Discord replay progress edits, attachment upload, filename, URL extraction, and client media publication continue to work.
+- A failed or unavailable Discord replay delivery falls back to working locally hosted media.
+- Commands remain operational when Discord is disabled or fails login.
+- Web chat and Discord use the same configured prefix and whole-token matching behavior.
+- Admin and lockdown permissions are enforced consistently from both transports.
+- Disabled feature commands return a clear unavailable result, while enabled feature commands use their owning service's runtime safety checks.
+- Hosted replay routes support playback and seeking, reject invalid paths, and cleanup only expired completed media.
+
+Use direct inspection and practical command checks for ordinary response wording. Additional tests are appropriate when complex logic is extracted, but exhaustive output transcription is not a prerequisite for the refactor.
+
+## Implementation sequence
+
+Build directly toward the final architecture. It is acceptable to move commands in logical groups while working, but avoid investing in a durable old/new compatibility framework. Once a replacement path works, remove the obsolete adapter and duplicated implementation.
+
+1. Add the operator command request, actor, result, parser, registry, authorization, and help foundations.
+2. Extract existing Discord formatting and embed construction into transport-owned renderers without changing their output.
+3. Move existing system and admin commands into the registry, using their current code as the behavioral reference.
+4. Move status and time status while separating neutral data collection from unchanged Discord embed rendering.
+5. Add organized registry-driven help with transport-specific output.
+6. Add lift and Neato feature command families using the existing feature flags, services, and safety rules.
+7. Add the automatic local replay media store, HTTP route, range serving, startup cleanup, periodic cleanup, and storage limits.
+8. Split replay generation from delivery and add the Discord-preferred/local-fallback delivery coordinator.
+9. Move replay onto the shared command service while preserving existing Discord progress and upload behavior.
+10. Convert web chat and Discord to the shared command service and move bridge commands into the Discord-only extension registry.
+11. Add Discord to the existing feature system and gate all Discord bootstrap and integrations through it.
+12. Remove the Discord-owned shared router, fake Discord message objects, web replay command injection, result-flattening workaround, and duplicate replay paths.
+13. Add or update focused tests for the high-risk boundaries listed above.
+14. Run server tests, practical command checks, the web UI build, and targeted lint for touched files.
+
+## Completion criteria
+
+- The server has one transport-neutral command registry and execution path.
+- Web chat commands work with Discord completely disabled.
+- Discord consumes the shared command service as an optional adapter.
+- The configured command prefix behaves consistently everywhere.
+- Help is organized by System, Admin, Features, and Discord-only extensions where applicable.
+- Detailed per-command and per-category help is available.
+- Lift and Neato commands use existing service safety and availability behavior.
+- Discord-hosted replays behave exactly as before when Discord delivery succeeds.
+- Replays automatically fall back to maintained server-hosted media without configuration.
+- Existing clients continue receiving compatible replay media payloads.
+- Existing Discord embeds and outward behavior remain unchanged.
+- Temporary adapters and duplicated command logic are removed.

plans/toggleable bandwidth savings.md

@@ -1,16 +1,32 @@
 # make all bandwidth saving options toggleable in one centralized server config
+- external spectators are people outside of local network
+
 - multitab protection mode
   - allowed
   - verified only
   - not allowed
 - snapshots
-  - non-turn snapshots
-    - on (you see snapshots when its not your turn)
-    - off (everyone gets full video all the time)
-  - non-local spectator snapshots
-    - on (external spectators are only allowed snapshots)
-    - off (all spectators get full video)
+  - non-turn video
+    - snapshots (rover non-active turn holders and PTZ non-operators see snapshots after the user threshold is exceeded)
+    - live (rover non-active turn holders and PTZ non-operators can get full video)
+    - userThreshold (snapshots turn on when controllable users exceed this number)
+  - external spectator video
+    - snapshots (external spectators are only allowed snapshots)
+    - live (external spectators can get full video)
 - external spectator access (new)
   - off (no one can access the spectate page externally)
   - on (everyone can access the spectate page externally)
-- anything else related to bandwidth savings should also get config
+  - verifiedOnly (only verified identities can access the spectate page externally)
+  - admin (external spectators need a saved spectatorAccess.external identity grant)
+- anything else related to bandwidth savings should also get config
+
+## implemented config shape
+```yaml
+bandwidthSavings:
+  multiTabProtection: "verifiedOnly" # allowed | verifiedOnly | notAllowed
+  nonTurnVideo:
+    mode: "snapshots" # snapshots | live
+    userThreshold: 0 # snapshots turn on when controllable users exceed this number
+  externalSpectatorVideo: "snapshots" # snapshots | live
+  externalSpectatorAccess: "on" # off | on | verifiedOnly | admin
+```

server/config.example.yaml

@@ -54,6 +54,32 @@ media:
   # Example: http://192.168.0.86:8889/video
   whepBaseUrl: "http://192.168.0.86:8889/video"
 
+bandwidthSavings:
+  # Duplicate driver-tab handling for the same browser identity.
+  #   allowed: no duplicate-tab protection
+  #   verifiedOnly: verified/admin users may keep multiple driver tabs; unverified users may not
+  #   notAllowed: every identity is limited to one driver tab
+  multiTabProtection: "verifiedOnly"
+  # Video for users who are attached to a source but do not currently own its
+  # active turn. "snapshots" saves upload bandwidth; "live" allows full video
+  # whenever the normal mode/visibility rules allow it.
+  nonTurnVideo:
+    mode: "snapshots"
+    # Snapshot mode activates only when controllable users exceed this number.
+    # A controllable user is attached to a rover or PTZ as operator/queue, not a
+    # plain spectator. 0 preserves always-on non-turn snapshots once anyone is
+    # actually attached to a controllable source.
+    userThreshold: 0
+  # Live video for spectators outside the local network. Local spectators are
+  # not restricted by this switch because LAN traffic is not the upload limit.
+  externalSpectatorVideo: "snapshots"
+  # Whether non-local users may enter the spectator page.
+  #   off: block external spectators
+  #   on: allow external spectators
+  #   verifiedOnly: require a verified identity, but no separate spectator grant
+  #   admin: require an identity feature-state grant at spectatorAccess.external
+  externalSpectatorAccess: "on"
+
 audioForward:
   enabled: true
   ffmpegBin: "ffmpeg"
@@ -151,29 +177,35 @@ kinect:
   # camera cache; it only gates browser-requested broadcasts.
   captureCooldownMs: 10000
 
+balanceBoard:
+  # The server installer always prepares Bluetooth and the kernel driver. This
+  # switch only starts the service and shows its small live-weight panel.
+  enabled: false
+
 buttonBox:
   enabled: false
 
 barcodeScanner:
   enabled: false
 
+commands:
+  # Commands are a core server capability shared by site chat and optional
+  # transports. Their names therefore do not belong to Discord configuration.
+  prefix: "rs"
+  # Set this to null to disable the legacy bare time-status shortcut.
+  timeStatusCommand: "ts"
+
 discord:
+  # Discord is optional. A token by itself never enables an external login.
+  enabled: false
   token: "DISCORD_BOT_TOKEN"
   guildId: "123456789012345678" # optional; bot works in any guild it's invited to
   siteUrl: "https://rover.example.com"
-  # Give each bot instance a unique command prefix when several rover servers
-  # share one Discord server. Commands are matched as whole tokens, so "rs"
-  # handles "rs status" but ignores normal words like "rsvp".
-  commandPrefix: "rs"
-  # Set this to null to disable the bare time-status shortcut. It is separate
-  # from commandPrefix because the legacy command is just "ts", and multiple
-  # bots in the same Discord server should not all answer the same bare word.
-  timeStatusCommand: "ts"
   channels:
     general: "123456789012345678"
     announcements: "123456789012345678"
     adminAlerts: "123456789012345678"
-    # chat bridge is configured per guild via `<commandPrefix> bridge` commands
+    # chat bridge is configured per guild via the shared `commands.prefix`
     replay: "123456789012345678"
     humanAlerts: "123456789012345678"
   roles:

server/index.js

@@ -46,8 +46,12 @@ require('./src/services/buttonBoxService');
 require('./src/services/barcodeScannerService');
 require('./src/services/barcodeGameService');
 require('./src/services/kinectService');
+require('./src/services/balanceBoardService');
 require('./src/services/sessionService');
 require('./src/services/batteryManager');
 require('./src/services/replayEngineV2');
+// Replay delivery is a core service. It must subscribe before the optional
+// Discord feature so web requests always have a local delivery path.
+require('./src/services/replayDeliveryService');
 require('./src/services/discordBotService');
 require('./src/services/httpServer');

server/install_server.sh

@@ -16,6 +16,8 @@ MULTIROVER_SERVICE="/etc/systemd/system/multirover.service"
 SNAPSHOT_DIR="/var/lib/rover-snapshots"
 REPLAY_SEGMENT_DIR="/var/lib/replay-segments"
 KINECT_UDEV_RULE="/etc/udev/rules.d/99-kinect-world.rules"
+BLUETOOTH_OVERRIDE_DIR="/etc/systemd/system/bluetooth.service.d"
+BLUETOOTH_OVERRIDE="$BLUETOOTH_OVERRIDE_DIR/20-multirover-balance-board.conf"
 
 if [[ $EUID -ne 0 ]]; then
   echo "This installer must be run with sudo/root." >&2
@@ -30,6 +32,8 @@ fi
 TARGET_USER="$SUDO_USER"
 SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
 SERVER_DIR="$SCRIPT_DIR"
+BALANCE_BOARD_NATIVE_DIR="$SCRIPT_DIR/src/services/balanceBoardService/native"
+BALANCE_BOARD_WORKER="$BALANCE_BOARD_NATIVE_DIR/balance_board_worker"
 CONFIG_PATH="$SERVER_DIR/config.yaml"
 MEDIAMTX_TEMPLATE="$SERVER_DIR/mediamtx/mediamtx.yml"
 ROVER_SNAPSHOT_WRITER_TEMPLATE="$SERVER_DIR/mediamtx/rover-snapshot-writer.sh"
@@ -134,7 +138,11 @@ dnf install -y \
   gstreamer1-rtsp-server \
   libfreenect \
   libfreenect-devel \
-  libusb1-devel >/dev/null
+  libusb1-devel \
+  bluez \
+  wiiuse \
+  wiiuse-devel \
+  libcap >/dev/null
 NODE_BIN="$(command -v node)"
 
 echo "      Installing Kinect udev rule -> $KINECT_UDEV_RULE"
@@ -166,12 +174,43 @@ if [[ -f "$SERVER_DIR/src/services/kinectService/native/Makefile" ]]; then
   runuser -u "$TARGET_USER" -- bash -c "cd '$SERVER_DIR/src/services/kinectService/native' && make"
 fi
 
+if [[ -f "$BALANCE_BOARD_NATIVE_DIR/Makefile" ]]; then
+  echo "      Building native Balance Board bridge..."
+  runuser -u "$TARGET_USER" -- bash -c "cd '$BALANCE_BOARD_NATIVE_DIR' && make"
+  if [[ ! -x "$BALANCE_BOARD_WORKER" ]]; then
+    echo "Balance Board worker build did not create $BALANCE_BOARD_WORKER" >&2
+    exit 1
+  fi
+  # Only this small audited bridge needs the management socket used for the
+  # board's raw six-byte pairing PIN and the two reserved HID PSMs used by
+  # front-button reconnects. Never grant either capability to node or the full
+  # multirover service executable.
+  setcap cap_net_admin,cap_net_bind_service+ep "$BALANCE_BOARD_WORKER"
+fi
+
 if [[ ! -f "$CONFIG_PATH" ]]; then
   cp "$SERVER_DIR/config.example.yaml" "$CONFIG_PATH"
   chown "$TARGET_USER":"$TARGET_USER" "$CONFIG_PATH"
   echo "Copied config.example.yaml to config.yaml; edit it before exposing the service."
 fi
 
+# Bluetoothd remains responsible for discovery and the one-time bond, but its
+# generic input plugin otherwise reserves control PSM 0x11 and interrupt PSM
+# 0x13 before the Balance Board worker can listen for the board's front-button
+# reconnect. This dedicated rover server gives those two HID listeners to the
+# worker; every other BlueZ profile is left enabled. Clearing ExecStart is
+# required by systemd before replacing the vendor unit's command in a drop-in.
+install -d -m 0755 "$BLUETOOTH_OVERRIDE_DIR"
+cat > "$BLUETOOTH_OVERRIDE" <<'EOF'
+[Service]
+ExecStart=
+ExecStart=/usr/libexec/bluetooth/bluetoothd --noplugin=input
+EOF
+chmod 0644 "$BLUETOOTH_OVERRIDE"
+systemctl daemon-reload
+systemctl enable bluetooth.service
+systemctl restart bluetooth.service
+
 tmpdir=$(mktemp -d)
 trap 'rm -rf "$tmpdir"' EXIT
 
@@ -229,9 +268,12 @@ if [[ ! -f "$ROVER_SNAPSHOT_WRITER_TEMPLATE" ]]; then
   echo "Snapshot writer template missing at $ROVER_SNAPSHOT_WRITER_TEMPLATE" >&2
   exit 1
 fi
-echo "      Installing mediaMTX config -> $MEDIAMTX_CONFIG"
-rm -f "$MEDIAMTX_CONFIG"
-install -m 0644 "$MEDIAMTX_TEMPLATE" "$MEDIAMTX_CONFIG"
+if [[ -f "$MEDIAMTX_CONFIG" ]]; then
+  echo "      Preserving existing mediaMTX config -> $MEDIAMTX_CONFIG"
+else
+  echo "      Installing mediaMTX config -> $MEDIAMTX_CONFIG"
+  install -m 0644 "$MEDIAMTX_TEMPLATE" "$MEDIAMTX_CONFIG"
+fi
 echo "      Installing rover snapshot writer -> $ROVER_SNAPSHOT_WRITER_BIN"
 install -m 0755 "$ROVER_SNAPSHOT_WRITER_TEMPLATE" "$ROVER_SNAPSHOT_WRITER_BIN"
 chown -R "$TARGET_USER":"$TARGET_USER" "$MEDIAMTX_CONF_DIR"
@@ -263,8 +305,8 @@ EOF
 cat > "$MULTIROVER_SERVICE" <<EOF
 [Unit]
 Description=Multi-Roomba Rover control server
-After=network-online.target mediamtx.service
-Wants=network-online.target
+After=network-online.target mediamtx.service bluetooth.service
+Wants=network-online.target bluetooth.service
 
 [Service]
 User=$TARGET_USER
@@ -301,3 +343,5 @@ echo
 echo "Update $CONFIG_PATH to set admins, lockdown settings, and media parameters."
 echo "Kinect/libfreenect packages and udev permissions were installed."
 echo "If a Kinect is already plugged in, unplug/replug its USB/power before testing so the new udev rule applies."
+echo "Wii Balance Board direct Bluetooth bridge and front-button listener were installed."
+echo "Enable balanceBoard in config.yaml, press red Sync once, then use the front button for later wakes."

server/public/index.html

@@ -78,8 +78,8 @@
 <script defer src="https://analytics.otter.land/script.js" data-website-id="82dd56a5-db44-4279-bd1e-a4d9fee39af7" data-domains="rover.otter.land"></script>
 <script defer src="https://analytics.otter.land/recorder.js" data-website-id="82dd56a5-db44-4279-bd1e-a4d9fee39af7" data-domains="rover.otter.land" data-sample-rate="0.15" data-mask-level="moderate" data-max-duration="300000"></script>
     <title>Roomba Rover</title>
-    <script type="module" crossorigin src="/assets/index-D5vPzVhj.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-BN3kEVFL.css">
+    <script type="module" crossorigin src="/assets/index-C-g10Rjz.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BwjDTdpq.css">
   </head>
   <body>
     <div id="root"></div>

server/src/helpers/bandwidthSavings.js

@@ -0,0 +1,134 @@
+// Bandwidth Savings Helper
+// Purpose: Normalizes bandwidth-saving config and exposes tiny policy helpers.
+// Scope: Keeps cross-service video/tab/spectator decisions consistent without
+// making individual services know raw YAML defaults or legacy config shapes.
+const { loadConfig } = require('./configLoader');
+
+const MULTI_TAB_MODES = new Set(['allowed', 'verifiedOnly', 'notAllowed']);
+const VIDEO_MODES = new Set(['snapshots', 'live']);
+const EXTERNAL_SPECTATOR_ACCESS_MODES = new Set(['off', 'on', 'verifiedOnly', 'admin']);
+
+const DEFAULT_BANDWIDTH_SAVINGS = Object.freeze({
+  multiTabProtection: 'verifiedOnly',
+  nonTurnVideo: Object.freeze({
+    mode: 'snapshots',
+    userThreshold: 0,
+  }),
+  externalSpectatorVideo: 'snapshots',
+  externalSpectatorAccess: 'on',
+});
+
+function normalizeEnum(value, allowed, fallback) {
+  /*
+    Config files are hand-edited on the server, so a typo should not crash the
+    process or silently broaden access. Each option falls back to the current
+    conservative behavior unless it exactly matches a known value.
+  */
+  const normalized = typeof value === 'string' ? value.trim() : '';
+  return allowed.has(normalized) ? normalized : fallback;
+}
+
+function normalizeNonTurnVideo(value) {
+  const raw = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+  const threshold = Number(raw.userThreshold);
+  /*
+    userThreshold is intentionally "greater than", not "greater than or equal".
+    A value of 4 means the first four controllable users can keep live non-turn
+    video, and the fifth controllable user activates snapshot saving. Invalid
+    or negative values fall back to zero, which preserves always-on snapshots
+    for any real non-turn participant.
+  */
+  const userThreshold = Number.isFinite(threshold) ? Math.max(0, Math.floor(threshold)) : 0;
+  return {
+    mode: normalizeEnum(raw.mode, VIDEO_MODES, DEFAULT_BANDWIDTH_SAVINGS.nonTurnVideo.mode),
+    userThreshold,
+  };
+}
+
+function buildBandwidthSavingsPolicy(config = loadConfig()) {
+  const raw = config.bandwidthSavings || {};
+  return {
+    multiTabProtection: normalizeEnum(
+      raw.multiTabProtection,
+      MULTI_TAB_MODES,
+      DEFAULT_BANDWIDTH_SAVINGS.multiTabProtection,
+    ),
+    nonTurnVideo: normalizeNonTurnVideo(raw.nonTurnVideo),
+    externalSpectatorVideo: normalizeEnum(
+      raw.externalSpectatorVideo,
+      VIDEO_MODES,
+      DEFAULT_BANDWIDTH_SAVINGS.externalSpectatorVideo,
+    ),
+    externalSpectatorAccess: normalizeEnum(
+      raw.externalSpectatorAccess,
+      EXTERNAL_SPECTATOR_ACCESS_MODES,
+      DEFAULT_BANDWIDTH_SAVINGS.externalSpectatorAccess,
+    ),
+  };
+}
+
+function getBandwidthSavingsPolicy() {
+  /*
+    loadConfig() is cached by configLoader, so rebuilding this small object per
+    caller is cheap while still letting tests pass explicit config objects into
+    buildBandwidthSavingsPolicy().
+  */
+  return buildBandwidthSavingsPolicy(loadConfig());
+}
+
+function shouldEnforceSingleDriverTab({ isVerified = false, isAdmin = false } = {}) {
+  const { multiTabProtection } = getBandwidthSavingsPolicy();
+  if (multiTabProtection === 'allowed') return false;
+  if (multiTabProtection === 'notAllowed') return true;
+  /*
+    verifiedOnly preserves the old behavior: trusted users can run multiple
+    driver tabs for operations/testing, while anonymous users are limited to one
+    active driver surface for fairness and bandwidth.
+  */
+  return !isVerified && !isAdmin;
+}
+
+function shouldUseSnapshotsForNonTurnVideo({ controllableUserCount = 0 } = {}) {
+  const { nonTurnVideo } = getBandwidthSavingsPolicy();
+  if (nonTurnVideo.mode !== 'snapshots') return false;
+  /*
+    The threshold is evaluated centrally so MediaMTX auth, socket-issued video
+    tokens, PTZ authorization, and browser session state all agree. Using a
+    strict greater-than comparison makes the configured value read like the
+    maximum number of controllable users allowed before snapshots start.
+  */
+  return Math.max(0, Number(controllableUserCount) || 0) > nonTurnVideo.userThreshold;
+}
+
+function shouldUseSnapshotsForExternalSpectatorVideo() {
+  return getBandwidthSavingsPolicy().externalSpectatorVideo === 'snapshots';
+}
+
+function canUseExternalSpectatorAccess({
+  isLocal = false,
+  isAdmin = false,
+  isVerified = false,
+  hasGrant = false,
+} = {}) {
+  /*
+    Local/LAN spectators are not the upload-bandwidth problem, and admins need
+    to retain access for maintenance. The configured external mode only applies
+    to ordinary non-local spectator sockets.
+  */
+  if (isLocal || isAdmin) return true;
+  const { externalSpectatorAccess } = getBandwidthSavingsPolicy();
+  if (externalSpectatorAccess === 'off') return false;
+  if (externalSpectatorAccess === 'verifiedOnly') return Boolean(isVerified);
+  if (externalSpectatorAccess === 'admin') return Boolean(hasGrant);
+  return true;
+}
+
+module.exports = {
+  DEFAULT_BANDWIDTH_SAVINGS,
+  buildBandwidthSavingsPolicy,
+  getBandwidthSavingsPolicy,
+  shouldEnforceSingleDriverTab,
+  shouldUseSnapshotsForNonTurnVideo,
+  shouldUseSnapshotsForExternalSpectatorVideo,
+  canUseExternalSpectatorAccess,
+};

server/src/helpers/features.js

@@ -46,10 +46,12 @@ function buildFeatureFlags(config = loadConfig()) {
   const kinectConfig = config.kinect || {};
   const buttonBoxConfig = config.buttonBox || {};
   const barcodeScannerConfig = config.barcodeScanner || {};
+  const balanceBoardConfig = config.balanceBoard || {};
   const barcodeGamesConfig = config.barcodeGames || {};
   const socialsConfig = config.socials || {};
   const interInstanceConfig = config.interInstance || {};
   const ptzCameraConfig = config.ptzCamera || {};
+  const discordConfig = config.discord || {};
   const homeAssistant = Boolean(
     asBoolean(homeAssistantConfig.enabled) &&
       asTrimmedString(homeAssistantConfig.url) &&
@@ -67,6 +69,10 @@ function buildFeatureFlags(config = loadConfig()) {
     kinect: asBoolean(kinectConfig.enabled),
     buttonBox: asBoolean(buttonBoxConfig.enabled),
     barcodeScanner,
+    // The worker performs its own runtime availability reporting. Advertising
+    // the feature from the explicit config switch lets the UI show useful
+    // commissioning and hardware-error states even before a board is paired.
+    balanceBoard: asBoolean(balanceBoardConfig.enabled),
     barcodeGames: Boolean(barcodeScanner && asBoolean(barcodeGamesConfig.enabled)),
     lift: Boolean(
       homeAssistant &&
@@ -87,6 +93,13 @@ function buildFeatureFlags(config = loadConfig()) {
         asTrimmedString(ptzCameraConfig.username) &&
         asTrimmedString(ptzCameraConfig.password),
     ),
+    /*
+      Discord is an optional transport, not a prerequisite for chat commands.
+      Requiring both the explicit switch and a token prevents an old token from
+      silently enabling external connections on installations that have chosen
+      to run without the integration.
+    */
+    discord: Boolean(asBoolean(discordConfig.enabled) && asTrimmedString(discordConfig.token)),
   };
 }
 

server/src/rewards/definitions/darkness.js

@@ -1,10 +1,8 @@
 // Reward Definition: Darkness
 // Purpose: Defines the darkness reward that alters visibility/lighting behavior. Scope: Encapsulates reward metadata and effect configuration for runtime execution.
 const DURATION_MS = 15 * 60 * 1000;
-const LIGHT_ENFORCE_TICK_MS = 3000;
 
 let activeTimer = null;
-let enforceLightsTimer = null;
 let headlightLockUntil = 0;
 
 function isHeadlightBlocked() {
@@ -16,10 +14,6 @@ function clearTimers() {
     clearTimeout(activeTimer);
     activeTimer = null;
   }
-  if (enforceLightsTimer) {
-    clearInterval(enforceLightsTimer);
-    enforceLightsTimer = null;
-  }
 }
 
 async function forceAllLightsOff(ctx) {
@@ -55,7 +49,6 @@ async function stopDarkness(ctx, effect = {}) {
     if (prevLockState === 'on' || prevLockState === 'off') {
       await ctx.setHomeAssistantLightsLockedOn(true, {
         source: 'buttonbox:darknessRestore',
-        forceApply: true,
         targetState: prevLockState,
       });
     } else {
@@ -92,7 +85,6 @@ async function startDarkness(ctx, effect) {
   try {
     await ctx.setHomeAssistantLightsLockedOn(true, {
       source: 'buttonbox:darkness',
-      forceApply: true,
       targetState: 'off',
     });
   } catch (err) {
@@ -100,11 +92,13 @@ async function startDarkness(ctx, effect) {
   }
   ctx.saveEffect('darkness', effect);
 
-  enforceLightsTimer = setInterval(() => {
-    forceAllLightsOff(ctx).catch((err) => {
-      ctx.logger.warn('darkness periodic light enforcement failed', { error: err.message });
-    });
-  }, LIGHT_ENFORCE_TICK_MS);
+  /*
+    Darkness locks the room-light policy off and performs the initial off
+    command through setHomeAssistantLightsLockedOn above. It deliberately does
+    not keep a polling interval that re-forces Home Assistant entities off:
+    after the lock is established, out-of-band manual controls must remain able
+    to change individual room lights without the server fighting them.
+  */
 
   activeTimer = setTimeout(() => {
     stopDarkness(ctx, effect).catch((err) => {

server/src/services/authService/index.js

@@ -8,9 +8,20 @@ const { loadConfig } = require('../../helpers/configLoader');
 const { clearLockdownTimer } = require('../lockdownGuard');
 const { getMode, MODES } = require('../modeManager');
 const { setRole } = require('../roleService');
+const { getSocketIp, isLocalNetwork } = require('../../helpers/ipResolver');
+const {
+  canUseExternalSpectatorAccess,
+  getBandwidthSavingsPolicy,
+} = require('../../helpers/bandwidthSavings');
+const {
+  getFeatureState,
+  getUserIdForSocket,
+  updateFeatureState,
+} = require('../identityService');
 
 const config = loadConfig();
 const admins = config.admins || [];
+const SPECTATOR_ACCESS_NAMESPACE = 'spectatorAccess';
 
 function findAdmin(username) {
   return admins.find((admin) => admin.username === username);
@@ -36,9 +47,91 @@ function isLockdownAdmin(socket) {
   return socket?.data?.role === 'lockdown';
 }
 
+function hasExternalSpectatorGrant(socket) {
+  const userId = getUserIdForSocket(socket);
+  if (!userId) return false;
+  const state = getFeatureState(userId, SPECTATOR_ACCESS_NAMESPACE, {});
+  /*
+    The identity database already owns per-user feature state. Keeping the grant
+    as a tiny namespaced boolean avoids a new table and lets the existing admin
+    database editor grant/revoke external spectator access immediately.
+  */
+  return Boolean(state?.external);
+}
+
+function canBecomeSpectator(socket) {
+  const ip = getSocketIp(socket);
+  const local = isLocalNetwork(ip);
+  return canUseExternalSpectatorAccess({
+    isLocal: local,
+    isAdmin: isAdmin(socket),
+    isVerified: Boolean(socket?.data?.isVerified),
+    hasGrant: hasExternalSpectatorGrant(socket),
+  });
+}
+
+function externalSpectatorAccessError() {
+  const mode = getBandwidthSavingsPolicy().externalSpectatorAccess;
+  if (mode === 'verifiedOnly') {
+    return 'External spectator access requires a verified identity.';
+  }
+  if (mode === 'admin') {
+    return 'External spectator access requires admin approval for this identity.';
+  }
+  return 'External spectator access is disabled.';
+}
+
+function grantExternalSpectatorAccessAfterAdminLogin(socket) {
+  const policy = getBandwidthSavingsPolicy();
+  if (policy.externalSpectatorAccess !== 'admin') {
+    return false;
+  }
+  const ip = getSocketIp(socket);
+  if (isLocalNetwork(ip)) {
+    return false;
+  }
+  const userId = getUserIdForSocket(socket);
+  if (!userId) {
+    /*
+      Sockets are normally identified on connection before login, but keeping a
+      guard here makes the admin grant fail closed instead of writing an orphan
+      feature-state row if identity setup changes later.
+    */
+    logger.warn('External spectator grant skipped because socket has no identity', { socketId: socket?.id });
+    return false;
+  }
+  updateFeatureState(
+    userId,
+    SPECTATOR_ACCESS_NAMESPACE,
+    (current) => ({
+      /*
+        Preserve any future spectatorAccess settings beside `external`. The
+        login flow is only approving this identity for external spectating, not
+        resetting the whole namespace back to a one-field object.
+      */
+      ...(current || {}),
+      external: true,
+      grantedByAdminLoginAt: Date.now(),
+      grantedByAdminUsername: socket?.data?.user?.username || null,
+    }),
+    {},
+  );
+  logger.info('External spectator access granted after admin login', {
+    socketId: socket.id,
+    userId,
+    username: socket?.data?.user?.username || null,
+  });
+  return true;
+}
+
 io.on('connection', (socket) => {
   const requestedRole = socket.handshake?.query?.role;
-  const initialRole = requestedRole === 'spectator' ? 'spectator' : 'user';
+  /*
+    Role is assigned before the browser's full identity heartbeat has completed.
+    For admin-gated external spectators, fail closed here; the spectator page can
+    identify the socket and then retry session:setRole once the grant exists.
+  */
+  const initialRole = requestedRole === 'spectator' && canBecomeSpectator(socket) ? 'spectator' : 'user';
   setRole(socket, initialRole);
   logger.info('Socket connected with role', socket.id, initialRole);
   socket.emit('auth:role', { role: initialRole });
@@ -51,6 +144,13 @@ io.on('connection', (socket) => {
       const role = admin.lockdown ? 'lockdown' : 'admin';
       socket.data.user = { username: admin.username, discordId: admin.discord_id };
       setRole(socket, role);
+      /*
+        In admin-gated external spectator mode, logging in from /spectate is the
+        approval action for this browser identity. Persist the grant before the
+        client retries switching back to spectator, otherwise the user would
+        lose the admin bypass and immediately fall back into the gate.
+      */
+      grantExternalSpectatorAccessAfterAdminLogin(socket);
       socket.emit('auth:role', { role });
       clearLockdownTimer(socket);
       logger.info('Login success', socket.id, role);
@@ -63,6 +163,12 @@ io.on('connection', (socket) => {
 
   function handleRoleChange({ role } = {}, cb = () => {}) {
     if (role === 'spectator' || role === 'user') {
+      if (role === 'spectator' && !canBecomeSpectator(socket)) {
+        const error = externalSpectatorAccessError();
+        logger.info('Spectator role denied by bandwidth policy', socket.id, { error });
+        cb({ error });
+        return;
+      }
       setRole(socket, role);
       socket.emit('auth:role', { role });
       logger.info('Role changed via client request', socket.id, role);

server/src/services/balanceBoardService/hardware.js

@@ -0,0 +1,179 @@
+// Balance Board Hardware Bridge
+// Purpose: Supervises the capability-limited native worker and converts its JSON-line protocol into service events.
+// Scope: Owns process lifecycle, restart recovery, shutdown, and protocol validation; scale policy remains in index.js.
+const { spawn } = require('child_process');
+const EventEmitter = require('events');
+const path = require('path');
+
+const WORKER_PATH =
+  process.env.BALANCE_BOARD_WORKER ||
+  path.join(__dirname, 'native', 'balance_board_worker');
+const RESTART_DELAY_MS = 2000;
+const STDERR_LOG_INTERVAL_MS = 5000;
+
+function createBalanceBoardHardware({ logger, address = '', simulate = false } = {}) {
+  const events = new EventEmitter();
+  let worker = null;
+  let stdoutBuffer = '';
+  let stopped = false;
+  let restarting = false;
+  let restartTimer = null;
+  let lastStderrLogAt = 0;
+  let suppressedStderrLines = 0;
+  let currentAddress = address;
+
+  function emitProtocolError(message) {
+    events.emit('message', {
+      type: 'status',
+      state: 'error',
+      error: message,
+    });
+  }
+
+  function processStdout(chunk) {
+    stdoutBuffer += chunk.toString('utf8');
+    let newline = stdoutBuffer.indexOf('\n');
+    while (newline !== -1) {
+      const line = stdoutBuffer.slice(0, newline).trim();
+      stdoutBuffer = stdoutBuffer.slice(newline + 1);
+      if (line) {
+        try {
+          const message = JSON.parse(line);
+          if (!message || typeof message !== 'object' || typeof message.type !== 'string') {
+            throw new Error('message needs a type');
+          }
+          events.emit('message', message);
+        } catch (err) {
+          // A corrupted stdout line means measurement framing can no longer be
+          // trusted. Surface the exact line rather than silently discarding a
+          // potential hardware failure that would otherwise look like zero kg.
+          emitProtocolError(`balance board worker returned invalid JSON: ${err.message}`);
+          logger?.warn?.('Balance Board worker protocol error', { line, error: err.message });
+        }
+      }
+      newline = stdoutBuffer.indexOf('\n');
+    }
+  }
+
+  function scheduleRestart() {
+    if (stopped || restartTimer) return;
+    restartTimer = setTimeout(() => {
+      restartTimer = null;
+      start();
+    }, RESTART_DELAY_MS);
+  }
+
+  function start() {
+    if (stopped || (worker && !worker.killed)) return;
+    stdoutBuffer = '';
+
+    const child = spawn(WORKER_PATH, [], {
+      env: {
+        ...process.env,
+        BALANCE_BOARD_ADDRESS: currentAddress || '',
+        BALANCE_BOARD_SIMULATE: simulate ? 'cycle' : '',
+      },
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    worker = child;
+
+    child.stdout.on('data', processStdout);
+    child.stderr.on('data', (chunk) => {
+      const text = chunk.toString('utf8').trim();
+      if (!text) return;
+      const now = Date.now();
+      if (now - lastStderrLogAt >= STDERR_LOG_INTERVAL_MS) {
+        const suffix = suppressedStderrLines
+          ? ` (${suppressedStderrLines} worker stderr lines suppressed)`
+          : '';
+        logger?.warn?.(`Balance Board worker: ${text}${suffix}`);
+        lastStderrLogAt = now;
+        suppressedStderrLines = 0;
+      } else {
+        suppressedStderrLines += 1;
+      }
+    });
+    child.on('error', (err) => {
+      if (worker === child) worker = null;
+      emitProtocolError(`balance board worker failed to start: ${err.message}`);
+      scheduleRestart();
+    });
+    child.on('close', (code, signal) => {
+      if (worker === child) worker = null;
+      if (!stopped) {
+        // Admin unpair deliberately replaces the worker with an empty address.
+        // Do not turn that expected exit into a red hardware-error state while
+        // still using the normal restart scheduler for the replacement.
+        if (!restarting) emitProtocolError(`balance board worker exited (${signal || code})`);
+        restarting = false;
+        scheduleRestart();
+      }
+    });
+  }
+
+  function stop() {
+    stopped = true;
+    restarting = false;
+    if (restartTimer) {
+      clearTimeout(restartTimer);
+      restartTimer = null;
+    }
+    if (!worker) return;
+    const child = worker;
+    worker = null;
+    try {
+      child.stdin.write(`${JSON.stringify({ command: 'stop' })}\n`);
+    } catch (_err) {
+      // The worker may have already closed stdin while its exit event is still
+      // queued. SIGTERM below remains the reliable cleanup path.
+    }
+    child.kill('SIGTERM');
+    setTimeout(() => {
+      // bluetoothctl may still be finishing a bounded pairing command inside a
+      // worker thread. Do not let that delay server shutdown indefinitely.
+      if (child.exitCode == null && child.signalCode == null) child.kill('SIGKILL');
+    }, 1500).unref();
+  }
+
+  function restart() {
+    if (stopped) return;
+    if (!worker) {
+      start();
+      return;
+    }
+
+    const child = worker;
+    restarting = true;
+    try {
+      // An admin forget changes the address used in the child environment. A
+      // controlled restart lets the replacement worker start with that new
+      // value, while the existing close handler remains the single owner of
+      // delayed respawn and avoids overlapping Bluetooth listeners.
+      child.stdin.write(`${JSON.stringify({ command: 'stop' })}\n`);
+    } catch (_err) {
+      // The child may have already closed stdin; SIGTERM below still guarantees
+      // that it cannot keep listening for the address that was just forgotten.
+    }
+    child.kill('SIGTERM');
+    setTimeout(() => {
+      if (child.exitCode == null && child.signalCode == null) child.kill('SIGKILL');
+    }, 1500).unref();
+  }
+
+  return {
+    events,
+    start,
+    stop,
+    restart,
+    setAddress(nextAddress) {
+      // The factory can be created before first commissioning. Preserve the
+      // newly paired address for later bridge restarts in the same Node process
+      // instead of reverting the replacement worker to discovery mode.
+      currentAddress = typeof nextAddress === 'string' ? nextAddress.trim().toUpperCase() : '';
+    },
+  };
+}
+
+module.exports = {
+  createBalanceBoardHardware,
+};

