insika 0.9.0 → 1.0.1

data/lib/insika/studio/app.rb

@@ -92,7 +92,7 @@ module Studio
                     tool_catalog: nil, tool_store: nil, memory_store: nil, session_store: nil,
                     memory_audit_store: nil,
                     settings_store: nil, llm_provider_store: nil, mcp_store: nil,
-                    system_file_store: nil, tool_trace_store: nil, context_trace_store: nil,
+                    system_file_store: nil, tool_trace_store: nil, llm_trace_store: nil, model_metrics_store: nil, context_trace_store: nil,
                     cache_series_store: nil,
                     task_store: nil, checkpoint_store: nil, pending_action_store: nil,
                     refinement_store: nil, golden_store: nil, session_secret: nil,
@@ -122,7 +122,7 @@ module Studio
           mcp_store: mcp_store, system_file_store: system_file_store,
           # per-session tool-call trace (debug): args + result + status per
           # turn, rendered in the session viewer.
-          tool_trace_store: tool_trace_store,
+          tool_trace_store: tool_trace_store, llm_trace_store: llm_trace_store, model_metrics_store: model_metrics_store,
           # per-session context breakdown: tokens by category +
           # budget per turn, on the same viewer. Counts only, no content.
           context_trace_store: context_trace_store,
@@ -216,6 +216,14 @@ module Studio
 
       # Versioned assets: public (the UI loads the bundle BEFORE login).
       r.on "assets", "dist" do
+        # The embedded webfonts are the one sub-directory under dist; the "fonts"
+        # segment is matched literally, so serve_asset still only ever joins a
+        # basename onto a path this app chose.
+        r.on "fonts" do
+          r.get String do |name|
+            serve_asset(name, "fonts")
+          end
+        end
         r.get String do |name|
           serve_asset(name)
         end
@@ -224,7 +232,8 @@ module Studio
       # Login: the only path without a session. GET shows the form; POST validates the
       # token in constant time and, if ok, marks the session and redirects.
       r.is "login" do
-        r.get { view("login") }
+        # Already signed in: the form would render inside the shell — go home.
+        r.get { authenticated? ? r.redirect("/studio/home") : view("login") }
         r.post do
           check_csrf!
           if authenticate(r.params["token"])
@@ -269,7 +278,8 @@ module Studio
       r.get "events" do
         next_404 unless insika[:event_stream] # no stream wired: the feature is not there
         subscription = insika[:event_stream].subscribe(
-          task_id: presence(r.params["task_id"]), session_id: presence(r.params["session_id"])
+          task_id: presence(r.params["task_id"]), session_id: presence(r.params["session_id"]),
+          replay: true # a viewer arriving mid-turn sees what the turn already did
         )
         r.halt([200,
                 { "content-type" => "text/event-stream", "cache-control" => "no-cache",
@@ -277,24 +287,30 @@ module Studio
                 Insika::Server::SSEBody.new(subscription: subscription)])
       end
 
-      # `/studio` and `/studio/` → overview home.
+      # `/studio/` → overview home. A bare `/studio` reaches here with an empty
+      # path (Rack::URLMap strips the mount), which r.root does not match.
+      r.redirect("/studio/home") if r.remaining_path.empty?
       r.root { r.redirect("/studio/home") }
 
       # --- Overview: at-a-glance dashboard ---------------------
+      r.on "inbox" do
+        r.is { r.get { render_inbox } }
+      end
+
       r.on "home" do
         r.is { r.get { render_home } }
       end
 
+      r.on "models" do
+        r.is { r.get { render_models } }
+      end
+
       # --- Agents: list + detail/authoring ---------------------
       r.on "agents" do
         # /studio/agents — agents grid (reads the ProfileSource).
         r.is do
           r.get do
             @agents = insika[:profile_source].all.sort_by(&:id)
-            # WS7 scorecard: the LAST outcome per agent, computed once for the
-            # whole grid (a store scan per card would be n scans). Series live
-            # on the agent detail — one agent's periods, not n charts here.
-            @latest_outcomes = insika[:outcome_store]&.latest_per_agent
             # "New from template" gallery — cheap (frontmatter
             # parse only, no evaluation) so it's safe on every render.
             @templates = Insika::Templates.all
@@ -307,10 +323,13 @@ module Studio
             check_csrf!
             id = presence(r.params["id"])
             result = with_flash("Agent '#{id}' created.") do
+              model, provider = picked_model(r)
               dispatch(:create_agent, {
-                         id: id, model: presence(r.params["model"]),
-                         provider: presence(r.params["provider"]),
-                         memory: r.params["memory"] == "1"
+                         id: id, model: model, provider: provider,
+                         memory: r.params["memory"] == "1",
+                         # Starts with nothing allowed: kits and the pickers decide
+                         # what it gets (an "all" start made every kit a no-op).
+                         tools_allow: [], skills: []
                        })
             end
             r.redirect(result ? agent_path(id) : "/studio/agents")
@@ -344,6 +363,10 @@ module Studio
           # Config/model → :update_agent (patch merge).
           r.post "config" do
             check_csrf!
+            # A section the agent stops inheriting starts from the platform's
+            # value, so the keys its form does not show (knowledge index,
+            # guardrails corpora) carry over.
+            @agent = Insika::AgentDefaults.apply_safely(@agent, platform_agent_defaults)
             with_flash("Configuration saved.") do
               dispatch(:update_agent, config_patch(r))
             end
@@ -451,6 +474,30 @@ module Studio
             end
           end
 
+          # POST /studio/agents/:id/tools — the agent's Tools tab. "all" = nil;
+          # otherwise the checked subset. `deny` is preserved.
+          r.post "tools" do
+            check_csrf!
+            profile = insika[:profile_source].fetch(id)
+            next_404 unless profile
+            all = r.params["all_tools"] == "1"
+            allow = all ? nil : Array(r.params["tools"]).map(&:to_s)
+            # "all tools" means every tool: a leftover group list would narrow it to
+            # those groups. Otherwise only the server switches this tab rendered
+            # (managed_groups) change; other groups (a pack's) stay.
+            groups = if all then nil
+                     else
+                       managed = Array(r.params["managed_groups"]).map(&:to_s)
+                       kept = Array(profile.tools_allow_groups).map(&:to_s) - managed
+                       picked = kept | Array(r.params["tool_groups"]).map(&:to_s)
+                       picked.empty? && profile.tools_allow_groups.nil? ? nil : picked
+                     end
+            with_flash("Tools updated.") do
+              dispatch(:set_agent_tools, { id: id, allow: allow, deny: Array(profile.tools_deny), allow_groups: groups })
+            end
+            r.redirect(agent_path(id, nil, "tab=tools"))
+          end
+
           r.on "skills" do
             # POST /studio/agents/:id/skills → :update_agent with the `skills`
             # allowlist. "all" = nil; otherwise the checked subset (possibly []).
@@ -477,6 +524,7 @@ module Studio
                   @selected = name
                   @scope_agent = id
                   @skill_content = skill_source(name, agent: id)
+                  @skill_versions = skill_versions(name, agent: id)
                   view("skills")
                 end
                 # Saving the specialization: same command, `agent:` set.
@@ -489,6 +537,12 @@ module Studio
                 end
               end
 