server/src/services/balanceBoardService/index.js

@@ -0,0 +1,575 @@
+// Balance Board Service
+// Purpose: Exposes one Wii Balance Board as a self-pairing Bluetooth scale.
+// Scope: Stores pairing and admin zero calibration, then publishes status plus live four-corner weight.
+const fs = require('fs');
+const { execFile } = require('child_process');
+const { promisify } = require('util');
+const EventEmitter = require('events');
+const io = require('../../globals/io');
+const logger = require('../../globals/logger').child('balanceBoardService');
+const { loadConfig } = require('../../helpers/configLoader');
+const { resolveDataDir, resolveDataPath } = require('../../helpers/dataPaths');
+const { isFeatureEnabled } = require('../../helpers/features');
+const { isAdmin } = require('../roleService');
+const { sendAlert } = require('../alertService');
+const { createBalanceBoardHardware } = require('./hardware');
+
+const events = new EventEmitter();
+const enabled = isFeatureEnabled('balanceBoard');
+const rawConfig = loadConfig().balanceBoard || {};
+const DATA_DIR = resolveDataDir();
+const STORE_PATH = resolveDataPath('balance-board.json');
+const FRAME_ROOM = 'balance-board-viewers';
+const CORNER_KEYS = ['topRight', 'bottomRight', 'topLeft', 'bottomLeft'];
+const ZERO_SAMPLE_COUNT = 10;
+const ZERO_SAMPLE_INTERVAL_MS = 1000;
+const ZERO_MAX_SAMPLE_AGE_MS = 1500;
+const ZERO_MAX_COMBINED_RANGE_KG = 0.5;
+const RECORD_PERSIST_DELAY_MS = 1000;
+const execFileAsync = promisify(execFile);
+const ALERT_COLOR = '#38bdf8';
+
+function emptyZeroCorners() {
+  return Object.fromEntries(CORNER_KEYS.map((key) => [key, 0]));
+}
+
+function normalizeStoredCorners(value) {
+  if (!value || typeof value !== 'object') return emptyZeroCorners();
+  return Object.fromEntries(CORNER_KEYS.map((key) => {
+    const number = Number(value[key]);
+    return [key, Number.isFinite(number) ? Math.max(0, number) : 0];
+  }));
+}
+
+function emptyStore() {
+  return {
+    address: '',
+    zeroCorners: emptyZeroCorners(),
+    zeroedAt: null,
+    recordKg: 0,
+    recordedAt: null,
+  };
+}
+
+function loadStore() {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(STORE_PATH, 'utf8'));
+    const address = typeof parsed?.address === 'string' ? parsed.address.trim().toUpperCase() : '';
+    const zeroedAt = Number.isFinite(Number(parsed?.zeroedAt)) ? Number(parsed.zeroedAt) : null;
+    const recordKg = Number.isFinite(Number(parsed?.recordKg))
+      ? roundedWeight(parsed.recordKg)
+      : 0;
+    const recordedAt = Number.isFinite(Number(parsed?.recordedAt))
+      ? Number(parsed.recordedAt)
+      : null;
+    return {
+      address,
+      zeroCorners: zeroedAt ? normalizeStoredCorners(parsed.zeroCorners) : emptyZeroCorners(),
+      zeroedAt,
+      recordKg,
+      recordedAt: recordKg > 0 ? recordedAt : null,
+    };
+  } catch (err) {
+    if (err.code !== 'ENOENT') logger.warn('Failed to load Balance Board address', err.message);
+    return emptyStore();
+  }
+}
+
+function persistStore() {
+  fs.mkdirSync(DATA_DIR, { recursive: true });
+  const temporary = `${STORE_PATH}.${process.pid}.${Date.now()}.tmp`;
+  fs.writeFileSync(temporary, `${JSON.stringify(store, null, 2)}\n`, 'utf8');
+  fs.renameSync(temporary, STORE_PATH);
+}
+
+function roundedWeight(value) {
+  return Math.round(Math.max(0, Number(value) || 0) * 100) / 100;
+}
+
+function cornerWeightsKg(corners = {}) {
+  // Preserve wiiuse's factory-calibrated load cells in kilograms. The separate
+  // admin zero calibration below is an installation baseline layered on top of
+  // this factory conversion; it must never replace the hardware calibration.
+  return {
+    topRight: roundedWeight((Number(corners.topRight) || 0) / 100),
+    bottomRight: roundedWeight((Number(corners.bottomRight) || 0) / 100),
+    topLeft: roundedWeight((Number(corners.topLeft) || 0) / 100),
+    bottomLeft: roundedWeight((Number(corners.bottomLeft) || 0) / 100),
+  };
+}
+
+function subtractZero(rawCorners) {
+  const baseline = store.zeroedAt ? store.zeroCorners : emptyZeroCorners();
+  return Object.fromEntries(CORNER_KEYS.map((key) => [
+    key,
+    roundedWeight(Math.max(0, rawCorners[key] - baseline[key])),
+  ]));
+}
+
+function totalCornerWeight(corners) {
+  return roundedWeight(CORNER_KEYS.reduce((total, key) => total + corners[key], 0));
+}
+
+let store = enabled ? loadStore() : emptyStore();
+let hardware = null;
+let status = enabled ? (store.address ? 'waiting' : 'starting') : 'disabled';
+let detail = enabled
+  ? (store.address ? 'Press the front power button.' : 'Starting Bluetooth discovery.')
+  : 'Balance Board support is disabled.';
+let connected = false;
+let batteryPercent = null;
+let latestFrame = null;
+let latestRawCorners = null;
+let latestRawFrameAt = 0;
+let zeroTimer = null;
+let recordPersistTimer = null;
+let zeroSamples = [];
+let zeroProgress = {
+  active: false,
+  samplesCollected: 0,
+  totalSamples: ZERO_SAMPLE_COUNT,
+  error: '',
+};
+let previousWorkerState = '';
+let lastAlertKey = '';
+let unpairing = false;
+
+function sendRawAlert(state, message = '') {
+  const rawMessage = message ? `${state}: ${message}` : state;
+  if (rawMessage === lastAlertKey) return;
+  lastAlertKey = rawMessage;
+  sendAlert({ color: ALERT_COLOR, title: 'Balance Board', message: rawMessage });
+}
+
+function sendStatusAlert(workerState, message = '') {
+  const shouldAlert =
+    workerState === 'connected' ||
+    workerState === 'sleeping' ||
+    workerState === 'connection-failed' ||
+    workerState === 'error' ||
+    (workerState === 'waiting' && previousWorkerState === 'connected');
+
+  previousWorkerState = workerState;
+  if (!shouldAlert) return;
+
+  // Keep the alert at the same system-level boundary as the worker protocol:
+  // state first, followed by its exact detail when one exists. The service does
+  // not reinterpret failures as friendlier product copy, but still collapses
+  // identical retries so a failing reconnect cannot flood the activity feed.
+  sendRawAlert(workerState, message);
+}
+
+function getState() {
+  return {
+    enabled,
+    paired: Boolean(store.address) || Boolean(rawConfig.simulate),
+    address: store.address || (rawConfig.simulate ? 'SIMULATED' : null),
+    connected,
+    status,
+    detail,
+    batteryPercent,
+    recordKg: store.recordKg,
+    recordedAt: store.recordedAt,
+    calibration: {
+      calibrated: Boolean(store.zeroedAt),
+      zeroedAt: store.zeroedAt,
+      ...zeroProgress,
+    },
+  };
+}
+
+function clearRecordPersistTimer() {
+  if (!recordPersistTimer) return;
+  clearTimeout(recordPersistTimer);
+  recordPersistTimer = null;
+}
+
+function scheduleRecordPersistence() {
+  clearRecordPersistTimer();
+
+  // A person driving onto the board produces many successively larger frames.
+  // Waiting until the maximum has stopped changing prevents a synchronous JSON
+  // rewrite for every 20 Hz sensor frame while still saving a settled record
+  // promptly enough to survive an ordinary service restart.
+  recordPersistTimer = setTimeout(() => {
+    recordPersistTimer = null;
+    persistStore();
+  }, RECORD_PERSIST_DELAY_MS);
+  recordPersistTimer.unref?.();
+}
+
+function publishLatestFrame() {
+  if (!latestFrame) return;
+  io.to(FRAME_ROOM).emit('balanceBoard:frame', latestFrame);
+}
+
+function resetWeightRecord() {
+  clearRecordPersistTimer();
+
+  // Reset means "start measuring the record from now." If the board currently
+  // has a load, that current measurement is the first candidate in the new
+  // period. Saving it immediately avoids briefly showing zero before the next
+  // live frame restores the same weight as the record.
+  const currentWeight = connected && latestFrame ? roundedWeight(latestFrame.totalKg) : 0;
+  store.recordKg = currentWeight;
+  store.recordedAt = currentWeight > 0 ? Date.now() : null;
+  persistStore();
+
+  if (latestFrame) {
+    latestFrame = {
+      ...latestFrame,
+      recordKg: store.recordKg,
+      recordedAt: store.recordedAt,
+    };
+    publishLatestFrame();
+  }
+  events.emit('change', { state: getState() });
+  sendRawAlert('record-reset');
+}
+
+function updateStatus(nextStatus, nextDetail) {
+  const normalizedStatus = String(nextStatus || 'unknown');
+  const normalizedDetail = String(nextDetail || '');
+  if (status === normalizedStatus && detail === normalizedDetail) return;
+  status = normalizedStatus;
+  detail = normalizedDetail;
+  events.emit('change', { state: getState() });
+}
+
+function publishCalibrationState() {
+  // Calibration progress belongs in the ordinary session payload because it
+  // changes only once per second for ten seconds. Live 20 Hz weights remain in
+  // their dedicated room and never trigger a full-session broadcast.
+  events.emit('change', { state: getState() });
+}
+
+function clearZeroTimer() {
+  if (!zeroTimer) return;
+  clearInterval(zeroTimer);
+  zeroTimer = null;
+}
+
+function failZeroCalibration(error, { alert = true } = {}) {
+  clearZeroTimer();
+  zeroSamples = [];
+  zeroProgress = {
+    active: false,
+    samplesCollected: 0,
+    totalSamples: ZERO_SAMPLE_COUNT,
+    error: String(error || 'Calibration failed'),
+  };
+  publishCalibrationState();
+  if (alert) sendRawAlert('zero-failed', zeroProgress.error);
+}
+
+function finishZeroCalibration() {
+  clearZeroTimer();
+
+  // A single average could hide movement that returns to its starting point.
+  // Sum every corner's complete ten-second range before accepting the result so
+  // distributed movement cannot hide below four independent thresholds. Retain
+  // three decimals so averaging ten centi-kilogram samples does not throw away
+  // useful sub-centi-kilogram precision in the persisted baseline.
+  const combinedRange = CORNER_KEYS.reduce((totalRange, key) => {
+    const values = zeroSamples.map((sample) => sample[key]);
+    return totalRange + Math.max(...values) - Math.min(...values);
+  }, 0);
+  if (combinedRange > ZERO_MAX_COMBINED_RANGE_KG) {
+    failZeroCalibration('Load moved during the ten-second calibration.');
+    return;
+  }
+
+  store.zeroCorners = Object.fromEntries(CORNER_KEYS.map((key) => {
+    const average = zeroSamples.reduce((sum, sample) => sum + sample[key], 0) /
+      zeroSamples.length;
+    return [key, Math.round(average * 1000) / 1000];
+  }));
+  store.zeroedAt = Date.now();
+  // A new zero changes the meaning of every adjusted weight, so an old record
+  // cannot be compared with measurements under the new baseline.
+  clearRecordPersistTimer();
+  store.recordKg = 0;
+  store.recordedAt = null;
+  persistStore();
+  zeroSamples = [];
+  zeroProgress = {
+    active: false,
+    samplesCollected: ZERO_SAMPLE_COUNT,
+    totalSamples: ZERO_SAMPLE_COUNT,
+    error: '',
+  };
+  publishCalibrationState();
+  sendRawAlert('zeroed');
+}
+
+function takeZeroSample() {
+  if (!connected || !latestRawCorners || Date.now() - latestRawFrameAt > ZERO_MAX_SAMPLE_AGE_MS) {
+    failZeroCalibration('Live Balance Board data stopped during calibration.');
+    return;
+  }
+
+  zeroSamples.push({ ...latestRawCorners });
+  zeroProgress = {
+    active: true,
+    samplesCollected: zeroSamples.length,
+    totalSamples: ZERO_SAMPLE_COUNT,
+    error: '',
+  };
+  publishCalibrationState();
+  if (zeroSamples.length >= ZERO_SAMPLE_COUNT) finishZeroCalibration();
+}
+
+function startZeroCalibration() {
+  if (zeroProgress.active) throw new Error('Balance Board zero calibration is already running');
+  if (!connected || !latestRawCorners || Date.now() - latestRawFrameAt > ZERO_MAX_SAMPLE_AGE_MS) {
+    throw new Error('The Balance Board must be connected and sending weight data');
+  }
+
+  zeroSamples = [];
+  zeroProgress = {
+    active: true,
+    samplesCollected: 0,
+    totalSamples: ZERO_SAMPLE_COUNT,
+    error: '',
+  };
+  publishCalibrationState();
+  sendRawAlert('zeroing');
+  // Delaying the first sample by one interval makes this a real ten-second
+  // calibration rather than ten rapid reads followed by nine seconds of UI.
+  zeroTimer = setInterval(takeZeroSample, ZERO_SAMPLE_INTERVAL_MS);
+}
+
+function processFrame(message = {}) {
+  const rawCorners = cornerWeightsKg(message.corners);
+  latestRawCorners = rawCorners;
+  latestRawFrameAt = Date.now();
+  if (Number.isFinite(Number(message.batteryPercent))) {
+    batteryPercent = Math.max(0, Math.min(100, Number(message.batteryPercent)));
+  }
+
+  connected = true;
+  updateStatus('connected', 'Live weight is updating.');
+  const adjustedCorners = subtractZero(rawCorners);
+  const totalKg = totalCornerWeight(adjustedCorners);
+  if (totalKg > store.recordKg) {
+    // Store only adjusted weight so the displayed record uses the same admin
+    // zero baseline as the live total and all four corner readings.
+    store.recordKg = totalKg;
+    store.recordedAt = Date.now();
+    scheduleRecordPersistence();
+  }
+  latestFrame = {
+    totalKg,
+    corners: adjustedCorners,
+    batteryPercent,
+    recordKg: store.recordKg,
+    recordedAt: store.recordedAt,
+  };
+  publishLatestFrame();
+}
+
+function handleWorkerMessage(message = {}) {
+  if (message.type === 'frame') {
+    processFrame(message);
+    return;
+  }
+
+  if (message.type === 'paired') {
+    const address = typeof message.address === 'string' ? message.address.trim().toUpperCase() : '';
+    if (address && address !== store.address) {
+      store.address = address;
+      // A zero baseline belongs to one physical board and whatever permanent
+      // platform/load was present when an admin calibrated it. Never carry that
+      // baseline across commissioning a different Bluetooth identity.
+      store.zeroCorners = emptyZeroCorners();
+      store.zeroedAt = null;
+      clearRecordPersistTimer();
+      store.recordKg = 0;
+      store.recordedAt = null;
+      persistStore();
+    }
+    hardware?.setAddress(address);
+    sendRawAlert('paired');
+    updateStatus('connecting', 'Paired. Connecting to the board now.');
+    return;
+  }
+
+  if (message.type !== 'status') return;
+  const workerState = String(message.state || 'unknown');
+  sendStatusAlert(workerState, message.error || '');
+  if (workerState === 'commissioning') {
+    updateStatus('starting', 'Starting Bluetooth discovery.');
+  } else if (workerState === 'discovering') {
+    updateStatus('waiting-for-sync', 'Press the red Sync button underneath the board.');
+  } else if (workerState === 'pairing') {
+    updateStatus('pairing', 'Board found. Pairing now.');
+  } else if (workerState === 'connected') {
+    connected = true;
+    updateStatus('connected', 'Connected. Waiting for live weight data.');
+  } else if (workerState === 'link-detected') {
+    connected = false;
+    // The native bridge can now distinguish which half of the board's HID
+    // connection reached the server. Preserve that diagnostic until both
+    // channels arrive; the generic text remains for the outbound Sync flow.
+    updateStatus('connecting', message.error || 'Board responded. Reading its sensor calibration.');
+  } else if (workerState === 'connection-failed') {
+    connected = false;
+    latestFrame = null;
+    latestRawCorners = null;
+    latestRawFrameAt = 0;
+    if (zeroProgress.active) failZeroCalibration('Board disconnected during calibration.');
+    updateStatus('connection-failed', message.error || 'The direct Balance Board connection failed.');
+  } else if (workerState === 'sleeping') {
+    connected = false;
+    latestFrame = null;
+    latestRawCorners = null;
+    latestRawFrameAt = 0;
+    if (zeroProgress.active) failZeroCalibration('Board slept during calibration.');
+    updateStatus('sleeping', message.error || 'Board is asleep. Press the front power button to wake it.');
+  } else if (workerState === 'waiting') {
+    connected = false;
+    latestFrame = null;
+    latestRawCorners = null;
+    latestRawFrameAt = 0;
+    if (zeroProgress.active) failZeroCalibration('Board disconnected during calibration.');
+    updateStatus('waiting', message.error || 'Press the front power button. The server will keep trying to connect.');
+  } else if (workerState === 'error') {
+    connected = false;
+    latestRawCorners = null;
+    latestRawFrameAt = 0;
+    if (zeroProgress.active) failZeroCalibration('Worker stopped during calibration.');
+    updateStatus('error', message.error || 'The Balance Board worker stopped.');
+  }
+}
+
+io.on('connection', (socket) => {
+  socket.on('balanceBoard:subscribe', (_payload = {}, cb = () => {}) => {
+    socket.join(FRAME_ROOM);
+    if (latestFrame) socket.emit('balanceBoard:frame', latestFrame);
+    cb({ success: true });
+  });
+  socket.on('balanceBoard:unsubscribe', () => socket.leave(FRAME_ROOM));
+  socket.on('balanceBoard:zero', (_payload = {}, cb = () => {}) => {
+    if (!isAdmin(socket)) {
+      cb({ error: 'Admin access required' });
+      return;
+    }
+    try {
+      startZeroCalibration();
+      cb({ success: true });
+    } catch (err) {
+      cb({ error: err.message || 'Failed to start Balance Board zero calibration' });
+    }
+  });
+  socket.on('balanceBoard:resetRecord', (_payload = {}, cb = () => {}) => {
+    if (!isAdmin(socket)) {
+      cb({ error: 'Admin access required' });
+      return;
+    }
+
+    try {
+      resetWeightRecord();
+      cb({ success: true });
+    } catch (err) {
+      logger.error('Failed to reset Balance Board weight record', err);
+      cb({ error: err.message || 'Failed to reset the Balance Board weight record' });
+    }
+  });
+  socket.on('balanceBoard:unpair', async (_payload = {}, cb = () => {}) => {
+    if (!isAdmin(socket)) {
+      cb({ error: 'Admin access required' });
+      return;
+    }
+    if (unpairing) {
+      cb({ error: 'The Balance Board is already being unpaired' });
+      return;
+    }
+
+    unpairing = true;
+    const address = store.address;
+    let bluetoothWarning = '';
+    try {
+      if (address) {
+        try {
+          // A complete forget removes both sources of remembered identity. If
+          // only the JSON address or only the BlueZ bond were removed, the next
+          // red-Sync attempt could inherit half of the previous relationship.
+          await execFileAsync('bluetoothctl', ['remove', address], { timeout: 10000 });
+        } catch (err) {
+          bluetoothWarning = String(
+            err?.stderr || err?.message || 'BlueZ did not remove the bond',
+          ).trim();
+          logger.warn('Balance Board BlueZ bond removal failed', bluetoothWarning);
+        }
+      }
+
+      store.address = '';
+      store.zeroCorners = emptyZeroCorners();
+      store.zeroedAt = null;
+      clearRecordPersistTimer();
+      store.recordKg = 0;
+      store.recordedAt = null;
+      persistStore();
+      clearZeroTimer();
+      zeroSamples = [];
+      zeroProgress = {
+        active: false,
+        samplesCollected: 0,
+        totalSamples: ZERO_SAMPLE_COUNT,
+        error: '',
+      };
+      connected = false;
+      batteryPercent = null;
+      latestFrame = null;
+      latestRawCorners = null;
+      latestRawFrameAt = 0;
+      previousWorkerState = '';
+      hardware?.setAddress('');
+      hardware?.restart();
+      updateStatus('starting', 'Starting Bluetooth discovery.');
+      sendRawAlert('unpaired');
+      cb({ success: true, warning: bluetoothWarning || null });
+    } catch (err) {
+      logger.error('Failed to unpair Balance Board', err);
+      cb({ error: err.message || 'Failed to unpair the Balance Board' });
+    } finally {
+      unpairing = false;
+    }
+  });
+});
+
+if (enabled) {
+  hardware = createBalanceBoardHardware({
+    logger,
+    address: store.address,
+    simulate: Boolean(rawConfig.simulate || process.env.BALANCE_BOARD_SIMULATE),
+  });
+  hardware.events.on('message', handleWorkerMessage);
+  hardware.start();
+} else {
+  logger.info('Balance Board disabled by config');
+}
+
+function installShutdownHooks() {
+  const shutdown = () => {
+    clearZeroTimer();
+    // A record may still be inside the short debounce window when the process
+    // receives a normal shutdown signal. Flush that newest maximum before the
+    // hardware worker stops so a clean restart cannot lose it.
+    if (recordPersistTimer) {
+      clearRecordPersistTimer();
+      persistStore();
+    }
+    hardware?.stop();
+  };
+  process.once('exit', shutdown);
+  process.once('SIGINT', shutdown);
+  process.once('SIGTERM', shutdown);
+}
+
+installShutdownHooks();
+
+module.exports = {
+  getState,
+  balanceBoardEvents: events,
+};

server/src/services/balanceBoardService/native/Makefile

@@ -0,0 +1,22 @@
+CXX ?= g++
+
+# Wiiuse owns the Balance Board's HID control/interrupt channels and applies the
+# calibration stored in the board. This deliberately avoids BlueZ's generic HID
+# profile: current BlueZ requests medium link security for a bonded board, and
+# the original Balance Board rejects that negotiation before an input device is
+# created.
+CXXFLAGS ?= -O2 -std=c++17 -Wall -Wextra -pedantic
+LDLIBS += -lwiiuse -lbluetooth -pthread
+
+TARGET := balance_board_worker
+SRC := balance_board_worker.cpp
+
+.PHONY: all clean
+
+all: $(TARGET)
+
+$(TARGET): $(SRC)
+	$(CXX) $(CXXFLAGS) -o $@ $< $(LDLIBS)
+
+clean:
+	rm -f $(TARGET)

server/src/services/chatService/handlers.js

@@ -8,7 +8,7 @@ const { hasProfanity, isKeymash, normalizeUserText } = require('./contentFilters
 const { buildMessage, buildTypingPayload, resolveRoverId, isPrivateClosedRoverId, buildRoverCtxSnapshot } = require('./contextBuilders');
 const { broadcastMessage, broadcastTyping } = require('./broadcast');
 const { playTypingNote, normalizeTtsOptions, maybeSendAccessNotice, maybeSpeak, TYPING_SEND_NOTE } = require('./notifications');
-const { runChatTextCommand } = require('./textCommands');
+const { isTextCommand, runChatTextCommand } = require('./textCommands');
 
 function createHandlers({ sendSystemMessage }) {
   async function handleIncoming({ text, tts, bot = false, profileImage = null } = {}, socket, cb = () => {}) {
@@ -53,21 +53,26 @@ function createHandlers({ sendSystemMessage }) {
     maybeSendAccessNotice(message, sendSystemMessage);
     maybeSpeak(socket, message, ttsOptions);
 
-    try {
-      // Commands sent from site chat should still be visible as normal chat
-      // messages. Running the command after broadcast preserves the user-visible
-      // transcript while keeping permissions and command execution entirely on
-      // the server.
-      const ranCommand = await runChatTextCommand({ text: clean, socket, sendSystemMessage });
-      cb({ success: true, command: ranCommand });
-      return;
-    } catch (err) {
-      logger.warn('Chat command failed after broadcast', { socket: socket?.id, error: err.message });
-      cb({ success: true, command: true, commandError: err.message || 'Command failed' });
-      return;
-    }
+    const command = isTextCommand(clean);
+    // Chat delivery is complete once validation, broadcast, and local side
+    // effects above have succeeded. A command may wait on Home Assistant,
+    // hardware, replay preparation, or an external transport, so tying the
+    // socket acknowledgement to command completion leaves the browser's send
+    // promise pending and makes its input state appear stuck. Acknowledge now;
+    // command replies continue through the normal Rover bot message stream.
+    cb({ success: true, command });
 
-    cb({ success: true });
+    if (command) {
+      // Deliberately do not await this promise. runChatTextCommand already turns
+      // ordinary command failures into visible bot messages; this final catch
+      // protects the service from an unexpected setup/programming failure and
+      // cannot attempt a second acknowledgement after the UI has moved on.
+      void runChatTextCommand({ text: clean, socket, sendSystemMessage }).catch((err) => {
+        logger.warn('Chat command failed after acknowledgement', { socket: socket?.id, error: err.message });
+        sendSystemMessage(`Command failed: ${err.message || 'unknown error'}`, { nickname: 'Rover bot', bot: true });
+      });
+    }
+    return;
   }
 
   function sendExternalMessage({ text, nickname = 'Discord', role = 'admin', roverId = null, discordGuildId = null, discordGuildName = null, discordGuildIconUrl = null, discordChannelId = null, discordUserId = null, discordUserName = null, discordUserAvatarUrl = null, bot = false, profileImage = null }) {

server/src/services/chatService/textCommands.js

@@ -10,6 +10,9 @@ const { getNickname } = require('../nicknameService');
 const { getGlobalObjective, setGlobalObjective, clearGlobalObjective } = require('../globalObjectiveService');
 const { getAdminReason, setAdminReason, clearAdminReason } = require('../adminReasonService');
 const homeAssistantService = require('../homeAssistantService');
+const liftService = require('../liftService');
+const neatoService = require('../neatoService');
+const { isFeatureEnabled } = require('../../helpers/features');
 const {
   listVerifiedUsers,
   removeVerifiedUser,
@@ -20,20 +23,21 @@ const {
 const { publishEvent } = require('../eventBus');
 const assignmentService = require('../assignmentService');
 const { loadConfig } = require('../../helpers/configLoader');
-const { createCommandHandlers } = require('../discordBotService/commands');
+const { createCommandHandlers } = require('../operatorCommandService');
+const { parseCommandText } = require('../operatorCommandService/config');
+const { createWebTransportHandlers } = require('../operatorCommandService/webTransport');
 const { commandReplyToText } = require('./commandResultFormatter');
 const {
   buildReplayJobId,
   buildReplayTitle,
   createReplaySourceResolver,
-} = require('../discordBotService/replayWorkflow');
+} = require('../replayDeliveryService/workflow');
 
 const config = loadConfig();
 const discordConfig = config.discord || {};
 
 function isTextCommand(text) {
-  const clean = String(text || '').trim();
-  return clean.toLowerCase() === 'ts' || /^rs(?:\s|$)/i.test(clean);
+  return parseCommandText(text, config).matched;
 }
 
 function sanitizeMentions(text) {
@@ -70,12 +74,6 @@ function createWebReplayTextCommand(socket, sendSystemMessage, replayApi) {
         return;
       }
 
-      const channelId = discordConfig?.channels?.replay || null;
-      if (!channelId) {
-        await message.reply({ content: 'Replay denied: replay channel is not configured.' });
-        return;
-      }
-
       const resolved = sourceResolver.resolve(query);
       if (resolved?.error) {
         await message.reply({ content: resolved.error });
@@ -99,7 +97,6 @@ function createWebReplayTextCommand(socket, sendSystemMessage, replayApi) {
         type: 'replay.requested',
         payload: {
           jobId,
-          channelId,
           requester,
           title: '',
           includeSidebar: true,
@@ -113,18 +110,18 @@ function createWebReplayTextCommand(socket, sendSystemMessage, replayApi) {
   };
 }
 
-function createChatCommandMessage({ socket, text, sendSystemMessage }) {
+function createChatCommandRequest({ socket, text, sendSystemMessage }) {
   const nickname = buildRequesterLabel(socket);
   return {
     content: String(text || '').trim(),
-    author: {
+    actor: {
       bot: false,
       id: socket.id,
-      username: nickname,
-    },
-    member: {
-      nickname,
+      label: nickname,
+      isAdmin: isAdmin(socket),
+      isLockdownAdmin: isLockdownAdmin(socket),
     },
+    transport: 'web-chat',
     reply: async (payload) => {
       const response = sanitizeMentions(commandReplyToText(payload));
       if (!response) return null;
@@ -139,8 +136,8 @@ async function runChatTextCommand({ text, socket, sendSystemMessage }) {
   // keeps ordinary chatService initialization from changing the service boot
   // order, while still letting `rs replay` use the existing replay pipeline.
   const replayApi = require('../replayEngineV2');
-  const message = createChatCommandMessage({ socket, text, sendSystemMessage });
-  const commands = createCommandHandlers({
+  const message = createChatCommandRequest({ socket, text, sendSystemMessage });
+  const commandDependencies = {
     logger: null,
     client: null,
     io,
@@ -168,6 +165,9 @@ async function runChatTextCommand({ text, socket, sendSystemMessage }) {
     // lights lock/unlock` from becoming transport-specific, and it preserves
     // the existing session update path for all connected browsers.
     homeAssistantService,
+    liftService,
+    neatoService,
+    isFeatureEnabled,
     getGuildConfig: () => null,
     setGuildConfig: () => null,
     removeGuildConfig: () => null,
@@ -183,9 +183,12 @@ async function runChatTextCommand({ text, socket, sendSystemMessage }) {
     isAdminUser: (id) => String(id) === String(socket.id) && isAdmin(socket),
     isLockdownAdminUser: (id) => String(id) === String(socket.id) && isLockdownAdmin(socket),
     discordConfig,
+    siteUrl: String(discordConfig.siteUrl || ''),
     config,
     createReplayTextCommand: createWebReplayTextCommand(socket, sendSystemMessage, replayApi),
-  });
+  };
+  commandDependencies.transportHandlers = createWebTransportHandlers(commandDependencies);
+  const commands = createCommandHandlers(commandDependencies);
 
   // Let the shared router perform normal command permission checks. Site chat
   // has already broadcast the user's command text, so command replies become a

server/src/services/commandService/index.js

@@ -9,6 +9,7 @@ const { isDeterred } = require('../verificationService');
 const logger = require('../../globals/logger').child('commandService');
 const { isHeadlightBlocked } = require('../../rewards/definitions/darkness');
 const homeAssistantService = require('../homeAssistantService');
+const overcurrentProtectionService = require('../overcurrentProtectionService');
 
 const pendingCommands = new Map(); // id -> { roverId }
 const lastDriveActivity = new Map(); // roverId -> { ts, socketId, direction, speed, isAdmin }
@@ -93,6 +94,31 @@ function issueCommand(roverId, payload) {
   return id;
 }
 
+/*
+  The protection service owns decisions about when a held command must be
+  resent at a lower output. Injecting this raw transport function keeps those
+  resends on the same rover websocket path as every other server command while
+  avoiding a circular dependency from the protection service back into this
+  socket-facing module.
+*/
+overcurrentProtectionService.configureCommandIssuer((roverId, payload) => {
+  const blockedUntil = driveCooldowns.get(roverId);
+  const safetyCooldownActive = blockedUntil && Date.now() < blockedUntil;
+  if (safetyCooldownActive && getCommandMotionMagnitude(payload?.type, payload) > 0) {
+    /*
+      Private-rover and dock safety own the existing command cooldown map. A
+      rate-limited protection resend must respect those independent systems;
+      otherwise this new service could restart drive or brushes immediately
+      after an unrelated safety feature deliberately stopped them. Returning
+      false tells the protection service to retry after the cooldown instead of
+      recording an output that never reached the rover.
+    */
+    return false;
+  }
+  issueCommand(roverId, payload);
+  return true;
+});
+
 function handleAck(msg) {
   const pending = pendingCommands.get(msg.id);
   if (!pending) return;
@@ -106,6 +132,28 @@ function handleAck(msg) {
   });
 }
 
+function issueUpdateToAllRovers() {
+  const updated = [];
+  const failed = [];
+
+  roverManager.rovers.forEach((record) => {
+    if (!record?.ws) return;
+
+    const roverId = String(record.id);
+    try {
+      // Use the same narrow update payload as the per-rover admin action. The
+      // browser only asks for "update all"; the Pi still owns the privileged
+      // pull/install/reboot sequence through its fixed self-update helper.
+      issueCommand(roverId, { type: 'update', update: {} });
+      updated.push(roverId);
+    } catch (err) {
+      failed.push({ roverId, error: err.message });
+    }
+  });
+
+  return { updated, failed };
+}
+
 function getRecentDriveActivity(windowMs, options = {}) {
   const now = Date.now();
   const results = [];
@@ -204,7 +252,7 @@ io.on('connection', (socket) => {
       if (type === 'audioLevels') {
         throw new Error('audioLevels command is service-managed');
       }
-      const payload = data ? { ...data } : {};
+      let payload = data ? { ...data } : {};
       if (type === 'headlight' && isHeadlightBlocked()) {
         logger.info('Ignoring headlight command while darkness lock is active', { socketId: socket.id, roverId });
         reply({ ignored: true, reason: 'darknessActive' });
@@ -269,6 +317,19 @@ io.on('connection', (socket) => {
           });
         }
       }
+
+      if (type === 'drive' || type === 'motors') {
+        /*
+          Role is supplied at the command boundary because telemetry does not
+          identify the operator who produced the active motor intent. Admin and
+          lockdown commands therefore enter the service explicitly bypassed;
+          they are recorded for status visibility but are never scaled, blocked,
+          or countermanded by a later sensor frame.
+        */
+        payload = overcurrentProtectionService.protectCommand(roverId, type, payload, {
+          bypassed: isAdminSocket,
+        });
+      }
       const id = issueCommand(roverId, { type, ...payload });
       logger.info('Queued command', socket.id, roverId, type);
       if (shouldRecordTurnActivity(type, payload)) {
@@ -288,6 +349,26 @@ io.on('connection', (socket) => {
 
   socket.on('command', handleCommand);
   socket.on('command:issue', handleCommand);
+
+  socket.on('command:updateAllRovers', (_payload = {}, cb) => {
+    const reply = typeof cb === 'function' ? cb : () => {};
+    try {
+      if (!isAdmin(socket)) {
+        throw new Error('Not authorized');
+      }
+
+      const result = issueUpdateToAllRovers();
+      logger.warn('Admin requested update for all online rovers', {
+        socketId: socket.id,
+        updated: result.updated,
+        failed: result.failed,
+      });
+      reply(result);
+    } catch (err) {
+      logger.warn('Update-all rovers rejected', socket.id, err.message);
+      reply({ error: err.message });
+    }
+  });
 });
 
 homeAssistantService.homeAssistantEvents.on('update', () => {

server/src/services/discordBotService/commandAdapter.js

@@ -0,0 +1,39 @@
+// Discord Command Adapter
+// Purpose: Supplies Discord-specific renderers and extension commands to the operator command service.
+// Scope: Keeps Discord embeds, attachments, guild permissions, and bridge context outside the shared command core.
+const { createStatusCommand } = require('./commands/status');
+const { createReplayCommand } = require('./commands/replay');
+const { createBridgeCommand } = require('./commands/bridge');
+const { createTimeStatusCommand } = require('./commands/timeStatus');
+
+function createDiscordTransportHandlers(deps) {
+  const status = createStatusCommand(deps);
+  const replay = createReplayCommand(deps);
+  const bridge = createBridgeCommand(deps);
+  const timeStatus = createTimeStatusCommand(deps);
+  return {
+    status: (request, query) => status(request.context.discordMessage, query),
+    replay: (request, query) => replay(request.context.discordMessage, query),
+    bridge: (request, tokens) => bridge(request.context.discordMessage, tokens),
+    timeStatus: (request) => timeStatus(request.context.discordMessage),
+  };
+}
+
+function createDiscordCommandRequest(message, { isAdminUser, isLockdownAdminUser }) {
+  const id = message.author?.id || null;
+  return {
+    content: String(message.content || ''),
+    transport: 'discord',
+    actor: {
+      id,
+      label: message.member?.nickname || message.author?.globalName || message.author?.username || 'Discord',
+      bot: Boolean(message.author?.bot),
+      isAdmin: isAdminUser(id),
+      isLockdownAdmin: isLockdownAdminUser(id),
+    },
+    reply: (payload) => message.reply(payload),
+    context: { discordMessage: message },
+  };
+}
+
+module.exports = { createDiscordTransportHandlers, createDiscordCommandRequest };

server/src/services/discordBotService/commands/bridge.js

@@ -2,11 +2,12 @@
 // Purpose: Handles chat bridge configuration/status commands per guild.
 // Scope: Manages bridge channel, mode, and webhook provisioning.
 const { PermissionsBitField } = require('discord.js');
+const { getCommandConfig } = require('../../operatorCommandService/config');
 
-function createBridgeCommand({ getGuildConfig, setGuildConfig, removeGuildConfig, normalizeMode, VALID_MODES, isAdminUser, discordConfig }) {
+function createBridgeCommand({ getGuildConfig, setGuildConfig, removeGuildConfig, normalizeMode, VALID_MODES, isAdminUser, config }) {
   // Error text should name the active prefix because bridge setup is one of the
   // first commands an admin runs when a bot instance joins a shared Discord.
-  const commandPrefix = String(discordConfig?.commandPrefix || 'rs').trim() || 'rs';
+  const { prefix: commandPrefix } = getCommandConfig(config);
   function canManageBridge(message) {
     if (isAdminUser(message.author.id)) return true;
     if (!message.guild || !message.member) return false;

server/src/services/discordBotService/commands/help.js

@@ -1,32 +0,0 @@
-// Discord Help Command
-// Purpose: Provides help text for rover bot Discord commands.
-// Scope: Returns usage text with the configured command names for this bot instance.
-function formatHelp({ commandPrefix = 'rs', timeStatusCommand = 'ts' } = {}) {
-  const prefix = String(commandPrefix || 'rs').trim() || 'rs';
-  const timeCommand = timeStatusCommand ? String(timeStatusCommand).trim() : '';
-  return [
-    '**Rover Bot Commands**',
-    `\`${prefix} help\` — show this help`,
-    `\`${prefix} status [rover]\` — show rover status; rover names can be fuzzy`,
-    `\`${prefix} replay [sources]\` — send instant replay; source names can be fuzzy`,
-    `\`${prefix} bridge\` — show chat bridge status for this server`,
-    `\`${prefix} bridge here <global|private>\` — set chat bridge to this channel`,
-    `\`${prefix} bridge mode <global|private>\` — change chat bridge mode`,
-    `\`${prefix} bridge off\` — disable chat bridge for this server`,
-    `\`${prefix} lights <status|lock|unlock>\` — show or change room light lock state`,
-    `\`${prefix} kick <user> [reason]\` — remove a user from their current rover; use \`user | reason\` for multi-word names`,
-    `\`${prefix} lock <rover>\` — lock a rover; rover names can be fuzzy`,
-    `\`${prefix} unlock <rover>\` — unlock a rover; rover names can be fuzzy`,
-    `\`${prefix} mode <open|turns|admin|lockdown>\` — change server mode`,
-    `\`${prefix} reason [text|clear]\` — show or set admin mode reason`,
-    `\`${prefix} goal [text|clear]\` — show or set global objective`,
-    `\`${prefix} verify list\` — list verified users (lockdown admins)`,
-    `\`${prefix} verify remove <cookieUserId|nickname>\` — remove verified user; nicknames can be fuzzy or multi-word (lockdown admins)`,
-    `\`${prefix} deter list\` — list deterred users (lockdown admins)`,
-    `\`${prefix} deter ban <cookieUserId|nickname|ip>\` — deter a user; nicknames can be fuzzy or multi-word (lockdown admins)`,
-    `\`${prefix} deter unban <id|cookieUserId|nickname|ip>\` — remove deterrence; nicknames can be fuzzy or multi-word (lockdown admins)`,
-    timeCommand ? `\`${timeCommand}\` — show time status` : '',
-  ].filter(Boolean).join('\n');
-}
-
-module.exports = { formatHelp };

server/src/services/discordBotService/commands/index.js

@@ -1,141 +0,0 @@
-// Discord Commands Router
-// Purpose: Routes incoming Discord command messages to one-file-per-command handlers.
-// Scope: Central command dispatcher and permission gate orchestration.
-const { formatHelp } = require('./help');
-const { createStatusCommand } = require('./status');
-const { createReplayCommand } = require('./replay');
-const { createLockCommand } = require('./lock');
-const { createModeCommand } = require('./mode');
-const { createReasonCommand } = require('./reason');
-const { createGoalCommand } = require('./goal');
-const { createVerifyCommand } = require('./verify');
-const { createDeterCommand } = require('./deter');
-const { createBridgeCommand } = require('./bridge');
-const { createTimeStatusCommand } = require('./timeStatus');
-const { createLightsCommand } = require('./lights');
-const { createKickCommand } = require('./kick');
-
-function createCommandHandlers(deps) {
-  const {
-    getMode,
-    MODES,
-    isAdminUser,
-    isLockdownAdminUser,
-  } = deps;
-  // Each running rover server can bring its own Discord bot into the same
-  // guild, so the primary command prefix must come from config instead of
-  // being hard-coded globally. The fallback preserves existing installs.
-  const commandPrefix = String(deps.discordConfig?.commandPrefix || 'rs').trim() || 'rs';
-  // The legacy time command is a bare word rather than a prefixed command. It
-  // therefore needs its own configurable value, and `null` intentionally
-  // disables it so multiple bots do not all answer `ts` in the same channel.
-  const timeStatusCommand = deps.discordConfig?.timeStatusCommand === null
-    ? ''
-    : String(deps.discordConfig?.timeStatusCommand || 'ts').trim();
-  // Lowercase cached copies avoid re-normalizing every message and keep command
-  // matching case-insensitive without changing the original configured text
-  // that is shown in help output.
-  const normalizedCommandPrefix = commandPrefix.toLowerCase();
-  const normalizedTimeStatusCommand = timeStatusCommand.toLowerCase();
-
-  const handleStatusCommand = createStatusCommand(deps);
-  const handleReplayCommand = deps.createReplayTextCommand
-    ? deps.createReplayTextCommand(deps)
-    : createReplayCommand(deps);
-  const handleLockCommand = createLockCommand(deps);
-  const handleModeCommand = createModeCommand(deps);
-  const handleReasonCommand = createReasonCommand(deps);
-  const handleGoalCommand = createGoalCommand(deps);
-  const handleVerifyCommand = createVerifyCommand(deps);
-  const handleDeterCommand = createDeterCommand(deps);
-  const handleBridgeCommand = createBridgeCommand(deps);
-  const handleTimeStatusCommand = createTimeStatusCommand(deps);
-  const handleLightsCommand = createLightsCommand(deps);
-  const handleKickCommand = createKickCommand(deps);
-
-  function stripCommandPrefix(content) {
-    const trimmed = String(content || '').trim();
-    const lower = trimmed.toLowerCase();
-    if (!lower.startsWith(normalizedCommandPrefix)) return null;
-
-    const nextCharacter = trimmed.charAt(commandPrefix.length);
-    // Prefixes are matched as whole command tokens so an instance using `rs`
-    // still ignores ordinary words such as `rsvp`. This mirrors the old regex
-    // behavior while letting each Discord bot instance use its own prefix.
-    if (nextCharacter && !/\s/.test(nextCharacter)) return null;
-
-    return trimmed.slice(commandPrefix.length).trim();
-  }
-
-  async function handleCommand(message) {
-    if (message.author.bot) return;
-    const content = (message.content || '').trim();
-    const lower = content.toLowerCase();
-    // Commands are intentionally matched as whole prefixes. The previous
-    // startsWith checks made ordinary messages such as "rsvp" or "tshirt" look
-    // like commands, which is especially bad now that web chat will run the
-    // same server-side dispatcher before broadcasting user text.
-    if (normalizedTimeStatusCommand && lower === normalizedTimeStatusCommand) return handleTimeStatusCommand(message);
-
-    const commandBody = stripCommandPrefix(content);
-    if (commandBody === null) return;
-
-    const tokens = commandBody ? commandBody.split(/\s+/) : [];
-    const action = (tokens.shift() || '').toLowerCase();
-    const rest = tokens.join(' ').trim();
-    const isAdmin = isAdminUser(message.author.id);
-    const isLockdownAdmin = isLockdownAdminUser(message.author.id);
-    const mode = getMode();
-    // Actions in this set can change operational safety or access policy, so
-    // lockdown mode narrows them from normal admins to lockdown admins. Room
-    // light locking belongs here because it can force the physical room lights
-    // on and disables ordinary Home Assistant room controls for everyone else.
-    const moderationActions = new Set(['lock', 'unlock', 'mode', 'goal', 'reason', 'verify', 'deter', 'lights', 'kick']);
-
-    if (!isAdmin && action !== '' && action !== 'status' && action !== 'help' && action !== 'replay' && action !== 'bridge' && action !== 'goal' && action !== 'reason' && action !== 'verify' && action !== 'deter') {
-      await message.reply({ content: 'Only admins can run that command.', allowedMentions: { parse: [], repliedUser: false } });
-      return;
-    }
-
-    if (mode === MODES.LOCKDOWN && moderationActions.has(action) && !isLockdownAdmin) {
-      await message.reply({ content: 'Lockdown mode: only lockdown admins can run that command.', allowedMentions: { parse: [], repliedUser: false } });
-      return;
-    }
-
-    switch (action) {
-      case '':
-      case 'status':
-        return handleStatusCommand(message, rest);
-      case 'help':
-        return message.reply(formatHelp({ commandPrefix, timeStatusCommand }));
-      case 'replay':
-        return handleReplayCommand(message, tokens.join(' '));
-      case 'bridge':
-        return handleBridgeCommand(message, tokens);
-      case 'lights':
-        return handleLightsCommand(message, tokens);
-      case 'kick':
-        return handleKickCommand(message, rest);
-      case 'lock':
-        return handleLockCommand(message, rest, true);
-      case 'unlock':
-        return handleLockCommand(message, rest, false);
-      case 'mode':
-        return handleModeCommand(message, tokens);
-      case 'goal':
-        return handleGoalCommand(message, tokens);
-      case 'reason':
-        return handleReasonCommand(message, tokens);
-      case 'verify':
-        return handleVerifyCommand(message, tokens);
-      case 'deter':
-        return handleDeterCommand(message, tokens);
-      default:
-        return message.reply(formatHelp({ commandPrefix, timeStatusCommand }));
-    }
-  }
-
-  return { handleCommand };
-}
-
-module.exports = { createCommandHandlers };

server/src/services/discordBotService/commands/lights.js

@@ -1,76 +0,0 @@
-// Discord Lights Command
-// Purpose: Handles admin room-light lock policy commands from Discord and web chat.
-// Scope: Delegates all actual Home Assistant policy behavior to homeAssistantService.
-function describeLightPolicy(lightPolicy = {}) {
-  // The HA service exposes both the newer explicit lockState and the older
-  // lockedOn boolean. Prefer lockState because it can distinguish locked-on
-  // from locked-off, but keep lockedOn as a defensive fallback for any caller
-  // that passes an older or partial policy object.
-  const lockState = lightPolicy?.lockState || (lightPolicy?.lockedOn ? 'on' : null);
-  if (lockState === 'on') return 'Room lights are locked on.';
-  if (lockState === 'off') return 'Room lights are locked off.';
-  return 'Room lights are unlocked.';
-}
-
-function createLightsCommand({ homeAssistantService, sanitizeMentions, discordConfig }) {
-  // The HA policy behavior is prefix-agnostic; this value is only used so
-  // invalid-command guidance points admins at this bot instance's namespace.
-  const commandPrefix = String(discordConfig?.commandPrefix || 'rs').trim() || 'rs';
-  return async function handleLightsCommand(message, tokens = []) {
-    // Defaulting to status makes the bare lights command safe to type while
-    // still exposing explicit mutating forms under the configured prefix. This
-    // matters when several bot instances share a Discord server and each one
-    // needs its own command namespace.
-    const action = String(tokens.shift() || 'status').trim().toLowerCase();
-
-    if (!homeAssistantService) {
-      await message.reply({
-        content: 'Room light controls are unavailable.',
-        allowedMentions: { parse: [], repliedUser: false },
-      });
-      return;
-    }
-
-    if (action === 'status') {
-      await message.reply({
-        content: describeLightPolicy(homeAssistantService.getLightPolicyState?.() || {}),
-        allowedMentions: { parse: [], repliedUser: false },
-      });
-      return;
-    }
-
-    if (action !== 'lock' && action !== 'unlock') {
-      await message.reply({
-        content: `Invalid lights command. Use \`${commandPrefix} lights lock\`, \`${commandPrefix} lights unlock\`, or \`${commandPrefix} lights status\`.`,
-        allowedMentions: { parse: [], repliedUser: false },
-      });
-      return;
-    }
-
-    try {
-      const locked = action === 'lock';
-      // The bot command intentionally calls the shared policy setter instead of
-      // issuing direct Home Assistant entity commands. That keeps all secondary
-      // behavior centralized: web UI controls become disabled through the
-      // session lightPolicy update, lock-on still forces configured lights to
-      // white where possible, and commandService sees the same update event that
-      // forces rover lasers off while the room is locked on.
-      await homeAssistantService.setLightsLockedOn(locked, {
-        source: `bot-command:lights:${action}`,
-        forceApply: true,
-      });
-
-      await message.reply({
-        content: sanitizeMentions(locked ? 'Room lights locked on.' : 'Room lights unlocked.'),
-        allowedMentions: { parse: [], repliedUser: false },
-      });
-    } catch (err) {
-      await message.reply({
-        content: sanitizeMentions(`Failed to update room lights: ${err.message}`),
-        allowedMentions: { parse: [], repliedUser: false },
-      });
-    }
-  };
-}
-
-module.exports = { createLightsCommand };

server/src/services/discordBotService/commands/replay.js

@@ -3,6 +3,7 @@
 // Scope: Resolves sources, enforces cooldowns, reports job progress, uploads video, and broadcasts media URLs.
 const { AttachmentBuilder } = require('discord.js');
 const io = require('../../../globals/io');
+const { hostReplay } = require('../../replayMediaService');
 const {
   DEFAULT_ALLOWED_MENTIONS,
   buildReplayJobId,
@@ -17,7 +18,7 @@ const {
   buildAcceptedMessage,
   buildStatusMessage,
   normalizeUserError,
-} = require('../replayWorkflow');
+} = require('../../replayDeliveryService/workflow');
 
 function createReplayCommand({
   logger,
@@ -32,6 +33,7 @@ function createReplayCommand({
   getActiveDrivers,
   getNickname,
   rovers,
+  discordConfig,
 }) {
   const sourceResolver = createReplaySourceResolver({
     rovers,
@@ -80,18 +82,21 @@ function createReplayCommand({
     });
     const stopTyping = startDiscordTypingLoop(message.channel, logger, 'discord replay command');
 
+    let builtReplay = null;
+    let deliveredMedia = null;
     try {
       jobStatus.emit(job, 'building', { message: buildStatusMessage(job, 'building') });
       if (progressMessage?.edit) {
         await progressMessage.edit({ content: sanitizeMentions(buildStatusMessage(job, 'building')), allowedMentions: DEFAULT_ALLOWED_MENTIONS });
       }
 
-      const { buffer, usedSources = job.sources, missingSources = [] } = await buildReplayVideo({
+      builtReplay = await buildReplayVideo({
         sources: job.sources,
         title: job.title,
         requester: job.requester,
         includeSidebar: job.includeSidebar,
       });
+      const { buffer, usedSources = job.sources, missingSources = [] } = builtReplay;
 
       jobStatus.emit(job, 'uploading', { message: buildStatusMessage(job, 'uploading') });
       if (progressMessage?.edit) {
@@ -108,14 +113,36 @@ function createReplayCommand({
       if (!uploadMessage) throw new Error('Discord upload did not return a message');
 
       const uploadedAttachment = firstAttachmentFromMessage(uploadMessage);
-      const media = buildDiscordReplayMediaPayload({ message: uploadMessage, attachment: uploadedAttachment, job });
-      if (!media) throw new Error('Discord upload did not include a replay attachment URL');
+      deliveredMedia = buildDiscordReplayMediaPayload({ message: uploadMessage, attachment: uploadedAttachment, job });
+      if (!deliveredMedia) throw new Error('Discord upload did not include a replay attachment URL');
 
-      jobStatus.emit(job, 'ready', { message: buildStatusMessage(job, 'ready'), media });
+      jobStatus.emit(job, 'ready', { message: buildStatusMessage(job, 'ready'), media: deliveredMedia });
       if (progressMessage?.edit) {
         await progressMessage.edit({ content: sanitizeMentions(buildStatusMessage(job, 'ready')), allowedMentions: DEFAULT_ALLOWED_MENTIONS });
       }
     } catch (err) {
+      if (deliveredMedia) {
+        logger?.warn?.('Replay uploaded but Discord progress message could not be finalized', { jobId: job.id, error: err.message });
+        return;
+      }
+      // A completed video should never be discarded merely because the
+      // optional Discord upload failed. Host that exact buffer locally and
+      // publish the same ready event consumed by existing clients.
+      if (builtReplay?.buffer && !deliveredMedia) {
+        try {
+          const media = await hostReplay({ buffer: builtReplay.buffer, job });
+          jobStatus.emit(job, 'ready', { message: buildStatusMessage(job, 'ready'), media });
+          if (progressMessage?.edit) {
+            await progressMessage.edit({ content: sanitizeMentions(buildStatusMessage(job, 'ready')), allowedMentions: DEFAULT_ALLOWED_MENTIONS });
+          }
+          const siteUrl = String(discordConfig?.siteUrl || '').replace(/\/$/, '');
+          const publicUrl = siteUrl ? `${siteUrl}${media.url}` : media.url;
+          await progressMessage.reply({ content: `Replay hosted by the rover server: ${publicUrl}`, allowedMentions: DEFAULT_ALLOWED_MENTIONS });
+          return;
+        } catch (fallbackError) {
+          logger?.warn?.('Local replay fallback failed', { jobId: job.id, error: fallbackError.message });
+        }
+      }
       const userMessage = normalizeUserError(err);
       jobStatus.emit(job, 'failed', { message: userMessage });
       if (progressMessage?.edit) {

server/src/services/discordBotService/commands/status.js

@@ -3,7 +3,7 @@
 // Scope: Builds and sends rover status embed for one rover or all visible rovers.
 const { EmbedBuilder } = require('discord.js');
 const { buildBatteryStatusEmbed } = require('../batteryEmbeds');
-const { resolveRoverSelector } = require('./resolvers');
+const { resolveRoverSelector } = require('../../operatorCommandService/commands/resolvers');
 
 function createStatusCommand({ rovers, roverManager }) {
   return async function handleStatusCommand(message, roverId) {

server/src/services/discordBotService/index.js

@@ -5,10 +5,13 @@ const {
   Client,
   GatewayIntentBits,
   Partials,
+  AttachmentBuilder,
 } = require('discord.js');
 const logger = require('../../globals/logger').child('discordBot');
 const io = require('../../globals/io');
 const { loadConfig } = require('../../helpers/configLoader');
+const { isFeatureEnabled } = require('../../helpers/features');
+const { parseCommandText } = require('../operatorCommandService/config');
 const roverManager = require('../roverManager');
 const { getRoster, lockRover, rovers } = roverManager;
 const { MODES, getMode, setMode } = require('../modeManager');
@@ -20,6 +23,8 @@ const { getNickname } = require('../nicknameService');
 const { getGlobalObjective, setGlobalObjective, clearGlobalObjective } = require('../globalObjectiveService');
 const { getAdminReason, setAdminReason, clearAdminReason } = require('../adminReasonService');
 const homeAssistantService = require('../homeAssistantService');
+const liftService = require('../liftService');
+const neatoService = require('../neatoService');
 const {
   getGuildConfig,
   listGuildConfigs,
@@ -48,26 +53,32 @@ const {
 const { subscribe } = require('../eventBus');
 const { createPresenceManager } = require('./presence');
 const { createChannelIO } = require('./channelIO');
-const { createCommandHandlers } = require('./commands');
+const { createCommandHandlers } = require('../operatorCommandService');
+const { createDiscordTransportHandlers, createDiscordCommandRequest } = require('./commandAdapter');
 const { createIntegrations } = require('./integrations');
+const { registerPreferredDeliveryProvider } = require('../replayDeliveryService');
+const {
+  DEFAULT_ALLOWED_MENTIONS,
+  createReplayCaptionBuilder,
+  startDiscordTypingLoop,
+  sanitizeReplayTitleForFilename,
+  firstAttachmentFromMessage,
+  buildDiscordReplayMediaPayload,
+  buildAcceptedMessage,
+  buildStatusMessage,
+} = require('../replayDeliveryService/workflow');
 
 const config = loadConfig();
 const discordConfig = config.discord || {};
-const enabled = Boolean(discordConfig.token);
+const enabled = isFeatureEnabled('discord');
 // These normalized command names mirror the command router. Bridge-channel
 // command replies are mirrored into web chat, so this entrypoint needs to know
 // the configured command names before it wraps message.reply.
-const commandPrefix = String(discordConfig.commandPrefix || 'rs').trim() || 'rs';
-const timeStatusCommand = discordConfig.timeStatusCommand === null
-  ? ''
-  : String(discordConfig.timeStatusCommand || 'ts').trim();
-const normalizedCommandPrefix = commandPrefix.toLowerCase();
-const normalizedTimeStatusCommand = timeStatusCommand.toLowerCase();
 const adminIds = new Set((config.admins || []).map((a) => String(a.discord_id || '').trim()).filter(Boolean));
 const lockdownAdminIds = new Set((config.admins || []).filter((admin) => admin.lockdown).map((admin) => String(admin.discord_id || '').trim()).filter(Boolean));
 
 if (!enabled) {
-  logger.info('Discord bot disabled; missing token in config.discord.token');
+  logger.info('Discord feature disabled or missing required token');
   return;
 }
 
@@ -123,7 +134,72 @@ const presence = createPresenceManager({
   countReady,
 });
 
-const commands = createCommandHandlers({
+const replayCaption = createReplayCaptionBuilder({
+  io,
+  rovers,
+  getActiveDrivers,
+  getNickname,
+  sanitizeMentions,
+});
+
+// Discord is the preferred replay host only while this optional feature is
+// active. The core replay delivery service owns generation and automatically
+// falls back to its local media store when any operation below fails.
+if (discordConfig?.channels?.replay) {
+  registerPreferredDeliveryProvider({
+    async begin(job) {
+      const channelId = discordConfig.channels.replay;
+      const progressMessage = await channelIO.sendToChannel(channelId, buildAcceptedMessage(job), {}, DEFAULT_ALLOWED_MENTIONS);
+      if (!progressMessage) throw new Error('Discord replay progress message could not be sent');
+      const channel = await channelIO.fetchChannel(channelId);
+      return {
+        channelId,
+        progressMessage,
+        stopTyping: startDiscordTypingLoop(channel, logger, 'web replay delivery'),
+      };
+    },
+    async deliver({ job, context, buffer, usedSources = job.sources, missingSources = [] }) {
+      const progressMessage = context?.progressMessage;
+      try {
+        if (progressMessage?.edit) {
+          await progressMessage.edit({ content: buildStatusMessage(job, 'uploading'), allowedMentions: DEFAULT_ALLOWED_MENTIONS });
+        }
+        const attachment = new AttachmentBuilder(buffer, { name: `${sanitizeReplayTitleForFilename(job.title)}.mp4` });
+        const body = replayCaption.build({ job, usedSources, missingSources });
+        const uploadMessage = await channelIO.sendToChannel(context.channelId, body, { files: [attachment] }, DEFAULT_ALLOWED_MENTIONS);
+        if (!uploadMessage) throw new Error('Discord upload did not return a message');
+        const media = buildDiscordReplayMediaPayload({ message: uploadMessage, attachment: firstAttachmentFromMessage(uploadMessage), job });
+        if (!media) throw new Error('Discord upload did not include a replay attachment URL');
+        if (progressMessage?.edit) {
+          // The attachment URL is already durable once Discord returns it. A
+          // cosmetic progress-edit failure must not trigger a duplicate local
+          // replay or replace the successful media payload sent to clients.
+          await progressMessage.edit({ content: buildStatusMessage(job, 'ready'), allowedMentions: DEFAULT_ALLOWED_MENTIONS }).catch((err) => {
+            logger.warn('Discord replay uploaded but progress message update failed', { jobId: job.id, error: err.message });
+          });
+        }
+        return media;
+      } catch (err) {
+        err.progressMessage = progressMessage;
+        throw err;
+      } finally {
+        if (context?.stopTyping) context.stopTyping();
+      }
+    },
+    async completeFallback({ context, media }) {
+      const siteUrl = String(discordConfig.siteUrl || '').replace(/\/$/, '');
+      const publicUrl = siteUrl ? `${siteUrl}${media.url}` : media.url;
+      if (context?.progressMessage?.reply) {
+        await context.progressMessage.reply({
+          content: `Replay hosted by the rover server: ${publicUrl}`,
+          allowedMentions: DEFAULT_ALLOWED_MENTIONS,
+        });
+      }
+    },
+  });
+}
+
+const commandDependencies = {
   logger,
   client,
   io,
@@ -151,6 +227,9 @@ const commands = createCommandHandlers({
   // service into the shared command router keeps Discord and mirrored web-chat
   // command behavior aligned without duplicating Home Assistant calls here.
   homeAssistantService,
+  liftService,
+  neatoService,
+  isFeatureEnabled,
   getGuildConfig,
   setGuildConfig,
   removeGuildConfig,
@@ -167,7 +246,9 @@ const commands = createCommandHandlers({
   isLockdownAdminUser,
   discordConfig,
   config,
-});
+};
+commandDependencies.transportHandlers = createDiscordTransportHandlers(commandDependencies);
+const commands = createCommandHandlers(commandDependencies);
 
   const integrations = createIntegrations({
   logger,
@@ -209,16 +290,9 @@ const commands = createCommandHandlers({
 const integrationHandlers = integrations.register();
 
 function isTextCommand(content) {
-  const clean = String(content || '').trim();
-  const lower = clean.toLowerCase();
-  if (normalizedTimeStatusCommand && lower === normalizedTimeStatusCommand) return true;
-  if (!lower.startsWith(normalizedCommandPrefix)) return false;
-
-  const nextCharacter = clean.charAt(commandPrefix.length);
-  // Mirrored bridge commands must use the exact same whole-token prefix rule
-  // as the command router. If this check is looser than the router, normal
-  // bridge chat can be wrapped as a command reply even though no command runs.
-  return !nextCharacter || /\s/.test(nextCharacter);
+  // Both transports share this parser so command detection cannot drift from
+  // the dispatcher when an installation changes its prefix.
+  return parseCommandText(content, config).matched;
 }
 
 function isBridgeChannelMessage(message) {
@@ -263,7 +337,8 @@ function createBridgeMirroredCommandMessage(message) {
 client.on('messageCreate', async (message) => {
   try {
     await integrationHandlers.handleBridgeInbound(message);
-    await commands.handleCommand(createBridgeMirroredCommandMessage(message));
+    const commandMessage = createBridgeMirroredCommandMessage(message);
+    await commands.handleCommand(createDiscordCommandRequest(commandMessage, { isAdminUser, isLockdownAdminUser }));
   } catch (err) {
     logger.warn('Error handling Discord message', err.message);
   }

server/src/services/discordBotService/integrations/busEvents.js

@@ -2,28 +2,12 @@
 // Purpose: Handles event-bus announcements to Discord channels.
 // Scope: Processes supported event types and posts formatted messages/embeds.
 const { EmbedBuilder, AttachmentBuilder } = require('discord.js');
-const io = require('../../../globals/io');
 const { buildBatteryStatusEmbed, buildBatteryCaption } = require('../batteryEmbeds');
-const {
-  DEFAULT_ALLOWED_MENTIONS,
-  createReplayJob,
-  createJobStatusEmitter,
-  createReplayCaptionBuilder,
-  startDiscordTypingLoop,
-  sanitizeReplayTitleForFilename,
-  firstAttachmentFromMessage,
-  buildDiscordReplayMediaPayload,
-  buildAcceptedMessage,
-  buildStatusMessage,
-  normalizeUserError,
-} = require('../replayWorkflow');
 
 function createBusEventHandler(deps) {
-  const { logger, discordConfig, roverManager, rovers, schedulePresenceRotation, formatDuration, sendToChannel, fetchChannel, buildReplayVideo, getActiveDrivers, getNickname, sanitizeMentions } = deps;
+  const { logger, discordConfig, roverManager, rovers, schedulePresenceRotation, formatDuration, sendToChannel } = deps;
   const ADMIN_ALERT_EVENT_TYPES = new Set(['rover.online', 'rover.offline', 'rover.dockGuard', 'battery.warn', 'battery.urgent', 'battery.docked', 'battery.undocked', 'battery.charging.start', 'battery.charging.stop', 'battery.locked', 'battery.unlocked']);
   let skippedFirstModeAnnouncement = false;
-  const jobStatus = createJobStatusEmitter({ io, logger, sanitizeMentions });
-  const replayCaption = createReplayCaptionBuilder({ io, rovers, getActiveDrivers, getNickname, sanitizeMentions });
 
   function buildEmbed({ title, description, color, includeSiteUrl = true }) {
     const embed = new EmbedBuilder().setTitle(title || 'Update').setColor(color || 0x2196f3);
@@ -55,66 +39,6 @@ function createBusEventHandler(deps) {
     await sendToChannel(channelId, `${prefix}${content || ''}`.trim(), { embeds: payloadEmbeds, files: Array.isArray(files) ? files : undefined }, { parse: [], roles: pingRoleId ? [pingRoleId] : [] }, !pingRoleId);
   }
 
-  async function sendReplayToChannel(channelId, requester, sources = [], explicitTitle = '', includeSidebar = true, jobId = null, requestedBy = null) {
-    if (!channelId) throw new Error('Replay channel not configured');
-    const job = createReplayJob({
-      id: jobId,
-      requester,
-      source: 'web',
-      title: explicitTitle,
-      sources,
-      includeSidebar,
-      requestedBy,
-    });
-    jobStatus.emit(job, 'accepted', { message: buildAcceptedMessage(job) });
-    const progressMessage = await sendToChannel(channelId, buildAcceptedMessage(job), {}, DEFAULT_ALLOWED_MENTIONS);
-    const channel = await fetchChannel(channelId);
-    const stopTyping = startDiscordTypingLoop(channel, logger, 'web replay delivery');
-    try {
-      jobStatus.emit(job, 'building', { message: buildStatusMessage(job, 'building') });
-      if (progressMessage?.edit) await progressMessage.edit({ content: buildStatusMessage(job, 'building'), allowedMentions: DEFAULT_ALLOWED_MENTIONS });
-      const { buffer, usedSources = job.sources, missingSources = [] } = await buildReplayVideo({
-        sources: job.sources,
-        title: job.title,
-        requester: job.requester,
-        includeSidebar: job.includeSidebar,
-      });
-      jobStatus.emit(job, 'uploading', { message: buildStatusMessage(job, 'uploading') });
-      if (progressMessage?.edit) await progressMessage.edit({ content: buildStatusMessage(job, 'uploading'), allowedMentions: DEFAULT_ALLOWED_MENTIONS });
-      const attachment = new AttachmentBuilder(buffer, { name: `${sanitizeReplayTitleForFilename(job.title)}.mp4` });
-      const body = replayCaption.build({ job, usedSources, missingSources });
-      const uploadMessage = await sendToChannel(channelId, body, { files: [attachment] }, DEFAULT_ALLOWED_MENTIONS);
-      if (!uploadMessage) throw new Error('Discord upload did not return a message');
-      const uploadedAttachment = firstAttachmentFromMessage(uploadMessage);
-      const media = buildDiscordReplayMediaPayload({ message: uploadMessage, attachment: uploadedAttachment, job });
-      if (!media) throw new Error('Discord upload did not include a replay attachment URL');
-      jobStatus.emit(job, 'ready', { message: buildStatusMessage(job, 'ready'), media });
-      if (progressMessage?.edit) await progressMessage.edit({ content: buildStatusMessage(job, 'ready'), allowedMentions: DEFAULT_ALLOWED_MENTIONS });
-    } catch (err) {
-      const message = normalizeUserError(err);
-      jobStatus.emit(job, 'failed', { message });
-      if (progressMessage?.edit) await progressMessage.edit({ content: sanitizeMentions(message), allowedMentions: DEFAULT_ALLOWED_MENTIONS });
-      throw err;
-    } finally {
-      stopTyping();
-    }
-  }
-
-  function handleReplayRequested(event) {
-    const payload = event?.payload || {};
-    sendReplayToChannel(
-      payload?.channelId,
-      payload?.requester,
-      payload?.sources || [],
-      payload?.title || '',
-      payload?.includeSidebar !== false,
-      payload?.jobId || null,
-      payload?.requestedBy || null,
-    ).catch((err) => {
-      logger.warn('Replay send failed', { error: err.message });
-    });
-  }
-
   function handleBusEvent(event) {
     const { type, payload } = event || {};
     const channels = discordConfig.channels || {};
@@ -200,9 +124,9 @@ function createBusEventHandler(deps) {
         });
         break;
       }
-      case 'replay.requested':
-        handleReplayRequested(event);
-        break;
+      // Replay requests are deliberately consumed by replayDeliveryService.
+      // Discord registers only a preferred delivery provider, allowing the
+      // same request to fall back locally without a second event subscriber.
       case 'buttonBox.discordStalkerPing': {
         const message = payload?.message ? String(payload.message) : 'Button box chaos reward triggered.';
         announce({
@@ -234,7 +158,7 @@ function createBusEventHandler(deps) {
     }
   }
 
-  return { handleBusEvent, handleReplayRequested };
+  return { handleBusEvent };
 }
 
 module.exports = { createBusEventHandler };

server/src/services/embedHttpService/index.js

@@ -4,7 +4,12 @@
 const { app } = require('../../globals/http');
 const { renderIndexHtml, renderOgImage } = require('../embedService');
 
-app.get(['/', '/spectate', '/mini', '/display', '/scanner', '/database'], async (req, res) => {
+/*
+  Every client-side BrowserRouter entry point must also be an explicit HTTP
+  entry point. Including /ptz here lets direct loads and browser refreshes
+  receive the same rendered index document as navigation from the driver page.
+*/
+app.get(['/', '/spectate', '/mini', '/display', '/scanner', '/database', '/ptz'], async (req, res) => {
   try {
     const html = await renderIndexHtml(req);
     res.type('html').send(html);

server/src/services/homeAssistantService/hooks.js

@@ -35,11 +35,26 @@ function registerHomeAssistantHooks(deps) {
       return true;
     }
 
+    function isBlockedByRoomControlLock() {
+      /*
+        The lock is meant to keep normal users and automated room-control
+        surfaces from changing the preferred room-light policy. Admins are the
+        exception because they may need to correct a single lamp, verify a Home
+        Assistant integration, or make an operational adjustment while the
+        public controls remain locked.
+
+        This server-side bypass is the authoritative rule. The React UI also
+        enables admin controls for usability, but clients are not trusted to
+        enforce permissions.
+      */
+      return isLightControlLocked() && !isAdmin(socket);
+    }
+
     socket.on('homeAssistant:toggle', async ({ entityId } = {}, cb = () => {}) => {
       if (!hasPermission()) {
         return cb({ error: 'Insufficient permissions to control Home Assistant' });
       }
-      if (isLightControlLocked()) {
+      if (isBlockedByRoomControlLock()) {
         return cb({ error: 'Room controls are locked' });
       }
       try {
@@ -55,7 +70,7 @@ function registerHomeAssistantHooks(deps) {
       if (!hasPermission()) {
         return cb({ error: 'Insufficient permissions to control Home Assistant' });
       }
-      if (isLightControlLocked()) {
+      if (isBlockedByRoomControlLock()) {
         return cb({ error: 'Room controls are locked' });
       }
       try {
@@ -71,7 +86,7 @@ function registerHomeAssistantHooks(deps) {
       if (!hasPermission()) {
         return cb({ error: 'Insufficient permissions to control Home Assistant' });
       }
-      if (isLightControlLocked()) {
+      if (isBlockedByRoomControlLock()) {
         return cb({ error: 'Room controls are locked' });
       }
       try {
@@ -90,7 +105,7 @@ function registerHomeAssistantHooks(deps) {
       if (!hasPermission()) {
         return cb({ error: 'Insufficient permissions to control Home Assistant' });
       }
-      if (isLightControlLocked()) {
+      if (isBlockedByRoomControlLock()) {
         return cb({ error: 'Room controls are locked' });
       }
       try {

server/src/services/homeAssistantService/index.js

@@ -78,6 +78,7 @@ module.exports = {
   setLightColor: runtimeEngine.setLightColor,
   setLightWhite: runtimeEngine.setLightWhite,
   setAllControllableEntitiesState: runtimeEngine.setAllControllableEntitiesState,
+  setRandomColorScene: runtimeEngine.setRandomColorScene,
   setLightsLockedOn: runtimeEngine.setLightsLockedOn,
   toggleLightsLockedOn: runtimeEngine.toggleLightsLockedOn,
   homeAssistantEvents: events,

server/src/services/homeAssistantService/runtimeEngine.js

@@ -196,6 +196,72 @@ function createRuntimeEngine(deps) {
     };
   }
 
+  function createBrightRandomRgbColor() {
+    // A completely random RGB triplet frequently produces colors that are very
+    // dark, gray, or visually indistinguishable from a bulb being off. Choosing
+    // a random hue at full saturation and brightness still gives every bulb a
+    // genuinely random color while keeping the requested room effect vivid.
+    const hueSegment = Math.random() * 6;
+    const segmentIndex = Math.floor(hueSegment);
+    const risingChannel = Math.round((hueSegment - segmentIndex) * 255);
+    const fallingChannel = 255 - risingChannel;
+
+    switch (segmentIndex) {
+      case 0: return [255, risingChannel, 0];
+      case 1: return [fallingChannel, 255, 0];
+      case 2: return [0, 255, risingChannel];
+      case 3: return [0, fallingChannel, 255];
+      case 4: return [risingChannel, 0, 255];
+      default: return [255, 0, fallingChannel];
+    }
+  }
+
+  async function setRandomColorScene(options = {}) {
+    const source = String(options?.source || 'homeAssistant:setRandomColorScene');
+    const entities = Array.from(entityConfig.values()).map((meta) => ({
+      meta,
+      state: entityState.get(meta.id) || buildState(meta, null),
+    }));
+
+    // RGB capability comes from Home Assistant's live supported_color_modes
+    // snapshot. This avoids a second operator-maintained list and makes newly
+    // replaced bulbs automatically participate once Home Assistant reports
+    // their capabilities. Everything else is turned off, including switches
+    // and white-only lights, exactly matching the scene's requested boundary.
+    const operations = entities.map(({ meta, state }) => {
+      if (state.supportsColor) {
+        return setLightColor(meta.id, createBrightRandomRgbColor());
+      }
+      return setEntityState(meta.id, 'off', { source: `${source}:non-rgb-off` });
+    });
+    const results = await Promise.allSettled(operations);
+    const failures = results
+      .map((result, index) => ({ result, entityId: entities[index].meta.id }))
+      .filter(({ result }) => result.status === 'rejected')
+      .map(({ result, entityId }) => ({ entityId, error: result.reason?.message || 'unknown error' }));
+    const succeeded = results
+      .map((result, index) => ({ result, entityId: entities[index].meta.id }))
+      .filter(({ result }) => result.status === 'fulfilled')
+      .map(({ entityId }) => entityId);
+
+    if (failures.length) {
+      logger.warn('Some Home Assistant random color scene updates failed', {
+        total: entities.length,
+        failed: failures.length,
+        failures,
+      });
+    }
+
+    return {
+      source,
+      total: entities.length,
+      colorLights: entities.filter(({ state }) => state.supportsColor).length,
+      nonColorEntities: entities.filter(({ state }) => !state.supportsColor).length,
+      succeeded,
+      failures,
+    };
+  }
+
   async function setEntityLockedOnWhite(entityId, options = {}) {
     const meta = entityConfig.get(entityId);
     const source = String(options?.source || 'homeAssistant:setEntityLockedOnWhite');
@@ -426,14 +492,26 @@ function createRuntimeEngine(deps) {
   async function setLightsLockedOn(nextValue, options = {}) {
     const next = Boolean(nextValue);
     const targetState = options?.targetState === 'off' ? 'off' : 'on';
-    const forceApply = Boolean(options.forceApply);
     const nextLockState = next ? targetState : null;
     const changed = runtime.lightsLockState !== nextLockState;
     runtime.lightsLockState = nextLockState;
 
     if (runtime.lightsLockState != null) {
-      if ((changed || forceApply) && enabled) {
+      if (changed && enabled) {
         const source = String(options?.source || 'homeAssistant:setLightsLockedOn');
+        /*
+          A room-light lock is a policy boundary, not an ongoing reconciliation
+          loop. Entering locked-on or locked-off sets every configured room
+          control to the preferred state once so the room starts from the
+          requested condition. After that first transition, the server leaves
+          Home Assistant alone so out-of-band controls such as wall switches,
+          Home Assistant dashboards, or vendor apps can still adjust individual
+          lights without being periodically overwritten.
+
+          Older callers may still pass forceApply from the previous behavior.
+          It is intentionally ignored here because repeated lock requests must
+          not become repeated light commands.
+        */
         if (runtime.lightsLockState === 'on') {
           // The lock-on path is intentionally stronger than a normal bulk
           // turn_on. It makes actual light entities white while still turning
@@ -486,6 +564,7 @@ function createRuntimeEngine(deps) {
     setLightColor,
     setLightWhite,
     setAllControllableEntitiesState,
+    setRandomColorScene,
     setAllControllableEntitiesLockedOnWhite,
     setLightsLockedOn,
     toggleLightsLockedOn,

server/src/services/humanAlertButtonService/index.js

@@ -151,7 +151,6 @@ async function handleTrigger(event = {}) {
   if (action === LIGHTS_LOCK_TOGGLE_ACTION) {
     const lockedOn = await toggleLightsLockedOn({
       source: 'ha-button:lightsLockToggle',
-      forceApply: true,
     });
     const message = lockedOn ? LIGHTS_LOCKED_TTS : LIGHTS_UNLOCKED_TTS;
     sendTtsToNonPrivateRovers(message);

server/src/services/idleService/index.js

@@ -73,6 +73,12 @@ function clearIdleTimer() {
 
 function scheduleIdleTimer() {
   if (runtime.timer) return;
+  if (runtime.idleActionsCompleted) {
+    logger.info('Idle timer not scheduled; idle actions already completed for this no-operator window', {
+      lastTriggeredAt: runtime.lastTriggeredAt,
+    });
+    return;
+  }
   runtime.deadlineAt = Date.now() + IDLE_TIMEOUT_MS;
   logger.info('Idle timer scheduled', {
     timeoutMs: IDLE_TIMEOUT_MS,
@@ -87,6 +93,13 @@ function scheduleIdleTimer() {
       return;
     }
     runtime.lastTriggeredAt = Date.now();
+    /*
+      Mark this idle window as handled before running the action pipeline. The
+      pipeline can take time and can call into services that emit their own
+      state changes; setting the guard first prevents any nested refresh from
+      scheduling a second timer for the same continuous no-operator period.
+    */
+    runtime.idleActionsCompleted = true;
     const results = await runIdleActions();
     logger.info('Idle automation executed', {
       idleMs: IDLE_TIMEOUT_MS,
@@ -102,6 +115,15 @@ function refreshIdleState() {
   logger.info('Idle state refresh', activity);
   if (activity.totalActive > 0) {
     clearIdleTimer();
+    if (runtime.idleActionsCompleted) {
+      logger.info('Idle action one-shot reset; operator is online again', activity);
+    }
+    /*
+      A user/admin coming online starts a new activity window. When the room
+      later becomes idle again, the cleanup pipeline should be allowed to run
+      once for that new idle period.
+    */
+    runtime.idleActionsCompleted = false;
     return;
   }
   scheduleIdleTimer();

server/src/services/idleService/state.js

@@ -5,6 +5,7 @@ const runtime = {
   timer: null,
   deadlineAt: null,
   lastTriggeredAt: null,
+  idleActionsCompleted: false,
 };
 
 module.exports = {

server/src/services/liftService/index.js

@@ -7,7 +7,7 @@ const logger = require('../../globals/logger').child('liftService');
 const { loadConfig } = require('../../helpers/configLoader');
 const { isFeatureEnabled } = require('../../helpers/features');
 const { getMode, MODES } = require('../modeManager');
-const { isLockdownAdmin } = require('../roleService');
+const { isAdmin, isLockdownAdmin } = require('../roleService');
 const {
   homeAssistantEvents,
   getRawEntitySnapshot,
@@ -186,13 +186,20 @@ if (featureEnabled) {
   homeAssistantEvents.on('status', emitUpdate);
 
   io.on('connection', (socket) => {
+    function assertFeatureAccess() {
+      const mode = getMode();
+      // Lift is a public activity feature in open and turns modes. Restricted
+      // access modes mirror the rest of the server: admin mode admits normal
+      // admins, while lockdown admits only the explicitly stronger lockdown
+      // role. Enforcing this in the owning service keeps UI buttons and text
+      // command behavior aligned instead of trusting individual callers.
+      if (mode === MODES.ADMIN && !isAdmin(socket)) throw new Error('Admin mode: admins only');
+      if (mode === MODES.LOCKDOWN && !isLockdownAdmin(socket)) throw new Error('Server in lockdown');
+    }
+
     socket.on('lift:up', async (_, cb = () => {}) => {
       try {
-        if (getMode() === MODES.LOCKDOWN && !isLockdownAdmin(socket)) {
-          throw new Error('Server in lockdown');
-        }
-        // Lift movement is now a public activity feature. Lockdown still wins
-        // above because that mode is the global safety/admin gate for the room.
+        assertFeatureAccess();
         const resp = await moveUp(socket.id || 'socket');
         cb({ success: true, ...resp });
       } catch (err) {
@@ -202,11 +209,7 @@ if (featureEnabled) {
 
     socket.on('lift:down', async (_, cb = () => {}) => {
       try {
-        if (getMode() === MODES.LOCKDOWN && !isLockdownAdmin(socket)) {
-          throw new Error('Server in lockdown');
-        }
-        // Public access intentionally mirrors lift:up so both directions share
-        // the same policy and cannot drift into different permission behavior.
+        assertFeatureAccess();
         const resp = await moveDown(socket.id || 'socket');
         cb({ success: true, ...resp });
       } catch (err) {

server/src/services/neatoService/index.js

@@ -8,7 +8,7 @@ const { loadConfig } = require('../../helpers/configLoader');
 const { isFeatureEnabled } = require('../../helpers/features');
 const { isVerified } = require('../verificationService');
 const { getMode, MODES } = require('../modeManager');
-const { isLockdownAdmin } = require('../roleService');
+const { isAdmin, isLockdownAdmin } = require('../roleService');
 const {
   homeAssistantEvents,
   getRawEntitySnapshot,
@@ -269,17 +269,19 @@ function hasVerifiedSockets() {
 
 if (featureEnabled) {
   io.on('connection', (socket) => {
-  function assertLockdownAccess() {
-    if (getMode() === MODES.LOCKDOWN && !isLockdownAdmin(socket)) {
-      throw new Error('Server in lockdown');
-    }
+  function assertFeatureAccess() {
+    const mode = getMode();
+    // Neato shares the same public-activity policy as lift: everyone may use
+    // it in open/turns modes, admin mode requires an admin, and lockdown
+    // requires a lockdown admin. This service-level gate protects every socket
+    // action even if a future client bypasses the current UI presentation.
+    if (mode === MODES.ADMIN && !isAdmin(socket)) throw new Error('Admin mode: admins only');
+    if (mode === MODES.LOCKDOWN && !isLockdownAdmin(socket)) throw new Error('Server in lockdown');
   }
 
   socket.on('neato:start', async (_, cb = () => {}) => {
     try {
-      assertLockdownAccess();
-      // Neato commands are public activity features. The lockdown check above
-      // remains the room-wide safety/admin gate when the server is restricted.
+      assertFeatureAccess();
       await startCleaning();
       cb({ success: true });
     } catch (err) {
@@ -289,8 +291,7 @@ if (featureEnabled) {
 
   socket.on('neato:sendHome', async (_, cb = () => {}) => {
     try {
-      assertLockdownAccess();
-      // Keep send-home public for consistency with the rest of the Neato card.
+      assertFeatureAccess();
       await sendHome();
       cb({ success: true });
     } catch (err) {
@@ -300,8 +301,7 @@ if (featureEnabled) {
 
   socket.on('neato:locate', async (_, cb = () => {}) => {
     try {
-      assertLockdownAccess();
-      // Locate is a public activity action; lockdown still blocks it above.
+      assertFeatureAccess();
       await locateRobot();
       cb({ success: true });
     } catch (err) {
@@ -311,9 +311,7 @@ if (featureEnabled) {
 
   socket.on('neato:clearErrors', async (_, cb = () => {}) => {
     try {
-      assertLockdownAccess();
-      // Error clearing is grouped with the public Neato controls so the UI does
-      // not show a button that only some public users can actually run.
+      assertFeatureAccess();
       await clearErrors();
       cb({ success: true });
     } catch (err) {
@@ -323,9 +321,7 @@ if (featureEnabled) {
 
   socket.on('neato:powerCycle', async (_, cb = () => {}) => {
     try {
-      assertLockdownAccess();
-      // Power cycle follows the same public policy as the rest of the card;
-      // operational safety remains controlled by lockdown mode.
+      assertFeatureAccess();
       await powerCycle();
       cb({ success: true });
     } catch (err) {

server/src/services/operatorCommandService/commands/deter.js

@@ -1,16 +1,15 @@
-// Discord Deter Command
+// Operator Deter Command
 // Purpose: Handles deterrence moderation commands for lockdown admins.
 // Scope: Supports list, ban, and unban subcommands.
 const { mask, resolveIdentitySelector } = require('./resolvers');
+const { getCommandConfig } = require('../../operatorCommandService/config');
 
-function createDeterCommand({ listDeterredUsers, listVerifiedUsers, deterUser, undeterUser, isLockdownAdminUser, sanitizeMentions, discordConfig }) {
-  // Moderation errors often get copied into Discord chat, so they should show
-  // the configured bot prefix instead of the legacy default when several bots
-  // are present in the same server.
-  const commandPrefix = String(discordConfig?.commandPrefix || 'rs').trim() || 'rs';
+function createDeterCommand({ listDeterredUsers, listVerifiedUsers, deterUser, undeterUser, sanitizeMentions, config }) {
+  // Moderation usage errors use the same core prefix shown by organized help.
+  const { prefix: commandPrefix } = getCommandConfig(config);
 
   return async function handleDeterCommand(message, tokens) {
-    if (!isLockdownAdminUser(message.author?.id)) {
+    if (!message.actor?.isLockdownAdmin) {
       await message.reply({ content: 'Only lockdown admins can manage deterred users.', allowedMentions: { parse: [], repliedUser: false } });
       return;
     }
@@ -33,7 +32,7 @@ function createDeterCommand({ listDeterredUsers, listVerifiedUsers, deterUser, u
         // full remaining text is now always the selector, which lets lockdown
         // admins deter multi-word nicknames without quoting or delimiter rules.
         const stableSelector = verifiedMatch.record?.userId || verifiedMatch.record?.id || verifiedMatch.record?.cookieUserId || selector;
-        const deterred = deterUser(stableSelector, { actor: message.author?.id || null });
+        const deterred = deterUser(stableSelector, { actor: message.actor?.id || null });
         return message.reply({ content: sanitizeMentions(`${deterred.created ? 'Deterred' : 'Updated deterrence for'} ${deterred.nickname || 'unknown'} (${mask(deterred.cookieUserId)}).`), allowedMentions: { parse: [], repliedUser: false } });
       } catch (err) {
         return message.reply({ content: sanitizeMentions(`Failed to deter user: ${err.message}`), allowedMentions: { parse: [], repliedUser: false } });
@@ -45,7 +44,7 @@ function createDeterCommand({ listDeterredUsers, listVerifiedUsers, deterUser, u
       try {
         const resolved = resolveIdentitySelector(selector, listDeterredUsers(), { includeId: true });
         if (resolved.error) return message.reply({ content: sanitizeMentions(resolved.error), allowedMentions: { parse: [], repliedUser: false } });
-        const removed = undeterUser(resolved.record.id || resolved.record.cookieUserId || selector, message.author?.id || null);
+        const removed = undeterUser(resolved.record.id || resolved.record.cookieUserId || selector, message.actor?.id || null);
         return message.reply({ content: sanitizeMentions(`Removed deterrence for ${removed.nickname || 'unknown'} (${mask(removed.cookieUserId)}).`), allowedMentions: { parse: [], repliedUser: false } });
       } catch (err) {
         return message.reply({ content: sanitizeMentions(`Failed to remove deterrence: ${err.message}`), allowedMentions: { parse: [], repliedUser: false } });

server/src/services/operatorCommandService/commands/goal.js

@@ -1,7 +1,7 @@
-// Discord Goal Command
+// Operator Goal Command
 // Purpose: Handles global objective view/update/clear operations.
 // Scope: Allows read by all and write by admins.
-function createGoalCommand({ getGlobalObjective, setGlobalObjective, clearGlobalObjective, isAdminUser, sanitizeMentions }) {
+function createGoalCommand({ getGlobalObjective, setGlobalObjective, clearGlobalObjective, sanitizeMentions }) {
   return async function handleGoalCommand(message, tokens) {
     const query = tokens.join(' ').trim();
     const lower = query.toLowerCase();
@@ -10,16 +10,16 @@ function createGoalCommand({ getGlobalObjective, setGlobalObjective, clearGlobal
       await message.reply({ content: goal?.text ? `Global objective: ${sanitizeMentions(goal.text)}` : 'No global objective set.', allowedMentions: { parse: [], repliedUser: false } });
       return;
     }
-    if (!isAdminUser(message.author.id)) {
+    if (!message.actor?.isAdmin) {
       await message.reply({ content: 'Only admins can update the global objective.', allowedMentions: { parse: [], repliedUser: false } });
       return;
     }
     try {
       if (lower === 'clear') {
-        clearGlobalObjective({ by: message.author?.id || null });
+        clearGlobalObjective({ by: message.actor?.id || null });
         await message.reply({ content: 'Global objective cleared.', allowedMentions: { parse: [], repliedUser: false } });
       } else {
-        setGlobalObjective(query, { by: message.author?.id || null });
+        setGlobalObjective(query, { by: message.actor?.id || null });
         await message.reply({ content: sanitizeMentions(`Global objective set: ${query}`), allowedMentions: { parse: [], repliedUser: false } });
       }
     } catch (err) {

server/src/services/operatorCommandService/commands/kick.js

@@ -1,7 +1,8 @@
-// Discord Kick Command
+// Operator Kick Command
 // Purpose: Removes a connected user from their current rover without applying any persistent moderation state.
 // Scope: Resolves an online driver, sends them a UI-visible reason, and releases their current rover assignment.
 const Fuse = require('fuse.js');
+const { getCommandConfig } = require('../../operatorCommandService/config');
 
 const DEFAULT_KICK_REASON = 'Removed from rover by admin.';
 
@@ -97,11 +98,11 @@ function resolveKickTarget(selector, candidates, commandPrefix = 'rs') {
   return { target: first.item };
 }
 