+              r.post "restore" do
+                check_csrf!
+                with_flash("Version restored.") { restore_skill_version(name, r.params["version"], agent: id) }
+                r.redirect("#{agent_path(id)}/skills/#{Rack::Utils.escape(name)}")
+              end
+
               # Un-specialize: the shared skill stays, and the agent falls back to it.
               r.post "delete" do
                 check_csrf!
@@ -563,9 +617,15 @@ module Studio
               load_skills_master
               @selected = name
               @skill_content = skill_source(name)
+              @skill_versions = skill_versions(name)
               view("skills")
             end
           end
+          r.post "restore" do
+            check_csrf!
+            with_flash("Version restored.") { restore_skill_version(name, r.params["version"]) }
+            r.redirect("/studio/skills/#{Rack::Utils.escape(name)}")
+          end
           # Enables/disables the skill on N agents at once, and marks it always-on for
           # the ones that checked `eager`. Both are per-agent decisions about the same
           # skill, so they are the same form and the same dispatch.
@@ -586,6 +646,11 @@ module Studio
           r.post "specialize" do
             check_csrf!
             agent_id = presence(r.params["agent_id"])
+            # the picker is free text (type-to-search), so the id is checked here
+            unless agent_id && insika[:profile_source].fetch(agent_id)
+              flash["error"] = "Agent '#{agent_id}' not found."
+              r.redirect("/studio/skills/#{Rack::Utils.escape(name)}")
+            end
             with_flash("Specialized for #{agent_id}.") do
               dispatch(:write_skill, { name: name, agent: agent_id, content: skill_source(name) })
             end
@@ -594,6 +659,69 @@ module Studio
         end
       end
 
+      # --- Kits: named bundles of skills + tools agents subscribe to ----------
+      r.on "kits" do
+        r.is do
+          r.get do
+            load_kits
+            @selected = nil
+            view("kits")
+          end
+          r.post do
+            check_csrf!
+            name = presence(r.params["name"]).to_s
+            payload = { name: name, description: r.params["description"].to_s,
+                        skills: Array(r.params["skills"]).map(&:to_s),
+                        tools: Array(r.params["tools"]).map(&:to_s),
+                        tool_groups: Array(r.params["tool_groups"]).map(&:to_s) }
+            result = with_flash("Kit '#{name}' saved.") { dispatch(:write_kit, payload) }
+            r.redirect(result ? "/studio/kits/#{Rack::Utils.escape(name)}" : "/studio/kits")
+          end
+        end
+
+        r.get "new" do
+          load_kits
+          @selected = ""
+          @kit = {}
+          view("kits")
+        end
+
+        r.on String do |name|
+          name = utf8(name)
+          r.is do
+            r.get do
+              load_kits
+              @kit = @kits[name]
+              next_404 unless @kit
+              @selected = name
+              view("kits")
+            end
+          end
+          # Membership lives on the AGENT (AgentProfile#kits). Only agents whose
+          # membership of THIS kit changed are written, and their other kits stay.
+          r.post "agents" do
+            check_csrf!
+            chosen = Array(r.params["agent_ids"]).map(&:to_s)
+            with_flash("Kit '#{name}' agents updated.") do
+              insika[:profile_source].all.each do |a|
+                has = Array(a.kits).include?(name)
+                want = chosen.include?(a.id)
+                next if has == want
+
+                kits = want ? Array(a.kits) | [name] : Array(a.kits) - [name]
+                dispatch(:update_agent, { id: a.id, kits: kits })
+              end
+            end
+            r.redirect("/studio/kits/#{Rack::Utils.escape(name)}")
+          end
+          r.post "delete" do
+            check_csrf!
+            with_flash("Kit '#{name}' removed.") { dispatch(:delete_kit, { name: name }) }
+            r.redirect("/studio/kits")
+          end
+        end
+      end
+
       # --- Tools: tool × agent matrix + DATA-DEFINED tool authoring -----------
       r.on "tools" do
         # Data-defined tool authoring. Under /tools/def/* — BEFORE the
@@ -650,20 +778,16 @@ module Studio
           end
         end
 
-        r.is { r.get { render_tools_matrix } }
+        r.is { r.get { render_tools_page } }
 
-        # POST /studio/tools/:id — writes an agent's tools allowlist.
-        # "all" = nil; otherwise the checked subset. `deny` is preserved.
-        r.post String do |id|
-          check_csrf!
-          id = utf8(id)
-          profile = insika[:profile_source].fetch(id)
-          next_404 unless profile
-          allow = r.params["all_tools"] == "1" ? nil : Array(r.params["tools"]).map(&:to_s)
-          with_flash("Agent '#{id}' tools updated.") do
-            dispatch(:set_agent_tools, { id: id, allow: allow, deny: Array(profile.tools_deny) })
-          end
-          r.redirect("/studio/tools?a=#{Rack::Utils.escape(id)}")
+        # GET /studio/tools/info/:name — read-only card for a code or MCP tool.
+        r.get "info", String do |name|
+          name = utf8(name)
+          load_tool_catalog
+          @info_tool = @tools.find { |t| t.name == name }
+          next_404 unless @info_tool
+          @info_label = @tool_groups.find { |_, tools| tools.include?(@info_tool) }&.first
+          render_tools_page(detail: :info, selected: name)
         end
       end
 
@@ -711,6 +835,26 @@ module Studio
           r.redirect("/studio/settings?s=edge")
         end
 
+        # Burst policy: the platform QueuePolicy layer. Its own form for the same
+        # reason as edge — and so "apply to every agent" is one save instead of
+        # one edit per agent (each agent still overrides in its config).
+        # Platform agent defaults: what an agent with no value of its own runs with.
+        r.post "agent-defaults" do
+          check_csrf!
+          with_flash("Agent defaults saved.") do
+            dispatch(:update_settings, { patch: { "agent_defaults" => agent_defaults_patch(r) } })
+          end
+          r.redirect("/studio/settings?s=agents")
+        end
+
+        r.post "queue" do
+          check_csrf!
+          with_flash("Burst policy saved.") do
+            dispatch(:update_settings, { patch: queue_patch(r) })
+          end
+          r.redirect("/studio/settings?s=burst")
+        end
+
         # Evals: the judge PANEL and how it agrees. Its own
         # form, like models and edge — a save here must not clobber those.
         r.post "evals" do
@@ -855,6 +999,13 @@ module Studio
         end
       end
 