-function createKickCommand({ io, roverManager, getNickname, sanitizeMentions, discordConfig }) {
+function createKickCommand({ io, roverManager, getNickname, sanitizeMentions, config }) {
   // The kick parser itself does not need the prefix, but its validation message
   // does. Keeping this local avoids passing display-only config through the
   // lower-level fuzzy target resolver except when an error string is needed.
-  const commandPrefix = String(discordConfig?.commandPrefix || 'rs').trim() || 'rs';
+  const { prefix: commandPrefix } = getCommandConfig(config);
   return async function handleKickCommand(message, rawText) {
     const { selector, reason } = splitSelectorAndReason(rawText);
     const assignmentService = require('../../assignmentService');
@@ -127,7 +128,7 @@ function createKickCommand({ io, roverManager, getNickname, sanitizeMentions, di
       title: 'Removed by admin',
       message: removalReason,
       reasonCode: 'admin-kick',
-      actor: message.author?.id || null,
+      actor: message.actor?.id || null,
     });
     await message.reply({
       content: sanitizeMentions(`Removed ${target.label} from ${target.roverId}: ${removalReason}`),

server/src/services/operatorCommandService/commands/lift.js

@@ -0,0 +1,27 @@
+// Lift Feature Command
+// Purpose: Exposes lift state and movement through the shared text command route.
+// Scope: Delegates interlocks, cooldowns, Home Assistant access, and runtime safety to liftService.
+function describeState(state = {}) {
+  const position = state.position || 'unknown';
+  const connection = state.connected ? 'connected' : 'offline';
+  const activity = state.busy ? `moving ${state.target || ''}`.trim() : 'idle';
+  return `Lift: ${connection}; position ${position}; ${activity}.`;
+}
+
+function createLiftCommand({ liftService, sanitizeMentions }) {
+  return async function handleLiftCommand(message, tokens = []) {
+    const action = String(tokens.shift() || 'status').toLowerCase();
+    if (action === 'status') return message.reply({ content: describeState(liftService.getState()) });
+
+    try {
+      if (action === 'up') await liftService.moveUp(`command:${message.actor?.id || 'unknown'}`);
+      else if (action === 'down') await liftService.moveDown(`command:${message.actor?.id || 'unknown'}`);
+      else return message.reply({ content: 'Invalid lift command. Use `lift status`, `lift up`, or `lift down`.' });
+      return message.reply({ content: `Lift moving ${action}.` });
+    } catch (err) {
+      return message.reply({ content: sanitizeMentions(`Lift command failed: ${err.message}`) });
+    }
+  };
+}
+
+module.exports = { createLiftCommand };

server/src/services/operatorCommandService/commands/lights.js

@@ -0,0 +1,131 @@
+// Operator Lights Command
+// Purpose: Handles admin room-light lock policy commands from Discord and web chat.
+// Scope: Delegates all actual Home Assistant policy behavior to homeAssistantService.
+const { getCommandConfig } = require('../../operatorCommandService/config');
+
+function describeLightPolicy(lightPolicy = {}) {
+  // The HA service exposes both the newer explicit lockState and the older
+  // lockedOn boolean. Prefer lockState because it can distinguish locked-on
+  // from locked-off, but keep lockedOn as a defensive fallback for any caller
+  // that passes an older or partial policy object.
+  const lockState = lightPolicy?.lockState || (lightPolicy?.lockedOn ? 'on' : null);
+  if (lockState === 'on') return 'Room lights are locked on.';
+  if (lockState === 'off') return 'Room lights are locked off.';
+  return 'Room lights are unlocked.';
+}
+
+function createLightsCommand({ homeAssistantService, sanitizeMentions, config }) {
+  // The HA policy behavior is prefix-agnostic; this value is only used so
+  // invalid-command guidance points admins at this bot instance's namespace.
+  const { prefix: commandPrefix } = getCommandConfig(config);
+  return async function handleLightsCommand(message, tokens = []) {
+    // Defaulting to status makes the bare lights command safe to type while
+    // still exposing explicit mutating forms under the configured prefix. This
+    // matters when several bot instances share a Discord server and each one
+    // needs its own command namespace.
+    const action = String(tokens.shift() || 'status').trim().toLowerCase();
+
+    if (!homeAssistantService) {
+      await message.reply({
+        content: 'Room light controls are unavailable.',
+        allowedMentions: { parse: [], repliedUser: false },
+      });
+      return;
+    }
+
+    const isAdmin = Boolean(message.actor?.isAdmin);
+    const adminActions = new Set(['status', 'lock', 'unlock']);
+
+    // The lights namespace intentionally contains both public feature actions
+    // and room-policy actions. The shared dispatcher applies the current server
+    // mode to the feature as a whole; this focused check preserves the stronger
+    // historical permission on status/lock/unlock without making on/off/colors
+    // admin-only during normal open or turns operation.
+    if (adminActions.has(action) && !isAdmin) {
+      await message.reply({
+        content: 'Only admins can manage the room-light lock.',
+        allowedMentions: { parse: [], repliedUser: false },
+      });
+      return;
+    }
+
+    // An active lock is a policy boundary for ordinary feature commands. Admin
+    // lock management remains available, but public scene commands must not
+    // silently defeat a locked-on or locked-off room state.
+    const lightPolicy = homeAssistantService.getLightPolicyState?.() || {};
+    if ((action === 'on' || action === 'off' || action === 'colors') && lightPolicy.locked) {
+      await message.reply({
+        content: describeLightPolicy(lightPolicy),
+        allowedMentions: { parse: [], repliedUser: false },
+      });
+      return;
+    }
+
+    if (action === 'status') {
+      await message.reply({
+        content: describeLightPolicy(homeAssistantService.getLightPolicyState?.() || {}),
+        allowedMentions: { parse: [], repliedUser: false },
+      });
+      return;
+    }
+
+    if (action === 'on' || action === 'off' || action === 'colors') {
+      try {
+        const result = action === 'colors'
+          ? await homeAssistantService.setRandomColorScene({ source: 'bot-command:lights:colors' })
+          : await homeAssistantService.setAllControllableEntitiesState(action, {
+            source: `bot-command:lights:${action}`,
+          });
+        const failed = result?.failures?.length || 0;
+        const succeeded = result?.succeeded?.length || 0;
+        const description = action === 'colors'
+          ? `Applied random colors to ${result?.colorLights || 0} RGB lights and requested off for ${result?.nonColorEntities || 0} non-RGB lights.`
+          : `Turned ${action} ${succeeded} room lights.`;
+        const failureSuffix = failed ? ` ${failed} failed.` : '';
+        await message.reply({
+          content: sanitizeMentions(`${description}${failureSuffix}`),
+          allowedMentions: { parse: [], repliedUser: false },
+        });
+      } catch (err) {
+        await message.reply({
+          content: sanitizeMentions(`Failed to update room lights: ${err.message}`),
+          allowedMentions: { parse: [], repliedUser: false },
+        });
+      }
+      return;
+    }
+
+    if (action !== 'lock' && action !== 'unlock') {
+      await message.reply({
+        content: `Invalid lights command. Use \`${commandPrefix} lights on\`, \`${commandPrefix} lights off\`, \`${commandPrefix} lights colors\`, \`${commandPrefix} lights lock\`, \`${commandPrefix} lights unlock\`, or \`${commandPrefix} lights status\`.`,
+        allowedMentions: { parse: [], repliedUser: false },
+      });
+      return;
+    }
+
+    try {
+      const locked = action === 'lock';
+      // The bot command intentionally calls the shared policy setter instead of
+      // issuing direct Home Assistant entity commands. That keeps all secondary
+      // behavior centralized: web UI controls become disabled through the
+      // session lightPolicy update, entering lock-on still sets configured
+      // lights to white where possible once, and commandService sees the same
+      // update event that forces rover lasers off while the room is locked on.
+      await homeAssistantService.setLightsLockedOn(locked, {
+        source: `bot-command:lights:${action}`,
+      });
+
+      await message.reply({
+        content: sanitizeMentions(locked ? 'Room lights locked on.' : 'Room lights unlocked.'),
+        allowedMentions: { parse: [], repliedUser: false },
+      });
+    } catch (err) {
+      await message.reply({
+        content: sanitizeMentions(`Failed to update room lights: ${err.message}`),
+        allowedMentions: { parse: [], repliedUser: false },
+      });
+    }
+  };
+}
+
+module.exports = { createLightsCommand };

server/src/services/operatorCommandService/commands/lock.js

@@ -1,12 +1,13 @@
-// Discord Lock Command
+// Operator Lock Command
 // Purpose: Handles lock and unlock operations for rover availability control.
 // Scope: Applies lock state updates for a single rover ID.
 const { resolveRoverSelector } = require('./resolvers');
+const { getCommandConfig } = require('../../operatorCommandService/config');
 
-function createLockCommand({ lockRover, sanitizeMentions, rovers, discordConfig }) {
+function createLockCommand({ lockRover, sanitizeMentions, rovers, config }) {
   // Only the user-facing example depends on the prefix. The actual lock logic
   // still receives the already-parsed rover selector from the shared router.
-  const commandPrefix = String(discordConfig?.commandPrefix || 'rs').trim() || 'rs';
+  const { prefix: commandPrefix } = getCommandConfig(config);
   return async function handleLockCommand(message, roverId, locked) {
     if (!roverId) {
       await message.reply({ content: `Specify a rover ID. Example: \`${commandPrefix} lock alpha\``, allowedMentions: { parse: [], repliedUser: false } });
@@ -21,7 +22,9 @@ function createLockCommand({ lockRover, sanitizeMentions, rovers, discordConfig
       // Mutate by canonical id after fuzzy resolution. This avoids letting a
       // display-name typo create a new path through roverManager, and it also
       // makes the response name match the rover that was actually changed.
-      lockRover(resolved.id, locked, { reason: 'discord' });
+      // Preserve the established Discord reason while allowing other adapters
+      // to identify themselves without pretending their request came from Discord.
+      lockRover(resolved.id, locked, { reason: message.transport === 'discord' ? 'discord' : 'web-chat' });
       await message.reply({ content: sanitizeMentions(`${locked ? 'Locked' : 'Unlocked'} ${resolved.label || resolved.id}.`), allowedMentions: { parse: [], repliedUser: false } });
     } catch (err) {
       await message.reply({ content: sanitizeMentions(`Failed: ${err.message}`), allowedMentions: { parse: [], repliedUser: false } });

server/src/services/operatorCommandService/commands/mode.js

@@ -1,7 +1,7 @@
-// Discord Mode Command
-// Purpose: Handles mode updates from Discord admins through the configured bot prefix.
+// Operator Mode Command
+// Purpose: Handles mode updates from authorized operators through the shared command prefix.
 // Scope: Validates mode values and applies mode changes with optional reason text.
-function createModeCommand({ MODES, setMode, setAdminReason, isLockdownAdminUser, sanitizeMentions }) {
+function createModeCommand({ MODES, setMode, setAdminReason, sanitizeMentions }) {
   return async function handleModeCommand(message, tokens = []) {
     const next = String(tokens.shift() || '').toLowerCase();
     const reasonText = tokens.join(' ').trim();
@@ -10,9 +10,9 @@ function createModeCommand({ MODES, setMode, setAdminReason, isLockdownAdminUser
       return;
     }
     try {
-      const role = isLockdownAdminUser(message.author?.id) ? 'lockdown' : 'admin';
-      setMode(next, { data: { role, user: { username: `discord:${message.author?.username || 'unknown'}` } } });
-      if (reasonText) setAdminReason(reasonText, { by: message.author?.id || null });
+      const role = message.actor?.isLockdownAdmin ? 'lockdown' : 'admin';
+      setMode(next, { data: { role, user: { username: `${message.transport}:${message.actor?.label || 'unknown'}` } } });
+      if (reasonText) setAdminReason(reasonText, { by: message.actor?.id || null });
       await message.reply({ content: sanitizeMentions(`Mode set to ${next}.`), allowedMentions: { parse: [], repliedUser: false } });
     } catch (err) {
       await message.reply({ content: sanitizeMentions(`Failed to set mode: ${err.message}`), allowedMentions: { parse: [], repliedUser: false } });

server/src/services/operatorCommandService/commands/neato.js

@@ -0,0 +1,35 @@
+// Neato Feature Command
+// Purpose: Exposes Neato state and supported actions through the shared text command route.
+// Scope: Delegates device availability, Home Assistant calls, and operational errors to neatoService.
+function describeState(state = {}) {
+  const telemetry = state.telemetry || {};
+  const connection = state.connected ? 'connected' : 'offline';
+  return `Neato: ${connection}; state ${telemetry.robotState || 'unknown'}; battery ${telemetry.batteryLevel ?? 'unknown'}%.`;
+}
+
+function createNeatoCommand({ neatoService, sanitizeMentions }) {
+  return async function handleNeatoCommand(message, tokens = []) {
+    const action = String(tokens.shift() || 'status').toLowerCase();
+    if (action === 'status') return message.reply({ content: describeState(neatoService.getState()) });
+
+    const actions = {
+      start: ['now cleaning', neatoService.startCleaning],
+      home: ['returning home', neatoService.sendHome],
+      locate: ['playing locate sound', neatoService.locateRobot],
+      'clear-errors': ['clearing errors', neatoService.clearErrors],
+    };
+    const selected = actions[action];
+    if (!selected) {
+      return message.reply({ content: 'Invalid Neato command. Use `neato status`, `neato start`, `neato home`, `neato locate`, or `neato clear-errors`.' });
+    }
+
+    try {
+      await selected[1]();
+      return message.reply({ content: `Neato is ${selected[0]}.` });
+    } catch (err) {
+      return message.reply({ content: sanitizeMentions(`Neato command failed: ${err.message}`) });
+    }
+  };
+}
+
+module.exports = { createNeatoCommand };

server/src/services/operatorCommandService/commands/reason.js

@@ -1,7 +1,7 @@
-// Discord Reason Command
+// Operator Reason Command
 // Purpose: Handles admin-mode reason view/update/clear operations.
 // Scope: Allows read by all and write by admins.
-function createReasonCommand({ getAdminReason, setAdminReason, clearAdminReason, isAdminUser, sanitizeMentions }) {
+function createReasonCommand({ getAdminReason, setAdminReason, clearAdminReason, sanitizeMentions }) {
   return async function handleReasonCommand(message, tokens) {
     const query = tokens.join(' ').trim();
     const lower = query.toLowerCase();
@@ -10,16 +10,16 @@ function createReasonCommand({ getAdminReason, setAdminReason, clearAdminReason,
       await message.reply({ content: reason?.text ? `Admin mode reason: ${sanitizeMentions(reason.text)}` : 'No admin mode reason set.', allowedMentions: { parse: [], repliedUser: false } });
       return;
     }
-    if (!isAdminUser(message.author.id)) {
+    if (!message.actor?.isAdmin) {
       await message.reply({ content: 'Only admins can update the admin mode reason.', allowedMentions: { parse: [], repliedUser: false } });
       return;
     }
     try {
       if (lower === 'clear') {
-        clearAdminReason({ by: message.author?.id || null });
+        clearAdminReason({ by: message.actor?.id || null });
         await message.reply({ content: 'Admin mode reason cleared.', allowedMentions: { parse: [], repliedUser: false } });
       } else {
-        setAdminReason(query, { by: message.author?.id || null });
+        setAdminReason(query, { by: message.actor?.id || null });
         await message.reply({ content: sanitizeMentions(`Admin mode reason set: ${query}`), allowedMentions: { parse: [], repliedUser: false } });
       }
     } catch (err) {

server/src/services/operatorCommandService/commands/resolvers.js

@@ -1,4 +1,4 @@
-// Discord Command Resolvers
+// Operator Command Resolvers
 // Purpose: Provides shared selector parsing and fuzzy matching for command handlers.
 // Scope: Keeps potentially destructive commands from each inventing their own lookup rules.
 const Fuse = require('fuse.js');

server/src/services/operatorCommandService/commands/verify.js

@@ -1,14 +1,14 @@
-// Discord Verify Command
+// Operator Verify Command
 // Purpose: Handles verified-user moderation commands for lockdown admins.
 // Scope: Supports list and remove subcommands.
 const { mask, resolveIdentitySelector } = require('./resolvers');
+const { getCommandConfig } = require('../../operatorCommandService/config');
 
-function createVerifyCommand({ listVerifiedUsers, removeVerifiedUser, isLockdownAdminUser, sanitizeMentions, discordConfig }) {
-  // Verification usage text follows the configured prefix for the same reason
-  // as the command router: each bot instance needs its own command namespace.
-  const commandPrefix = String(discordConfig?.commandPrefix || 'rs').trim() || 'rs';
+function createVerifyCommand({ listVerifiedUsers, removeVerifiedUser, sanitizeMentions, config }) {
+  // Usage text comes from the same core prefix that both transports parse.
+  const { prefix: commandPrefix } = getCommandConfig(config);
   return async function handleVerifyCommand(message, tokens) {
-    if (!isLockdownAdminUser(message.author?.id)) {
+    if (!message.actor?.isLockdownAdmin) {
       await message.reply({ content: 'Only lockdown admins can manage verified users.', allowedMentions: { parse: [], repliedUser: false } });
       return;
     }
@@ -29,7 +29,7 @@ function createVerifyCommand({ listVerifiedUsers, removeVerifiedUser, isLockdown
         // The command resolver only turns a human-friendly or fuzzy nickname
         // into the stable cookie id so the service does not need Discord/Web
         // command concerns baked into its storage API.
-        const removed = removeVerifiedUser(resolved.record.userId || resolved.record.id || resolved.record.cookieUserId, message.author?.id || null);
+        const removed = removeVerifiedUser(resolved.record.userId || resolved.record.id || resolved.record.cookieUserId, message.actor?.id || null);
         return message.reply({ content: `Removed verified user ${sanitizeMentions(removed.nickname || 'unknown')} (${mask(removed.cookieUserId)}).`, allowedMentions: { parse: [], repliedUser: false } });
       } catch (err) {
         return message.reply({ content: sanitizeMentions(`Failed to remove verified user: ${err.message}`), allowedMentions: { parse: [], repliedUser: false } });

server/src/services/operatorCommandService/config.js

@@ -0,0 +1,45 @@
+// Operator Command Configuration
+// Purpose: Owns transport-neutral command names used by site chat and optional integrations.
+// Scope: Prevents Discord configuration from defining whether core server commands can be parsed.
+const { loadConfig } = require('../../helpers/configLoader');
+
+function getCommandConfig(config = loadConfig()) {
+  const commandConfig = config.commands || {};
+  const prefix = String(commandConfig.prefix || 'rs').trim() || 'rs';
+  const timeStatusCommand = commandConfig.timeStatusCommand === null
+    ? ''
+    : String(commandConfig.timeStatusCommand || 'ts').trim();
+
+  return { prefix, timeStatusCommand };
+}
+
+function parseCommandText(text, config = loadConfig()) {
+  const clean = String(text || '').trim();
+  const lower = clean.toLowerCase();
+  const { prefix, timeStatusCommand } = getCommandConfig(config);
+  const normalizedPrefix = prefix.toLowerCase();
+  const normalizedTimeStatus = timeStatusCommand.toLowerCase();
+
+  if (normalizedTimeStatus && lower === normalizedTimeStatus) {
+    return { matched: true, kind: 'time-status', body: '', action: 'time-status', tokens: [] };
+  }
+
+  if (!lower.startsWith(normalizedPrefix)) return { matched: false };
+  const nextCharacter = clean.charAt(prefix.length);
+  if (nextCharacter && !/\s/.test(nextCharacter)) return { matched: false };
+
+  const body = clean.slice(prefix.length).trim();
+  const tokens = body ? body.split(/\s+/) : [];
+  return {
+    matched: true,
+    kind: 'prefixed',
+    body,
+    action: String(tokens[0] || '').toLowerCase(),
+    tokens,
+  };
+}
+
+module.exports = {
+  getCommandConfig,
+  parseCommandText,
+};

server/src/services/operatorCommandService/help.js

@@ -0,0 +1,46 @@
+// Operator Command Help
+// Purpose: Generates organized command help from one descriptive command catalogue.
+// Scope: Keeps shared command discovery consistent while allowing Discord-only extensions to stay transport-specific.
+const { CATEGORIES, buildCommandRegistry } = require('./registry');
+
+function renderDetailed(name, entry, isFeatureEnabled) {
+  const details = [`**${name}**`, entry.summary];
+  if (entry.access) details.push(`Permission: ${entry.access}`);
+  if (entry.requiredFeature) details.push(`Required feature: ${entry.requiredFeature}`);
+  if (entry.requiredFeature && !isFeatureEnabled(entry.requiredFeature)) details.push('Availability: unavailable on this server');
+  details.push('Usage:', ...entry.usage.map((usage) => `- \`${usage}\``));
+  return details.join('\n');
+}
+
+function formatHelp({ commandPrefix = 'rs', timeStatusCommand = 'ts', topic = '', includeDiscord = true, isFeatureEnabled = () => true } = {}) {
+  const prefix = String(commandPrefix || 'rs').trim() || 'rs';
+  const timeCommand = timeStatusCommand ? String(timeStatusCommand).trim() : '';
+  const entries = buildCommandRegistry(prefix, timeCommand);
+  const normalizedTopic = String(topic || '').trim().toLowerCase();
+
+  if (entries[normalizedTopic] && (normalizedTopic !== 'bridge' || includeDiscord)) {
+    return renderDetailed(normalizedTopic, entries[normalizedTopic], isFeatureEnabled);
+  }
+
+  const requestedCategory = normalizedTopic === 'feature' ? 'features' : normalizedTopic;
+  const categoryNames = requestedCategory && CATEGORIES[requestedCategory]
+    ? [requestedCategory]
+    : ['system', 'admin', 'features', ...(includeDiscord ? ['discord'] : [])];
+
+  const output = ['**Rover Bot Commands**'];
+  for (const categoryName of categoryNames) {
+    if (categoryName === 'discord' && !includeDiscord) continue;
+    const category = CATEGORIES[categoryName];
+    output.push('', `**${category.title}**`);
+    for (const name of category.names) {
+      const entry = entries[name];
+      if (!entry?.usage?.length) continue;
+      const availability = entry.requiredFeature && !isFeatureEnabled(entry.requiredFeature) ? ' *(unavailable)*' : '';
+      output.push(`\`${entry.usage[0]}\` — ${entry.summary}${availability}`);
+    }
+  }
+  output.push('', `Use \`${prefix} help <command|category>\` for details.`);
+  return output.join('\n');
+}
+
+module.exports = { formatHelp };

server/src/services/operatorCommandService/index.js

@@ -0,0 +1,164 @@
+// Operator Command Service
+// Purpose: Routes transport-neutral operator command requests to registered server handlers.
+// Scope: Owns shared parsing, authorization, feature gating, help, and execution without importing Discord.js.
+const { formatHelp } = require('./help');
+const { createLockCommand } = require('./commands/lock');
+const { createModeCommand } = require('./commands/mode');
+const { createReasonCommand } = require('./commands/reason');
+const { createGoalCommand } = require('./commands/goal');
+const { createVerifyCommand } = require('./commands/verify');
+const { createDeterCommand } = require('./commands/deter');
+const { createLightsCommand } = require('./commands/lights');
+const { createKickCommand } = require('./commands/kick');
+const { createLiftCommand } = require('./commands/lift');
+const { createNeatoCommand } = require('./commands/neato');
+const { getCommandConfig } = require('./config');
+const { buildCommandRegistry } = require('./registry');
+
+function createCommandHandlers(deps) {
+  const {
+    getMode,
+    MODES,
+  } = deps;
+  // The prefix belongs to the always-available command system so every
+  // transport parses the same namespace instead of maintaining local defaults.
+  const { prefix: commandPrefix, timeStatusCommand } = getCommandConfig(deps.config);
+  // The legacy time command is a bare word rather than a prefixed command. It
+  // therefore needs its own configurable value, and `null` intentionally
+  // disables it so multiple bots do not all answer `ts` in the same channel.
+  // Lowercase cached copies avoid re-normalizing every message and keep command
+  // matching case-insensitive without changing the original configured text
+  // that is shown in help output.
+  const normalizedCommandPrefix = commandPrefix.toLowerCase();
+  const normalizedTimeStatusCommand = timeStatusCommand.toLowerCase();
+  const registry = buildCommandRegistry(commandPrefix, timeStatusCommand);
+
+  // Status, time status, replay delivery, and transport extensions may have
+  // different presentation needs. Adapters inject those focused handlers while
+  // the core retains parsing, policy, and command discovery ownership.
+  const transportHandlers = deps.transportHandlers || {};
+  const handleStatusCommand = transportHandlers.status;
+  const handleReplayCommand = deps.createReplayTextCommand
+    ? deps.createReplayTextCommand(deps)
+    : transportHandlers.replay;
+  const handleLockCommand = createLockCommand(deps);
+  const handleModeCommand = createModeCommand(deps);
+  const handleReasonCommand = createReasonCommand(deps);
+  const handleGoalCommand = createGoalCommand(deps);
+  const handleVerifyCommand = createVerifyCommand(deps);
+  const handleDeterCommand = createDeterCommand(deps);
+  const handleBridgeCommand = transportHandlers.bridge;
+  const handleTimeStatusCommand = transportHandlers.timeStatus;
+  const handleLightsCommand = createLightsCommand(deps);
+  const handleKickCommand = createKickCommand(deps);
+  const handleLiftCommand = createLiftCommand(deps);
+  const handleNeatoCommand = createNeatoCommand(deps);
+
+  function stripCommandPrefix(content) {
+    const trimmed = String(content || '').trim();
+    const lower = trimmed.toLowerCase();
+    if (!lower.startsWith(normalizedCommandPrefix)) return null;
+
+    const nextCharacter = trimmed.charAt(commandPrefix.length);
+    // Prefixes are matched as whole command tokens so an instance using `rs`
+    // still ignores ordinary words such as `rsvp`. This mirrors the old regex
+    // behavior while letting each Discord bot instance use its own prefix.
+    if (nextCharacter && !/\s/.test(nextCharacter)) return null;
+
+    return trimmed.slice(commandPrefix.length).trim();
+  }
+
+  async function handleCommand(request) {
+    if (request.actor?.bot) return;
+    const content = (request.content || '').trim();
+    const lower = content.toLowerCase();
+    // Commands are intentionally matched as whole prefixes. The previous
+    // startsWith checks made ordinary messages such as "rsvp" or "tshirt" look
+    // like commands, which is especially bad now that web chat will run the
+    // same server-side dispatcher before broadcasting user text.
+    if (normalizedTimeStatusCommand && lower === normalizedTimeStatusCommand) return handleTimeStatusCommand?.(request);
+
+    const commandBody = stripCommandPrefix(content);
+    if (commandBody === null) return;
+
+    const tokens = commandBody ? commandBody.split(/\s+/) : [];
+    const action = (tokens.shift() || '').toLowerCase();
+    const rest = tokens.join(' ').trim();
+    const isAdmin = Boolean(request.actor?.isAdmin);
+    const isLockdownAdmin = Boolean(request.actor?.isLockdownAdmin);
+    const mode = getMode();
+    const commandDefinition = registry[action];
+    if (commandDefinition?.requiredFeature && !deps.isFeatureEnabled(commandDefinition.requiredFeature)) {
+      await request.reply({ content: `${commandDefinition.unavailableLabel || commandDefinition.requiredFeature} feature is not configured.` });
+      return;
+    }
+    // Actions in this set can change operational safety or access policy, so
+    // lockdown mode narrows them from normal admins to lockdown admins. Lights
+    // is included because its lock/unlock subcommands change room policy. Its
+    // ordinary on/off/color actions are also intentionally restricted to a
+    // lockdown admin while the entire server is in lockdown.
+    const moderationActions = new Set(['lock', 'unlock', 'mode', 'goal', 'reason', 'verify', 'deter', 'lights', 'kick', 'lift', 'neato']);
+    const isAccessModeCommand = commandDefinition?.permission === 'access-mode';
+
+    // Feature commands are public activities while access is open or managed
+    // by turns. In admin mode they follow the same admin-only boundary as rover
+    // access, and lockdown continues to require the stricter lockdown role.
+    // Keeping this policy in the shared dispatcher makes web chat and Discord
+    // behave identically instead of each transport interpreting modes itself.
+    if (isAccessModeCommand && mode === MODES.ADMIN && !isAdmin) {
+      await request.reply({ content: 'Admin mode: only admins can run feature commands.', allowedMentions: { parse: [], repliedUser: false } });
+      return;
+    }
+
+    if (!isAccessModeCommand && !isAdmin && action !== '' && action !== 'status' && action !== 'help' && action !== 'replay' && action !== 'bridge' && action !== 'goal' && action !== 'reason' && action !== 'verify' && action !== 'deter') {
+      await request.reply({ content: 'Only admins can run that command.', allowedMentions: { parse: [], repliedUser: false } });
+      return;
+    }
+
+    if (mode === MODES.LOCKDOWN && moderationActions.has(action) && !isLockdownAdmin) {
+      await request.reply({ content: 'Lockdown mode: only lockdown admins can run that command.', allowedMentions: { parse: [], repliedUser: false } });
+      return;
+    }
+
+    switch (action) {
+      case '':
+      case 'status':
+        return handleStatusCommand?.(request, rest);
+      case 'help':
+        return request.reply(formatHelp({ commandPrefix, timeStatusCommand, topic: rest, includeDiscord: request.transport === 'discord', isFeatureEnabled: deps.isFeatureEnabled }));
+      case 'replay':
+        return handleReplayCommand?.(request, tokens.join(' '));
+      case 'bridge':
+        if (!handleBridgeCommand) return request.reply(formatHelp({ commandPrefix, timeStatusCommand, includeDiscord: false, isFeatureEnabled: deps.isFeatureEnabled }));
+        return handleBridgeCommand(request, tokens);
+      case 'lights':
+        return handleLightsCommand(request, tokens);
+      case 'kick':
+        return handleKickCommand(request, rest);
+      case 'lift':
+        return handleLiftCommand(request, tokens);
+      case 'neato':
+        return handleNeatoCommand(request, tokens);
+      case 'lock':
+        return handleLockCommand(request, rest, true);
+      case 'unlock':
+        return handleLockCommand(request, rest, false);
+      case 'mode':
+        return handleModeCommand(request, tokens);
+      case 'goal':
+        return handleGoalCommand(request, tokens);
+      case 'reason':
+        return handleReasonCommand(request, tokens);
+      case 'verify':
+        return handleVerifyCommand(request, tokens);
+      case 'deter':
+        return handleDeterCommand(request, tokens);
+      default:
+        return request.reply(formatHelp({ commandPrefix, timeStatusCommand, includeDiscord: request.transport === 'discord', isFeatureEnabled: deps.isFeatureEnabled }));
+    }
+  }
+
+  return { handleCommand };
+}
+
+module.exports = { createCommandHandlers };

server/src/services/operatorCommandService/registry.js

@@ -0,0 +1,43 @@
+// Operator Command Registry
+// Purpose: Describes command categories, discovery text, permissions, and feature requirements in one place.
+// Scope: Supplies transport-neutral metadata; execution handlers remain focused on server operations.
+const CATEGORIES = {
+  system: { title: 'System', names: ['help', 'status', 'replay', 'time-status'] },
+  admin: { title: 'Admin', names: ['lock', 'unlock', 'mode', 'reason', 'goal', 'kick', 'verify', 'deter'] },
+  features: { title: 'Features', names: ['lights', 'lift', 'neato'] },
+  discord: { title: 'Discord', names: ['bridge'] },
+};
+
+function buildCommandRegistry(prefix, timeCommand) {
+  return {
+    help: { category: 'system', summary: 'Show command help.', usage: [`${prefix} help [command|category]`] },
+    status: { category: 'system', summary: 'Show rover status; rover names can be fuzzy.', usage: [`${prefix} status [rover]`] },
+    replay: { category: 'system', summary: 'Create an instant replay from selected sources.', usage: [`${prefix} replay [sources]`] },
+    'time-status': { category: 'system', summary: 'Show the current time status.', usage: timeCommand ? [timeCommand] : [] },
+    lock: { category: 'admin', summary: 'Lock a rover.', usage: [`${prefix} lock <rover>`], access: 'Admin', permission: 'admin' },
+    unlock: { category: 'admin', summary: 'Unlock a rover.', usage: [`${prefix} unlock <rover>`], access: 'Admin', permission: 'admin' },
+    mode: { category: 'admin', summary: 'Change the server mode.', usage: [`${prefix} mode <open|turns|admin|lockdown>`], access: 'Admin', permission: 'admin' },
+    reason: { category: 'admin', summary: 'Show, set, or clear the admin-mode reason.', usage: [`${prefix} reason [text|clear]`], access: 'Admin to change' },
+    goal: { category: 'admin', summary: 'Show, set, or clear the global objective.', usage: [`${prefix} goal [text|clear]`], access: 'Admin to change' },
+    lights: {
+      category: 'features',
+      summary: 'Control room lights or manage the admin light lock.',
+      usage: [
+        `${prefix} lights <on|off|colors>`,
+        `${prefix} lights <status|lock|unlock>`,
+      ],
+      access: 'Light controls are public unless server access is restricted; lock controls require admin',
+      permission: 'access-mode',
+      requiredFeature: 'homeAssistant',
+      unavailableLabel: 'Home Assistant',
+    },
+    kick: { category: 'admin', summary: 'Remove a user from their current rover.', usage: [`${prefix} kick <user> [reason]`], access: 'Admin', permission: 'admin' },
+    verify: { category: 'admin', summary: 'List or remove verified identities.', usage: [`${prefix} verify list`, `${prefix} verify remove <identity>`], access: 'Lockdown admin', permission: 'lockdown-admin' },
+    deter: { category: 'admin', summary: 'List, add, or remove identity deterrence.', usage: [`${prefix} deter list`, `${prefix} deter ban <identity>`, `${prefix} deter unban <identity>`], access: 'Lockdown admin', permission: 'lockdown-admin' },
+    lift: { category: 'features', summary: 'Show or move the lift.', usage: [`${prefix} lift <status|up|down>`], access: 'Public unless server access is restricted', permission: 'access-mode', requiredFeature: 'lift', unavailableLabel: 'Lift' },
+    neato: { category: 'features', summary: 'Show or control Neato.', usage: [`${prefix} neato <status|start|home|locate|clear-errors>`], access: 'Public unless server access is restricted', permission: 'access-mode', requiredFeature: 'neato', unavailableLabel: 'Neato' },
+    bridge: { category: 'discord', summary: 'Configure this Discord server chat bridge.', usage: [`${prefix} bridge`, `${prefix} bridge here <global|private>`, `${prefix} bridge mode <global|private>`, `${prefix} bridge off`], access: 'Discord server manager' },
+  };
+}
+
+module.exports = { CATEGORIES, buildCommandRegistry };

server/src/services/operatorCommandService/webTransport.js

@@ -0,0 +1,68 @@
+// Web Chat Command Transport
+// Purpose: Renders status-oriented operator commands as the same plain text web chat expects.
+// Scope: Avoids importing Discord.js merely to flatten an embed back into text.
+const { resolveRoverSelector } = require('./commands/resolvers');
+
+function formatTimeInZone(date, timeZone) {
+  try {
+    return new Intl.DateTimeFormat('en-US', { timeZone, hour: '2-digit', minute: '2-digit', hour12: false }).format(date);
+  } catch (_err) {
+    return 'n/a';
+  }
+}
+
+function createWebTransportHandlers({ rovers, roverManager, config, siteUrl = '' }) {
+  return {
+    async status(message, roverId) {
+      const resolved = roverId ? resolveRoverSelector(roverId, rovers) : null;
+      if (roverId && resolved?.error) return message.reply(`Rover Status\n\n${resolved.error}`);
+      const records = roverId
+        ? [resolved.record]
+        : Array.from(rovers.values()).filter((entry) => roverManager.canReplayRoverId(entry?.id));
+      if (!records.length) return message.reply('Rover Battery Status\n\nNo rovers online.');
+
+      // This mirrors the human-readable content of the established Discord
+      // battery embed while remaining a plain transport-neutral chat result.
+      const fields = records.map((record) => {
+        const sensors = record.lastSensor?.decoded || record.lastSensor?.sensors || {};
+        const battery = record.batteryState || {};
+        const name = record.meta?.name || record.id;
+        const docked = Boolean(sensors?.chargingSources?.homeBase);
+        const chargingLabel = String(sensors?.chargingState?.label || 'unknown');
+        const charging = ['waiting', 'full charging', 'trickle charging'].includes(chargingLabel.toLowerCase()) || [2, 3, 4].includes(sensors?.chargingState?.code);
+        const lockLabel = record.locked ? `locked${record.lockReason ? ` (${record.lockReason})` : ''}` : 'unlocked';
+        const charge = battery.charge != null && battery.capacity != null ? `${battery.charge}/${battery.capacity}mAh` : 'n/a';
+        const percent = battery.percentDisplay != null ? `${battery.percentDisplay}%` : 'n/a';
+        return [
+          name,
+          `Dock: ${docked ? 'docked' : 'undocked'}`,
+          `Charging: ${charging ? `charging (${chargingLabel})` : 'not charging'}`,
+          `Battery: ${charge} (${percent})`,
+          `Voltage: ${sensors?.voltageMv == null ? 'n/a' : `${(sensors.voltageMv / 1000).toFixed(2)}V`}`,
+          `Current: ${sensors?.currentMa == null ? 'n/a' : `${sensors.currentMa}mA`}`,
+          `OI: ${String(sensors?.oiMode?.label || 'unknown').toLowerCase()}`,
+          `Lock: ${lockLabel}`,
+        ].join('\n');
+      });
+      return message.reply(['Rover Battery Status', ...fields].join('\n\n'));
+    },
+    async timeStatus(message) {
+      const serverTimezone = config.timezone || config.server?.timezone || process.env.TZ || 'America/New_York';
+      const zones = [
+        ['UTC', 'UTC'], ['US Pacific', 'America/Los_Angeles'], ['US Mountain', 'America/Denver'],
+        ['US Central', 'America/Chicago'], ['US Eastern', 'America/New_York'], ['Europe London', 'Europe/London'],
+        ['Europe Berlin', 'Europe/Berlin'], ['Asia Kolkata', 'Asia/Kolkata'], ['Asia Shanghai', 'Asia/Shanghai'],
+        ['Asia Tokyo', 'Asia/Tokyo'], ['Australia Sydney', 'Australia/Sydney'], ['New Zealand Auckland', 'Pacific/Auckland'],
+      ];
+      const now = new Date();
+      const lines = zones.map(([label, zone]) => `${label} — ${formatTimeInZone(now, zone)}${zone.toLowerCase() === String(serverTimezone).toLowerCase() ? ' **(server local timezone)**' : ''}`);
+      if (!zones.some(([, zone]) => zone.toLowerCase() === String(serverTimezone).toLowerCase())) {
+        lines.push(`Server Local — ${formatTimeInZone(now, serverTimezone)} **(server local timezone)**`);
+      }
+      const siteLink = siteUrl ? `\n\n${siteUrl}` : '';
+      return message.reply(`Time Status\n${lines.join('\n')}${siteLink}\n\nServer local timezone: ${serverTimezone}`);
+    },
+  };
+}
+
+module.exports = { createWebTransportHandlers };

server/src/services/overcurrentProtectionService/index.js

@@ -0,0 +1,587 @@
+// Overcurrent Protection Service
+// Purpose: Owns fleet-wide, server-authoritative motor stress calculation and command limiting.
+// Scope: Keeps overcurrent policy out of rover-manager sensor orchestration while combining command intent with decoded telemetry.
+
+const logger = require('../../globals/logger').child('overcurrentProtectionService');
+
+const DEFAULT_CONFIG = Object.freeze({
+  minimumUsefulWheelIntent: 75,
+  stressGrace: 0.25,
+  wheelProgressWindowSec: 0.4,
+  encoderNoiseFloorMmPerSec: 15,
+  fullStallProgressRatio: 0.1,
+  movingProgressRatio: 0.6,
+  movingOrUnknownRatePerSec: 0.2,
+  fullStallRatePerSec: 0.6,
+  wheelRecoveryDelaySec: 0.75,
+  wheelRecoveryRatePerSec: 0.4,
+  brushOvercurrentRatePerSec: 1,
+  brushRecoveryRatePerSec: 0.75,
+  clearBeforeUnlockSec: 0.75,
+  outputRateMs: 250,
+  maxTelemetryDeltaSec: 0.5,
+});
+
+const MOTOR_KEYS = Object.freeze(['leftWheel', 'rightWheel', 'mainBrush', 'sideBrush']);
+
+function clampUnit(value) {
+  if (!Number.isFinite(value)) return 0;
+  return Math.max(0, Math.min(1, value));
+}
+
+function finiteNumber(value, fallback = 0) {
+  const number = Number(value);
+  return Number.isFinite(number) ? number : fallback;
+}
+
+function createMotorState() {
+  return {
+    overcurrent: false,
+    commandedSpeed: 0,
+    measuredSpeed: null,
+    currentMa: null,
+    stallFactor: 0,
+    progressRatio: null,
+    classification: 'unknown',
+    progressSamples: [],
+    windowCommandSign: 0,
+    clearSec: 0,
+    stress: 0,
+    cap: 1,
+  };
+}
+
+function createRoverState() {
+  return {
+    bypassed: false,
+    lastTelemetryAt: 0,
+    driveIntent: { left: 0, right: 0 },
+    auxIntent: { main: 0, side: 0, vacuum: 0 },
+    driveBlocked: false,
+    requiresNeutral: false,
+    neutralSeen: false,
+    driveClearSec: 0,
+    stopReason: null,
+    lastDriveOutputAt: 0,
+    lastAuxOutputAt: 0,
+    lastDriveOutput: { left: 0, right: 0 },
+    lastAuxOutput: { main: 0, side: 0, vacuum: 0 },
+    motors: {
+      leftWheel: createMotorState(),
+      rightWheel: createMotorState(),
+      mainBrush: createMotorState(),
+      sideBrush: createMotorState(),
+    },
+  };
+}
+
+function createOvercurrentProtectionService(options = {}) {
+  const config = Object.freeze({ ...DEFAULT_CONFIG, ...(options.config || {}) });
+  const states = new Map();
+  let commandIssuer = typeof options.issueCommand === 'function' ? options.issueCommand : null;
+
+  function getState(roverId) {
+    const key = String(roverId || '');
+    if (!states.has(key)) states.set(key, createRoverState());
+    return states.get(key);
+  }
+
+  function resetProtectionState(state, { bypassed = state.bypassed } = {}) {
+    /*
+      An administrator bypass is a change of authority, not merely a cap of
+      one. Clearing accumulated stress here prevents a previous user's event
+      from unexpectedly affecting the first command after authority changes.
+      Both command intents are cleared before the caller records the new command
+      so telemetry cannot apply a previous operator's held drive or brush value
+      after authority changes.
+    */
+    state.bypassed = Boolean(bypassed);
+    state.lastTelemetryAt = 0;
+    state.driveBlocked = false;
+    state.requiresNeutral = false;
+    state.neutralSeen = false;
+    state.driveClearSec = 0;
+    state.stopReason = null;
+    state.driveIntent = { left: 0, right: 0 };
+    state.auxIntent = { main: 0, side: 0, vacuum: 0 };
+    state.lastDriveOutput = { left: 0, right: 0 };
+    state.lastAuxOutput = { main: 0, side: 0, vacuum: 0 };
+    state.lastDriveOutputAt = 0;
+    state.lastAuxOutputAt = 0;
+    MOTOR_KEYS.forEach((key) => {
+      state.motors[key] = createMotorState();
+    });
+  }
+
+  function configureCommandIssuer(nextIssuer) {
+    commandIssuer = typeof nextIssuer === 'function' ? nextIssuer : null;
+  }
+
+  function calculateCap(stress) {
+    /*
+      The grace region absorbs short mechanical events such as initial wheel
+      acceleration and direction changes. Above it, the remaining stress range
+      maps linearly to output so the cap reaches exactly zero at hard-stop
+      stress instead of leaving a small command applied to a stalled motor.
+    */
+    const grace = clampUnit(config.stressGrace);
+    if (stress <= grace) return 1;
+    const usableRange = Math.max(0.0001, 1 - grace);
+    return clampUnit(1 - (stress - grace) / usableRange);
+  }
+
+  function getDriveCap(state) {
+    return Math.min(state.motors.leftWheel.cap, state.motors.rightWheel.cap);
+  }
+
+  function scaleDrive(state, driveDirect = state.driveIntent) {
+    if (state.bypassed) return { ...driveDirect };
+    if (state.driveBlocked) return { left: 0, right: 0 };
+    const cap = getDriveCap(state);
+    return {
+      left: Math.round(finiteNumber(driveDirect?.left) * cap),
+      right: Math.round(finiteNumber(driveDirect?.right) * cap),
+    };
+  }
+
+  function scaleAux(state, motorPwm = state.auxIntent) {
+    if (state.bypassed) return { ...motorPwm };
+    return {
+      main: Math.round(finiteNumber(motorPwm?.main) * state.motors.mainBrush.cap),
+      side: Math.round(finiteNumber(motorPwm?.side) * state.motors.sideBrush.cap),
+      // Create 2/Roomba 600 does not expose a vacuum overcurrent bit, so this
+      // service must not imply that it can measure or limit vacuum motor stress.
+      vacuum: Math.round(finiteNumber(motorPwm?.vacuum)),
+    };
+  }
+
+  function hasDriveIntent(state) {
+    return Boolean(state.driveIntent.left || state.driveIntent.right);
+  }
+
+  function hasAuxIntent(state) {
+    return Boolean(state.auxIntent.main || state.auxIntent.side || state.auxIntent.vacuum);
+  }
+
+  function driveOutputsEqual(left, right) {
+    return left.left === right.left && left.right === right.right;
+  }
+
+  function auxOutputsEqual(left, right) {
+    return left.main === right.main && left.side === right.side && left.vacuum === right.vacuum;
+  }
+
+  function issueAdjustedCommand(roverId, payload) {
+    if (!commandIssuer) return false;
+    try {
+      /*
+        The injected issuer is the raw server-to-roverd transport function.
+        Calling it here intentionally avoids routing a service-generated update
+        through the socket authorization/filter path a second time.
+      */
+      return commandIssuer(roverId, payload) !== false;
+    } catch (err) {
+      logger.warn('Failed to issue overcurrent protection command', {
+        roverId,
+        type: payload?.type,
+        error: err.message,
+      });
+      return false;
+    }
+  }
+
+  function protectCommand(roverId, type, payload = {}, context = {}) {
+    const state = getState(roverId);
+    const bypassed = Boolean(context.bypassed);
+    if (bypassed !== state.bypassed) {
+      resetProtectionState(state, { bypassed });
+    }
+
+    if (type === 'drive' && payload?.driveDirect) {
+      state.driveIntent = {
+        left: finiteNumber(payload.driveDirect.left),
+        right: finiteNumber(payload.driveDirect.right),
+      };
+
+      if (bypassed) {
+        state.lastDriveOutput = { ...state.driveIntent };
+        state.lastDriveOutputAt = Date.now();
+        return { ...payload, driveDirect: { ...state.driveIntent } };
+      }
+
+      const neutral = !state.driveIntent.left && !state.driveIntent.right;
+      if (neutral) {
+        /*
+          A real neutral command proves the operator released their controls.
+          Merely observing zero encoder motion cannot provide that assurance,
+          because a held command against an obstruction also produces no motion.
+        */
+        state.neutralSeen = true;
+        if (state.driveBlocked && state.driveClearSec >= config.clearBeforeUnlockSec) {
+          state.driveBlocked = false;
+          state.requiresNeutral = false;
+          state.stopReason = null;
+        }
+      }
+
+      const driveDirect = scaleDrive(state);
+      state.lastDriveOutput = { ...driveDirect };
+      state.lastDriveOutputAt = Date.now();
+      return { ...payload, driveDirect };
+    }
+
+    if (type === 'motors' && payload?.motorPwm) {
+      state.auxIntent = {
+        main: finiteNumber(payload.motorPwm.main),
+        side: finiteNumber(payload.motorPwm.side),
+        vacuum: finiteNumber(payload.motorPwm.vacuum),
+      };
+      const motorPwm = scaleAux(state);
+      state.lastAuxOutput = { ...motorPwm };
+      state.lastAuxOutputAt = Date.now();
+      return { ...payload, motorPwm };
+    }
+
+    return payload;
+  }
+
+  function resetWheelProgressWindow(motor, commandSign = 0) {
+    motor.progressSamples = [];
+    motor.windowCommandSign = commandSign;
+    motor.progressRatio = null;
+    motor.classification = 'unknown';
+    motor.stallFactor = 0;
+  }
+
+  function appendWheelProgressSample(motor, sample) {
+    motor.progressSamples.push(sample);
+    let windowSec = motor.progressSamples.reduce((total, entry) => total + entry.deltaSec, 0);
+
+    /*
+      Keep an actual rolling time window rather than periodically clearing a
+      bucket. If the oldest sample crosses the boundary, retain only its
+      proportional tail so classification does not depend on sensor cadence.
+    */
+    while (motor.progressSamples.length && windowSec > config.wheelProgressWindowSec) {
+      const excessSec = windowSec - config.wheelProgressWindowSec;
+      const oldest = motor.progressSamples[0];
+      if (oldest.deltaSec <= excessSec) {
+        motor.progressSamples.shift();
+        windowSec -= oldest.deltaSec;
+        continue;
+      }
+      const retainedFraction = (oldest.deltaSec - excessSec) / oldest.deltaSec;
+      oldest.deltaSec -= excessSec;
+      oldest.expectedDistance *= retainedFraction;
+      oldest.alignedDistance *= retainedFraction;
+      windowSec = config.wheelProgressWindowSec;
+    }
+    return windowSec;
+  }
+
+  function classifyWheelProgress(motor, windowSec) {
+    if (windowSec < config.wheelProgressWindowSec * 0.9) return;
+    const totals = motor.progressSamples.reduce(
+      (result, sample) => ({
+        expectedDistance: result.expectedDistance + sample.expectedDistance,
+        alignedDistance: result.alignedDistance + sample.alignedDistance,
+      }),
+      { expectedDistance: 0, alignedDistance: 0 },
+    );
+    if (totals.expectedDistance <= 0) return;
+
+    /*
+      Signed, command-aligned distance lets forward/backward encoder wobble
+      cancel over the window. The fixed noise floor then removes small residual
+      bias from gearbox lash or a wheel module rocking without real travel.
+    */
+    const averageExpectedSpeed = totals.expectedDistance / windowSec;
+    const averageAlignedSpeed = totals.alignedDistance / windowSec;
+    const usefulProgressSpeed = Math.max(0, averageAlignedSpeed - config.encoderNoiseFloorMmPerSec);
+    const progressRatio = clampUnit(usefulProgressSpeed / averageExpectedSpeed);
+    const ratioRange = Math.max(0.0001, config.movingProgressRatio - config.fullStallProgressRatio);
+    const stallFactor = clampUnit((config.movingProgressRatio - progressRatio) / ratioRange);
+
+    motor.progressRatio = progressRatio;
+    motor.stallFactor = stallFactor;
+    motor.classification = progressRatio <= config.fullStallProgressRatio
+      ? 'stalled'
+      : progressRatio >= config.movingProgressRatio
+        ? 'moving'
+        : 'partial';
+  }
+
+  function updateWheelMotor(motor, { overcurrent, command, intent, measured, currentMa, deltaSec }) {
+    const commandNumber = finiteNumber(command);
+    const commandMagnitude = Math.abs(commandNumber);
+    const commandSign = Math.sign(commandNumber);
+    const intentMagnitude = Math.abs(finiteNumber(intent));
+    // Null is intentionally checked before Number conversion because
+    // Number(null) is zero, which would falsely turn missing telemetry into a
+    // perfectly stalled wheel.
+    const measuredNumber = measured == null ? null : Number(measured);
+    const measuredValid = Number.isFinite(measuredNumber);
+    const usefulIntent = intentMagnitude >= config.minimumUsefulWheelIntent;
+
+    motor.overcurrent = Boolean(overcurrent);
+    motor.commandedSpeed = commandNumber;
+    motor.measuredSpeed = measuredValid ? measuredNumber : null;
+    motor.currentMa = Number.isFinite(Number(currentMa)) ? Number(currentMa) : null;
+    motor.clearSec = motor.overcurrent ? 0 : motor.clearSec + deltaSec;
+
+    if (!motor.overcurrent) {
+      resetWheelProgressWindow(motor, commandSign);
+    } else if (!usefulIntent || commandMagnitude <= 0 || !measuredValid) {
+      // Low commands and missing telemetry are real overcurrent events, but
+      // neither supplies enough evidence to label the wheel mechanically stalled.
+      // Raw operator intent decides whether the classifier remains meaningful;
+      // the progressively smaller applied output must not erase an already
+      // confirmed stall merely because protection itself reduced it below the
+      // normal command threshold.
+      resetWheelProgressWindow(motor, commandSign);
+    } else {
+      if (motor.windowCommandSign !== commandSign) {
+        // Samples from opposite requested directions cannot share a progress
+        // window because their aligned distances describe different motion.
+        resetWheelProgressWindow(motor, commandSign);
+      }
+      if (deltaSec > 0) {
+        const windowSec = appendWheelProgressSample(motor, {
+          deltaSec,
+          expectedDistance: commandMagnitude * deltaSec,
+          alignedDistance: measuredNumber * commandSign * deltaSec,
+        });
+        classifyWheelProgress(motor, windowSec);
+      }
+    }
+
+    const riseRate = config.movingOrUnknownRatePerSec
+      + (config.fullStallRatePerSec - config.movingOrUnknownRatePerSec) * motor.stallFactor;
+    const recoveryAllowed = !motor.overcurrent && motor.clearSec >= config.wheelRecoveryDelaySec;
+    motor.stress = clampUnit(
+      motor.stress
+        + (motor.overcurrent
+          ? riseRate * deltaSec
+          : recoveryAllowed
+            ? -config.wheelRecoveryRatePerSec * deltaSec
+            : 0),
+    );
+    motor.cap = calculateCap(motor.stress);
+  }
+
+  function updateBrushMotor(motor, { overcurrent, command, currentMa, deltaSec }) {
+    motor.overcurrent = Boolean(overcurrent);
+    motor.commandedSpeed = finiteNumber(command);
+    motor.measuredSpeed = null;
+    motor.currentMa = Number.isFinite(Number(currentMa)) ? Number(currentMa) : null;
+    motor.stallFactor = 0;
+    motor.stress = clampUnit(
+      motor.stress
+        + (motor.overcurrent
+          ? config.brushOvercurrentRatePerSec * deltaSec
+          : -config.brushRecoveryRatePerSec * deltaSec),
+    );
+    motor.cap = calculateCap(motor.stress);
+  }
+
+  function maybeStopDrive(roverId, state) {
+    if (state.bypassed || state.driveBlocked || !hasDriveIntent(state)) return;
+    const stalledWheel = ['leftWheel', 'rightWheel'].find((key) => state.motors[key].stress >= 1);
+    if (!stalledWheel) return;
+
+    state.driveBlocked = true;
+    state.requiresNeutral = true;
+    state.neutralSeen = false;
+    state.driveClearSec = 0;
+    state.stopReason = stalledWheel;
+    state.lastDriveOutputAt = Date.now();
+    state.lastDriveOutput = { left: 0, right: 0 };
+    issueAdjustedCommand(roverId, {
+      type: 'drive',
+      driveDirect: { left: 0, right: 0 },
+    });
+    logger.warn('Stopped rover after persistent wheel overcurrent', {
+      roverId,
+      motor: stalledWheel,
+    });
+  }
+
+  function maybeResendScaledOutputs(roverId, state, now) {
+    if (state.bypassed) return;
+
+    /*
+      A held keyboard/gamepad value may not emit another browser command while
+      telemetry continues changing the cap. Rate-limited resends make each new
+      server calculation effective without requiring the user to move the
+      control again or flooding the Pi websocket at sensor-frame cadence.
+    */
+    const nextDriveOutput = scaleDrive(state);
+    if (
+      hasDriveIntent(state)
+      && !state.driveBlocked
+      && !driveOutputsEqual(nextDriveOutput, state.lastDriveOutput)
+      && now - state.lastDriveOutputAt >= config.outputRateMs
+    ) {
+      const issued = issueAdjustedCommand(roverId, {
+        type: 'drive',
+        driveDirect: nextDriveOutput,
+      });
+      if (issued) {
+        state.lastDriveOutputAt = now;
+        state.lastDriveOutput = { ...nextDriveOutput };
+      }
+    }
+
+    const nextAuxOutput = scaleAux(state);
+    if (
+      hasAuxIntent(state)
+      && !auxOutputsEqual(nextAuxOutput, state.lastAuxOutput)
+      && now - state.lastAuxOutputAt >= config.outputRateMs
+    ) {
+      const issued = issueAdjustedCommand(roverId, {
+        type: 'motors',
+        motorPwm: nextAuxOutput,
+      });
+      if (issued) {
+        state.lastAuxOutputAt = now;
+        state.lastAuxOutput = { ...nextAuxOutput };
+      }
+    }
+  }
+
+  function processTelemetry(roverId, sensors = {}, now = Date.now()) {
+    const state = getState(roverId);
+    const timestamp = finiteNumber(now, Date.now());
+    const previousAt = state.lastTelemetryAt;
+    state.lastTelemetryAt = timestamp;
+
+    if (state.bypassed) {
+      /*
+        Admin bypass means telemetry remains visible but cannot build hidden
+        stress or schedule a delayed stop. Motor observations are still copied
+        into the public snapshot so administrators can see the hardware warning
+        while deliberately retaining full control.
+      */
+      state.driveBlocked = false;
+      state.requiresNeutral = false;
+      state.neutralSeen = false;
+      state.driveClearSec = 0;
+      state.stopReason = null;
+    }
+
+    const rawDeltaSec = previousAt > 0 ? Math.max(0, (timestamp - previousAt) / 1000) : 0;
+    const deltaSec = state.bypassed
+      ? 0
+      : Math.min(config.maxTelemetryDeltaSec, rawDeltaSec);
+    const flags = sensors?.wheelOvercurrents || {};
+    const speeds = sensors?.wheelSpeedsMmPerSecond || {};
+
+    updateWheelMotor(state.motors.leftWheel, {
+      overcurrent: flags.leftWheel,
+      command: state.lastDriveOutput.left,
+      intent: state.driveIntent.left,
+      measured: speeds.left,
+      currentMa: sensors?.wheelLeftCurrentMa,
+      deltaSec,
+    });
+    updateWheelMotor(state.motors.rightWheel, {
+      overcurrent: flags.rightWheel,
+      command: state.lastDriveOutput.right,
+      intent: state.driveIntent.right,
+      measured: speeds.right,
+      currentMa: sensors?.wheelRightCurrentMa,
+      deltaSec,
+    });
+    updateBrushMotor(state.motors.mainBrush, {
+      overcurrent: flags.mainBrush,
+      command: state.auxIntent.main,
+      currentMa: sensors?.mainBrushCurrentMa,
+      deltaSec,
+    });
+    updateBrushMotor(state.motors.sideBrush, {
+      overcurrent: flags.sideBrush,
+      command: state.auxIntent.side,
+      currentMa: sensors?.sideBrushCurrentMa,
+      deltaSec,
+    });
+
+    const wheelOvercurrent = Boolean(flags.leftWheel || flags.rightWheel);
+    state.driveClearSec = wheelOvercurrent ? 0 : state.driveClearSec + deltaSec;
+    if (
+      state.driveBlocked
+      && state.neutralSeen
+      && state.driveClearSec >= config.clearBeforeUnlockSec
+    ) {
+      state.driveBlocked = false;
+      state.requiresNeutral = false;
+      state.stopReason = null;
+    }
+
+    maybeStopDrive(roverId, state);
+    maybeResendScaledOutputs(roverId, state, timestamp);
+    return getPublicState(roverId);
+  }
+
+  function getStatus(state) {
+    const anyOvercurrent = MOTOR_KEYS.some((key) => state.motors[key].overcurrent);
+    if (state.bypassed && anyOvercurrent) return 'bypassed';
+    if (state.driveBlocked) return 'stopped';
+    const anyLimited = MOTOR_KEYS.some((key) => state.motors[key].cap < 1);
+    if (anyLimited && anyOvercurrent) return 'limiting';
+    // The raw Roomba flag is useful operator information even while stress is
+    // still inside the transient grace region. Reporting it separately keeps
+    // HUD visibility immediate without falsely claiming output is being scaled.
+    if (anyOvercurrent) return 'overcurrent';
+    // Stress below the command-limiting grace threshold still represents a
+    // recent hardware event. Keeping recovery visible until it reaches zero
+    // prevents the HUD from vanishing the instant the raw flag clears.
+    const anyStress = MOTOR_KEYS.some((key) => state.motors[key].stress > 0);
+    if (anyStress) return 'recovering';
+    return 'idle';
+  }
+
+  function getPublicState(roverId) {
+    const state = getState(roverId);
+    const motors = MOTOR_KEYS.reduce((result, key) => {
+      // Rolling samples are internal evidence, not UI state. Excluding them
+      // keeps every sensor frame compact while exposing the resulting ratio and
+      // classification needed to explain the service's decision.
+      const { progressSamples: _progressSamples, windowCommandSign: _windowCommandSign, ...motor } = state.motors[key];
+      result[key] = motor;
+      return result;
+    }, {});
+    return {
+      status: getStatus(state),
+      bypassed: state.bypassed,
+      drive: {
+        cap: getDriveCap(state),
+        blocked: state.driveBlocked,
+        requiresNeutral: state.requiresNeutral,
+        clearSec: state.driveClearSec,
+        stopReason: state.stopReason,
+      },
+      motors,
+      config: { ...config },
+    };
+  }
+
+  function cleanupRover(roverId) {
+    states.delete(String(roverId || ''));
+  }
+
+  return {
+    configureCommandIssuer,
+    protectCommand,
+    processTelemetry,
+    getPublicState,
+    cleanupRover,
+  };
+}
+
+const service = createOvercurrentProtectionService();
+
+module.exports = {
+  ...service,
+  createOvercurrentProtectionService,
+  DEFAULT_CONFIG,
+};

server/src/services/overcurrentProtectionService/index.test.js

@@ -0,0 +1,327 @@
+// Overcurrent Protection Service Tests
+// Purpose: Verifies stress integration, administrator bypass, neutral recovery, and independent brush limiting.
+// Scope: Exercises the service as a pure state machine with an injected command sink; no rover or socket process is started.
+
+const assert = require('node:assert/strict');
+const test = require('node:test');
+const { createOvercurrentProtectionService } = require('./index');
+
+function makeSensors(overrides = {}) {
+  return {
+    wheelOvercurrents: {
+      leftWheel: false,
+      rightWheel: false,
+      mainBrush: false,
+      sideBrush: false,
+      ...(overrides.wheelOvercurrents || {}),
+    },
+    wheelSpeedsMmPerSecond: {
+      left: 300,
+      right: 300,
+      ...(overrides.wheelSpeedsMmPerSecond || {}),
+    },
+  };
+}
+
+function createHarness(config = {}) {
+  const issued = [];
+  const service = createOvercurrentProtectionService({
+    config,
+    issueCommand: (roverId, payload) => issued.push({ roverId, payload }),
+  });
+  return { service, issued };
+}
+
+test('a short stalled-wheel spike remains inside the grace region', () => {
+  const { service } = createHarness();
+  const start = Date.now();
+  service.protectCommand('rover', 'drive', {
+    driveDirect: { left: 300, right: 300 },
+  });
+
+  service.processTelemetry('rover', makeSensors({
+    wheelOvercurrents: { leftWheel: true },
+    wheelSpeedsMmPerSecond: { left: 0 },
+  }), start);
+  const snapshot = service.processTelemetry('rover', makeSensors({
+    wheelOvercurrents: { leftWheel: true },
+    wheelSpeedsMmPerSecond: { left: 0 },
+  }), start + 100);
+
+  // Stress is accumulated with floating-point time arithmetic, so compare
+  // within a tiny tolerance instead of depending on an exact binary decimal.
+  assert.ok(Math.abs(snapshot.motors.leftWheel.stress - 0.02) < 1e-9);
+  assert.equal(snapshot.motors.leftWheel.cap, 1);
+  // The hardware event is visible immediately even though the grace region
+  // correctly leaves the command cap at full output.
+  assert.equal(snapshot.status, 'overcurrent');
+});
+
+test('persistent stalled-wheel overcurrent scales both wheels and then stops drive', () => {
+  const { service, issued } = createHarness();
+  const start = Date.now();
+  service.protectCommand('rover', 'drive', {
+    driveDirect: { left: 300, right: 200 },
+  });
+
+  for (let step = 0; step <= 18; step += 1) {
+    service.processTelemetry('rover', makeSensors({
+      wheelOvercurrents: { leftWheel: true },
+      wheelSpeedsMmPerSecond: { left: 0, right: 200 },
+    }), start + step * 100);
+  }
+
+  /*
+    The first 400 ms establish that the wheel is making no net progress. The
+    tuned stalled rate should then approach—but not yet cross—the hard-stop
+    boundary at 1.8 seconds.
+  */
+  assert.equal(service.getPublicState('rover').drive.blocked, false);
+  service.processTelemetry('rover', makeSensors({
+    wheelOvercurrents: { leftWheel: true },
+    wheelSpeedsMmPerSecond: { left: 0, right: 200 },
+  }), start + 1900);
+
+  const snapshot = service.getPublicState('rover');
+  assert.equal(snapshot.status, 'stopped');
+  assert.equal(snapshot.drive.blocked, true);
+  assert.equal(snapshot.drive.requiresNeutral, true);
+  assert.equal(snapshot.drive.stopReason, 'leftWheel');
+  assert.deepEqual(issued.at(-1), {
+    roverId: 'rover',
+    payload: { type: 'drive', driveDirect: { left: 0, right: 0 } },
+  });
+
+  /*
+    Before the hard stop, any rate-limited drive update must use one shared cap.
+    This preserves the requested curve instead of driving the healthy wheel at
+    full output around the mechanically obstructed side.
+  */
+  const scaledDrive = issued.find((entry) => entry.payload.type === 'drive'
+    && entry.payload.driveDirect.left > 0);
+  assert.ok(scaledDrive);
+  const leftScale = scaledDrive.payload.driveDirect.left / 300;
+  const rightScale = scaledDrive.payload.driveDirect.right / 200;
+  /*
+    Motor commands are integers, so applying one shared fractional cap can
+    round the two differently sized wheel commands by different sub-unit
+    amounts. A one-percent tolerance verifies the shared curve without
+    pretending integer transport preserves an exact floating-point ratio.
+  */
+  assert.ok(Math.abs(leftScale - rightScale) < 0.01);
+});
+
+test('administrator commands and telemetry bypass all enforcement', () => {
+  const { service, issued } = createHarness({ outputRateMs: 0 });
+  const start = Date.now();
+  const command = service.protectCommand('rover', 'drive', {
+    driveDirect: { left: 500, right: -500 },
+  }, { bypassed: true });
+
+  for (let step = 0; step <= 20; step += 1) {
+    service.processTelemetry('rover', makeSensors({
+      wheelOvercurrents: { leftWheel: true, rightWheel: true },
+      wheelSpeedsMmPerSecond: { left: 0, right: 0 },
+    }), start + step * 100);
+  }
+
+  const snapshot = service.getPublicState('rover');
+  assert.deepEqual(command.driveDirect, { left: 500, right: -500 });
+  assert.equal(snapshot.status, 'bypassed');
+  assert.equal(snapshot.bypassed, true);
+  assert.equal(snapshot.motors.leftWheel.stress, 0);
+  assert.equal(snapshot.motors.rightWheel.stress, 0);
+  assert.equal(snapshot.drive.blocked, false);
+  assert.equal(issued.length, 0);
+});
+
+test('encoder wobble around zero is classified as a full stall', () => {
+  const { service } = createHarness();
+  const start = Date.now();
+  service.protectCommand('rover', 'drive', {
+    driveDirect: { left: 300, right: 300 },
+  });
+
+  for (let step = 0; step <= 19; step += 1) {
+    const wobbleSpeed = step % 2 === 0 ? 10 : -9;
+    service.processTelemetry('rover', makeSensors({
+      wheelOvercurrents: { leftWheel: true },
+      wheelSpeedsMmPerSecond: { left: wobbleSpeed },
+    }), start + step * 100);
+  }
+
+  const snapshot = service.getPublicState('rover');
+  assert.equal(snapshot.motors.leftWheel.classification, 'stalled');
+  assert.equal(snapshot.motors.leftWheel.stallFactor, 1);
+  assert.equal(snapshot.drive.blocked, true);
+});
+
+test('overcurrent while a wheel keeps moving accumulates at the slower rate', () => {
+  const { service } = createHarness();
+  const start = Date.now();
+  service.protectCommand('rover', 'drive', {
+    driveDirect: { left: 300, right: 300 },
+  });
+
+  for (let step = 0; step <= 20; step += 1) {
+    service.processTelemetry('rover', makeSensors({
+      wheelOvercurrents: { leftWheel: true },
+      wheelSpeedsMmPerSecond: { left: 240 },
+    }), start + step * 100);
+  }
+
+  const snapshot = service.getPublicState('rover');
+  assert.equal(snapshot.motors.leftWheel.classification, 'moving');
+  assert.equal(snapshot.motors.leftWheel.stallFactor, 0);
+  assert.equal(snapshot.drive.blocked, false);
+  assert.ok(snapshot.motors.leftWheel.stress < 0.6);
+});
+
+test('partial wheel progress produces an intermediate stall factor', () => {
+  const { service } = createHarness();
+  const start = Date.now();
+  service.protectCommand('rover', 'drive', {
+    driveDirect: { left: 300, right: 300 },
+  });
+
+  for (let step = 0; step <= 5; step += 1) {
+    service.processTelemetry('rover', makeSensors({
+      wheelOvercurrents: { leftWheel: true },
+      wheelSpeedsMmPerSecond: { left: 105 },
+    }), start + step * 100);
+  }
+
+  const motor = service.getPublicState('rover').motors.leftWheel;
+  assert.equal(motor.classification, 'partial');
+  assert.ok(motor.stallFactor > 0 && motor.stallFactor < 1);
+});
+
+test('missing wheel speed remains unknown instead of becoming a full stall', () => {
+  const { service } = createHarness();
+  const start = Date.now();
+  service.protectCommand('rover', 'drive', {
+    driveDirect: { left: 300, right: 300 },
+  });
+
+  for (let step = 0; step <= 20; step += 1) {
+    service.processTelemetry('rover', makeSensors({
+      wheelOvercurrents: { leftWheel: true },
+      wheelSpeedsMmPerSecond: { left: null },
+    }), start + step * 100);
+  }
+
+  const snapshot = service.getPublicState('rover');
+  assert.equal(snapshot.motors.leftWheel.measuredSpeed, null);
+  assert.equal(snapshot.motors.leftWheel.classification, 'unknown');
+  assert.equal(snapshot.motors.leftWheel.stallFactor, 0);
+  assert.equal(snapshot.drive.blocked, false);
+});
+
+test('wheel comparison follows scaled output and resets after reversal', () => {
+  const { service } = createHarness();
+  const start = Date.now();
+  service.protectCommand('rover', 'drive', {
+    driveDirect: { left: 300, right: 300 },
+  });
+
+  for (let step = 0; step <= 8; step += 1) {
+    service.processTelemetry('rover', makeSensors({
+      wheelOvercurrents: { leftWheel: true },
+      wheelSpeedsMmPerSecond: { left: 0 },
+    }), start + step * 100);
+  }
+  const scaled = service.getPublicState('rover').motors.leftWheel.commandedSpeed;
+  assert.ok(scaled < 300);
+
+  service.protectCommand('rover', 'drive', {
+    driveDirect: { left: -300, right: -300 },
+  });
+  const reversed = service.processTelemetry('rover', makeSensors({
+    wheelOvercurrents: { leftWheel: true },
+    wheelSpeedsMmPerSecond: { left: -250 },
+  }), start + 900);
+  assert.equal(reversed.motors.leftWheel.classification, 'unknown');
+  assert.equal(reversed.motors.leftWheel.progressRatio, null);
+});
+
+test('a stopped drive stays blocked until both clear time and neutral are observed', () => {
+  const { service } = createHarness();
+  const start = Date.now();
+  service.protectCommand('rover', 'drive', {
+    driveDirect: { left: 300, right: 300 },
+  });
+  for (let step = 0; step <= 19; step += 1) {
+    service.processTelemetry('rover', makeSensors({
+      wheelOvercurrents: { leftWheel: true },
+      wheelSpeedsMmPerSecond: { left: 0 },
+    }), start + step * 100);
+  }
+
+  for (let step = 20; step <= 52; step += 1) {
+    service.processTelemetry('rover', makeSensors(), start + step * 100);
+  }
+  assert.equal(service.getPublicState('rover').drive.blocked, true);
+
+  const heldCommand = service.protectCommand('rover', 'drive', {
+    driveDirect: { left: 300, right: 300 },
+  });
+  assert.deepEqual(heldCommand.driveDirect, { left: 0, right: 0 });
+
+  service.protectCommand('rover', 'drive', {
+    driveDirect: { left: 0, right: 0 },
+  });
+  assert.equal(service.getPublicState('rover').drive.blocked, false);
+
+  const resumed = service.protectCommand('rover', 'drive', {
+    driveDirect: { left: 300, right: 300 },
+  });
+  assert.deepEqual(resumed.driveDirect, { left: 300, right: 300 });
+});
+
+test('cleared wheel stress remains visible through the hold and drains to idle', () => {
+  const { service } = createHarness();
+  const start = Date.now();
+  service.protectCommand('rover', 'drive', {
+    driveDirect: { left: 300, right: 300 },
+  });
+  service.processTelemetry('rover', makeSensors({
+    wheelOvercurrents: { leftWheel: true },
+    wheelSpeedsMmPerSecond: { left: 0 },
+  }), start);
+  service.processTelemetry('rover', makeSensors({
+    wheelOvercurrents: { leftWheel: true },
+    wheelSpeedsMmPerSecond: { left: 0 },
+  }), start + 100);
+
+  const justCleared = service.processTelemetry('rover', makeSensors(), start + 200);
+  assert.equal(justCleared.status, 'recovering');
+  assert.ok(justCleared.motors.leftWheel.stress > 0);
+
+  const held = service.processTelemetry('rover', makeSensors(), start + 800);
+  assert.equal(held.status, 'recovering');
+  assert.ok(held.motors.leftWheel.stress > 0);
+
+  const recovered = service.processTelemetry('rover', makeSensors(), start + 1000);
+  assert.equal(recovered.status, 'idle');
+  assert.equal(recovered.motors.leftWheel.stress, 0);
+});
+
+test('brush stress limits only the brush that reports overcurrent', () => {
+  const { service } = createHarness();
+  const start = Date.now();
+  service.protectCommand('rover', 'motors', {
+    motorPwm: { main: 100, side: 100, vacuum: 100 },
+  });
+  for (let step = 0; step <= 4; step += 1) {
+    service.processTelemetry('rover', makeSensors({
+      wheelOvercurrents: { mainBrush: true },
+    }), start + step * 100);
+  }
+
+  const protectedCommand = service.protectCommand('rover', 'motors', {
+    motorPwm: { main: 100, side: 100, vacuum: 100 },
+  });
+  assert.ok(protectedCommand.motorPwm.main < 100);
+  assert.equal(protectedCommand.motorPwm.side, 100);
+  assert.equal(protectedCommand.motorPwm.vacuum, 100);
+});

server/src/services/ptzCameraService/index.js

@@ -11,6 +11,10 @@ const io = require('../../globals/io');
 const logger = require('../../globals/logger').child('ptzCamera');
 const { loadConfig } = require('../../helpers/configLoader');
 const { isFeatureEnabled } = require('../../helpers/features');
+const {
+  shouldUseSnapshotsForNonTurnVideo,
+  shouldUseSnapshotsForExternalSpectatorVideo,
+} = require('../../helpers/bandwidthSavings');
 const { getMode, MODES, modeEvents } = require('../modeManager');
 const { isAdmin, isLockdownAdmin, getRole } = require('../roleService');
 const { isVerified } = require('../verificationService');
@@ -25,6 +29,16 @@ const PTZ_STREAM_PATH = 'ptz-camera';
 const DEFAULT_ONVIF_PORT = 8000;
 const DEFAULT_PROFILE_TOKEN = '003';
 const DEFAULT_TURN_DURATION_MS = 5 * 60 * 1000;
+// The TrackMix exposes pan/tilt and zoom through the same ONVIF method but does
+// not behave as if they were the same kind of motor. Pan/tilt runs smoothly from
+// one long ContinuousMove; zoom advances in command-sized increments. Keep the
+// timings separate so zoom can repeat quickly without restarting pan/tilt.
+const MOTION_WATCHDOG_MS = 650;
+const PAN_TILT_TIMEOUT_MS = 10000;
+const PAN_TILT_RENEW_MS = 8000;
+const ZOOM_PULSE_TIMEOUT_MS = 1000;
+const ZOOM_REPEAT_MS = 120;
+const STOP_MOTION = Object.freeze({ pan: 0, tilt: 0, zoom: 0 });
 // PTZ is a normal replay source now, so capture should be on unless the feature
 // explicitly disables replay for the camera.
 const DEFAULT_REPLAY_ENABLED = true;
@@ -88,6 +102,14 @@ let publisherStderrSyncTimer = null;
 let snapshotTimer = null;
 let spotlightVerifyTimer = null;
 let vendorStatePromise = Promise.resolve();
+let motionWatchdogTimer = null;
+let panTiltRenewTimer = null;
+let zoomRepeatTimer = null;
+let desiredMotion = STOP_MOTION;
+let pendingFullStopCommand = false;
+let pendingPanTiltCommand = false;
+let pendingZoomCommand = false;
+let motionCommandPromise = null;
 let lastSnapshotState = null;
 const snapshotSubscribers = new Map();
 const socketSnapshotSubscriptions = new Map();
@@ -335,6 +357,34 @@ function getChatTargetForSocket(socketId) {
   };
 }
 
+function getParticipantSocketIds() {
+  /*
+    PTZ has no roverManager record, so services that need a global "how many
+    controllable users are online" count need a tiny PTZ-owned participant list.
+    The operator and queue are the only users attached to this controllable
+    camera target; spectators merely viewing snapshots/live video are excluded.
+  */
+  return Array.from(new Set([
+    state.operatorSocketId,
+    ...state.queue,
+  ].filter(Boolean)));
+}
+
+function countControllableUsers() {
+  const ids = new Set();
+  io.sockets.sockets.forEach((candidate) => {
+    if (!candidate?.id || getRole(candidate) === 'spectator') return;
+    if (roverManager.getRoversForSocket(candidate.id).length > 0) {
+      ids.add(candidate.id);
+    }
+  });
+  getParticipantSocketIds().forEach((socketId) => {
+    const socket = io.sockets.sockets.get(socketId);
+    if (socket && getRole(socket) !== 'spectator') ids.add(socketId);
+  });
+  return ids.size;
+}
+
 function canSpeakThroughPtz(socket) {
   /*
     PTZ chat uses roverId for identity, but the camera has its own queue rather
@@ -892,7 +942,10 @@ function revokeOperator(reason = 'release') {
   state.deadline = null;
   clearTurnTimer();
   videoSessions.revokeWhere((info) => info.socketId === previous && info.sourceType === 'ptz');
-  callOnvif('stop', { profileToken: state.profileToken, panTilt: true, zoom: true }).catch(() => {});
+  // Operator handoff/disconnect must enter the same serialized stream as
+  // movement. A raw concurrent Stop could otherwise finish before an older
+  // ContinuousMove and allow that stale move to restart the camera afterward.
+  forceMotionStop(`operator-${reason}`);
   events.emit('operator', { socketId: previous, action: 'release', reason });
 }
 
@@ -1013,9 +1066,10 @@ function requirePtzUser(socket) {
 
 function requirePresetAdmin(socket) {
   /*
-    Preset creation and deletion changes shared camera state for everyone. Keep
-    that narrower than normal PTZ operation so regular camera users can only
-    choose from positions an admin has intentionally published.
+    Preset removal is intentionally narrower than normal PTZ operation because
+    deleting a shared camera position is destructive for every future operator.
+    Creation now uses requirePtzUser instead so any authorized PTZ user can save
+    a useful current position without also being allowed to remove presets.
   */
   if (!enabled) throw new Error('PTZ camera disabled');
   if (!passesMode(socket)) throw new Error('Not authorized for PTZ camera');
@@ -1056,26 +1110,235 @@ function normalizePresetCreateName(rawName) {
   return name;
 }
 
-async function move(socket, payload = {}) {
-  requireOperator(socket);
-  await initialize();
-  const x = clampUnit(payload.pan ?? payload.x);
-  const y = clampUnit(payload.tilt ?? payload.y);
-  const zoom = clampUnit(payload.zoom);
-  await callOnvif('continuousMove', {
-    profileToken: state.profileToken,
-    x,
-    y,
-    zoom,
-    timeout: 1000,
-  });
-  return { ok: true };
+function normalizeMotionIntent(payload = {}) {
+  return {
+    pan: clampUnit(payload.pan ?? payload.x),
+    tilt: clampUnit(payload.tilt ?? payload.y),
+    zoom: clampUnit(payload.zoom),
+  };
 }
 