+      # --- Live floor: the latest conversations as cards ------------
+      # Read-only. live_floor_controller keeps the cards and the event
+      # ticker moving over /studio/events; the server only renders the baseline.
+      r.on "live" do
+        r.is { r.get { render_live } }
+      end
+
       # --- Chats: conversations index ------------------------------
       # Read-only: lists sessions and links to the existing viewer (/sessions/:id).
       r.on "chats" do
@@ -868,18 +1019,36 @@ module Studio
       # renders the two right zones alone.
       r.on "sessions" do
         r.on String do |sid|
-          sid = utf8(sid)
+          # Roda captures the segment URL-encoded; ids may hold a colon
+          # (tenant:session), which every link escapes as %3A.
+          sid = utf8(Rack::Utils.unescape_path(sid))
+          # POST /studio/sessions/:id/guardrail — a person's verdict on one
+          # guardrail flag (false positive / resolved / undo).
+          r.post "guardrail" do
+            check_csrf!
+            status = presence(r.params["status"])
+            with_flash(status ? "Guardrail flag marked #{status == "reported" ? "as a false positive" : status}." : "Guardrail report undone.") do
+              dispatch(:review_guardrail_flag, { session_id: sid, message: r.params["message"],
+                                                 flag: r.params["flag"], status: status })
+            end
+            r.redirect(presence(r.params["back"])&.start_with?("/studio/") ? r.params["back"] : "/studio/sessions/#{Rack::Utils.escape_path(sid)}")
+          end
+
           r.get do
             @session = insika[:session_store]&.find(sid)
             next_404 unless @session
 
             # master column: recent conversations, current one active
-            @sessions = recent_sessions(limit: 60)
-            # Session's tool-call trace (debug): grouped by turn in the view.
+            setup_chat_list(r.params)
+            # Session's tool-call trace (debug), one group per turn of a task:
+            # `turn` restarts at 1 every task (entries without a task_id, written
+            # before it, group by consecutive turn).
             @tool_traces = (insika[:tool_trace_store]&.for_session(sid) || [])
-                           .group_by { |t| t["turn"] }
+                           .chunk_while { |a, b| a["task_id"] == b["task_id"] && a["turn"] == b["turn"] }.to_a
             # Context breakdown per turn: chronological entries.
             @context_traces = insika[:context_trace_store]&.for_session(sid) || []
+            # Per-reply "why did it say that?" panels, drawn under each reply.
+            @why = why_panels(Array(@session.messages), @context_traces, @tool_traces.flatten)
             # the stage history — the session's outcomes folded
             # into the agent's declared stages (unmapped kinds render raw).
             @stage_history = stage_history_for(sid)
@@ -907,7 +1076,7 @@ module Studio
         r.on String do |raw_scope|
           # Roda captures the segment URL-encoded; a customer cell contains
           # colons (memory:acme:c-1), so decode before parsing.
-          scope = Rack::Utils.unescape_path(utf8(raw_scope))
+          scope = utf8(Rack::Utils.unescape_path(raw_scope))
           cell = Insika::MemoryStore.parse_cell(scope)
 
           r.get { render_customer(scope, cell) }
@@ -922,7 +1091,7 @@ module Studio
                          expires_at: presence(r.params["expires_at"]), operator: "studio"
                        })
             end
-            r.redirect(customer_path(scope))
+            r.redirect(customer_path(scope, agent: presence(r.params["agent"])))
           end
 
           r.post "forget-fact" do
@@ -933,7 +1102,7 @@ module Studio
                          key: presence(r.params["key"]), operator: "studio"
                        })
             end
-            r.redirect(customer_path(scope))
+            r.redirect(customer_path(scope, agent: presence(r.params["agent"])))
           end
 
           # The LGPD access right: JSON download of the cell's content (D7 —
@@ -952,7 +1121,7 @@ module Studio
             JSON.pretty_generate(result)
           rescue Insika::ValidationError => e
             flash["error"] = e.message
-            r.redirect(customer_path(scope))
+            r.redirect(customer_path(scope, agent: presence(r.params["agent"])))
           end
 
           # The LGPD forget — purges the cell AND the customer's sessions.
@@ -963,7 +1132,8 @@ module Studio
                          tenant: cell[:tenant], customer: cell[:customer], operator: "studio"
                        })
             end
-            r.redirect("/studio/customers")
+            agent = presence(r.params["agent"])
+            r.redirect(agent ? "/studio/customers?agent=#{Rack::Utils.escape(agent)}" : "/studio/customers")
           end
         end
       end
@@ -1090,6 +1260,14 @@ end
           control_action(:resolve_refinement, payload, ok: ok)
           r.redirect("/studio/refinement?agent=#{Rack::Utils.escape(agent.to_s)}")
         end
+
+        # GET /studio/refinement/:id — one run's findings/proposal/diff. Same
+        # miller-column pattern as agent_detail/fact_detail: a Turbo-Frame
+        # request gets the pane alone, a plain hit gets the shell.
+        r.on String do |id|
+          id = utf8(id)
+          r.get { render_refinement_detail(id) }
+        end
       end
 
       # --- Harvest: the gated skill loop  ----------------------
@@ -1164,7 +1342,7 @@ end
               dispatch(:write_concept, { agent: agent, name: name, tenant: tenant,
                                         content: r.params["content"].to_s }.compact)
             end
-            r.redirect(knowledge_path(agent, name, tenant))
+            r.redirect(knowledge_path(agent, name, tenant, status: presence(r.params["status"])))
           end
         end
 
@@ -1201,7 +1379,7 @@ end
             with_flash("Concept removed.") do
               dispatch(:delete_concept, { agent: agent, name: name, tenant: tenant }.compact)
             end
-            r.redirect("/studio/knowledge?agent=#{Rack::Utils.escape(agent.to_s)}")
+            r.redirect(knowledge_path(agent, nil, tenant, status: presence(r.params["status"])))
           end
 
           r.post "restore" do
@@ -1212,7 +1390,7 @@ end
               dispatch(:restore_concept, { agent: agent, name: name, tenant: tenant,
                                           version: r.params["version"] }.compact)
             end
-            r.redirect(knowledge_path(agent, name, tenant))
+            r.redirect(knowledge_path(agent, name, tenant, status: presence(r.params["status"])))
           end
         end
       end
@@ -1222,7 +1400,10 @@ end
       # hit the stores, mutations go through the bus); the ONLY mutation — the
       # approve/reject/dismiss answer — dispatches :resolve_proposal.
       r.on "facts" do
-        r.get { render_facts }
+        r.is do
+          r.get { render_facts }
+        end
+
         r.post "resolve" do
           check_csrf!
           decision = presence(r.params["decision"])
@@ -1234,7 +1415,17 @@ end
                                           operator: "studio" })
           end
           filter = presence(r.params["filter"])
-          r.redirect("/studio/facts#{filter ? "?store=#{Rack::Utils.escape(filter)}" : ""}")
+          # lands the operator on the NEXT pending item (same filter scope), not
+          # an empty list — resolving one fact should feed straight into the next.
+          r.redirect(next_fact_path(filter))
+        end
+
+        # GET /studio/facts/:id — one fact's evidence + decision (pending/stale)
+        # or its resolution (recent). Same miller-column pattern as agent_detail:
+        # a Turbo-Frame request gets the pane alone, a plain hit gets the shell.
+        r.on String do |id|
+          id = utf8(id)
+          r.get { render_fact_detail(id) }
         end
       end
 