-async function stop(socket) {
+function isMotionIdle(motion = STOP_MOTION) {
+  return !motion.pan && !motion.tilt && !motion.zoom;
+}
+
+function clearMotionWatchdog() {
+  if (!motionWatchdogTimer) return;
+  clearTimeout(motionWatchdogTimer);
+  motionWatchdogTimer = null;
+}
+
+function clearPanTiltRenewal() {
+  if (!panTiltRenewTimer) return;
+  clearTimeout(panTiltRenewTimer);
+  panTiltRenewTimer = null;
+}
+
+function clearZoomRepeat() {
+  if (!zoomRepeatTimer) return;
+  clearInterval(zoomRepeatTimer);
+  zoomRepeatTimer = null;
+}
+
+function panTiltMatches(left = STOP_MOTION, right = STOP_MOTION) {
+  return left.pan === right.pan && left.tilt === right.tilt;
+}
+
+function requestMotionCommands({ fullStop = false, panTilt = false, zoom = false } = {}) {
+  pendingFullStopCommand = pendingFullStopCommand || fullStop;
+  pendingPanTiltCommand = pendingPanTiltCommand || panTilt;
+  pendingZoomCommand = pendingZoomCommand || zoom;
+  if (
+    motionCommandPromise ||
+    (!pendingFullStopCommand && !pendingPanTiltCommand && !pendingZoomCommand)
+  ) {
+    return motionCommandPromise || Promise.resolve();
+  }
+
+  /*
+    Keep one ONVIF request in flight at a time, but coalesce independently by
+    axis. A zoom timer can tick several times while the camera answers one SOAP
+    request; one pending boolean preserves the newest required pulse without
+    building a delayed command backlog that would continue after release.
+  */
+  motionCommandPromise = (async () => {
+    while (pendingFullStopCommand || pendingPanTiltCommand || pendingZoomCommand) {
+      const sendFullStop = pendingFullStopCommand;
+      pendingFullStopCommand = false;
+      if (sendFullStop) {
+        try {
+          await initialize();
+          /*
+            Reserve ONVIF Stop for real all-axis safety events. The TrackMix
+            appears to treat even an axis-filtered Stop as global, so ordinary
+            user releases below use zero velocity instead.
+          */
+          await callOnvif('stop', {
+            profileToken: state.profileToken,
+            panTilt: true,
+            zoom: true,
+          });
+        } catch (err) {
+          logger.warn('PTZ full stop command failed', { error: getErrorMessage(err) });
+        }
+      }
+
+      const sendPanTilt = pendingPanTiltCommand;
+      pendingPanTiltCommand = false;
+      if (sendPanTilt) {
+        const pan = desiredMotion.pan;
+        const tilt = desiredMotion.tilt;
+        try {
+          await initialize();
+          if (!pan && !tilt) {
+            /*
+              Zero pan/tilt velocity stops only that axis under ContinuousMove.
+              Do not use ONVIF Stop here: this TrackMix ignores the requested
+              axis filter and can also stop zoom that is still being held.
+            */
+            await callOnvif('continuousMove', {
+              profileToken: state.profileToken,
+              x: 0,
+              y: 0,
+              onlySendPanTilt: true,
+              timeout: PAN_TILT_TIMEOUT_MS,
+            });
+          } else {
+            await callOnvif('continuousMove', {
+              profileToken: state.profileToken,
+              x: pan,
+              y: tilt,
+              onlySendPanTilt: true,
+              timeout: PAN_TILT_TIMEOUT_MS,
+            });
+          }
+        } catch (err) {
+          logger.warn('PTZ pan/tilt command failed', { error: getErrorMessage(err), pan, tilt });
+        }
+      }
+
+      const sendZoom = pendingZoomCommand;
+      pendingZoomCommand = false;
+      if (sendZoom) {
+        const zoom = desiredMotion.zoom;
+        try {
+          await initialize();
+          if (zoom) {
+            /*
+              The TrackMix does not advertise continuous zoom, but physical
+              testing showed each accepted zoom-only ContinuousMove advances one
+              step. Repeating this axis-only request restores responsive zoom
+              without resending or restarting the pan/tilt motor.
+            */
+            await callOnvif('continuousMove', {
+              profileToken: state.profileToken,
+              zoom,
+              onlySendZoom: true,
+              timeout: ZOOM_PULSE_TIMEOUT_MS,
+            });
+          }
+        } catch (err) {
+          logger.warn('PTZ zoom command failed', { error: getErrorMessage(err), zoom });
+        }
+      }
+    }
+  })().finally(() => {
+    motionCommandPromise = null;
+    // Cover an intent arriving between the loop check and promise cleanup.
+    if (pendingFullStopCommand || pendingPanTiltCommand || pendingZoomCommand) {
+      requestMotionCommands();
+    }
+  });
+
+  return motionCommandPromise;
+}
+
+function armPanTiltRenewal() {
+  clearPanTiltRenewal();
+  if (!desiredMotion.pan && !desiredMotion.tilt) return;
+  /*
+    The camera requires a finite timeout. Renew close to the ten-second limit,
+    not on every browser heartbeat, so an unusually long hold stays continuous
+    without bringing back the quarter-second motor restarts.
+  */
+  panTiltRenewTimer = setTimeout(() => {
+    panTiltRenewTimer = null;
+    requestMotionCommands({ panTilt: true });
+    armPanTiltRenewal();
+  }, PAN_TILT_RENEW_MS);
+}
+
+function syncZoomRepeater() {
+  clearZoomRepeat();
+  if (!desiredMotion.zoom) return;
+  // queueMotionIntent sends the first step once after configuring this timer;
+  // subsequent ticks retain the old fast hold cadence without a double pulse.
+  zoomRepeatTimer = setInterval(() => {
+    requestMotionCommands({ zoom: true });
+  }, ZOOM_REPEAT_MS);
+}
+
+function queueMotionIntent(motion, reason = 'input') {
+  const nextMotion = normalizeMotionIntent(motion);
+  const panTiltChanged = !panTiltMatches(nextMotion, desiredMotion);
+  const zoomChanged = nextMotion.zoom !== desiredMotion.zoom;
+  desiredMotion = nextMotion;
+  clearMotionWatchdog();
+
+  if (!isMotionIdle(nextMotion)) {
+    /*
+      Socket disconnect normally arrives quickly, but it is not a suitable motor
+      safety boundary. Every non-zero browser heartbeat replaces this timer; if
+      releases or subsequent heartbeats disappear, the server injects a zero
+      intent into the same serialized stream as ordinary control changes.
+    */
+    motionWatchdogTimer = setTimeout(() => {
+      motionWatchdogTimer = null;
+      queueMotionIntent(STOP_MOTION, 'watchdog');
+    }, MOTION_WATCHDOG_MS);
+  }
+
+  /*
+    Identical browser heartbeats refresh only the watchdog. They must not touch
+    either motor scheduler: pan/tilt already has a long continuous command, and
+    zoom has its own 120 ms axis-only repeater.
+  */
+  const sendPanTilt = panTiltChanged;
+  /*
+    A live-camera recording proved that both Stop(Zoom=true) and a zero-velocity
+    zoom ContinuousMove halt pan/tilt on this firmware. Zoom itself is step-based:
+    each non-zero pulse advances once and then settles. Releasing zoom therefore
+    means clearing its timer and any coalesced-but-unsent pulse, with no camera
+    command at all. The last transmitted pulse retains its finite one-second
+    timeout as a backstop.
+  */
+  if (zoomChanged && !nextMotion.zoom) pendingZoomCommand = false;
+  const sendZoom = Boolean(nextMotion.zoom) && zoomChanged;
+  if (sendPanTilt) armPanTiltRenewal();
+  if (sendZoom) syncZoomRepeater();
+  if (zoomChanged && !nextMotion.zoom) clearZoomRepeat();
+  const pending = requestMotionCommands({ panTilt: sendPanTilt, zoom: sendZoom });
+  pending.catch(() => {});
+  return { ok: true, motion: desiredMotion, reason };
+}
+
+function acceptMotionIntent(socket, payload = {}) {
   requireOperator(socket);
-  await callOnvif('stop', { profileToken: state.profileToken, panTilt: true, zoom: true });
-  return { ok: true };
+  return queueMotionIntent(payload, 'operator-input');
+}
+
+function forceMotionStop(reason = 'safety-stop') {
+  /*
+    Lifecycle stops force a real all-axis ONVIF Stop even when local state is
+    already zero. The browser may have lost its final packet, or the camera may
+    have accepted a command whose response has not returned, so deduplicating a
+    safety stop would trust precisely the state we are trying to recover from.
+  */
+  clearPanTiltRenewal();
+  clearZoomRepeat();
+  queueMotionIntent(STOP_MOTION, reason);
+  requestMotionCommands({ fullStop: true });
+  return motionCommandPromise || Promise.resolve();
 }
 
 async function getStatus(socket) {
@@ -1100,9 +1363,10 @@ async function gotoPreset(socket, payload = {}) {
     Stop any continuous move before jumping to a preset. Without this, a held
     key or touch control can keep sending pan/tilt velocity while the camera is
     trying to execute the absolute preset move, which makes the final position
-    feel inconsistent.
+    feel inconsistent. Await the serialized safety stop instead of issuing a
+    raw concurrent ONVIF request that could itself race an older movement.
   */
-  await callOnvif('stop', { profileToken: state.profileToken, panTilt: true, zoom: true }).catch(() => {});
+  await forceMotionStop('preset').catch(() => {});
   await callOnvif('gotoPreset', {
     profileToken: state.profileToken,
     /*
@@ -1117,7 +1381,7 @@ async function gotoPreset(socket, payload = {}) {
 }
 
 async function createPreset(socket, payload = {}) {
-  requirePresetAdmin(socket);
+  requirePtzUser(socket);
   await initialize();
   const presetName = normalizePresetCreateName(payload.name || payload.presetName);
   const options = {
@@ -1290,7 +1554,29 @@ function canRequestLiveVideo(socket) {
   if (!enabled || !passesMode(socket)) return false;
   if (state.operatorSocketId === socket?.id) return true;
   if (isAdmin(socket) || isLockdownAdmin(socket)) return true;
-  return isLocalNetwork(getSocketIp(socket));
+  const role = getRole(socket);
+  const local = isLocalNetwork(getSocketIp(socket));
+  if (role === 'spectator') {
+    /*
+      Spectator PTZ viewing follows the spectator bandwidth switch. LAN viewers
+      stay live because they do not consume server upload; non-local spectators
+      only get live PTZ when the external spectator video policy allows it.
+    */
+    return local || !shouldUseSnapshotsForExternalSpectatorVideo();
+  }
+  if (
+    canUsePtzFeature(socket) &&
+    !shouldUseSnapshotsForNonTurnVideo({ controllableUserCount: countControllableUsers() })
+  ) {
+    /*
+      Verified/VIP users who can queue or claim the camera are PTZ "turn"
+      participants even before they become operator. When non-turn video is set
+      to live, they may watch the live feed while waiting; camera movement still
+      remains limited to the active operator by the command handlers.
+    */
+    return true;
+  }
+  return false;
 }
 
 function getSnapshotPath() {
@@ -1420,18 +1706,16 @@ function registerSocketHandlers() {
         cb({ error: err.message });
       }
     });
-    socket.on('ptzCamera:move', async (firstArg, secondArg) => {
+    socket.on('ptzCamera:motion', (firstArg, secondArg) => {
       const { payload, cb } = normalizeSocketArgs(firstArg, secondArg);
       try {
-        cb(await move(socket, payload));
-      } catch (err) {
-        cb({ error: err.message });
-      }
-    });
-    socket.on('ptzCamera:stop', async (firstArg, secondArg) => {
-      const { cb } = normalizeSocketArgs(firstArg, secondArg);
-      try {
-        cb(await stop(socket));
+        /*
+          Acknowledge acceptance of the newest desired state immediately. The
+          serialized ONVIF pump deliberately runs independently of Socket.IO
+          request latency so browser heartbeats cannot accumulate while waiting
+          for a camera SOAP response.
+        */
+        cb(acceptMotionIntent(socket, payload));
       } catch (err) {
         cb({ error: err.message });
       }
@@ -1553,6 +1837,7 @@ module.exports = {
   ptzCameraEvents: events,
   getPublicState,
   getChatTargetForSocket,
+  getParticipantSocketIds,
   canSpeakThroughPtz,
   speakText,
   canRequestLiveVideo,

server/src/services/replayDeliveryService/index.js

@@ -0,0 +1,109 @@
+// Replay Delivery Service
+// Purpose: Builds each web-requested replay once and chooses Discord or automatic local hosting.
+// Scope: Keeps replay generation functional even when the optional Discord feature is disabled or unhealthy.
+const io = require('../../globals/io');
+const logger = require('../../globals/logger').child('replayDelivery');
+const { subscribe } = require('../eventBus');
+const { buildReplayVideo } = require('../replayEngineV2');
+const { hostReplay } = require('../replayMediaService');
+const {
+  createReplayJob,
+  createJobStatusEmitter,
+  buildAcceptedMessage,
+  buildStatusMessage,
+  normalizeUserError,
+} = require('./workflow');
+
+const jobStatus = createJobStatusEmitter({ io, logger, sanitizeMentions: (value) => String(value || '') });
+let preferredDeliveryProvider = null;
+
+function registerPreferredDeliveryProvider(provider) {
+  preferredDeliveryProvider = provider && typeof provider.deliver === 'function' ? provider : null;
+  return () => {
+    if (preferredDeliveryProvider === provider) preferredDeliveryProvider = null;
+  };
+}
+
+async function deliverReplay(payload = {}) {
+  const job = createReplayJob({
+    id: payload.jobId,
+    requester: payload.requester,
+    source: 'web',
+    title: payload.title,
+    sources: payload.sources,
+    includeSidebar: payload.includeSidebar,
+    requestedBy: payload.requestedBy,
+  });
+
+  jobStatus.emit(job, 'accepted', { message: buildAcceptedMessage(job) });
+  let providerContext = null;
+  try {
+    let providerError = null;
+    if (preferredDeliveryProvider?.begin) {
+      try {
+        providerContext = await preferredDeliveryProvider.begin(job);
+      } catch (err) {
+        providerError = err;
+        logger.warn('Preferred replay delivery could not start; using hosted media', { jobId: job.id, error: err.message });
+      }
+    }
+    jobStatus.emit(job, 'building', { message: buildStatusMessage(job, 'building') });
+    if (providerContext?.progressMessage?.edit) {
+      await providerContext.progressMessage.edit({ content: buildStatusMessage(job, 'building'), allowedMentions: { parse: [], repliedUser: false } }).catch(() => {});
+    }
+    const built = await buildReplayVideo({
+      sources: job.sources,
+      title: job.title,
+      requester: job.requester,
+      includeSidebar: job.includeSidebar,
+    });
+
+    let media = null;
+    if (preferredDeliveryProvider && !providerError) {
+      try {
+        jobStatus.emit(job, 'uploading', { message: buildStatusMessage(job, 'uploading') });
+        media = await preferredDeliveryProvider.deliver({ job, context: providerContext, ...built });
+      } catch (err) {
+        providerError = err;
+        if (!providerError.progressMessage && providerContext?.progressMessage) providerError.progressMessage = providerContext.progressMessage;
+        logger.warn('Preferred replay delivery failed; using hosted media', { jobId: job.id, error: err.message });
+      }
+    }
+
+    if (!media) media = await hostReplay({ buffer: built.buffer, job });
+    jobStatus.emit(job, 'ready', { message: buildStatusMessage(job, 'ready'), media });
+    if (providerError && preferredDeliveryProvider?.completeFallback) {
+      await preferredDeliveryProvider.completeFallback({ job, context: providerContext, media }).catch((err) => {
+        logger.warn('Unable to announce hosted replay fallback', { jobId: job.id, error: err.message });
+      });
+    }
+    if (providerContext?.stopTyping) providerContext.stopTyping();
+
+    // A Discord progress message may already exist when upload fails. Let the
+    // provider attach it to the error so fallback can finish that outward UI
+    // instead of leaving a permanent "uploading" message in the channel.
+    if (providerError?.progressMessage?.edit) {
+      await providerError.progressMessage.edit({ content: buildStatusMessage(job, 'ready'), allowedMentions: { parse: [], repliedUser: false } }).catch(() => {});
+    }
+    return media;
+  } catch (err) {
+    if (providerContext?.stopTyping) providerContext.stopTyping();
+    const message = normalizeUserError(err);
+    jobStatus.emit(job, 'failed', { message });
+    if (providerContext?.progressMessage?.edit) {
+      await providerContext.progressMessage.edit({ content: message, allowedMentions: { parse: [], repliedUser: false } }).catch(() => {});
+    }
+    throw err;
+  }
+}
+
+subscribe('replay.requested', (event) => {
+  deliverReplay(event?.payload || {}).catch((err) => {
+    logger.warn('Replay delivery failed', { error: err.message });
+  });
+});
+
+module.exports = {
+  deliverReplay,
+  registerPreferredDeliveryProvider,
+};

server/src/services/replayDeliveryService/workflow.js

@@ -1,6 +1,6 @@
-// Discord Replay Workflow
-// Purpose: Provides the shared replay job, Discord upload, fuzzy source lookup, and user-facing status helpers.
-// Scope: Keeps Discord-command and web-triggered replay delivery on the same status pipeline.
+// Replay Delivery Workflow
+// Purpose: Provides transport-neutral replay jobs, source lookup, status events, and user-facing progress text.
+// Scope: Keeps Discord-command and web-triggered replay delivery on the same core status pipeline.
 const Fuse = require('fuse.js');
 
 const DEFAULT_ALLOWED_MENTIONS = { parse: [], repliedUser: false };

server/src/services/replayEngineV2/replaySources.js

@@ -61,6 +61,25 @@ function validateSources(list = [], socket = null) {
 }
 
 function getDefaultWebSources(assignment = {}, socket = null) {
+  /*
+    PTZ ownership is intentionally tracked outside assignmentService because
+    taking the camera releases the user's rover assignment. Check the PTZ
+    service directly so a source-less web replay request, including `rs
+    replay`, follows the camera currently controlled by that socket just as it
+    follows an assigned rover below.
+
+    isOperator is deliberately stricter than PTZ access or queue membership:
+    spectators and users waiting for a camera turn must not silently replay a
+    camera they are not currently operating. Keeping this rule here also makes
+    every web replay entry point share the same default instead of teaching the
+    chat-command adapter about PTZ-specific state.
+  */
+  if (ptzCameraService.getPublicState(socket).isOperator) {
+    const source = ptzCameraService.getReplaySource();
+    if (!source) return [];
+    return [{ type: source.type, id: String(source.id), label: source.label || source.id }];
+  }
+
   if (assignment?.roverId) {
     const id = String(assignment.roverId);
     const match = getReplaySources(socket).find((entry) => entry.type === 'rover' && entry.id === id);

server/src/services/replayEngineV2/socketHooks.js

@@ -7,11 +7,7 @@ const { getMode, MODES } = require('../modeManager');
 const { publishEvent } = require('../eventBus');
 const assignmentService = require('../assignmentService');
 const { getNickname } = require('../nicknameService');
-const { loadConfig } = require('../../helpers/configLoader');
-const { buildReplayJobId, buildReplayTitle } = require('../discordBotService/replayWorkflow');
-
-const config = loadConfig();
-const discordConfig = config.discord || {};
+const { buildReplayJobId, buildReplayTitle } = require('../replayDeliveryService/workflow');
 
 function buildRequesterLabel(socket) {
   return getNickname(socket) || socket?.data?.user?.username || socket?.id || 'unknown';
@@ -34,11 +30,6 @@ function registerReplaySocketHooks({ tryTriggerReplay, validateSources, getDefau
         cb({ error: 'Replay disabled in lockdown', state: null });
         return;
       }
-      const channelId = discordConfig?.channels?.replay || null;
-      if (!channelId) {
-        cb({ error: 'Replay channel not configured', state: null });
-        return;
-      }
       const requestedSources = Array.isArray(payload?.sources) ? payload.sources : null;
       let sources = requestedSources ? validateSources(requestedSources, socket) : [];
       if (!sources.length) {
@@ -65,7 +56,6 @@ function registerReplaySocketHooks({ tryTriggerReplay, validateSources, getDefau
         type: 'replay.requested',
         payload: {
           jobId,
-          channelId,
           requester,
           title,
           includeSidebar,

server/src/services/replayMediaService/index.js

@@ -0,0 +1,123 @@
+// Replay Media Service
+// Purpose: Stores and serves completed replay videos when Discord delivery is unavailable.
+// Scope: Owns only final hosted MP4 files; replay frame caches and active video builds remain outside this service.
+const crypto = require('crypto');
+const fsp = require('fs/promises');
+const path = require('path');
+const logger = require('../../globals/logger').child('replayMedia');
+const { app } = require('../../globals/http');
+const { resolveDataDir } = require('../../helpers/dataPaths');
+
+const REPLAY_DIR = path.join(resolveDataDir(), 'replays');
+const MAX_AGE_MS = 6 * 60 * 60 * 1000;
+const CLEANUP_INTERVAL_MS = 30 * 60 * 1000;
+const MAX_TOTAL_BYTES = 1024 * 1024 * 1024;
+const PUBLIC_FILE_PATTERN = /^[a-f0-9]{32}\.mp4$/;
+
+async function listCompletedFiles() {
+  await fsp.mkdir(REPLAY_DIR, { recursive: true });
+  const entries = await fsp.readdir(REPLAY_DIR, { withFileTypes: true });
+  const files = [];
+  for (const entry of entries) {
+    if (!entry.isFile()) continue;
+    const filePath = path.join(REPLAY_DIR, entry.name);
+    try {
+      const stat = await fsp.stat(filePath);
+      files.push({ name: entry.name, path: filePath, size: stat.size, mtimeMs: stat.mtimeMs });
+    } catch (err) {
+      if (err.code !== 'ENOENT') logger.warn('Unable to inspect hosted replay', { file: entry.name, error: err.message });
+    }
+  }
+  return files;
+}
+
+async function cleanup() {
+  const now = Date.now();
+  const files = await listCompletedFiles();
+  const completed = files.filter((file) => PUBLIC_FILE_PATTERN.test(file.name)).sort((a, b) => a.mtimeMs - b.mtimeMs);
+  const temporary = files.filter((file) => file.name.endsWith('.tmp'));
+
+  // Temporary files are never served. An old one means a write was interrupted,
+  // so it is safe to remove after the same conservative expiry used for media.
+  const expiredTemporary = temporary.filter((file) => now - file.mtimeMs > MAX_AGE_MS);
+  const expiredCompleted = completed.filter((file) => now - file.mtimeMs > MAX_AGE_MS);
+  const toDelete = new Set([...expiredTemporary, ...expiredCompleted].map((file) => file.path));
+
+  let retainedBytes = completed.reduce((total, file) => total + file.size, 0)
+    - expiredCompleted.reduce((total, file) => total + file.size, 0);
+  for (const file of completed) {
+    if (retainedBytes <= MAX_TOTAL_BYTES) break;
+    if (toDelete.has(file.path)) continue;
+    toDelete.add(file.path);
+    retainedBytes -= file.size;
+  }
+
+  await Promise.all(Array.from(toDelete).map(async (filePath) => {
+    try {
+      await fsp.unlink(filePath);
+    } catch (err) {
+      if (err.code !== 'ENOENT') logger.warn('Unable to remove hosted replay', { file: path.basename(filePath), error: err.message });
+    }
+  }));
+}
+
+async function hostReplay({ buffer, job }) {
+  if (!Buffer.isBuffer(buffer) || !buffer.length) throw new Error('Replay output was empty');
+  await fsp.mkdir(REPLAY_DIR, { recursive: true });
+  const filename = `${crypto.randomBytes(16).toString('hex')}.mp4`;
+  const finalPath = path.join(REPLAY_DIR, filename);
+  const temporaryPath = `${finalPath}.${process.pid}.tmp`;
+
+  // Atomic rename ensures cleanup and HTTP requests can only observe a fully
+  // written MP4, never a partially flushed replay.
+  try {
+    await fsp.writeFile(temporaryPath, buffer, { flag: 'wx' });
+    await fsp.rename(temporaryPath, finalPath);
+  } catch (err) {
+    await fsp.unlink(temporaryPath).catch(() => {});
+    throw err;
+  }
+
+  return {
+    jobId: job.id,
+    status: 'ready',
+    title: job.title,
+    requester: job.requester,
+    requestedBy: job.requestedBy || null,
+    url: `/media/replays/${filename}`,
+    proxyUrl: null,
+    messageUrl: null,
+    filename,
+    size: buffer.length,
+    contentType: 'video/mp4',
+    sources: Array.isArray(job.sources) ? job.sources : [],
+    ts: Date.now(),
+  };
+}
+
+app.get('/media/replays/:filename', (req, res, next) => {
+  const filename = String(req.params.filename || '');
+  if (!PUBLIC_FILE_PATTERN.test(filename)) return res.status(404).end();
+  const filePath = path.join(REPLAY_DIR, filename);
+  // Express sendFile supports byte-range requests, which preserves seeking in
+  // the existing browser video players without implementing a second streamer.
+  res.setHeader('Cache-Control', 'private, max-age=3600');
+  return res.sendFile(filePath, { headers: { 'Content-Type': 'video/mp4' } }, (err) => {
+    if (!err || res.headersSent) return;
+    if (err.code === 'ENOENT') return res.status(404).end();
+    return next(err);
+  });
+});
+
+cleanup().catch((err) => logger.warn('Initial hosted replay cleanup failed', err.message));
+const cleanupTimer = setInterval(() => {
+  cleanup().catch((err) => logger.warn('Hosted replay cleanup failed', err.message));
+}, CLEANUP_INTERVAL_MS);
+// Maintenance must never keep a process alive during normal shutdown.
+if (typeof cleanupTimer.unref === 'function') cleanupTimer.unref();
+
+module.exports = {
+  hostReplay,
+  cleanup,
+  replayDirectory: REPLAY_DIR,
+};

server/src/services/roverManager/index.js

@@ -6,6 +6,7 @@ const logger = require('../../globals/logger').child('roverManager');
 const { sendAlert } = require('../alertService');
 const { parseSensorFrame } = require('../../helpers/sensorDecoder');
 const odometerService = require('../odometerService');
+const overcurrentProtectionService = require('../overcurrentProtectionService');
 const { MODES, getMode } = require('../modeManager');
 const { isAdmin, isLockdownAdmin, roleEvents } = require('../roleService');
 const { publishEvent } = require('../eventBus');
@@ -179,6 +180,7 @@ const sensorPipeline = createSensorPipeline({
   sendAlert,
   publishEvent,
   processOdometerFrame: odometerService.processSensorFrame,
+  processOvercurrentTelemetry: overcurrentProtectionService.processTelemetry,
   isPrivateRecord,
   isPrivateOpen,
   getPrivateSafety,
@@ -190,6 +192,18 @@ const sensorPipeline = createSensorPipeline({
 const { handleSensorFrame, applyPrivateDriveSafety } = sensorPipeline;
 stopDockGuard = sensorPipeline.stopDockGuard;
 
+managerEvents.on('rover', ({ roverId, action }) => {
+  /*
+    Protection state contains the last motor intent for a specific physical
+    rover connection. Removing it with the roster record prevents a reconnect
+    from inheriting stale stress, an old administrator bypass, or a neutral
+    requirement from the previous connection.
+  */
+  if (action === 'removed') {
+    overcurrentProtectionService.cleanupRover(roverId);
+  }
+});
+
 function removeSocket(socket) {
   roverLifecycle.removeSocket(socket, disableSpectator);
 }

server/src/services/roverManager/sensorPipeline.js

@@ -31,6 +31,7 @@ function createSensorPipeline(deps) {
     sendAlert,
     publishEvent,
     processOdometerFrame,
+    processOvercurrentTelemetry,
     isPrivateRecord,
     isPrivateOpen,
     getPrivateSafety,
@@ -551,6 +552,19 @@ function createSensorPipeline(deps) {
       };
       record.lastSensor = { raw: frame, decoded };
     }
+    /*
+      Rover manager remains responsible only for decoding and routing sensor
+      frames. The dedicated service receives the completed sensor object after
+      odometry has added measured wheel speeds, because requested-versus-actual
+      motion is the evidence that distinguishes a transient current spike from
+      a mechanically stalled wheel.
+    */
+    // Use server arrival time inside the service rather than the Pi timestamp.
+    // Raspberry Pi clocks can differ across the fleet, while command resend
+    // throttling is also measured on this server and needs one clock domain.
+    const overcurrentProtection = decoded && typeof processOvercurrentTelemetry === 'function'
+      ? processOvercurrentTelemetry(roverId, decoded)
+      : null;
     updateMovement(record, decoded);
     const hasDockInfo = decoded?.chargingSources != null;
     if (hasDockInfo) {
@@ -563,8 +577,18 @@ function createSensorPipeline(deps) {
     if (bumps?.bumpLeft || bumps?.bumpRight) record.lastBumpAt = Date.now();
     handlePrivateButtonHold(record, decoded);
     evaluatePrivateSafety(record, decoded);
-    io.to(record.room).volatile.emit('sensorFrame', { roverId, frame, sensors: decoded });
-    managerEvents.emit('sensor', { roverId, sensors: decoded, batteryState: record.batteryState });
+    io.to(record.room).volatile.emit('sensorFrame', {
+      roverId,
+      frame,
+      sensors: decoded,
+      overcurrentProtection,
+    });
+    managerEvents.emit('sensor', {
+      roverId,
+      sensors: decoded,
+      batteryState: record.batteryState,
+      overcurrentProtection,
+    });
     evaluateDockGuard(record, decoded);
   }
 

server/src/services/sessionService/index.js

@@ -3,7 +3,7 @@
 // Scope: Keeps runtime behavior unchanged while isolating responsibilities into a clear module boundary.
 const io = require('../../globals/io');
 const logger = require('../../globals/logger').child('sessionService');
-const { getRole, roleEvents } = require('../roleService');
+const { getRole, isAdmin, roleEvents } = require('../roleService');
 const { getMode, modeEvents } = require('../modeManager');
 const roverManager = require('../roverManager');
 const { managerEvents } = roverManager;
@@ -20,6 +20,10 @@ const { getState: getHomeAssistantState, homeAssistantEvents } = require('../hom
 const { getState: getNeatoState, neatoEvents } = require('../neatoService');
 const { getState: getLiftState, liftEvents } = require('../liftService');
 const { getState: getKinectState, kinectEvents } = require('../kinectService');
+const {
+  getState: getBalanceBoardState,
+  balanceBoardEvents,
+} = require('../balanceBoardService');
 const { getVoteStatus: getOverseerVoteStatus } = require('../overseerControlService');
 const { getNickname, nicknameEvents } = require('../nicknameService');
 const {
@@ -39,6 +43,15 @@ const { getAdminReason } = require('../adminReasonService');
 const { subscribe } = require('../eventBus');
 const { getSocketIp, isLocalNetwork } = require('../../helpers/ipResolver');
 const { getFeatureFlags } = require('../../helpers/features');
+const {
+  canUseExternalSpectatorAccess,
+  getBandwidthSavingsPolicy,
+  shouldUseSnapshotsForNonTurnVideo,
+} = require('../../helpers/bandwidthSavings');
+const {
+  getFeatureState,
+  getUserIdForSocket,
+} = require('../identityService');
 const { getAudioForwardState, audioForwardEvents } = require('../audioForwardService');
 const { getAudioLevels, audioLevelsEvents } = require('../audioLevelsService');
 const { getButtonBoxState } = require('../buttonBoxService');
@@ -62,6 +75,59 @@ logger.info('Discord invite loaded:', discordInvite ? 'present' : 'not configure
 logger.info('Ko-fi link loaded:', kofiLink ? 'present' : 'not configured');
 logger.info('Socials config loaded:', configuredSocials?.length ? `${configuredSocials.length} entries` : 'not configured');
 
+const SPECTATOR_ACCESS_NAMESPACE = 'spectatorAccess';
+
+function hasExternalSpectatorGrant(socket) {
+  const userId = getUserIdForSocket(socket);
+  if (!userId) return false;
+  const state = getFeatureState(userId, SPECTATOR_ACCESS_NAMESPACE, {});
+  return Boolean(state?.external);
+}
+
+function buildBandwidthSavingsSessionState(socket, controllableUserCount = 0) {
+  const policy = getBandwidthSavingsPolicy();
+  const local = isLocalNetwork(getSocketIp(socket));
+  const granted = hasExternalSpectatorGrant(socket);
+  return {
+    ...policy,
+    nonTurnVideo: {
+      ...policy.nonTurnVideo,
+      controllableUserCount,
+      snapshotsActive: shouldUseSnapshotsForNonTurnVideo({ controllableUserCount }),
+    },
+    /*
+      These derived fields let browser routes make clear UI choices without
+      re-implementing IP/admin/grant logic. The server still enforces the same
+      decisions in auth and video services, so the UI remains advisory only.
+    */
+    externalSpectatorGranted: granted,
+    canUseExternalSpectatorAccess: canUseExternalSpectatorAccess({
+      isLocal: local,
+      isAdmin: isAdmin(socket),
+      isVerified: Boolean(socket?.data?.isVerified),
+      hasGrant: granted,
+    }),
+  };
+}
+
+function countControllableUsers(userEntries = []) {
+  const ids = new Set();
+  userEntries.forEach((entry) => {
+    const role = String(entry?.role || '');
+    if (role === 'spectator') return;
+    const socketId = String(entry?.socketId || '').trim();
+    const roverId = String(entry?.roverId || '').trim();
+    /*
+      buildUserEntry already maps PTZ queued/operators to the PTZ pseudo-rover
+      id and normal drivers to their physical rover. Counting entries after that
+      normalization gives the browser the same conceptual "controllable users"
+      count it shows in the user/queue panels without duplicating PTZ UI logic.
+    */
+    if (socketId && roverId) ids.add(socketId);
+  });
+  return ids.size;
+}
+
 function buildUserEntry(socket) {
   if (!socket) return null;
   const role = getRole(socket);
@@ -86,19 +152,22 @@ function buildUserEntry(socket) {
 function buildSession(socket) {
   const overseerVote = getOverseerVoteStatus();
   const features = getFeatureFlags();
-  const users = Array.from(io.sockets.sockets.values())
+  const userEntries = Array.from(io.sockets.sockets.values())
     .map((sock) => buildUserEntry(sock))
-    .filter(Boolean)
-    .map((entry) => ({
-      ...entry,
-      /*
-        PTZ is intentionally not a roverManager record, so the normal physical
-        rover visibility filter would erase the user's PTZ chat target. Preserve
-        it here because getPtzChatTargetForSocket already applied the PTZ access
-        and queue/operator rules before buildUserEntry returned it.
-      */
-      roverId: entry.roverId === PTZ_CAMERA_ID ? entry.roverId : filterVisibleRoverId(socket, entry.roverId),
-    }));
+    .filter(Boolean);
+  const controllableUserCount = countControllableUsers(userEntries);
+  const users = userEntries.map((entry) => ({
+    ...entry,
+    /*
+      PTZ is intentionally not a roverManager record, so the normal physical
+      rover visibility filter would erase the user's PTZ chat target. Preserve
+      it here because getPtzChatTargetForSocket already applied the PTZ access
+      and queue/operator rules before buildUserEntry returned it.
+    */
+    roverId: entry.roverId === PTZ_CAMERA_ID
+      ? entry.roverId
+      : filterVisibleRoverId(socket, entry.roverId),
+  }));
   const roster = roverManager.getRosterForSocket(socket);
   const assignment = assignmentService.describeAssignment(socket?.id || '');
   const assignmentRoverId = filterVisibleRoverId(socket, assignment?.roverId);
@@ -110,6 +179,7 @@ function buildSession(socket) {
     role: getRole(socket),
     mode: getMode(),
     isLocalNetwork: isLocalNetwork(getSocketIp(socket)),
+    bandwidthSavings: buildBandwidthSavingsSessionState(socket, controllableUserCount),
     /*
       Features is the single UI contract for optional server capabilities. A
       disabled feature should be absent from navigation/layout decisions even
@@ -131,6 +201,7 @@ function buildSession(socket) {
     neato: getNeatoState(),
     lift: getLiftState(),
     kinect: getKinectState(),
+    balanceBoard: getBalanceBoardState(),
     replay: getReplayState(),
     replaySources: getReplaySources(socket),
     health: getHealthSnapshot(),
@@ -331,6 +402,14 @@ kinectEvents.on('change', () => {
   syncAll();
 });
 
+balanceBoardEvents.on('change', () => {
+  // Live weight frames use their own Socket.IO room because they change much
+  // faster than the full session. Only connection/status changes reach this
+  // listener, keeping session sync inexpensive while the panel stays current.
+  logger.info('Balance Board state change; syncing all clients');
+  syncAll();
+});
+
 replayEvents.on('update', () => {
   logger.info('Replay cooldown updated; syncing all clients');
   syncAll();

server/src/services/turnService/index.js

@@ -196,6 +196,26 @@ function canDrive(roverId, socket) {
   return activeDrivers.get(roverId) === socket.id;
 }
 
+function canRequestLiveVideo(roverId, socket) {
+  if (!socket) return false;
+  if (canDrive(roverId, socket)) return true;
+
+  const queue = driverQueues.get(roverId);
+  if (!queue || getMode() !== MODES.TURNS) {
+    return false;
+  }
+
+  /*
+    This helper is intentionally broader than canDrive(). Bandwidth saving is a
+    presentation/subscription decision for normal driver clients: the UI keeps
+    non-current drivers on snapshots, and only asks for live video when it wants
+    to warm or show the stream. The server should still verify that the socket is
+    actually attached to this rover, but it should not reject a legitimate queued
+    driver because the browser and turn timer are a few milliseconds out of sync.
+  */
+  return queue.queue.includes(socket.id);
+}
+
 function isQueuedDriver(roverId, socketId) {
   if (!socketId) return false;
   const queue = driverQueues.get(roverId);
@@ -410,6 +430,7 @@ module.exports = {
   driverRemoved,
   cleanupRover,
   canDrive,
+  canRequestLiveVideo,
   isQueuedDriver,
   getActiveDrivers,
   turnEvents,

server/src/services/verificationService/index.js

@@ -31,6 +31,7 @@ const {
   resolveUserBySelector,
   userToLegacyIdentityEntry,
 } = require('../identityService');
+const { shouldEnforceSingleDriverTab } = require('../../helpers/bandwidthSavings');
 
 const verificationEvents = new EventEmitter();
 const IDENTITY_TIMEOUT_MS = 2 * 60 * 1000;
@@ -103,7 +104,7 @@ function identifySocket(socket, payload = {}) {
     nickname: incomingNickname || getNickname(socket) || '',
   });
   refreshSocketIdentityFlags(socket);
-  enforceSingleUnverifiedSocketPerIdentity(socket);
+  enforceSingleDriverSocketPerIdentity(socket);
   emitChange('identify', { socketId: socket.id, userId: result.userId });
 
   return {
@@ -132,13 +133,18 @@ function emitDuplicateIdentityAndDisconnect(socket, payload = {}) {
   }, DUPLICATE_IDENTITY_DISCONNECT_DELAY_MS);
 }
 
-function enforceSingleUnverifiedSocketPerIdentity(currentSocket) {
+function enforceSingleDriverSocketPerIdentity(currentSocket) {
   const currentUserId = getUserIdForSocket(currentSocket);
+  const currentRole = getRole(currentSocket);
+  const enforceForCurrentSocket = shouldEnforceSingleDriverTab({
+    isVerified: Boolean(currentSocket?.data?.isVerified),
+    isAdmin: isAdminRole(currentRole),
+  });
   if (
     !currentSocket?.id ||
     !currentUserId ||
-    currentSocket.data?.isVerified ||
-    currentSocket.data?.identitySurface !== 'driver'
+    currentSocket.data?.identitySurface !== 'driver' ||
+    !enforceForCurrentSocket
   ) {
     return;
   }
@@ -150,9 +156,21 @@ function enforceSingleUnverifiedSocketPerIdentity(currentSocket) {
   });
 
   if (!duplicates.length) return;
-  const verifiedDuplicate = duplicates.find((candidate) => candidate?.data?.isVerified);
+  const verifiedDuplicate = duplicates.find((candidate) => {
+    /*
+      verifiedOnly keeps the previous "verified tab wins" rule. In notAllowed
+      mode, verified users are subject to the same single-driver-tab rule, so a
+      verified duplicate should not protect the newer socket from enforcement.
+    */
+    const candidateRole = getRole(candidate);
+    const enforceForCandidate = shouldEnforceSingleDriverTab({
+      isVerified: Boolean(candidate?.data?.isVerified),
+      isAdmin: isAdminRole(candidateRole),
+    });
+    return candidate?.data?.isVerified && !enforceForCandidate;
+  });
   if (verifiedDuplicate) {
-    logger.info('Disconnecting non-verified socket because its user is already active on a verified socket', {
+    logger.info('Disconnecting driver socket because its user is already active on an exempt verified socket', {
       socketId: currentSocket.id,
       retainedSocketId: verifiedDuplicate.id,
       userId: currentUserId,
@@ -162,7 +180,7 @@ function enforceSingleUnverifiedSocketPerIdentity(currentSocket) {
   }
 
   duplicates.forEach((duplicate) => {
-    logger.info('Disconnecting older non-verified duplicate user socket', {
+    logger.info('Disconnecting older duplicate driver socket', {
       socketId: duplicate.id,
       retainedSocketId: currentSocket.id,
       userId: currentUserId,

server/src/services/videoAuthService/index.js

@@ -30,6 +30,7 @@ const { canAccessStream } = createVideoAuthPolicy({
   ptzCameraService,
   getSocketIp,
   isLocalNetwork,
+  io,
 });
 
 registerVideoAuthRoute({

server/src/services/videoAuthService/policy.js

@@ -1,6 +1,11 @@
 // Video Auth Policy
 // Purpose: Encapsulates mode, role, and stream-specific authorization decisions for MediaMTX auth checks.
 // Scope: Evaluates viewer/publisher eligibility from normalized request context and socket/session state.
+const {
+  shouldUseSnapshotsForNonTurnVideo,
+  shouldUseSnapshotsForExternalSpectatorVideo,
+} = require('../../helpers/bandwidthSavings');
+
 function createVideoAuthPolicy(deps) {
   const {
     getMode,
@@ -14,8 +19,31 @@ function createVideoAuthPolicy(deps) {
     ptzCameraService,
     getSocketIp,
     isLocalNetwork,
+    io,
   } = deps;
 
+  function countControllableUsers() {
+    const ids = new Set();
+    io.sockets.sockets.forEach((candidate) => {
+      if (!candidate?.id || getRole(candidate) === 'spectator') return;
+      /*
+        MediaMTX can ask for authorization after a browser has already received
+        a token, so this count intentionally mirrors videoSocketService instead
+        of trusting the client-visible session policy snapshot.
+      */
+      if (roverManager.getRoversForSocket(candidate.id).length > 0) {
+        ids.add(candidate.id);
+      }
+    });
+    if (typeof ptzCameraService.getParticipantSocketIds === 'function') {
+      ptzCameraService.getParticipantSocketIds().forEach((socketId) => {
+        const socket = io.sockets.sockets.get(socketId);
+        if (socket && getRole(socket) !== 'spectator') ids.add(socketId);
+      });
+    }
+    return ids.size;
+  }
+
   function canView(socket) {
     const mode = getMode();
     if (!socket) return false;
@@ -63,7 +91,7 @@ function createVideoAuthPolicy(deps) {
     const isAudio = streamInfo.id?.endsWith('-audio');
     if (role === 'spectator' && !isAdmin(socket) && !isAudio) {
       const socketIp = getSocketIp(socket);
-      if (!isLocalNetwork(socketIp)) {
+      if (!isLocalNetwork(socketIp) && shouldUseSnapshotsForExternalSpectatorVideo()) {
         return false;
       }
     }
@@ -73,6 +101,18 @@ function createVideoAuthPolicy(deps) {
       if (!roverManager.isDriver(roverId, socket)) {
         return false;
       }
+      if (
+        !isAudio &&
+        shouldUseSnapshotsForNonTurnVideo({ controllableUserCount: countControllableUsers() }) &&
+        !turnService.canRequestLiveVideo(roverId, socket)
+      ) {
+        /*
+          This mirrors videoSocketService's token gate. MediaMTX can ask auth
+          after a token has been issued, so the same "must belong to this rover's
+          driver queue" rule has to be evaluated here too.
+        */
+        return false;
+      }
     }
 
     return true;

server/src/services/videoSocketService/index.js

@@ -8,8 +8,13 @@ const { isAdmin, isLockdownAdmin, getRole } = require('../roleService');
 const videoSessions = require('../videoSessions');
 const roverManager = require('../roverManager');
 const ptzCameraService = require('../ptzCameraService');
+const turnService = require('../turnService');
 const { loadConfig } = require('../../helpers/configLoader');
 const { getSocketIp, isLocalNetwork } = require('../../helpers/ipResolver');
+const {
+  shouldUseSnapshotsForNonTurnVideo,
+  shouldUseSnapshotsForExternalSpectatorVideo,
+} = require('../../helpers/bandwidthSavings');
 
 const config = loadConfig();
 const mediaConfig = config.media || {};
@@ -80,6 +85,29 @@ function canViewRoomCamera(socket) {
   return passesMode(socket);
 }
 