@@ -1354,7 +1545,10 @@ end
           # (@sent_message) until it lands in history — an optimistic JS echo can't
           # work here (POST→redirect wipes the DOM).
           @history = @session_id ? Array(insika[:session_store]&.find(@session_id)&.messages) : []
-          @sent_message = flash["sent_message"]
+          @sent_message = flash["sent_message"] || running_message(@session_id)
+          # The id a NEW conversation will get, minted here so the router can
+          # send its first turn to the worker that will keep running it.
+          @new_session_id = SecureRandom.uuid unless @session_id
           view("playground")
         end
         r.post do
@@ -1362,15 +1556,18 @@ end
           agent = presence(r.params["agent"]) || default_agent
           typed_session = presence(r.params["session_id"])
           message = r.params["message"].to_s
-          # Blank session = new conversation: created via Command (create_session
-          # generates the id — the Studio doesn't write to the store directly). A typed id
-          # continues an existing conversation (send_message requires it to exist).
+          # Blank session = new conversation: created via Command with the id the
+          # page minted (the router already sent this POST to that id's worker —
+          # the Studio doesn't write to the store directly). A typed id continues
+          # an existing conversation (send_message requires it to exist); so does
+          # a re-submitted page whose minted id already exists.
           # The per-chat model pin is set at creation and rides the whole
           # conversation, so it only applies to a NEW session — an existing one keeps
           # whatever it was pinned to.
+          minted = presence(r.params["new_session_id"])
           session_id = typed_session ||
-                       create_session(model: presence(r.params["model"]),
-                                      provider: presence(r.params["provider"]),
+                       (minted if minted && insika[:session_store]&.find(minted)) ||
+                       create_session(id: minted, **pinned_model(r),
                                       thinking: presence(r.params["thinking"]))
           dispatch_send_message(agent: agent, session_id: session_id, message: message)
           # Optimistic echo of the just-sent message: survives the redirect
@@ -1394,53 +1591,162 @@ end
 
     def insika = self.class.insika
 
-    # Sidebar navigation, grouped by operator intent (build / runtime /
-    # operate). Each item: [label, href, icon-key]. The view marks the active item
-    # by comparing the path and renders the icon via `nav_icon`.
+    # Sidebar navigation, grouped by operator intent (operate / review /
+    # build / insights / platform). Each item: [label, href, icon-key] plus an
+    # optional pending count (Review items) the layout shows as a badge. The
+    # view marks the active item by comparing the path and renders the icon via
+    # `nav_icon`.
     def nav_sections
+      counts = review_counts
       [
         ["", [
           ["Home", "/studio/home", :home]
         ]],
+        ["operate", [
+          ["Live", "/studio/live", :live],
+          ["Chats", "/studio/chats", :chats],
+          ["Customers", "/studio/customers", :chats],
+          ["Playground", "/studio/playground", :playground]
+        ]],
+        ["review", [
+          ["Inbox", "/studio/inbox", :approvals, counts.values.sum],
+          ["Approvals", "/studio/approvals", :approvals, counts[:approvals]],
+          # the human gate on distilled proposals (approve/reject/dismiss).
+          ["Facts", "/studio/facts", :facts, counts[:facts]],
+          # the human gate on mined skills (gate, promote, reject, rollback).
+          ["Harvest", "/studio/harvest", :harvest, counts[:harvest]],
+          ["Refinement", "/studio/refinement", :refinement, counts[:refinement]]
+        ]],
         ["build", [
           ["Agents", "/studio/agents", :agents],
           ["Skills", "/studio/skills", :skills],
+          ["Kits", "/studio/kits", :kits],
           ["Tools", "/studio/tools", :tools],
-          ["System files", "/studio/system-files", :system]
-        ]],
-        ["runtime", [
           ["MCP", "/studio/mcp", :mcp],
-          ["Settings", "/studio/settings", :settings]
+          ["System files", "/studio/system-files", :system]
         ]],
-        ["operate", [
-          ["Chats", "/studio/chats", :chats],
-          ["Customers", "/studio/customers", :chats],
-          ["Playground", "/studio/playground", :playground],
+        ["insights", [
           ["Funnel", "/studio/funnel", :funnel],
-          # the Follow-ups page — scheduled, fired, blocked and
-          # cancelled records per agent + the per-arm A/B readout card.
+          # scheduled, fired, blocked and cancelled follow-ups per agent.
           ["Follow-ups", "/studio/followups", :followups],
-          # the Artifacts page — the report destination: per-agent
-          # list, sandboxed preview, signed sharing link.
+          # the report destination: per-agent list, preview, signed link.
           ["Artifacts", "/studio/artifacts", :artifacts],
-          # the Facts (wiki) page — the human gate on distilled
-          # proposals (approve/reject/dismiss, the latch, the CAS re-present).
-          ["Facts", "/studio/facts", :facts],
-          # the Harvest page — the human gate on mined skills
-          # (gate, promote, reject, rollback; the append-only promotion log).
-          ["Harvest", "/studio/harvest", :harvest],
-          # the Knowledge page — concepts the engine extracted from
-          # finished conversations; edit, delete, resolve a conflict.
+          # concepts the engine extracted from finished conversations.
           ["Knowledge", "/studio/knowledge", :knowledge],
-          ["Tasks", "/studio/tasks", :tasks],
-          ["Approvals", "/studio/approvals", :approvals],
-          ["Refinement", "/studio/refinement", :refinement],
-          ["Evals", "/studio/evals", :evals]
-        ] + parity_nav_item
-        ]
+          ["Evals", "/studio/evals", :evals],
+          ["Tasks", "/studio/tasks", :tasks]
+        ] + parity_nav_item],
+        ["platform", [
+          ["Models", "/studio/models", :settings],
+          ["Settings", "/studio/settings", :settings]
+        ]]
       ]
     end
 