+function countControllableUsers() {
+  const ids = new Set();
+  io.sockets.sockets.forEach((candidate) => {
+    if (!candidate?.id || getRole(candidate) === 'spectator') return;
+    /*
+      Rover drivers and PTZ participants are both "controllable" users for this
+      bandwidth decision because either group can create a non-turn video view.
+      Counting unique socket ids prevents someone who is transitioning between
+      rover and PTZ from being counted twice.
+    */
+    if (roverManager.getRoversForSocket(candidate.id).length > 0) {
+      ids.add(candidate.id);
+    }
+  });
+  if (typeof ptzCameraService.getParticipantSocketIds === 'function') {
+    ptzCameraService.getParticipantSocketIds().forEach((socketId) => {
+      const socket = io.sockets.sockets.get(socketId);
+      if (socket && getRole(socket) !== 'spectator') ids.add(socketId);
+    });
+  }
+  return ids.size;
+}
+
 function normalizeRequest(payload = {}) {
   if (!payload) return null;
   if (payload.type && payload.id) {
@@ -116,10 +144,25 @@ io.on('connection', (socket) => {
         const role = getRole(socket);
         if (role === 'spectator' && !isAdmin(socket) && !isAudio) {
           const ip = getSocketIp(socket);
-          if (!isLocalNetwork(ip)) {
+          if (!isLocalNetwork(ip) && shouldUseSnapshotsForExternalSpectatorVideo()) {
             throw new Error('Not authorized for video');
           }
         }
+        if (
+          !isAudio &&
+          role !== 'spectator' &&
+          !isAdmin(socket) &&
+          shouldUseSnapshotsForNonTurnVideo({ controllableUserCount: countControllableUsers() }) &&
+          !turnService.canRequestLiveVideo(baseId, socket)
+        ) {
+          /*
+            The browser owns the snapshot-vs-live presentation for queued rover
+            drivers. The server side only verifies that the socket belongs to
+            this rover's driver queue so legitimate warm-up/switch requests are
+            not rejected by small turn-timer timing differences.
+          */
+          throw new Error('Live video is limited to this rover queue');
+        }
       } else if (target.type === 'room') {
         throw new Error('Room cameras now use the snapshot feed');
       } else if (target.type === 'ptz') {

to-do.md

@@ -1,12 +1,15 @@
-1. improve spectator page, options on what to see and what not to see
-2. assign rovers based on battery percentage, give people highest one
-3. add config to disable client snapshot forcing, disable bandwidth saving
-4. add admin ui for VIP and private requests instead of only through discord
-5. pull page / tab title from session, use the name from profile of interinstance if enabled, if not just default to old one
-6. make overcurrent limiter speed sensitive, slower fill at lower speeds
-7. add feature chat commands, like /neato start, /lift up, etc
-8. add more background gap themes
-9.  fix this:
+1. assign rovers based on battery percentage, give people highest one
+2. add admin ui for VIP and private requests instead of only through discord
+3. add flag in roverd for video aspect ratio
+   1. maybe dont? whats the point anyway? why do we exist at all? is there purpose to life?
+      1. just removing the black bars, doesnt do anything practical for the driver page
+      2. would only actually help for keeping spectate page compact
+         1. maybe just make the spectate videos be fixed width and match the height of the media
+   2. either 4:3 or 16:9
+   3. default is 4:3
+   4. all it does is tell the web UI to make the rover video 16:9 or 4:3 shaped
+      1. web UI should default to 4:3 if that rover doesnt yet have that config yet
+4.  fix this:
 `Jun 18 15:14:18 roombaserver.local node[216731]: /home/daniel/MultiRoombaRover/server/src/services/roverManager/socketHandlers.js:92
 Jun 18 15:14:18 roombaserver.local node[216731]:         cb({ error: err.message });
 Jun 18 15:14:18 roombaserver.local node[216731]:         ^

webui/src/App.jsx

@@ -15,6 +15,7 @@ import {
 } from './controls/index.js';
 import RoomCameraPanel from './components/RoomCameraPanel/index.jsx';
 import KinectPanel from './components/KinectPanel/index.jsx';
+import BalanceBoardPanel from './components/BalanceBoardPanel/index.jsx';
 import DriverVideo from './components/DriverVideo/index.jsx';
 import RightPaneTabs from './components/RightPaneTabs/index.jsx';
 import ModeGateOverlay from './components/ModeGateOverlay/index.jsx';
@@ -50,38 +51,14 @@ import NeatoCard from './components/NeatoCard/index.jsx';
 import RewardRunOverlay from './components/RewardRunOverlay/index.jsx';
 import SocketConnectionPill from './components/SocketConnectionPill/index.jsx';
 import DuplicateIdentityOverlay from './components/DuplicateIdentityOverlay/index.jsx';
-import { pageBackgroundClass, themeGapClass, themeStackClass } from './themeFlags.js';
+import {
+  DEFAULT_PAGE_THEME_KEY,
+  getPageThemeClass,
+  themeGapClass,
+  themeStackClass,
+} from './themes/index.js';
 import { trackAnalyticsEvent } from './analytics/index.js';
-
-function useLayoutMode() {
-  const [mode, setMode] = useState(() => {
-    if (typeof window === 'undefined') return 'desktop';
-    return window.innerWidth >= 1024
-      ? 'desktop'
-      : window.innerWidth > window.innerHeight
-      ? 'mobile-landscape'
-      : 'mobile-portrait';
-  });
-
-  useEffect(() => {
-    function updateMode() {
-      if (typeof window === 'undefined') return;
-      const { innerWidth, innerHeight } = window;
-      if (innerWidth >= 1024) {
-        setMode('desktop');
-      } else if (innerWidth > innerHeight) {
-        setMode('mobile-landscape');
-      } else {
-        setMode('mobile-portrait');
-      }
-    }
-    updateMode();
-    window.addEventListener('resize', updateMode);
-    return () => window.removeEventListener('resize', updateMode);
-  }, []);
-
-  return mode;
-}
+import useLayoutMode from './hooks/useLayoutMode.js';
 
 function DesktopLayout({ layout, onOpenHelpOverlay }) {
   return (
@@ -200,6 +177,7 @@ function MobileFeatureTabs({
             <div className={`flex flex-col ${themeGapClass}`}>
               <NeatoCard />
               <LiftCard />
+              <BalanceBoardPanel />
               <BarcodeGamesPanel />
               <OdometerPanel />
               <ButtonBoxPanel />
@@ -307,6 +285,12 @@ function App() {
   const layout = useLayoutMode();
   const isDesktop = layout === 'desktop';
   const fullscreen = useFullscreenPrompt(layout);
+  const { value: pageSettings } = useSettingsNamespace('page', {
+    backgroundTheme: DEFAULT_PAGE_THEME_KEY,
+  });
+  // Resolve the cookie value through the shared catalog before painting the page. This prevents
+  // an obsolete or hand-edited key from stripping the background class from every exposed seam.
+  const pageBackgroundClass = getPageThemeClass(pageSettings?.backgroundTheme);
 
   return (
     <div className={`${pageBackgroundClass} text-slate-100 ${isDesktop ? 'h-screen overflow-hidden' : 'ios-safe-screen min-h-screen'}`}>

webui/src/components/AdminPanel/AdminPanelContent.jsx

@@ -69,6 +69,7 @@ export default function AdminPanelContent() {
     setAdminReason,
     rebootRover,
     updateRover,
+    updateAllRovers,
     rebootServer,
     setAudioLevels,
     setPrivateSafety,
@@ -181,6 +182,35 @@ export default function AdminPanelContent() {
     }
   };
 
+  const handleUpdateAll = async () => {
+    const roverCount = roster.filter((rover) => rover?.id).length;
+    if (roverCount === 0) return;
+
+    const ok = window.confirm(
+      `Update all ${roverCount} rover${roverCount === 1 ? '' : 's'} now? Each rover will run its self-update and reboot if the update starts successfully.`,
+    );
+    if (!ok) return;
+
+    trackAnalyticsEvent('rover_update_all_click', { roverCount });
+    try {
+      // The server owns the fan-out because it has the authoritative online
+      // rover map and can enforce admin privileges once before issuing the
+      // existing per-rover update command to every connected rover.
+      const result = await updateAllRovers();
+      trackAnalyticsEvent('rover_update_all_result', {
+        status: 'accepted',
+        updated: result?.updated?.length || 0,
+        failed: result?.failed?.length || 0,
+      });
+      if (result?.failed?.length) {
+        alert(`Update requested for ${result.updated?.length || 0} rover(s). ${result.failed.length} rover(s) failed to queue.`);
+      }
+    } catch (err) {
+      trackAnalyticsEvent('rover_update_all_result', { status: 'failed', reason: err?.message || 'unknown' });
+      alert(err.message);
+    }
+  };
+
   const handleServerReboot = async () => {
     const ok = window.confirm('Reboot the server host now? This will disconnect all users.');
     if (!ok) return;
@@ -487,6 +517,17 @@ export default function AdminPanelContent() {
         </div>
       </div>
 
+      <div className="flex items-center justify-between gap-0.5 text-xs">
+        <span className="text-slate-400">Rovers</span>
+        <button
+          type="button"
+          onClick={handleUpdateAll}
+          disabled={roster.length === 0}
+          className="button-danger disabled:cursor-not-allowed disabled:opacity-60"
+        >
+          Update All
+        </button>
+      </div>
       <RoverRoster
         roster={roster}
         renderActions={(rover) => (

webui/src/components/BalanceBoardPanel/index.jsx

@@ -0,0 +1,269 @@
+// Balance Board Panel
+// Purpose: Shows exactly what the Bluetooth board is doing and its current total weight.
+// Scope: Owns optional feature gating and the live weight-frame subscription only.
+import { useEffect, useState } from 'react';
+import { useSocket } from '../../context/SocketContext.jsx';
+import { useSessionSelector } from '../../context/SessionContext.jsx';
+import { isFeatureEnabled } from '../../lib/features.js';
+import CardFrame from '../CardFrame/index.jsx';
+
+const EMPTY_CORNERS = {
+  topLeft: 0,
+  topRight: 0,
+  bottomLeft: 0,
+  bottomRight: 0,
+};
+const EMPTY_FRAME = {
+  totalKg: 0,
+  batteryPercent: null,
+  // Null distinguishes "no live frame received yet" from a legitimate record
+  // of zero, allowing the persisted session value to remain visible while the
+  // socket room subscription is being established.
+  recordKg: null,
+  recordedAt: null,
+  corners: EMPTY_CORNERS,
+};
+
+function formatWeight(value) {
+  const weight = Number(value);
+  return Number.isFinite(weight) ? `${weight.toFixed(2)} kg` : '0.00 kg';
+}
+
+function finiteNumber(value) {
+  if (value == null || value === '') return null;
+  const number = Number(value);
+  return Number.isFinite(number) ? number : null;
+}
+
+function centerOfPressure(corners) {
+  const topLeft = Math.max(0, finiteNumber(corners.topLeft) || 0);
+  const topRight = Math.max(0, finiteNumber(corners.topRight) || 0);
+  const bottomLeft = Math.max(0, finiteNumber(corners.bottomLeft) || 0);
+  const bottomRight = Math.max(0, finiteNumber(corners.bottomRight) || 0);
+  const total = topLeft + topRight + bottomLeft + bottomRight;
+
+  // Only an exact zero stays centered because dividing by zero cannot produce a
+  // position. Every positive reading participates immediately, with no minimum
+  // weight or center deadzone hiding small shifts reported by the load cells.
+  if (total === 0) return { left: 50, top: 50, active: false };
+  const horizontal = ((topRight + bottomRight) - (topLeft + bottomLeft)) / total;
+  const vertical = ((bottomLeft + bottomRight) - (topLeft + topRight)) / total;
+  return {
+    left: 50 + Math.max(-1, Math.min(1, horizontal)) * 37,
+    top: 50 + Math.max(-1, Math.min(1, vertical)) * 37,
+    active: true,
+  };
+}
+
+function CornerReading({ className, label, value }) {
+  return (
+    <div className={`surface absolute min-w-[5.5rem] text-center ${className}`}>
+      <div className="text-[0.62rem] text-slate-400">{label}</div>
+      <div className="text-sm font-semibold text-slate-100">{formatWeight(value)}</div>
+    </div>
+  );
+}
+
+export default function BalanceBoardPanel() {
+  const enabled = useSessionSelector((state) => isFeatureEnabled(state, 'balanceBoard'));
+  // Keep feature ownership inside the component so layouts do not need special
+  // cases or empty wrappers when the optional hardware is disabled.
+  if (!enabled) return null;
+  return <BalanceBoardPanelContent />;
+}
+
+function BalanceBoardPanelContent() {
+  const socket = useSocket();
+  const board = useSessionSelector((state) => state.session?.balanceBoard || null);
+  const role = useSessionSelector((state) => state.session?.role || null);
+  const [frame, setFrame] = useState(EMPTY_FRAME);
+  const [unpairing, setUnpairing] = useState(false);
+  const [zeroRequesting, setZeroRequesting] = useState(false);
+  const [resettingRecord, setResettingRecord] = useState(false);
+
+  useEffect(() => {
+    if (!socket) return undefined;
+    const handleFrame = (next = {}) => setFrame({ ...EMPTY_FRAME, ...next });
+
+    // Socket.IO room membership belongs to one server-side connection, not to
+    // the long-lived browser socket object. A brief network interruption gives
+    // the browser a new server-side socket while React keeps this component and
+    // this effect mounted, so subscribing only here would silently lose all
+    // later weight frames. Rejoin after every connection as well as immediately
+    // for the already-connected case.
+    const subscribe = () => {
+      socket.emit('balanceBoard:subscribe', {}, () => {});
+    };
+
+    socket.on('balanceBoard:frame', handleFrame);
+    socket.on('connect', subscribe);
+    subscribe();
+
+    return () => {
+      socket.off('balanceBoard:frame', handleFrame);
+      socket.off('connect', subscribe);
+      // The panel is the only consumer represented by this component. Leaving
+      // the room on unmount prevents an inactive route or tab from continuing
+      // to receive the board's continuous measurement stream.
+      socket.emit('balanceBoard:unsubscribe');
+    };
+  }, [socket]);
+
+  // Mask the previous reading immediately when disconnected. Keeping the last
+  // socket frame in state avoids effect-driven state resets and stale flashes.
+  const liveFrame = board?.connected ? frame : EMPTY_FRAME;
+  const corners = { ...EMPTY_CORNERS, ...(liveFrame.corners || {}) };
+  const center = centerOfPressure(corners);
+  const liveBattery = finiteNumber(liveFrame.batteryPercent);
+  const sessionBattery = finiteNumber(board?.batteryPercent);
+  const battery = liveBattery ?? sessionBattery;
+  // Live frames make a newly reached record move immediately. The session copy
+  // remains available while the board sleeps or before this panel subscribes,
+  // which is important because the record belongs to the installation rather
+  // than to one Bluetooth connection.
+  const liveRecord = board?.connected ? finiteNumber(frame.recordKg) : null;
+  const sessionRecord = finiteNumber(board?.recordKg);
+  const record = liveRecord ?? sessionRecord ?? 0;
+  const sleeping = board?.status === 'sleeping';
+  const isAdmin = role === 'admin' || role === 'lockdown';
+  const calibration = board?.calibration || null;
+  const zeroing = Boolean(calibration?.active);
+
+  const zero = () => {
+    if (zeroRequesting || zeroing || !board?.connected) return;
+    if (!window.confirm('Use the board’s current load as zero? Keep everything still for ten seconds.')) return;
+    setZeroRequesting(true);
+    socket.emit('balanceBoard:zero', {}, (response = {}) => {
+      setZeroRequesting(false);
+      if (response.error) window.alert(response.error);
+    });
+  };
+
+  const unpair = () => {
+    if (unpairing || !board?.paired) return;
+    if (!window.confirm('Unpair this Balance Board and require the red Sync button to pair it again?')) return;
+    setUnpairing(true);
+    socket.emit('balanceBoard:unpair', {}, (response = {}) => {
+      setUnpairing(false);
+      if (response.error) {
+        window.alert(response.error);
+      } else if (response.warning) {
+        window.alert('Board forgotten locally, but BlueZ reported a bond-removal warning.');
+      }
+    });
+  };
+
+  const resetRecord = () => {
+    if (resettingRecord) return;
+    if (!window.confirm('Reset the highest weight record?')) return;
+    setResettingRecord(true);
+    socket.emit('balanceBoard:resetRecord', {}, (response = {}) => {
+      setResettingRecord(false);
+      if (response.error) window.alert(response.error);
+    });
+  };
+
+  const actions = isAdmin ? (
+    <div className="flex items-center gap-0.5">
+      <button
+        type="button"
+        className="button-dark text-xs disabled:opacity-50"
+        disabled={!board?.connected || zeroRequesting || zeroing || unpairing}
+        onClick={zero}
+      >
+        {zeroing
+          ? `Zeroing ${calibration.samplesCollected}/${calibration.totalSamples}`
+          : zeroRequesting ? 'Starting…' : 'Zero'}
+      </button>
+      <button
+        type="button"
+        className="button-dark text-xs disabled:opacity-50"
+        disabled={!board?.paired || unpairing || zeroing}
+        onClick={unpair}
+      >
+        {unpairing ? 'Unpairing…' : 'Unpair'}
+      </button>
+    </div>
+  ) : null;
+
+  return (
+    <CardFrame
+      title="Balance Board"
+      className="relative w-full"
+      bodyClassName="text-sm text-slate-200"
+      actions={actions}
+    >
+      {sleeping ? (
+        <div className="absolute inset-0 z-20 flex items-center justify-center rounded-md bg-slate-950/85 px-2 text-center">
+          <div className="space-y-0.5">
+            <p className="text-lg font-semibold text-slate-100">The Balance Board is asleep</p>
+            <p className="text-sm text-slate-300">Press the front power button on the board to wake it.</p>
+          </div>
+        </div>
+      ) : null}
+
+      {/* Keep the measurement column narrow and fixed so the board remains the
+          dominant visual while record and battery stay in one predictable
+          place. Both pieces use the shared dark panel treatment instead of
+          introducing a Balance Board-specific background style. */}
+      <div className="grid grid-cols-[minmax(0,1fr)_8rem] gap-0.5">
+        <div className="panel-section relative h-52 overflow-hidden">
+          {zeroing ? (
+            <div className="absolute inset-0 z-20 flex items-center justify-center bg-neutral-950/90 px-2 text-center">
+              <div className="space-y-0.5">
+                <p className="text-lg font-semibold text-slate-100">
+                  Zeroing {calibration.samplesCollected}/{calibration.totalSamples}
+                </p>
+                <p className="text-sm text-slate-300">Keep the board and everything on it still.</p>
+              </div>
+            </div>
+          ) : null}
+          <CornerReading className="left-0.5 top-0.5" label="Top left" value={corners.topLeft} />
+          <CornerReading className="right-0.5 top-0.5" label="Top right" value={corners.topRight} />
+          <CornerReading className="bottom-0.5 left-0.5" label="Bottom left" value={corners.bottomLeft} />
+          <CornerReading className="bottom-0.5 right-0.5" label="Bottom right" value={corners.bottomRight} />
+          <div
+            aria-label="Center of pressure"
+            className={`absolute z-10 h-3 w-3 -translate-x-1/2 -translate-y-1/2 rounded-full border transition-all duration-100 ${
+              center.active
+                ? 'border-sky-200 bg-sky-500'
+                : 'border-neutral-500 bg-neutral-600 opacity-50'
+            }`}
+            style={{ left: `${center.left}%`, top: `${center.top}%` }}
+          />
+          <div className="pointer-events-none absolute inset-0 flex items-center justify-center">
+            <div className="surface px-1 py-0.5 text-center">
+              <div className="text-[0.65rem] text-slate-400">Total weight</div>
+              <div className="text-3xl font-bold leading-none text-white">
+                {formatWeight(liveFrame.totalKg)}
+              </div>
+            </div>
+          </div>
+        </div>
+
+        <div className="grid h-52 grid-rows-[minmax(0,1fr)_auto] gap-0.5">
+          <div className="panel-section flex min-h-0 flex-col items-center justify-center gap-1 text-center">
+            <div className="text-xs text-slate-400">Weight record</div>
+            <div className="text-xl font-bold text-white">{formatWeight(record)}</div>
+            {isAdmin ? (
+              <button
+                type="button"
+                className="button-dark text-xs disabled:opacity-50"
+                disabled={resettingRecord}
+                onClick={resetRecord}
+              >
+                {resettingRecord ? 'Resetting…' : 'Reset'}
+              </button>
+            ) : null}
+          </div>
+          <div className="panel-section px-1 py-1 text-center">
+            <div className="text-xs text-slate-400">Battery</div>
+            <div className="text-xl font-semibold text-slate-100">
+              {battery == null ? '—' : `${Math.round(battery)}%`}
+            </div>
+          </div>
+        </div>
+      </div>
+    </CardFrame>
+  );
+}

webui/src/components/ChatPanel/index.jsx

@@ -6,6 +6,7 @@ import { memo, useEffect, useMemo, useRef, useState } from 'react';
 import { useChatActions, useChatTimeline } from '../../context/ChatContext.jsx';
 import { useSessionSelector } from '../../context/SessionContext.jsx';
 import { useSettingsNamespace } from '../../settings/index.js';
+import useChatMessageHistoryNavigation from '../../hooks/useChatMessageHistoryNavigation.js';
 import ChatMessageRow from '../ChatMessageRow/index.jsx';
 import CardFrame from '../CardFrame/index.jsx';
 import NicknameForm from '../NicknameForm/index.jsx';
@@ -260,6 +261,7 @@ function ChatComposer({
   const [draft, setDraft] = useState('');
   const [sending, setSending] = useState(false);
   const [speak, setSpeak] = useState(true);
+  const { navigateHistory, resetHistoryNavigation } = useChatMessageHistoryNavigation();
   const effectiveSpeak = ttsSupported && speak;
   const ttsPayload = useMemo(() => {
     if (!effectiveSpeak) return null;
@@ -291,6 +293,7 @@ function ChatComposer({
     try {
       await sendMessage(clean, ttsPayload);
       setDraft('');
+      resetHistoryNavigation();
       blurChat();
       setTypingActive(false);
     } catch (err) {
@@ -314,6 +317,9 @@ function ChatComposer({
         value={draft}
         onChange={(event) => {
           const next = event.target.value;
+          // A direct edit starts a fresh history traversal. This prevents an
+          // old ArrowDown position from overwriting text the user just typed.
+          resetHistoryNavigation();
           setDraft(next);
           setTypingActive(Boolean(next.trim()));
         }}
@@ -326,6 +332,15 @@ function ChatComposer({
           setTypingActive(false);
         }}
         onKeyDown={(event) => {
+          if (event.key === 'ArrowUp' || event.key === 'ArrowDown') {
+            const recalledDraft = navigateHistory(event.key === 'ArrowUp' ? 'previous' : 'next', draft);
+            if (recalledDraft !== null) {
+              event.preventDefault();
+              setDraft(recalledDraft);
+              setTypingActive(Boolean(recalledDraft.trim()));
+            }
+            return;
+          }
           if (event.key === 'Enter' && !draft.trim()) {
             event.preventDefault();
             blurChat();

webui/src/components/HomeAssistantControls/index.jsx

@@ -187,9 +187,13 @@ function HomeAssistantControlsContent() {
   const ha = useSessionSelector((state) => state.session?.homeAssistant || null);
   const { homeAssistantToggle, homeAssistantSetLightColor, homeAssistantSetLightWhite } =
     useSessionActions();
+  const role = useSessionSelector((state) => state.session?.role || null);
+  const mode = useSessionSelector((state) => state.session?.mode || null);
   const entities = useMemo(() => ha?.entities || [], [ha?.entities]);
   const lightPolicy = ha?.lightPolicy || null;
-  const controlsLocked = Boolean(lightPolicy?.locked || lightPolicy?.lockedOn);
+  const adminCanControlLockedLights = role === 'lockdown' || (role === 'admin' && mode !== 'lockdown');
+  const lightPolicyLocked = Boolean(lightPolicy?.locked || lightPolicy?.lockedOn);
+  const controlsLocked = lightPolicyLocked && !adminCanControlLockedLights;
   const lockState = lightPolicy?.lockState || (lightPolicy?.lockedOn ? 'on' : null);
   const onKeyLabel = formatKeyLabel(keymap?.homeAssistantOn?.[0]);
   const offKeyLabel = formatKeyLabel(keymap?.homeAssistantOff?.[0]);
@@ -224,18 +228,22 @@ function HomeAssistantControlsContent() {
           {offKeyLabel ? <KeyPill label={offKeyLabel} /> : null}
         </span>
       </div>
-      {controlsLocked ? <StatusBadge label={lockState === 'off' ? 'Locked Off' : 'Locked On'} tone="warn" /> : null}
+      {lightPolicyLocked ? <StatusBadge label={lockState === 'off' ? 'Locked Off' : 'Locked On'} tone="warn" /> : null}
       <StatusBadge label={connected ? 'Connected' : 'Offline'} tone={connected ? 'success' : 'warn'} />
     </>
   );
 
   return (
     <CardFrame title="Room Controls" actions={actions} bodyClassName="space-y-0.5 text-base">
-      {controlsLocked ? (
+      {lightPolicyLocked ? (
         <p className="rounded border border-amber-600/60 bg-amber-900/40 px-1 py-0.5 text-xs text-amber-100">
-          {lockState === 'off'
-            ? 'Lights are locked off. Room controls are disabled.'
-            : 'Lights are locked on. Room controls are disabled.'}
+          {adminCanControlLockedLights
+            ? lockState === 'off'
+              ? 'Lights are locked off. Admin room controls remain available.'
+              : 'Lights are locked on. Admin room controls remain available.'
+            : lockState === 'off'
+              ? 'Lights are locked off. Room controls are disabled.'
+              : 'Lights are locked on. Room controls are disabled.'}
         </p>
       ) : null}
       <div className="grid grid-cols-1 gap-0.5 sm:grid-cols-2 lg:grid-cols-3">

webui/src/components/HudOverlays/HudChatInput/index.jsx

@@ -5,6 +5,7 @@ import { memo, useMemo, useState } from 'react';
 import { useChatActions } from '../../../context/ChatContext.jsx';
 import { useSessionSelector } from '../../../context/SessionContext.jsx';
 import { useSettingsNamespace } from '../../../settings/index.js';
+import useChatMessageHistoryNavigation from '../../../hooks/useChatMessageHistoryNavigation.js';
 
 function detectSafari() {
   if (typeof navigator === 'undefined') return false;
@@ -42,6 +43,7 @@ function HudChatInput({ compact = false }) {
   });
   const [draft, setDraft] = useState('');
   const [sending, setSending] = useState(false);
+  const { navigateHistory, resetHistoryNavigation } = useChatMessageHistoryNavigation();
   const canChat = role !== 'spectator';
   const hideHudChat = role === 'spectator';
   const chatTargetId = useMemo(() => {
@@ -118,6 +120,7 @@ function HudChatInput({ compact = false }) {
     try {
       await sendMessage(clean, ttsPayload);
       setDraft('');
+      resetHistoryNavigation();
       blurChat();
       setTypingActive(false);
     } catch (err) {
@@ -136,6 +139,9 @@ function HudChatInput({ compact = false }) {
         value={draft}
         onChange={(event) => {
           const next = event.target.value;
+          // Keep HUD navigation independent from the panel's cursor even
+          // though both inputs read the same persisted message collection.
+          resetHistoryNavigation();
           setDraft(next);
           setTypingActive(Boolean(next.trim()));
         }}
@@ -148,6 +154,15 @@ function HudChatInput({ compact = false }) {
           setTypingActive(false);
         }}
         onKeyDown={(event) => {
+          if (event.key === 'ArrowUp' || event.key === 'ArrowDown') {
+            const recalledDraft = navigateHistory(event.key === 'ArrowUp' ? 'previous' : 'next', draft);
+            if (recalledDraft !== null) {
+              event.preventDefault();
+              setDraft(recalledDraft);
+              setTypingActive(Boolean(recalledDraft.trim()));
+            }
+            return;
+          }
           if (event.key === 'Enter' && !draft.trim()) {
             event.preventDefault();
             blurChat();

webui/src/components/HudOverlays/OvercurrentOverlay/index.jsx

@@ -1,63 +1,74 @@
 // Overcurrent Overlay
-// Purpose: Defines the Overcurrent Overlay module and the local helpers/components used in this file.
-// Scope: Keeps behavior unchanged while isolating this concern into a clear, single-responsibility unit.
-import React from 'react';
-import { useMemo } from 'react';
+// Purpose: Shows server-authoritative motor limiting, stop, recovery, and administrator-bypass status.
+// Scope: Renders protection state only; it never calculates stress or changes motor commands.
+
+import React, { useMemo } from 'react';
 import { useSessionSelector } from '../../../context/SessionContext.jsx';
-import { useVisualTelemetrySelector } from '../../../context/TelemetryContext.jsx';
-import { overcurrentFlagsEqual, selectOvercurrentFlags } from '../../../context/telemetryViews.js';
 import { useOvercurrentLimiter } from '../../../controls/index.js';
 import { OVERCURRENT_LABELS } from './constants.js';
 
-function OvercurrentOverlay({ roverId = null, sensors, overcurrentLimiter = null, compact = false }) {
+function OvercurrentOverlay({ roverId = null, overcurrentLimiter = null, compact = false }) {
   const assignedRoverId = useSessionSelector((state) => state.session?.assignment?.roverId ?? null);
   const effectiveRoverId = roverId ?? assignedRoverId;
-  const selectedOvercurrents = useVisualTelemetrySelector(effectiveRoverId, selectOvercurrentFlags, overcurrentFlagsEqual);
   const internalLimiter = useOvercurrentLimiter(effectiveRoverId);
-  const resolvedOvercurrents = sensors?.wheelOvercurrents ?? selectedOvercurrents;
-  const resolvedOvercurrentLimiter = overcurrentLimiter ?? internalLimiter ?? null;
-  const overcurrentMotors = useMemo(
-    () =>
-      resolvedOvercurrents == null
-        ? []
-        : Object.entries(resolvedOvercurrents)
-            .filter(([, active]) => Boolean(active))
-            .map(([key]) => key),
-    [resolvedOvercurrents],
+  const protection = overcurrentLimiter ?? internalLimiter;
+  const status = protection?.status || 'idle';
+  const motors = protection?.motors || {};
+  const activeMotors = useMemo(
+    () => Object.entries(motors)
+      .filter(([, motor]) => Boolean(motor?.overcurrent) || Number(motor?.stress) > 0)
+      .map(([key]) => key),
+    [motors],
   );
-  const limiterCaps = resolvedOvercurrentLimiter?.caps || null;
-  const limiterFill = useMemo(() => {
-    if (!limiterCaps) return null;
-    const driveCap = Number.isFinite(limiterCaps?.drive?.cap) ? limiterCaps.drive.cap : 1;
-    const auxCap = Number.isFinite(limiterCaps?.aux?.cap) ? limiterCaps.aux.cap : 1;
-    return Math.max(0, Math.min(1, 1 - Math.min(driveCap, auxCap)));
-  }, [limiterCaps]);
-  const limiterActive = Boolean(resolvedOvercurrentLimiter?.isActive);
-  const motors = useMemo(
-    () => (overcurrentMotors.length ? overcurrentMotors : limiterActive ? ['limiter'] : []),
-    [overcurrentMotors, limiterActive],
-  );
-  const fill = limiterFill ?? (overcurrentMotors.length ? 1 : 0);
 
-  if (!motors?.length) return null;
-  const safeLabels = motors.map((name) => OVERCURRENT_LABELS[name] || name);
-  const containerClass = compact ? 'w-[12rem] h-[3.5rem]' : 'w-[20rem] h-[7rem]';
-  const padClass = compact ? 'px-2 py-1' : 'px-4 py-2';
-  const textClass = compact ? 'text-lg' : 'text-4xl';
-  const subTextClass = compact ? 'text-xs' : 'text-xl';
-  const safeFill = Math.max(0, Math.min(1, fill));
-  const fillWidth = `${Math.round(safeFill * 100)}%`;
+  if (status === 'idle') return null;
+
+  const stopReason = protection?.drive?.stopReason;
+  const displayMotors = stopReason ? [stopReason] : activeMotors;
+  const labels = displayMotors.map((name) => OVERCURRENT_LABELS[name] || name);
+  const highestStress = displayMotors.reduce(
+    (highest, name) => Math.max(highest, Number(motors?.[name]?.stress) || 0),
+    0,
+  );
+  const driveCap = Number.isFinite(protection?.drive?.cap) ? protection.drive.cap : 1;
+  const fillWidth = `${Math.round(Math.max(0, Math.min(1, highestStress)) * 100)}%`;
+  const bypassed = status === 'bypassed';
+  const stopped = status === 'stopped';
+  const title = bypassed
+    ? 'Overcurrent detected'
+    : stopped
+      ? 'Drive stopped'
+      : status === 'recovering'
+        ? 'Protection recovering'
+        : status === 'limiting'
+          ? 'Overcurrent limiting'
+          : 'Overcurrent detected';
+  const detail = bypassed
+    ? 'Admin bypass'
+    : stopped && protection?.drive?.requiresNeutral
+      ? `${labels.join(', ') || 'Wheel stall'} · release controls to resume`
+      : status === 'limiting'
+        ? `${labels.join(', ')} · output ${Math.round(driveCap * 100)}%`
+        : labels.join(', ');
+  const containerClass = bypassed
+    ? 'h-[3.5rem] w-[14rem]'
+    : compact
+      ? 'h-[3.5rem] w-[14rem]'
+      : 'h-[7rem] w-[22rem]';
+  const titleClass = compact || bypassed ? 'text-base' : 'text-3xl';
+  const detailClass = compact || bypassed ? 'text-xs' : 'text-base';
+  const backgroundClass = bypassed ? 'bg-amber-950/75' : 'bg-red-950/70';
+  const fillClass = bypassed ? 'bg-amber-700/50' : 'bg-red-700/60';
+
   return (
     <div
-      className={`pointer-events-none absolute flex items-center justify-center bg-red-900/50 top-1/2 left-1/2 -translate-x-1/2 -translate-y-1/2 ${containerClass}`}
+      className={`pointer-events-none absolute left-1/2 top-1/2 flex -translate-x-1/2 -translate-y-1/2 items-center justify-center ${backgroundClass} ${containerClass}`}
     >
-      <div className="relative h-full w-full">
-        <div className="absolute inset-0 overflow-hidden">
-          <div className="h-full bg-red-700/60" style={{ width: fillWidth }} />
-        </div>
-        <div className={`relative z-10 flex h-full w-full flex-col items-center justify-center text-center font-semibold text-white animate-pulse ${textClass} ${padClass}`}>
-          <div>OVERCURRENT</div>
-          <div className={`mt-0 font-medium text-white ${subTextClass}`}>{safeLabels.join(', ')}</div>
+      <div className="relative h-full w-full overflow-hidden">
+        <div className={`absolute inset-y-0 left-0 ${fillClass}`} style={{ width: fillWidth }} />
+        <div className="relative z-10 flex h-full flex-col items-center justify-center px-2 text-center font-semibold text-white">
+          <div className={titleClass}>{title}</div>
+          <div className={`font-medium ${detailClass}`}>{detail}</div>
         </div>
       </div>
     </div>

webui/src/components/InterInstancePanel/index.jsx

@@ -1,7 +1,7 @@
 // Inter Instance Panel
 // Purpose: Renders remote rover servers discovered through the inter-instance directory.
 // Scope: Owns external server metadata presentation while reusing RoverQueuesPanel for rover/queue rows.
-import { useMemo, useState } from 'react';
+import { useMemo } from 'react';
 import { useSessionSelector } from '../../context/SessionContext.jsx';
 import CardFrame from '../CardFrame/index.jsx';
 import RoverQueuesPanel from '../RoverQueuesPanel/index.jsx';
@@ -133,45 +133,52 @@ function RemoteMediaStrip({ remote }) {
   );
 }
 
-export function ExternalInstancesCompact() {
-  const [expanded, setExpanded] = useState(false);
-  const [popupOpen, setPopupOpen] = useState(false);
+export function ExternalInstancesCompact({ onBrowse = null }) {
   const enabled = useInterInstanceEnabled();
   const instances = useRemoteInstances();
   const visible = useMemo(() => instances.filter((remote) => remote?.online || remote?.url), [instances]);
   if (!enabled) return null;
   if (!visible.length) return null;
+  const browseAction = onBrowse ? (
+    <button type="button" className="button-dark" onClick={onBrowse}>
+      Browse Servers
+    </button>
+  ) : null;
   return (
-    <div className="space-y-0.5">
-      <div className="grid grid-cols-2 gap-0.5">
-        <button type="button" className="button-dark w-full" onClick={() => setExpanded((value) => !value)}>
-          {expanded ? 'Hide external' : `Show external (${visible.length})`}
-        </button>
-        <button type="button" className="button-dark w-full" onClick={() => setPopupOpen(true)}>
-          Browse servers
-        </button>
-      </div>
-      {expanded ? (
-        <div className="space-y-0.5">
-          {visible.map((remote) =>
-            remote.online ? (
-              <RoverQueuesPanel
-                key={remote.url}
-                title={remote.instance?.name || remote.url}
-                roster={remote.roster}
-                turnQueues={remote.turnQueues}
-                users={remote.users}
-                externalInstance={remote}
-                disabledOverlay={getRemoteAvailability(remote).blocked ? getRemoteAvailability(remote).overlay : ''}
-              />
-            ) : (
-              <InstancePanel key={remote.url} remote={remote} />
-            ),
-          )}
-        </div>
-      ) : null}
-      {popupOpen ? <InterInstancePopup onClose={() => setPopupOpen(false)} /> : null}
-    </div>
+    /*
+      External instances are intentionally always mounted. Besides removing an
+      unnecessary disclosure click, this preserves the live queue rows while
+      the local Rover Queues card can provide one continuous scroll surface for
+      both its local and external rows. Scrolling belongs to that owning panel,
+      so this nested section deliberately keeps its natural content height.
+    */
+    <CardFrame
+      title="External servers below:"
+      actions={browseAction}
+      bodyClassName="space-y-0.5 text-sm"
+    >
+      {/*
+        One containing card gives the remote-server collection a clear boundary
+        below the local rover rows. Individual remote queue cards stay intact
+        inside it because they still own each server's title and operational
+        status, while this outer title bar owns the collection-wide browser.
+      */}
+      {visible.map((remote) =>
+        remote.online ? (
+          <RoverQueuesPanel
+            key={remote.url}
+            title={remote.instance?.name || remote.url}
+            roster={remote.roster}
+            turnQueues={remote.turnQueues}
+            users={remote.users}
+            externalInstance={remote}
+            disabledOverlay={getRemoteAvailability(remote).blocked ? getRemoteAvailability(remote).overlay : ''}
+          />
+        ) : (
+          <InstancePanel key={remote.url} remote={remote} />
+        ),
+      )}
+    </CardFrame>
   );
 }
 
@@ -180,8 +187,9 @@ export function InterInstancePopup({ onClose }) {
     <div className="fixed inset-0 z-[70] flex items-center justify-center bg-black/80 p-0.5">
       <InterInstanceBrowserFrame
         onClose={onClose}
-        className="max-w-[calc(100vw-0.5rem)]"
-        bodyClassName="max-h-[82vh] overflow-y-auto p-0.5"
+        scaledOverlay
+        className="inter-instance-overlay-frame"
+        bodyClassName="inter-instance-overlay-body overflow-y-auto p-0.5"
       />
     </div>
   );
@@ -226,6 +234,7 @@ export function InterInstanceBrowserFrame({
   className = '',
   bodyClassName = 'p-0.5',
   centered = false,
+  scaledOverlay = false,
 }) {
   const enabled = useInterInstanceEnabled();
   const instances = useRemoteInstances();
@@ -245,7 +254,7 @@ export function InterInstanceBrowserFrame({
     <CardFrame
       title="External instances"
       actions={actions}
-      className={className}
+      className={classNames(scaledOverlay && 'inter-instance-overlay-scale', className)}
       bodyClassName={bodyClassName}
       clipOverflow={false}
     >

webui/src/components/MobileControls/ControlPadPanel.jsx

@@ -148,13 +148,25 @@ export default function ControlPadPanel({ compact = false, disabled = false }) {
     return () => {
       clearRepeatTimer();
       /*
-        Mobile controls can unmount when layouts change or the driver leaves the
-        control surface. Clear the shared flag so a stale mobile precision choice
-        cannot leave desktop/keyboard camera tilt in fine-step mode.
+        Mobile controls can unmount during an orientation/layout change while a
+        pointer is still captured by the disappearing element. Publish a neutral
+        vector directly during cleanup so neither rover drive nor PTZ pan/tilt
+        can retain the last cell merely because pointerup had nowhere to land.
       */
+      activeCellRef.current = null;
+      setDriveVector({ x: 0, y: 0, boost: false }, { source: SOURCE });
+      registerInputState(SOURCE, {
+        keys: [],
+        vector: { x: 0, y: 0, boost: false },
+        activeCell: 'stop',
+        speedMode: speedModeRef.current,
+        lastEvent: 'unmount',
+      });
+      // Clear the shared flag too, so a stale mobile precision choice cannot
+      // leave desktop/keyboard camera tilt in fine-step mode.
       setCameraPrecisionMode(false);
     };
-  }, [clearRepeatTimer, setCameraPrecisionMode]);
+  }, [clearRepeatTimer, registerInputState, setCameraPrecisionMode, setDriveVector]);
 
   useEffect(() => {
     if (!disabled) return;

webui/src/components/ModeGateOverlay/index.jsx

@@ -102,8 +102,9 @@ export default function ModeGateOverlay() {
           */
           <InterInstanceBrowserFrame
             hideWhenEmpty
-            className="max-w-[calc(100vw-0.5rem)]"
-            bodyClassName="max-h-[86vh] overflow-y-auto p-0.5"
+            scaledOverlay
+            className="inter-instance-overlay-frame"
+            bodyClassName="inter-instance-overlay-body overflow-y-auto p-0.5"
           />
         ) : null}
       </div>

webui/src/components/OvercurrentLimiterPanel/index.jsx

@@ -1,14 +1,15 @@
-// Overcurrent Limiter Panel
-// Purpose: Defines the Overcurrent Limiter Panel module and the local helpers/components used in this file.
-// Scope: Keeps behavior unchanged while isolating this concern into a clear, single-responsibility unit.
-import { useMemo } from 'react';
+// Overcurrent Protection Panel
+// Purpose: Presents detailed server-calculated motor stress and command-tracking diagnostics.
+// Scope: Read-only status surface for the assigned rover; protection and recovery remain server-owned.
+
 import { useControlSelector } from '../../controls/index.js';
-import { OVERCURRENT_GROUPS } from '../../controls/overcurrentLimiter.js';
 import CardFrame from '../CardFrame/index.jsx';
 
-const GROUP_LABELS = {
-  drive: 'Drive wheels',
-  aux: 'Aux motors',
+const MOTOR_LABELS = {
+  leftWheel: 'Left wheel',
+  rightWheel: 'Right wheel',
+  mainBrush: 'Main brush',
+  sideBrush: 'Side brush',
 };
 
 function formatPct(value) {
@@ -16,8 +17,20 @@ function formatPct(value) {
   return `${Math.round(value * 100)}%`;
 }
 
+function formatSpeed(value) {
+  if (!Number.isFinite(value)) return '--';
+  return `${Math.round(value)} mm/s`;
+}
+
+function formatClassification(value) {
+  if (value === 'stalled') return 'Stalled';
+  if (value === 'partial') return 'Partial';
+  if (value === 'moving') return 'Moving';
+  return 'Unknown';
+}
+
 function ProgressBar({ value, color = 'bg-emerald-500' }) {
-  const width = `${Math.round(Math.max(0, Math.min(1, value)) * 100)}%`;
+  const width = `${Math.round(Math.max(0, Math.min(1, Number(value) || 0)) * 100)}%`;
   return (
     <div className="h-2 w-full overflow-hidden rounded bg-slate-800">
       <div className={`h-full ${color}`} style={{ width }} />
@@ -25,51 +38,74 @@ function ProgressBar({ value, color = 'bg-emerald-500' }) {
   );
 }
 