+    # What the ⌘K palette lists: [group, label, href] for every nav page,
+    # then every agent.
+    def palette_entries
+      pages = nav_sections.flat_map do |group, items|
+        items.map { |label, href, _| [group, label, href] }
+      end
+      agents = Array(insika[:profile_source]&.ids).sort.map { |id| ["agent", id, "/studio/agents/#{Rack::Utils.escape_path(id)}"] }
+      pages + agents
+    end
+
+    # The Overview's "Needs attention" row: [text, href, tone] for every
+    # non-zero item — review queues, customers waiting on a reply, tools that
+    # failed in the last 24h. `turns` is the metrics store's 24h turn block.
+    def attention_items(turns)
+      counts = review_counts
+      failing = Array(turns && turns["tools"]).count { |t| t["failures"].to_i.positive? }
+      [
+        [counts[:approvals], "approval(s) waiting", "/studio/approvals", "warn"],
+        [counts[:facts], "fact proposal(s) to review", "/studio/facts", "info"],
+        [counts[:harvest], "mined skill(s) to review", "/studio/harvest", "info"],
+        [counts[:refinement], "refinement run(s) to review", "/studio/refinement", "info"],
+        [counts[:false_positives], "guardrail false positive(s) reported", "/studio/inbox?type=false_positive", "err"],
+        [Array(@stalled).size, "customer(s) waiting for a reply", "/studio/chats", "warn"],
+        [failing, "tool(s) failing in 24h", "/studio/tools", "err"]
+      ].select { |n, *| n.positive? }.map { |n, text, href, tone| ["#{n} #{text}", href, tone] }
+    end
+
+    # Items parked on a human, per Review page — the sidebar badges.
+    def review_counts = review_queues.transform_values(&:size)
+
+    # The Review queues themselves, read once per request (the sidebar and the
+    # inbox share them); a store that is missing or fails is empty (the nav
+    # never breaks a page).
+    def review_queues
+      @review_queues ||= {
+        approvals: safe_list { insika[:pending_action_store]&.all_open(kind: Insika::PendingActionStore::OPERATOR) },
+        facts: safe_list { insika[:proposal_store]&.pending(limit: 100) },
+        harvest: safe_list { insika[:harvest_store]&.awaiting_approval(limit: 100) },
+        refinement: safe_list { insika[:refinement_store]&.awaiting_approval(limit: 100) },
+        false_positives: safe_list { reported_sessions }
+      }
+    end
+
+    # Every session's stats, read once per request: the sidebar badge, the
+    # inbox and the page itself all ask for them.
+    def session_stats
+      @session_stats ||= insika[:session_store].all_stats
+    end
+
+    # Sessions holding a guardrail flag someone reported as a false positive
+    # and nobody resolved yet (stats only).
+    def reported_sessions
+      store = insika[:session_store]
+      store.respond_to?(:all_stats) ? session_stats.select { |s| s.reported.positive? } : []
+    end
+
+    INBOX_TYPES = { "approval" => "Approval", "fact" => "Fact", "skill" => "Skill",
+                    "refinement" => "Refinement", "false_positive" => "False positive" }.freeze
+
+    # The Review inbox: every item parked on a person, oldest first, each
+    # linking to the page where it is decided. -> [{ type:, title:, agent:, at:, href: }]
+    def inbox_items
+      tasks = insika[:task_store]
+      queues = review_queues
+      items = []
+      queues[:approvals].each do |pa|
+        items << { type: "approval", title: "#{pa.tool} needs approval", agent: (task = tasks&.find(pa.task_id)) && task_agent(task),
+                   at: pa.requested_at, href: "/studio/approvals" }
+      end
+      queues[:facts].each do |p|
+        items << { type: "fact", title: "#{p.key}: #{p.value}"[0, 120], agent: p.scope,
+                   at: p.created_at, href: "/studio/facts/#{Rack::Utils.escape_path(p.id)}" }
+      end
+      queues[:harvest].each do |c|
+        items << { type: "skill", title: "Mined skill: #{c.name}", agent: c.agent,
+                   at: c.updated_at, href: "/studio/harvest?agent=#{Rack::Utils.escape(c.agent.to_s)}" }
+      end
+      queues[:refinement].each do |run|
+        items << { type: "refinement", title: "Refinement run waiting for a decision", agent: run.agent_id,
+                   at: run.finished_at || run.started_at, href: "/studio/refinement/#{Rack::Utils.escape_path(run.id)}" }
+      end
+      queues[:false_positives].each do |st|
+        who = presence(st.vars["customer_name"]) || presence(st.vars["customer"]) || st.id
+        items << { type: "false_positive", title: "Guardrail false positive · #{who}", agent: st.vars["agent"],
+                   at: st.reported_at || st.updated_at, href: "/studio/sessions/#{Rack::Utils.escape_path(st.id)}" }
+      end
+      items.sort_by { |i| i[:at].to_s }
+    end
+
+    def render_inbox
+      all = inbox_items
+      @inbox_counts = INBOX_TYPES.keys.to_h { |t| [t, all.count { |i| i[:type] == t }] }
+      @inbox_type = INBOX_TYPES.key?(request.params["type"]) ? request.params["type"] : nil
+      @inbox_total = all.size
+      @items = @inbox_type ? all.select { |i| i[:type] == @inbox_type } : all
+      view("inbox")
+    end
+
+    def safe_list
+      Array(yield)
+    rescue StandardError
+      []
+    end
+
     # NAV_ICONS + nav_icon moved to Studio::NavIcons.
 
     def authenticated? = session["auth"] == true
@@ -1465,6 +1771,25 @@ end
       path == target || path.start_with?("#{target}/")
     end
 
+    # The nav group the current page sits in ("operate" / "review" / "build" / …),
+    # or nil for the ungrouped Home.
+    def nav_group
+      group, = nav_sections.find { |_, items| items.any? { |(_, href, _)| nav_active?(href) } }
+      presence(group)
+    end
+
+    # The one-segment breadcrumb above a page title. It is always the nav GROUP,
+    # never the page's own name: a crumb that echoes the title ("knowledge /
+    # Knowledge") tells the operator nothing. Renders "" when there is no group,
+    # or when the group would only repeat the title. Pages with a real hierarchy
+    # (agents / :id, chats / session) spell their crumbs out in the view.
+    def crumbs_for(title)
+      group = nav_group
+      return "" if group.nil? || group.casecmp?(title.to_s)
+
+      %(<nav class="crumbs"><span>#{h(group)}</span></nav>)
+    end
+
     # CSP nonce for inline styles (CodeMirror's injected theme). Stable PER SESSION,
     # not per request: the browser enforces the CSP from the initial document load
     # for the whole SPA session, but Turbo Drive fetches later pages carrying their
@@ -1484,6 +1809,15 @@ end
     # they are looking at. No new state; just reads the process env.
     def env_label = (presence(Insika::EnvSchema.read("INSIKA_ENV")) || presence(ENV["RACK_ENV"]) || "local").to_s
 
+    # The top-of-page environment strip: nil on production (no strip), else
+    # the label plus a style — staging amber, anything else (dev, local) blue.
+    def env_banner
+      label = env_label.downcase
+      return nil if %w[production prod].include?(label)
+
+      { label: label, kind: label.start_with?("stag") ? "staging" : "other" }
+    end
+
     # Theme preference read from the cookie (applied server-side on <html> → no
     # flash). Strict allowlist: an unexpected value falls back to "auto".
     THEMES = %w[auto light dark].freeze
@@ -1625,6 +1959,10 @@ end
 
     def render_agent_detail
       id = @agent.id
+      # The config sections show what the agent runs with: its own values, or
+      # the platform's where it inherits (the inherit boxes read @agent_own).
+      @agent_own = @agent
+      @agent = Insika::AgentDefaults.apply_safely(@agent, platform_agent_defaults)
       # Which subnav tab the frame should land on. Selecting a prompt file or
       # a config group is a real navigation (advances the frame + history),
       # which reconnects the `tabs` Stimulus controller — but Turbo's history
@@ -1636,6 +1974,8 @@ end
         "prompts"
       elsif request.params["cfg"]
         "config"
+      elsif %w[tools skills].include?(request.params["tab"])
+        request.params["tab"]
       end
       @config_group = CONFIG_SECTIONS.include?(request.params["cfg"]) ? request.params["cfg"] : "model"
       store = insika[:agent_file_store]
@@ -1643,11 +1983,13 @@ end
         {
           name: name.to_s,
           content: store&.read(id, name).to_s,
+          updated_at: store&.updated_at(id, name),
           versions: store ? store.versions(id, name) : []
         }
       end
-      @all_skills = insika[:skill_catalog]&.all || []
+      @all_skills = insika[:skill_catalog]&.all(agent: id) || []
       @agent_skills = @agent.skills.nil? ? nil : Array(@agent.skills).map(&:to_s)
+      load_tool_catalog
       # v2 config surfaces: generation params + model fence. AgentProfile.build
       # string-keys these hashes, so the form helpers read plain string keys.
       @params = @agent.params
@@ -1657,10 +1999,17 @@ end
       mem = insika[:memory_store]
       @facts = mem ? mem.facts(tenant: id) : []
       @notes = mem ? mem.notes(tenant: id, limit: 20) : []
-      @recent_sessions = recent_sessions
+      # Sessions stamp their agent (vars["agent"]); keep this agent's only.
+      # ponytail: scans the 200 most recent sessions; a per-agent index if an
+      # agent's conversations fall out of that window.
+      @recent_sessions = agent_sessions(recent_sessions(limit: 200), id).first(8)
       # WS7: last outcome + per-day series for THIS agent. The grid already
       # shows the last-outcome pill; the series is the period view.
       outcomes = insika[:outcome_store]
+      # one read of this agent's outcomes, shared by the performance and History tabs
+      mine = Array(outcomes&.all(agent: id))
+      agent_performance(id, mine)
+      agent_changes(id, mine)
       @latest_outcome = outcomes&.latest_per_agent&.[](id)
       @outcome_series = outcomes ? outcomes.series(agent: id) : {}
       # the per-agent cache-hit series (nil store -> the view's
@@ -1672,7 +2021,6 @@ end
       # the master column: the detail page IS the shell when
       # visited directly; only a frame request renders the pane alone.
       @agents = insika[:profile_source].all.sort_by(&:id)
-      @latest_outcomes = insika[:outcome_store]&.latest_per_agent
       if turbo_frame?("agent-detail")
         render("agent_detail", locals: { frame_only: true }, layout: false)
       else
@@ -1699,6 +2047,33 @@ end
       config.to_s
     end
 
+    # "Use the platform default" box of an inheritable config section, on the
+    # agent page only. Checked while the agent has no value of its own.
+    def inherit_toggle(field)
+      return "" if @agent_own.nil?
+
+      checked = @agent_own.public_send(field).nil? ? " checked" : ""
+      %(<label class="check inherit"><input type="checkbox" name="inherit[]" value="#{field}"#{checked}> ) +
+        %(use the platform default <span class="muted">(Settings › Agent defaults)</span></label>)
+    end
+
+    def platform_agent_defaults
+      store = insika[:settings_store]
+      (store ? store.get : Insika::SettingsStore::DEFAULTS)["agent_defaults"] || {}
+    end
+
+    # The platform defaults as a profile, so the agent's sections render them.
+    # A field that no longer builds (a rerank model the registry dropped) shows
+    # blank, so this page stays the place to fix it.
+    def agent_defaults_profile
+      fields = platform_agent_defaults.slice(*Insika::AgentDefaults::FIELDS).select do |field, value|
+        Insika::AgentDefaults.validate!(field => value)
+      rescue Insika::ValidationError
+        false
+      end
+      Insika::AgentProfile.build(id: "agent-defaults", model: nil, **fields.transform_keys(&:to_sym))
+    end
+
     # A list field as comma-joined text for the form's textarea.
     def agent_list(list)
       Array(list).join(", ")
@@ -1713,12 +2088,10 @@ end
     # (home, chats, tasks, approvals, customers, evals, funnel, follow-ups,
     # facts, parity). Same markup everywhere: a select that submits on change.
     def agent_filter_form(path, current)
-      ids = insika[:profile_source].ids.sort
-      options = [["", "all"]] + ids.map { |id| [id, id] }
-      rows = options.map do |value, label|
-        %(<option value="#{value}"#{' selected' if value.to_s == current.to_s}>#{label}</option>)
-      end.join
-      %(<form method="get" action="#{path}" class="actions inline"><label>Agent <select name="agent" data-controller="auto-submit" data-action="change->auto-submit#submit">#{rows}</select></label></form>)
+      picker = render("_agent_picker", locals: { name: "agent", options: insika[:profile_source].ids.sort,
+                                                 value: current, blank: "All agents — type to search",
+                                                 auto_submit: true })
+      %(<form method="get" action="#{path}" class="actions inline"><label>Agent #{picker}</label></form>)
     end
 
     # The sessions of one agent — the session stamps its agent in
@@ -1734,6 +2107,34 @@ end
       vars.is_a?(Hash) ? vars["agent"].to_s : ""
     end
 