+function statusLabel(protection) {
+  if (protection?.adminImmune) return 'Admin bypass';
+  if (protection?.status === 'stopped') return 'Drive stopped';
+  if (protection?.status === 'limiting') return 'Limiting';
+  if (protection?.status === 'overcurrent') return 'Overcurrent detected';
+  if (protection?.status === 'recovering') return 'Recovering';
+  return 'Ready';
+}
+
 export default function OvercurrentLimiterPanel() {
   const roverId = useControlSelector((control) => control.state.roverId);
-  const overcurrentLimiter = useControlSelector((control) => control.overcurrentLimiter);
-  const groups = useMemo(() => OVERCURRENT_GROUPS.map((group) => group.key), []);
+  const protection = useControlSelector((control) => control.overcurrentLimiter);
+  const motors = protection?.motors || {};
 
   return (
     <CardFrame
-      title="Overcurrent limiter"
-      meta={overcurrentLimiter?.adminImmune ? 'Admin immune' : 'Active'}
-      bodyClassName="space-y-0.5 text-sm"
+      title="Overcurrent protection"
+      meta={statusLabel(protection)}
+      bodyClassName="space-y-1 text-sm"
     >
       {!roverId ? (
-        <p className="text-xs text-slate-500">Assign a rover to view limiter status.</p>
+        <p className="text-xs text-slate-500">Assign a rover to view protection status.</p>
       ) : (
-        <div className="space-y-0.5">
-          {groups.map((key) => {
-            const cap = overcurrentLimiter?.caps?.[key]?.cap ?? 0;
-            const over = overcurrentLimiter?.overcurrent?.groups?.[key] ?? false;
-            const scale = overcurrentLimiter?.scales?.perGroup?.[key] ?? 1;
+        <div className="space-y-1">
+          {Object.entries(MOTOR_LABELS).map(([key, label]) => {
+            const motor = motors[key] || {};
+            const wheel = key === 'leftWheel' || key === 'rightWheel';
             return (
-              <div key={key} className="space-y-0.5">
+              <div key={key} className="space-y-0.5 border-b border-slate-800 pb-1 last:border-0">
                 <div className="flex items-center justify-between text-xs">
-                  <span className="text-slate-200">{GROUP_LABELS[key] || key}</span>
-                  <span className={over ? 'text-red-300' : 'text-slate-400'}>
-                    {over ? 'overcurrent' : 'ok'}
+                  <span className="text-slate-200">{label}</span>
+                  <span className={motor.overcurrent ? 'text-red-300' : 'text-slate-400'}>
+                    {motor.overcurrent ? 'Overcurrent' : 'Clear'}
                   </span>
                 </div>
-                <div className="space-y-0.5">
-                  <div className="flex items-center justify-between text-[0.7rem] text-slate-400">
-                    <span>Cap</span>
-                    <span>{formatPct(cap)}</span>
-                  </div>
-                  <ProgressBar value={cap} color="bg-amber-500" />
-                  <div className="flex items-center justify-between text-[0.7rem] text-slate-400">
-                    <span>Scale</span>
-                    <span>{formatPct(scale)}</span>
-                  </div>
+                <div className="flex items-center justify-between text-[0.7rem] text-slate-400">
+                  <span>Stress {formatPct(motor.stress)}</span>
+                  <span>Output {formatPct(motor.cap)}</span>
                 </div>
+                <ProgressBar
+                  value={motor.stress}
+                  color={motor.overcurrent ? 'bg-red-500' : 'bg-amber-500'}
+                />
+                {wheel ? (
+                  <div className="grid grid-cols-2 gap-1 text-[0.65rem] text-slate-500">
+                    <span>{`Command ${formatSpeed(Math.abs(Number(motor.commandedSpeed)))}`}</span>
+                    <span>{`Measured ${formatSpeed(motor.measuredSpeed)}`}</span>
+                    <span>{`Progress ${formatPct(motor.progressRatio)}`}</span>
+                    <span>{`${formatClassification(motor.classification)} · stall ${formatPct(motor.stallFactor)}`}</span>
+                  </div>
+                ) : null}
               </div>
             );
           })}
+          {protection?.drive?.blocked ? (
+            <p className="text-xs text-red-300">
+              {protection.drive.requiresNeutral
+                ? 'Drive is stopped. Release controls to neutral before resuming.'
+                : 'Drive is stopped while the wheel condition clears.'}
+            </p>
+          ) : null}
           <div className="text-[0.7rem] text-slate-400">
-            <div>{`Down rate ${overcurrentLimiter?.config?.downRatePerSec}/s · Up rate ${overcurrentLimiter?.config?.upRatePerSec}/s`}</div>
-            <div>{`Release delay ${overcurrentLimiter?.config?.releaseDelaySec}s`}</div>
-            <div>{`Output rate ${overcurrentLimiter?.config?.outputRateMs}ms`}</div>
+            <div>{`Drive output ${formatPct(protection?.drive?.cap)}`}</div>
+            <div>
+              {protection?.adminImmune
+                ? 'This session bypasses all overcurrent enforcement.'
+                : 'Status and output limits are calculated by the server.'}
+            </div>
           </div>
         </div>
       )}

webui/src/components/PiHostStatsCard/index.jsx

@@ -35,6 +35,8 @@ const PLACEHOLDER_STATS = Object.freeze({
     qualityMax: 70,
     rxBitrateMbit: 72.2,
     txBitrateMbit: 58.5,
+    downloadMbps: 12.4,
+    uploadMbps: 3.7,
     rxBytes: 12400000,
     txBytes: 2300000,
     rxPackets: 12640,
@@ -304,14 +306,22 @@ export default function PiHostStatsCard() {
 
         <section className="min-w-0 space-y-0.5">
           <ColumnTitle label="WiFi" />
-          <div className="surface grid min-w-0 grid-cols-[minmax(0,1fr)_auto] items-start gap-1">
-            <div className="min-w-0">
-              <div className="truncate text-base leading-tight text-slate-100">SSID: {valueOrDash(wifi.ssidSample)}</div>
-              <div className="text-xs text-slate-400">{formatFrequency(wifi.frequencyMhz)}</div>
+          <div className="grid min-w-0 grid-cols-2 gap-0.5">
+            <div className="surface grid min-w-0 grid-cols-[minmax(0,1fr)_auto] items-start gap-1">
+              <div className="min-w-0">
+                <div className="truncate text-base leading-tight text-slate-100">SSID: {valueOrDash(wifi.ssidSample)}</div>
+                <div className="text-xs text-slate-400">{formatFrequency(wifi.frequencyMhz)}</div>
+              </div>
+              <div className="text-right">
+                <div className={`font-semibold leading-tight ${toneTextClass(currentSignalTone)}`}>{formatDbm(wifi.signalDbm)}</div>
+                <SignalBars bars={bars} tone={currentSignalTone} />
+              </div>
             </div>
-            <div className="text-right">
-              <div className={`font-semibold leading-tight ${toneTextClass(currentSignalTone)}`}>{formatDbm(wifi.signalDbm)}</div>
-              <SignalBars bars={bars} tone={currentSignalTone} />
+            <div className="surface flex min-w-0 flex-col justify-center gap-0.5 text-xs">
+              {/* Actual traffic belongs beside connection identity and signal,
+                  while negotiated link rates remain in their existing rows. */}
+              <ThroughputRow label="Download" value={formatBitrate(wifi.downloadMbps)} />
+              <ThroughputRow label="Upload" value={formatBitrate(wifi.uploadMbps)} />
             </div>
           </div>
           <BarRow
@@ -347,6 +357,15 @@ function StatRow({ label, value, compact = false, valueClassName = 'text-slate-1
   );
 }
 
+function ThroughputRow({ label, value }) {
+  return (
+    <div className="flex min-w-0 items-center justify-between gap-1">
+      <span className="shrink-0 text-slate-400">{label}</span>
+      <span className="min-w-0 truncate text-right text-slate-100">{value}</span>
+    </div>
+  );
+}
+
 function BarRow({ label, value, detail = null, percent, tone = 'neutral' }) {
   return (
     <div className="surface">

webui/src/components/PtzCamera/index.jsx

@@ -1,14 +1,16 @@
 // PTZ Camera UI
 // Purpose: Integrates the single PTZ camera into the main rover UI flow as a
 // queueable controllable target instead of a VIP-panel card.
-// Scope: Owns PTZ entry card and fullscreen composition; PTZ command authority,
-// queue ownership, and stream authorization remain server-owned.
+// Scope: Owns the driver-page PTZ entry card and the dedicated PTZ route
+// composition; PTZ command authority, queue ownership, and stream authorization
+// remain server-owned.
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
-import { createPortal } from 'react-dom';
+import { useNavigate } from 'react-router-dom';
 import CardFrame from '../CardFrame/index.jsx';
 import ChatPanel from '../ChatPanel/index.jsx';
 import ControlPadPanel from '../MobileControls/ControlPadPanel.jsx';
 import GPIOToggleControl from '../GPIOToggleControl/index.jsx';
+import HomeAssistantControls from '../HomeAssistantControls/index.jsx';
 import PtzLiveVideo, { PTZ_CAMERA_ID } from '../PtzLiveVideo/index.jsx';
 import ReplaySourcesPanel from '../ReplaySourcesPanel/index.jsx';
 import QueueTargetRow, { QueueUserChips } from '../QueueTargetRow/index.jsx';
@@ -21,6 +23,8 @@ import { usePtzCameraSnapshots } from '../../hooks/usePtzCameraSnapshot.js';
 import { useSharedClock } from '../../hooks/useSharedClock.js';
 import { isFeatureEnabled } from '../../lib/features.js';
 import { trackAnalyticsEvent } from '../../analytics/index.js';
+import { useSettingsNamespace } from '../../settings/index.js';
+import { DEFAULT_PAGE_THEME_KEY, getPageThemeClass } from '../../themes/index.js';
 
 const PTZ_DEFAULT_COLOR = '#38bdf8';
 
@@ -116,45 +120,6 @@ function PtzSnapshotPreview({ feed, label = 'PTZ Camera', className = 'h-full w-
   );
 }
 
-function StatusRow({ label, value, tone = '' }) {
-  return (
-    <div className="flex items-center justify-between gap-1 text-xs">
-      <span className="text-slate-400">{label}</span>
-      <span className={`min-w-0 truncate font-medium ${tone || 'text-slate-100'}`}>{value}</span>
-    </div>
-  );
-}
-
-function PtzStatePanel({ ptz, compact = false }) {
-  const now = useSharedClock(1000, Boolean(ptz?.deadline));
-  const spotlightOn = isSpotlightOn(ptz?.light);
-  const irMode = normalizeIrMode(ptz?.ir?.state);
-  const publisher = ptz?.publisher || {};
-  const publisherStatus = publisher.running
-    ? 'running'
-    : publisher.restartAt
-    ? 'restarting'
-    : publisher.lastEvent || 'stopped';
-  const mode = ptz?.isOperator ? 'operator' : ptz?.queuedPosition ? `queued ${ptz.queuedPosition}` : 'spectator';
-
-  return (
-    <CardFrame title="Camera state" bodyClassName="space-y-0.5 p-1 text-sm">
-      <StatusRow label="Mode" value={mode} tone={ptz?.isOperator ? 'text-emerald-300' : ''} />
-      <StatusRow label="Operator" value={ptz?.operatorLabel || 'none'} />
-      <StatusRow label="Remaining" value={formatRemaining(ptz?.deadline, now)} />
-      <StatusRow label="Spotlight" value={spotlightOn ? 'On' : 'Off'} tone={spotlightOn ? 'text-emerald-300' : 'text-slate-200'} />
-      <StatusRow label="Infrared mode" value={irMode} />
-      <StatusRow label="Stream" value={ptz?.status || ptz?.error || 'idle'} tone={ptz?.error ? 'text-amber-300' : ''} />
-      {!compact ? <StatusRow label="Transcoder" value={publisherStatus} tone={publisher.running ? 'text-emerald-300' : 'text-amber-300'} /> : null}
-      {ptz?.blocked?.message ? (
-        <div className="rounded border border-amber-500/50 bg-amber-950/40 p-1 text-xs text-amber-100">
-          {ptz.blocked.message}
-        </div>
-      ) : null}
-    </CardFrame>
-  );
-}
-
 function PtzQueueSummary({ ptz, title = 'PTZ queue' }) {
   const selfId = useSessionSelector((state) => state.session?.socketId || null);
   const lookupUser = usePtzQueueLookup(ptz);
@@ -223,41 +188,30 @@ function PtzLightingControls({ ptz, disabled = false }) {
 }
 
 function PtzMobileZoomButtons({ disabled = false }) {
-  const { nudgeServo, stopAllMotion } = useControlActions();
-  const repeatTimerRef = useRef(null);
+  const { setCameraAxisIntent } = useControlActions();
 
   const stopZoom = useCallback(() => {
     /*
-      Mobile zoom is intentionally routed through the normal camera-up/down
-      control action instead of emitting PTZ socket commands directly. That
-      keeps the zoom buttons on the same path as keyboard/gamepad camera tilt,
-      and the PTZ adapter remains the one place that translates "camera nudge"
-      into Reolink zoom pulses.
+      Zero only releases the zoom axis. The PTZ adapter combines it with any
+      pan/tilt direction still held on the movement pad, so lifting one finger
+      cannot erase the other finger's intent.
     */
-    if (repeatTimerRef.current) {
-      clearInterval(repeatTimerRef.current);
-      repeatTimerRef.current = null;
-    }
-    stopAllMotion();
-  }, [stopAllMotion]);
+    setCameraAxisIntent(0);
+  }, [setCameraAxisIntent]);
 
   const startZoom = useCallback(
     (direction) => (event) => {
       /*
-        Send an immediate nudge and then repeat while held. The adapter turns
-        each nudge into a short zoom pulse, so repeating the standard action is
-        the simplest way to get continuous hold-to-zoom without adding another
-        PTZ-specific command loop.
+        Publish held state once. The adapter owns the single motion heartbeat,
+        so this button no longer creates a second interval whose queued callback
+        could run after pointerup and restart zoom.
       */
       event.preventDefault();
       if (disabled) return;
-      stopZoom();
-      nudgeServo(direction);
-      repeatTimerRef.current = setInterval(() => {
-        nudgeServo(direction);
-      }, 120);
+      event.currentTarget.setPointerCapture?.(event.pointerId);
+      setCameraAxisIntent(direction);
     },
-    [disabled, nudgeServo, stopZoom],
+    [disabled, setCameraAxisIntent],
   );
   const stopFromPointer = useCallback(
     (event) => {
@@ -272,16 +226,12 @@ function PtzMobileZoomButtons({ disabled = false }) {
     () => () => {
       /*
         A touch surface can unmount during orientation changes or fullscreen
-        close while a pointer is still down. Clear the repeat timer here so a
-        held zoom button cannot keep firing camera-up/down actions after the
-        mobile controls have disappeared.
+        close while a pointer is still down. Explicitly clear zoom here because
+        an unmounted DOM node cannot deliver its pointerup/pointercancel event.
       */
-      if (repeatTimerRef.current) {
-        clearInterval(repeatTimerRef.current);
-        repeatTimerRef.current = null;
-      }
+      setCameraAxisIntent(0);
     },
-    [],
+    [setCameraAxisIntent],
   );
 
   return (
@@ -293,7 +243,7 @@ function PtzMobileZoomButtons({ disabled = false }) {
         onPointerDown={startZoom(-1)}
         onPointerUp={stopFromPointer}
         onPointerCancel={stopFromPointer}
-        onPointerLeave={stopFromPointer}
+        onLostPointerCapture={stopFromPointer}
         onContextMenu={(event) => event.preventDefault()}
       >
         Zoom out
@@ -305,7 +255,7 @@ function PtzMobileZoomButtons({ disabled = false }) {
         onPointerDown={startZoom(1)}
         onPointerUp={stopFromPointer}
         onPointerCancel={stopFromPointer}
-        onPointerLeave={stopFromPointer}
+        onLostPointerCapture={stopFromPointer}
         onContextMenu={(event) => event.preventDefault()}
       >
         Zoom in
@@ -372,6 +322,7 @@ function PtzPresetPanel({ ptz }) {
   const [busy, setBusy] = useState('');
   const presets = Array.isArray(ptz?.presets) ? ptz.presets : [];
   const isPresetAdmin = role === 'admin' || role === 'lockdown';
+  const canCreatePreset = Boolean(ptz?.canUse);
   const canMoveToPreset = Boolean(ptz?.isOperator);
 
   const refreshPresets = async () => {
@@ -410,13 +361,14 @@ function PtzPresetPanel({ ptz }) {
   const createPreset = async (event) => {
     event.preventDefault();
     const trimmed = name.trim();
-    if (!isPresetAdmin || busy || !trimmed) return;
+    if (!canCreatePreset || busy || !trimmed) return;
     setBusy('create');
     try {
       /*
         ONVIF setPreset stores the camera's current physical position. The UI
-        only sends the admin's label; the server supplies the active profile
-        token so browser code does not need to know camera profile internals.
+        only sends the user's label; the server supplies the active profile
+        token so browser code does not need camera profile internals, and the
+        server still enforces the PTZ feature gate for raw socket callers.
       */
       await ptzCreatePreset({ name: trimmed });
       setName('');
@@ -461,15 +413,20 @@ function PtzPresetPanel({ ptz }) {
           {ptz.presetsError}
         </div>
       ) : null}
-      <div className="min-h-0 flex-1 space-y-0.5 overflow-y-auto">
+      <div className="flex min-h-0 flex-1 flex-wrap content-start items-start gap-0.5 overflow-y-auto">
+        {/*
+          Presets should behave like a compact pile of actions, not a table.
+          flex-wrap lets each preset keep its natural button width and only
+          starts a new visual line when the current line runs out of room.
+        */}
         {presets.length ? presets.map((preset) => {
           const gotoBusy = busy === `goto:${preset.token}`;
           const removeBusy = busy === `remove:${preset.token}`;
           return (
-            <div key={preset.token} className="surface grid grid-cols-[minmax(0,1fr)_auto] items-center gap-1">
+            <div key={preset.token} className="surface inline-flex max-w-full items-center gap-1">
               <button
                 type="button"
-                className="button-dark min-w-0 truncate text-left text-xs disabled:opacity-50"
+                className="button-dark min-w-0 max-w-40 truncate text-left text-xs disabled:opacity-50"
                 disabled={!canMoveToPreset || Boolean(busy)}
                 onClick={() => goToPreset(preset)}
                 title={canMoveToPreset ? `Move to ${preset.name}` : 'Your PTZ turn must be active'}
@@ -494,10 +451,10 @@ function PtzPresetPanel({ ptz }) {
           </div>
         )}
       </div>
-      {isPresetAdmin ? (
+      {canCreatePreset ? (
         <form className="grid grid-cols-[minmax(0,1fr)_auto] gap-1" onSubmit={createPreset}>
           <input
-            className="min-w-0 rounded border border-slate-700 bg-black px-2 py-1 text-xs text-slate-100 outline-none focus:border-cyan-300"
+            className="field-input min-w-0 text-xs"
             value={name}
             maxLength={60}
             disabled={Boolean(busy)}
@@ -533,13 +490,32 @@ function buildPtzTurnModel(ptz, selfId) {
 
 function PtzMediaPane({ ptz, open, framed = true }) {
   const isOperator = Boolean(ptz?.isOperator);
+  const isParticipant = Boolean(isOperator || ptz?.queuedPosition);
+  const nonTurnSnapshotsActive = useSessionSelector(
+    (state) => Boolean(state.session?.bandwidthSavings?.nonTurnVideo?.snapshotsActive),
+  );
   const selfId = useSessionSelector((state) => state.session?.socketId || null);
-  const snapshotFeeds = usePtzCameraSnapshots([PTZ_CAMERA_ID], { enabled: open && !isOperator });
+  /*
+    PTZ has its own turn queue, so non-operators are the camera equivalent of a
+    non-active rover driver. The server enforces the same policy in
+    canRequestLiveVideo(); this branch only chooses the expected browser render
+    path and never unlocks movement controls.
+  */
+  /*
+    A direct /ptz load renders before its automatic queue claim is acknowledged.
+    Do not mount the live player during that short pre-claim window: its first
+    token request would correctly be rejected, and PtzLiveVideo intentionally
+    treats authorization rejection as a terminal snapshot fallback. Once the
+    session confirms queue/operator membership, mounting the player creates a
+    fresh authorized request without changing shared retry or server policy.
+  */
+  const shouldUseLiveVideo = isParticipant && (isOperator || !nonTurnSnapshotsActive);
+  const snapshotFeeds = usePtzCameraSnapshots([PTZ_CAMERA_ID], { enabled: open && !shouldUseLiveVideo });
   const snapshot = snapshotFeeds[PTZ_CAMERA_ID] || null;
   const turnModel = useMemo(() => buildPtzTurnModel(ptz, selfId), [ptz, selfId]);
   const media = (
     <>
-      {isOperator ? (
+      {shouldUseLiveVideo ? (
         <PtzLiveVideo enabled={open} startMuted={false} />
       ) : (
         <PtzSnapshotPreview feed={snapshot} label={ptz?.name || 'PTZ Camera'} />
@@ -568,7 +544,10 @@ function PtzDesktopFullscreen({ ptz, releasePending }) {
         <main className="min-h-0 shrink-0 overflow-hidden bg-black" style={{ aspectRatio: '16 / 9' }}>
           <PtzMediaPane ptz={ptz} open framed />
         </main>
-        <aside className="flex min-h-0 min-w-56 flex-1 flex-col gap-0.5 overflow-y-auto bg-neutral-950 text-sm">
+        {/* Keep the sidebar itself transparent. Its child cards still own their dark surfaces,
+            while the shared PTZ page theme can show through the same compact gaps as the driver
+            layout instead of being covered by one solid sidebar rectangle. */}
+        <aside className="flex min-h-0 min-w-56 flex-1 flex-col gap-0.5 overflow-y-auto text-sm">
           <PtzQueueSummary ptz={ptz} />
           {ptz?.isOperator ? (
             <PtzLightingControls ptz={ptz} />
@@ -578,8 +557,13 @@ function PtzDesktopFullscreen({ ptz, releasePending }) {
             </CardFrame>
           )}
           <PtzControlReference />
-          <PtzStatePanel ptz={ptz} />
-          <ReplaySourcesPanel panelId="ptz-controller-replay" />
+          <ReplaySourcesPanel panelId="ptz-controller-replay" defaultSelectedKey={`ptz:${PTZ_CAMERA_ID}`} />
+          {/*
+            Desktop keeps room controls as the final sidebar tool so camera
+            turn controls and replay remain above the less-frequent room-wide
+            actions. HomeAssistantControls owns its own feature and policy gate.
+          */}
+          <HomeAssistantControls />
         </aside>
       </div>
       <div className="grid min-h-0 grid-cols-[minmax(0,1.6fr)_minmax(16rem,0.7fr)] gap-0.5 overflow-hidden">
@@ -595,78 +579,258 @@ function PtzDesktopFullscreen({ ptz, releasePending }) {
   );
 }
 
-function PtzMobileFullscreen({ ptz, layout, onClose, releasePending = false }) {
-  const landscape = layout === 'mobile-landscape';
-  const topHeightClass = landscape ? 'h-full min-h-[calc(100dvh-0.25rem)]' : 'h-[48dvh]';
-  const topGridClass = landscape
-    ? 'grid-cols-[minmax(0,1fr)_13rem]'
-    : 'grid-cols-[minmax(0,1fr)_11rem]';
-
+function PtzMobileLandscape({ ptz, onClose, releasePending = false }) {
   return (
     <div className="flex min-h-0 flex-1 flex-col gap-0.5 overflow-y-auto p-0.5">
-      <section className={`mobile-touch-control grid ${topHeightClass} min-h-48 shrink-0 ${topGridClass} gap-0.5`}>
-        <main className="relative min-h-0 overflow-hidden bg-black">
-          <button
-            type="button"
-            className="absolute left-1 top-1 z-50 rounded border border-white/40 bg-black/80 px-2 py-1 text-xs font-semibold text-white shadow disabled:opacity-50"
-            disabled={releasePending}
-            onClick={onClose}
-          >
-            Close
-          </button>
-          <PtzMediaPane ptz={ptz} open framed={false} />
-        </main>
-        <aside className="min-h-0 overflow-y-auto">
+      {/*
+        Landscape intentionally retains one control column beside the video.
+        This is the established PTZ interaction and avoids forcing rover-style
+        left/right columns onto a camera that has a smaller control inventory.
+      */}
+      <section className="mobile-touch-control grid min-h-[calc(100dvh-0.25rem)] shrink-0 grid-cols-[minmax(0,1fr)_13rem] items-start gap-0.5">
+        {/*
+          The video keeps one viewport of height, but the grid row is allowed to
+          grow when the control column is taller. That makes the sidebar's tail
+          extend below the video instead of forcing it into a nested scroller.
+        */}
+        <div className="min-w-0 space-y-0.5">
+          <main className="relative h-[calc(100dvh-0.25rem)] min-h-0 overflow-hidden bg-black">
+            <button
+              type="button"
+              className="absolute left-1 top-1 z-50 rounded border border-white/40 bg-black/80 px-2 py-1 text-xs font-semibold text-white shadow disabled:opacity-50"
+              disabled={releasePending}
+              onClick={onClose}
+            >
+              Close
+            </button>
+            <PtzMediaPane ptz={ptz} open framed={false} />
+          </main>
+          {/*
+            The right control column is naturally taller than the viewport.
+            Placing room controls after the fixed-height video uses that left-
+            column space while the whole landscape page continues scrolling as
+            one surface.
+          */}
+          <HomeAssistantControls />
+        </div>
+        {/*
+          Do not put overflow scrolling on this column. The surrounding PTZ
+          landscape content is the single page scroller, so a swipe over either
+          the video area or these controls advances the same document flow.
+        */}
+        <aside className="min-h-0 space-y-0.5">
+          {/*
+            Landscape keeps all turn-critical controls in its one existing
+            sidebar. Queue position belongs first so the operator can confirm
+            control ownership before touching the camera, while replay follows
+            the lighting buttons because it is the next secondary action in
+            the same scroll column.
+          */}
+          <PtzQueueSummary ptz={ptz} />
           <PtzMobileControlsPanel ptz={ptz} disabled={!ptz?.isOperator} />
+          <ReplaySourcesPanel
+            panelId="ptz-controller-replay-mobile-landscape"
+            defaultSelectedKey={`ptz:${PTZ_CAMERA_ID}`}
+          />
         </aside>
       </section>
       <section className="grid gap-0.5 md:grid-cols-[minmax(0,1fr)_minmax(0,0.7fr)]">
         <ChatPanel title="Chat" allowSpectatorInput inputTarget="overlay" />
-        <div className="space-y-0.5">
-          <PtzQueueSummary ptz={ptz} />
-          <PtzPresetPanel ptz={ptz} />
-          <PtzStatePanel ptz={ptz} compact />
-          <ReplaySourcesPanel panelId="ptz-controller-replay-mobile" />
-        </div>
+        <PtzPresetPanel ptz={ptz} />
       </section>
     </div>
   );
 }
 
-export function PtzFullscreenController({ open, onClose, layout = 'desktop' }) {
+function PtzMobilePortrait({ ptz, onClose, releasePending = false }) {
+  return (
+    <div className="flex min-h-0 flex-1 flex-col gap-0.5 overflow-y-auto p-0.5">
+      <main className="relative aspect-video min-h-0 shrink-0 overflow-hidden bg-black">
+        <button
+          type="button"
+          className="absolute left-1 top-1 z-50 rounded border border-white/40 bg-black/80 px-2 py-1 text-xs font-semibold text-white shadow disabled:opacity-50"
+          disabled={releasePending}
+          onClick={onClose}
+        >
+          Close
+        </button>
+        <PtzMediaPane ptz={ptz} open framed={false} />
+      </main>
+      {/*
+        Portrait gives the video its full available width and places controls
+        below it. Reusing the landscape sidebar width here was the source of the
+        cramped portrait presentation, while the controls themselves remain the
+        same shared PTZ controls used in landscape.
+      */}
+      <section className="mobile-touch-control">
+        <PtzMobileControlsPanel ptz={ptz} disabled={!ptz?.isOperator} />
+      </section>
+      <section className="space-y-0.5">
+        {/*
+          Replay and presets are compact secondary actions, so portrait places
+          them in one equal-width row before the full-width queue and chat. The
+          explicit two-column grid keeps this arrangement local to portrait and
+          leaves the desktop and one-column landscape compositions unchanged.
+        */}
+        <div className="grid grid-cols-2 items-start gap-0.5">
+          <ReplaySourcesPanel
+            panelId="ptz-controller-replay-mobile-portrait"
+            defaultSelectedKey={`ptz:${PTZ_CAMERA_ID}`}
+          />
+          <PtzPresetPanel ptz={ptz} />
+        </div>
+        <PtzQueueSummary ptz={ptz} />
+        <ChatPanel title="Chat" allowSpectatorInput inputTarget="overlay" />
+        {/* Portrait keeps room controls immediately after chat as requested. */}
+        <HomeAssistantControls />
+      </section>
+    </div>
+  );
+}
+
+export function PtzControllerPage({ layout = 'desktop' }) {
   const ptz = useSessionSelector((state) => state.session?.ptzCamera || null);
-  const { ptzRelease } = useSessionActions();
+  const featureEnabled = useSessionSelector((state) => isFeatureEnabled(state, 'ptzCamera'));
+  const isVerified = useSessionSelector((state) => Boolean(state.session?.isVerified));
+  const role = useSessionSelector((state) => state.session?.role || null);
+  const socketId = useSessionSelector((state) => state.session?.socketId || null);
+  const { ptzClaim, ptzRelease, pushAlert } = useSessionActions();
   const { stopAllMotion } = useControlActions();
+  const navigate = useNavigate();
   const [releasePending, setReleasePending] = useState(false);
-  const isMobile = layout === 'mobile-portrait' || layout === 'mobile-landscape';
+  const autoClaimSocketRef = useRef(null);
+  const routeExitReleaseTimerRef = useRef(null);
+  const participantRef = useRef(false);
+  const closingThroughButtonRef = useRef(false);
+  const { value: pageSettings } = useSettingsNamespace('page', {
+    backgroundTheme: DEFAULT_PAGE_THEME_KEY,
+  });
+  const isMobile = layout !== 'desktop';
+  const canUse = Boolean(ptz?.canUse || isVerified || role === 'admin' || role === 'lockdown');
+  const isParticipant = Boolean(ptz?.isOperator || ptz?.queuedPosition);
+  // PTZ is a separate route but shares the browser's page settings. Applying the catalog class to
+  // its body surface exposes the theme only through layout padding and card gaps; camera pixels,
+  // controls, and card interiors retain their purpose-built dark backgrounds.
+  const pageBackgroundClass = getPageThemeClass(pageSettings?.backgroundTheme);
+
+  useEffect(() => {
+    // Route-exit cleanup runs after the last render, so retain the latest
+    // server-confirmed membership without making the lifecycle effect resubscribe.
+    participantRef.current = isParticipant;
+  }, [isParticipant]);
+
+  useEffect(() => {
+    if (routeExitReleaseTimerRef.current) {
+      clearTimeout(routeExitReleaseTimerRef.current);
+      routeExitReleaseTimerRef.current = null;
+    }
+
+    return () => {
+      if (!participantRef.current || closingThroughButtonRef.current) return;
+      /*
+        Browser Back and route navigation unmount the PTZ page without invoking
+        its Close button. Defer release by one task so React Strict Mode's
+        development-only cleanup/remount cycle can cancel it in the next setup;
+        a real route exit has no replacement setup, so membership is released.
+
+        This is intentionally membership-gated. An admin release command can
+        revoke the current operator even when the admin is not that operator,
+        so an admin merely visiting/leaving a disabled or unjoined page must not
+        emit a release command.
+      */
+      routeExitReleaseTimerRef.current = setTimeout(() => {
+        routeExitReleaseTimerRef.current = null;
+        ptzRelease().catch(() => {});
+      }, 0);
+    };
+  }, [ptzRelease]);
+
+  useEffect(() => {
+    if (!featureEnabled || !ptz || !socketId || !canUse) return undefined;
+
+    if (ptz.isOperator || ptz.queuedPosition) {
+      /*
+        Navigation from the driver queue normally arrives with membership
+        already established. Mark this socket complete so later session syncs
+        cannot turn that normal route transition into another claim request.
+      */
+      autoClaimSocketRef.current = socketId;
+      return undefined;
+    }
+
+    if (autoClaimSocketRef.current === socketId) return undefined;
+    autoClaimSocketRef.current = socketId;
+    let active = true;
+
+    /*
+      A direct /ptz load still receives the ordinary user role first, which can
+      briefly assign a rover. Claiming through the existing server action is
+      deliberate: ptzCameraService releases that rover ownership before it
+      activates or queues this socket, keeping one authoritative transition.
+
+      The socket-keyed ref suppresses repeats caused by session updates and
+      React's development effect replay. The server claim is also idempotent for
+      an existing operator/queue member, which covers an acknowledgement racing
+      with a fresh public-state sync.
+    */
+    ptzClaim().catch((err) => {
+      if (!active) return;
+      pushAlert({
+        id: `ptz-auto-claim-${socketId}`,
+        title: 'PTZ camera',
+        message: err?.message || 'Unable to join the PTZ queue.',
+        color: '#f59e0b',
+        lifetimeMs: 6000,
+      });
+    });
+
+    return () => {
+      // Do not emit or update UI from a rejected request after this route has
+      // unmounted; the server still owns completion of any request in flight.
+      active = false;
+    };
+  }, [canUse, featureEnabled, ptz, ptzClaim, pushAlert, socketId]);
 
   const releaseAndClose = useCallback(async () => {
     if (releasePending) return;
     setReleasePending(true);
+    closingThroughButtonRef.current = true;
     try {
       /*
         Stop first so a held key/pointer cannot leave ONVIF continuous movement
         running while the server removes this socket from the PTZ queue.
       */
       stopAllMotion?.();
-      await ptzRelease();
-      onClose?.();
+      if (ptz?.isOperator || ptz?.queuedPosition) {
+        await ptzRelease();
+      }
+      navigate('/');
+    } catch (err) {
+      // A rejected manual release leaves the route mounted, so route-exit
+      // cleanup must remain armed for a later Back/navigation attempt.
+      closingThroughButtonRef.current = false;
+      throw err;
     } finally {
       setReleasePending(false);
     }
-  }, [onClose, ptzRelease, releasePending, stopAllMotion]);
+  }, [navigate, ptz?.isOperator, ptz?.queuedPosition, ptzRelease, releasePending, stopAllMotion]);
 
-  if (!open) return null;
+  if (!featureEnabled) {
+    return (
+      <main className={`flex min-h-[100dvh] items-center justify-center p-2 text-slate-100 ${pageBackgroundClass}`}>
+        <CardFrame title="PTZ camera" bodyClassName="space-y-1 p-2 text-sm">
+          <p>The PTZ camera is not available.</p>
+          <button type="button" className="button-dark w-full" onClick={() => navigate('/')}>Return to driver page</button>
+        </CardFrame>
+      </main>
+    );
+  }
 
-  const controller = (
-    /*
-      The PTZ controller needs to cover the driver page, but it must not become
-      the top-most application layer. Global fullscreen overlays like help,
-      quickstart, mode gates, and connection warnings are still part of the
-      active app state while PTZ is open, so this portal intentionally sits
-      below their z-30+ overlay stack instead of hiding them.
-    */
-    <div className="fixed inset-0 z-20 h-[100dvh] w-[100vw] overflow-hidden bg-black text-slate-100">
+  return (
+    <main className={`h-[100dvh] w-full overflow-hidden text-slate-100 ${pageBackgroundClass}`}>
+      {/* The fullscreen CardFrame remains the structural shell. Painting its otherwise
+          transparent body is what lets every desktop and mobile PTZ composition share one
+          continuous pattern without threading theme props into each individual child panel. */}
       <CardFrame
         title={isMobile ? '' : ptz?.name || 'PTZ Camera'}
         actions={isMobile ? null : (
@@ -678,23 +842,20 @@ export function PtzFullscreenController({ open, onClose, layout = 'desktop' }) {
         fillHeight
         clipOverflow={false}
         className="h-[100dvh] w-[100vw] rounded-none border-0 !bg-black"
-        bodyClassName="relative min-h-0 flex-1"
+        bodyClassName={`relative min-h-0 flex-1 ${pageBackgroundClass}`}
       >
         {isMobile ? (
-          <PtzMobileFullscreen
-            ptz={ptz}
-            layout={layout}
-            onClose={releaseAndClose}
-            releasePending={releasePending}
-          />
+          layout === 'mobile-landscape' ? (
+            <PtzMobileLandscape ptz={ptz} onClose={releaseAndClose} releasePending={releasePending} />
+          ) : (
+            <PtzMobilePortrait ptz={ptz} onClose={releaseAndClose} releasePending={releasePending} />
+          )
         ) : (
           <PtzDesktopFullscreen ptz={ptz} releasePending={releasePending} />
         )}
       </CardFrame>
-    </div>
+    </main>
   );
-
-  return createPortal(controller, document.body);
 }
 
 export default function PtzQueueCard({ layout = 'desktop' }) {
@@ -704,10 +865,10 @@ export default function PtzQueueCard({ layout = 'desktop' }) {
   const role = useSessionSelector((state) => state.session?.role || null);
   const selfId = useSessionSelector((state) => state.session?.socketId || null);
   const { ptzClaim, ptzRelease } = useSessionActions();
+  const navigate = useNavigate();
   const lookupUser = usePtzQueueLookup(ptz);
   const { queue, currentId, nextId } = normalizePtzQueue(ptz);
   const now = useSharedClock(1000, Boolean(ptz?.deadline));
-  const [controllerOpen, setControllerOpen] = useState(false);
   const [pending, setPending] = useState(false);
   const canUse = Boolean(ptz?.canUse || isVerified || role === 'admin' || role === 'lockdown');
   const isParticipant = Boolean(ptz?.isOperator || ptz?.queuedPosition);
@@ -718,7 +879,7 @@ export default function PtzQueueCard({ layout = 'desktop' }) {
   const handleRequest = async () => {
     if (!canUse || pending) return;
     if (isParticipant) {
-      setControllerOpen(true);
+      navigate('/ptz');
       return;
     }
     setPending(true);
@@ -731,7 +892,7 @@ export default function PtzQueueCard({ layout = 'desktop' }) {
         dock-guard rejection does not strand the user in fullscreen.
       */
       if (response?.state?.isOperator || response?.state?.queuedPosition) {
-        setControllerOpen(true);
+        navigate('/ptz');
       }
       trackAnalyticsEvent('ptz_queue_join_result', { layout, status: 'accepted' });
     } catch (err) {
@@ -767,8 +928,7 @@ export default function PtzQueueCard({ layout = 'desktop' }) {
     : 'request';
 
   return (
-    <>
-      <CardFrame title={ptz?.name || 'PTZ camera'} bodyClassName="relative space-y-0.5 text-sm">
+    <CardFrame title={ptz?.name || 'PTZ camera'} bodyClassName="relative space-y-0.5 text-sm">
         <ul className="space-y-0.5 text-sm">
           <QueueTargetRow
             target={{
@@ -806,8 +966,6 @@ export default function PtzQueueCard({ layout = 'desktop' }) {
             Verify your account to use the PTZ camera.
           </div>
         ) : null}
-      </CardFrame>
-      <PtzFullscreenController open={controllerOpen} onClose={() => setControllerOpen(false)} layout={layout} />
-    </>
+    </CardFrame>
   );
 }

webui/src/components/ReplaySourcesPanel/ReplayReadyPopup.jsx

@@ -1,5 +1,5 @@
 // Replay Ready Popup
-// Purpose: Presents the latest Discord-hosted replay video to web users as soon as upload completes.
+// Purpose: Presents the latest delivered replay video, whether Discord-hosted or served by the rover server.
 // Scope: Owns the ephemeral modal shell, immediate video loading, and click-outside close behavior.
 import { useCallback, useEffect, useRef } from 'react';
 import CardFrame from '../CardFrame/index.jsx';

webui/src/components/ReplaySourcesPanel/index.jsx

@@ -35,13 +35,16 @@ function selectedKeysEqual(left, right) {
   return true;
 }
 
-export default function ReplaySourcesPanel({ panelId = 'replay-sources', fillHeight = false }) {
+export default function ReplaySourcesPanel({
+  panelId = 'replay-sources',
+  fillHeight = false,
+  defaultSelectedKey = null,
+}) {
   const replaySources = useSessionSelector((state) => state.session?.replaySources ?? []);
   const mode = useSessionSelector((state) => state.session?.mode || null);
   const assignmentRoverId = useSessionSelector((state) => state.session?.assignment?.roverId ?? null);
   const roster = useSessionSelector((state) => state.session?.roster ?? []);
   const replayState = useSessionSelector((state) => state.session?.replay || null);
-  const latestReplay = useSessionSelector((state) => state.latestReplay);
   const { triggerReplay } = useSessionActions();
   const sources = useMemo(() => normalizeSources(replaySources || []), [replaySources]);
   const { value: settings, save: saveSettings } = useSettingsNamespace('replaySources', {});
@@ -65,20 +68,35 @@ export default function ReplaySourcesPanel({ panelId = 'replay-sources', fillHei
   const activeReplayJob = useSessionSelector((state) => (
     activeJobId ? state.replayJobs?.[activeJobId] || null : null
   ));
-  const latestReplayJobId = latestReplay?.jobId || null;
+  // The job id is deliberately local to this mounted panel. Reading the global
+  // latestReplay value here caused a newly mounted panel to resurrect the last
+  // replay popup even though this panel did not request it. The job record can
+  // remain in shared session state for asynchronous socket updates; selecting
+  // it through this panel-owned id keeps popup ownership and lifetime local.
+  const panelReplay = activeReplayJob?.media || null;
+  const panelReplayJobId = panelReplay?.jobId || null;
   const showPanelReplay = Boolean(
-    latestReplay?.url &&
-    latestReplayJobId &&
-    dismissedPanelReplayId !== latestReplayJobId,
+    panelReplay?.url &&
+    panelReplayJobId &&
+    dismissedPanelReplayId !== panelReplayJobId,
   );
 
-  const defaults = useMemo(() => {
-    const roverId = assignmentRoverId;
-    if (roverId) {
-      return [`rover:${roverId}`];
+  const availableDefaultKey = useMemo(() => {
+    // PTZ layouts provide their camera key explicitly so entering the dedicated
+    // camera page does not inherit the user's assigned rover. Waiting until the
+    // source is actually advertised also handles the initial session load: an
+    // unavailable key is never left selected, but it becomes the default as
+    // soon as the server publishes that replay source.
+    if (defaultSelectedKey && sources.some((source) => source.key === defaultSelectedKey)) {
+      return defaultSelectedKey;
     }
-    return [];
-  }, [assignmentRoverId]);
+    const roverKey = assignmentRoverId ? `rover:${assignmentRoverId}` : null;
+    if (roverKey && sources.some((source) => source.key === roverKey)) {
+      return roverKey;
+    }
+    return null;
+  }, [assignmentRoverId, defaultSelectedKey, sources]);
+  const defaults = useMemo(() => (availableDefaultKey ? [availableDefaultKey] : []), [availableDefaultKey]);
 
   const defaultTitle = useMemo(() => {
     const roverId = assignmentRoverId || null;
@@ -225,9 +243,9 @@ export default function ReplaySourcesPanel({ panelId = 'replay-sources', fillHei
       {showPanelReplay ? (
         <div className="absolute bottom-[calc(100%+0.125rem)] left-1/2 z-[70] w-[min(20rem,calc(100vw-1rem))] -translate-x-1/2">
           <ReplayReadyPopup
-            replay={latestReplay}
+            replay={panelReplay}
             variant="floating-panel"
-            onClose={() => setDismissedPanelReplayId(latestReplayJobId)}
+            onClose={() => setDismissedPanelReplayId(panelReplayJobId)}
           />
         </div>
       ) : null}
@@ -261,6 +279,16 @@ export default function ReplaySourcesPanel({ panelId = 'replay-sources', fillHei
                 setTitleDirty(true);
                 saveSettings((current) => ({ ...(current || {}), [titleSettingKey]: next }));
               }}
+              onKeyDown={(event) => {
+                // Enter is the keyboard equivalent of clicking Replay. Ignore
+                // composition events so confirming an IME candidate cannot
+                // accidentally submit a replay before the title is complete.
+                // handleReplay remains the single authority for cooldown,
+                // lockdown, busy, and empty-source checks.
+                if (event.key !== 'Enter' || event.nativeEvent?.isComposing) return;
+                event.preventDefault();
+                handleReplay();
+              }}
               placeholder={defaultTitle}
               maxLength={120}
             />