+    # The customer a session belongs to — blank for a session that never got
+    # far enough to identify one (a fresh playground run, an abandoned turn).
+    # Same vars lookup as session_agent, one key over.
+    def session_customer(session)
+      vars = session.respond_to?(:vars) ? session.vars : nil
+      vars.is_a?(Hash) ? vars["customer"].to_s : ""
+    end
+
+    # The label a conversation shows: the caller's customer_name, else the
+    # customer key. Blank when neither was sent.
+    def session_customer_label(session)
+      vars = session.respond_to?(:vars) ? session.vars : nil
+      presence(vars.is_a?(Hash) ? vars["customer_name"] : nil) || session_customer(session)
+    end
+
+    def session_customer_phone(session)
+      vars = session.respond_to?(:vars) ? session.vars : nil
+      presence(vars.is_a?(Hash) ? vars["customer_phone"] : nil)
+    end
+
+    # The Chats/History "active" presence dot: lit while the session's last
+    # activity sits inside the same 5-minute window the home dashboard's
+    # conversation rail uses (views/home.erb) — one rule, read in both places.
+    def session_fresh?(session, cutoff: Time.now - 300)
+      t = parse_time(session.updated_at)
+      !t.nil? && t >= cutoff
+    end
+
     # The distill button's scope (the DistillEngine's own scan, scoped to ONE
     # agent): the agent's sessions that are idle past the pack's window, long
     # enough, and not yet distilled. Oldest first, capped — each entry is a
@@ -1749,9 +2150,8 @@ end
       idle_hours = positive_int(config["idle_hours"]) || 6
       min_messages = positive_int(config["min_messages"]) || 3
       cutoff = Time.now.utc - idle_hours * 3600
-      store.each_id.filter_map do |sid|
-        session = store.find(sid)
-        next unless session
+      every_record(store).filter_map do |session|
+        sid = session.id
         next unless session.vars.is_a?(Hash) && session.vars["agent"] == agent_id
         next if Insika::Coercion.blank?(session.vars["customer"])
         next unless aged?(session.updated_at, cutoff)
@@ -1788,6 +2188,68 @@ end
       %(<select name="#{name}">#{rows}</select>)
     end
 
+    # The model pickers offer ONLY refs that resolve: each Studio provider's declared
+    # models, plus the chat models of every provider RubyLLM holds a key for that the
+    # Studio does not declare (e.g. a DEEPSEEK_API_KEY deployment). A typed ref is how
+    # "openai/gpt-x" under provider "openai" reached the API as "openai/openai/gpt-x".
+    # -> ["provider/model", ...] sorted.
+    def model_refs
+      @model_refs ||= begin
+        providers = insika[:llm_provider_store] ? insika[:llm_provider_store].all : []
+        declared = providers.flat_map { |p| Array(p["models"]).map { |m| "#{p['api']}/#{m}" } }
+        apis = providers.map { |p| p["api"].to_s }
+        native = RubyLLM::Provider.configured_providers(RubyLLM.config).flat_map do |klass|
+          slug = klass.slug.to_s
+          apis.include?(slug) ? [] : RubyLLM.models.by_provider(slug).chat_models.map { |m| "#{slug}/#{m.id}" }
+        end
+        (declared + native).uniq.sort
+      end
+    end
+
+    # Type-to-search picker over model_refs (the _agent_picker idiom: <input list>
+    # over a <datalist>, native, no JS). The datalist suggests; the SERVER decides —
+    # `checked_model_ref` refuses a typed ref outside the list. A stored value outside
+    # it is shown as is, marked, and may be saved back unchanged.
+    def model_select(name, current, blank_label)
+      cur = current.to_s
+      esc = ->(s) { Rack::Utils.escape_html(s.to_s) }
+      list_id = "model-options-#{@model_picker_seq = (@model_picker_seq || 0) + 1}"
+      options = model_refs.map { |ref| %(<option value="#{esc.(ref)}"></option>) }.join
+      stale = cur.empty? || model_refs.include?(cur) ? "" : %( <span class="muted">not configured</span>)
+      %(<input type="search" class="filter-input" name="#{esc.(name)}" list="#{list_id}" value="#{esc.(cur)}" ) +
+        %(autocomplete="off" placeholder="#{esc.(blank_label)} — type to search">#{stale}) +
+        %(<datalist id="#{list_id}">#{options}</datalist>)
+    end
+
+    # An ORDERED list of refs (fallback chains, proposers): one picker per slot,
+    # posted as "<name>[]", always one empty slot more than stored (min `min`).
+    def model_slots(name, values, min: 3)
+      values = Array(values)
+      slots = [values.size + 1, min].max.times.map do |i|
+        %(<label>#{i + 1}. #{model_select("#{name}[]", values[i], 'empty')}</label>)
+      end
+      %(<div class="grid-2">#{slots.join}</div>)
+    end
+
+    # A picked ref must be one the picker offers; `kept` (the stored value) may come
+    # back unchanged even when it is no longer listed. Blank = nil (inherit/none).
+    def checked_model_ref(raw, kept = nil)
+      ref = presence(raw)
+      return ref if ref.nil? || model_refs.include?(ref) || Array(kept).include?(ref)
+
+      raise Insika::ValidationError, "unknown model '#{ref}' — pick one from the list (Settings › LLM providers)"
+    end
+
+    # "provider/model" for a stored pair (the agent and the platform default keep
+    # them apart); a bare model when there is no provider.
+    def model_ref_of(model, provider)
+      m = model.to_s
+      p = provider.to_s
+      return "" if m.empty?
+
+      p.empty? ? m : "#{p}/#{m}"
+    end
+
     # Renders the per-model reasoning map ({ "ref" => { "thinking" => v } }) back to
     # the textarea lines "ref | thinking" that model_params_patch parses. Only refs
     # with a set thinking are shown (blank ones are inherit no-ops).
@@ -1841,6 +2303,38 @@ end
       # Which agents specialized THIS skill — the availability grid shows it, so an
       # override is discoverable from the shared skill it overrides.
       @specialized = insika[:skill_store] ? specialized_by : {}
+      @skill_reach = skill_reach(@agents, @skills)
+      @skill_groups = skill_groups(@skills)
+    end
+
+    # { skill name => [agent ids that can load it] }: own list + kits, or "all".
+    def skill_reach(agents, skills)
+      reach = Hash.new { |h, k| h[k] = [] }
+      agents.each do |own|
+        p = Insika::Kits.apply(own, kits_by_name)
+        allowed = p.skills.nil? ? nil : Array(p.skills).map(&:to_s)
+        skills.each { |s| reach[s.name] << p.id if allowed.nil? || allowed.include?(s.name) }
+      end
+      reach
+    end
+
+    # [[label, skills]]: skills sharing a name prefix ("grocery-core",
+    # "grocery-offers" -> "grocery") group together; the rest go to "Other", last.
+    def skill_groups(skills)
+      prefix = ->(s) { s.name.include?("-") ? s.name.split("-").first : nil }
+      shared = skills.filter_map { |s| prefix.(s) }.tally.select { |_, n| n > 1 }.keys
+      skills.group_by { |s| shared.include?(prefix.(s)) ? prefix.(s) : "Other" }
+            .sort_by { |label, _| [label == "Other" ? 1 : 0, label] }
+    end
+
+    # Kits drill: master = every kit; the editor checks skills/tools/groups from the
+    # live catalogs. @selected nil = none open, "" = new.
+    def load_kits
+      @kits = (insika[:settings_store]&.kits || {}).sort.to_h
+      @skills = (insika[:skill_catalog]&.all || []).sort_by(&:name)
+      @tools = (insika[:tool_catalog]&.all || []).sort_by(&:name)
+      @tool_group_names = @tools.filter_map { |t| t.plugin.to_s if t.plugin.to_s.start_with?("mcp:") }.uniq.sort
+      @agents = insika[:profile_source].all.sort_by(&:id)
     end
 
     # { skill name => [agent ids] } across every agent scope in the store.
@@ -1862,6 +2356,31 @@ end
     # Raw content for the editor: prefer the store (real SKILL.md), otherwise
     # reconstruct from what the catalog parsed (editing a disk skill
     # creates an override in the store — Store wins).
+    # -> [ { "content" =>, "from" =>, "to" => } ] most recent first, the current
+    # one included (to: nil). Each version was in use from its write until the
+    # next one, so a turn's time picks the version it ran. Disk-only skill: [].
+    def skill_versions(name, agent: nil)
+      store = insika[:skill_store]
+      current = store&.get(name, agent: agent)
+      return [] unless current
+
+      all = [{ "content" => current, "at" => store.updated_at(name, agent: agent) }] + store.versions(name, agent: agent)
+      all.each_with_index.map do |v, i|
+        { "content" => v["content"], "from" => v["at"], "to" => i.zero? ? nil : all[i - 1]["at"] }
+      end
+    end
+
+    # Restoring is writing an old text again: the same command as a save, so the
+    # catalog reloads and the old version stays in the history. `version` indexes
+    # SkillStore#versions (0 = the one before the current).
+    def restore_skill_version(name, version, agent: nil)
+      i = Integer(version.to_s, exception: false)
+      old = i&.>=(0) ? insika[:skill_store]&.versions(name, agent: agent)&.[](i) : nil
+      raise Insika::ValidationError, "version #{version} does not exist" unless old
+
+      dispatch(:write_skill, { name: name, agent: agent, content: old["content"] })
+    end
+
     def skill_source(name, agent: nil)
       raw = insika[:skill_store]&.get(name, agent: agent)
       return raw if raw
@@ -1916,22 +2435,39 @@ end
 
     # --- Tools matrix --------------------------------------------------------
 
-    def render_tools_matrix
+    # The live tool catalog, grouped by origin (Native / HTTP / MCP: x). Feeds the
+    # Tools page and the agent's Tools tab.
+    def load_tool_catalog
       @tools = (insika[:tool_catalog]&.all || []).sort_by(&:name)
       # Names of the DATA-DEFINED tools (editable via the UI). The rest of the catalog are
       # code tools (allow/deny only). Used to mark and link the editor.
       @data_tool_names = insika[:tool_store] ? insika[:tool_store].names : []
+      # A data tool's `group` (commerce, b2b, groceries…) splits the HTTP section, so a
+      # catalog with every store type's tools reads by type instead of one long list.
+      data_groups = (insika[:tool_store]&.all || []).to_h { |d| [(d["name"] || d[:name]).to_s, (d["group"] || d[:group]).to_s] }
+      @tool_groups = @tools.group_by do |tool|
+        if tool.plugin.to_s.start_with?("mcp:")
+          "MCP: #{tool.plugin.delete_prefix('mcp:')}"
+        elsif @data_tool_names.include?(tool.name)
+          group = data_groups[tool.name]
+          group.to_s.empty? ? "HTTP tools" : "HTTP: #{group}"
+        else
+          "Native tools"
+        end
+      end.sort_by { |label, _| [label == "Native tools" ? 0 : label.start_with?("HTTP") ? 1 : 2, label] }
       # Stored but NOT in the catalog = the overlay refused the definition and dropped it
       # (only a stderr warn otherwise). The pane still links its editor, so the panel is
       # where you see it and where you fix it. `insika doctor` reports the same set.
       @dropped_tool_names = @data_tool_names - @tools.map(&:name)
-      @agents = insika[:profile_source].all.sort_by(&:id)
-      # Drill-down: ?a= selects the agent whose allow/deny matrix fills the detail;
-      # default to the first agent so the pane is useful on landing.
-      sel = request.params["a"]
-      @sel_agent = (sel && @agents.find { |a| a.id == sel }) || @agents.first
-      # Miller columns: the master rows frame-navigate (?a=),
-      # so a Turbo-Frame request renders just the detail pane.
+    end
+
+    # The Tools page: catalog master + one detail (nil landing, :edit, :info). A
+    # Turbo-Frame request renders just the detail pane.
+    def render_tools_page(detail: nil, selected: nil)
+      load_tool_catalog unless @tools
+      @tool_reach = tool_reach(insika[:profile_source].all, @tools)
+      @detail = detail
+      @selected = selected
       if turbo_frame?("tool-detail")
         render("tools", locals: { frame_only: true }, layout: false)
       else
@@ -1939,6 +2475,57 @@ end
       end
     end
 
+    # { tool name => [agent ids that can call it] }: the agent's own list, its kits,
+    # its tool groups, or "all"; deny wins. The same reading the turn's
+    # ToolAllowlist policy makes, over the catalog.
+    def tool_reach(agents, tools)
+      reach = Hash.new { |h, k| h[k] = [] }
+      agents.sort_by(&:id).each do |own|
+        p = Insika::Kits.apply(own, kits_by_name)
+        open = p.tools_allow.nil? && p.tools_allow_groups.nil?
+        allow = Array(p.tools_allow).map(&:to_s)
+        groups = Array(p.tools_allow_groups).map(&:to_s)
+        deny = Array(p.tools_deny).map(&:to_s)
+        tools.each do |t|
+          next if deny.include?(t.name)
+
+          reach[t.name] << p.id if open || allow.include?(t.name) || groups.include?(t.plugin.to_s)
+        end
+      end
+      reach
+    end
+
+    # Kits as stored (Settings["kits"]), read once per request.
+    def kits_by_name = (@kits_by_name ||= insika[:settings_store]&.kits || {})
+
+    # { item name => kit name } for what the agent gets from its kits (key "tools" or
+    # "skills"). The views show these on and locked: they come from the kit at turn
+    # time, never from the agent's own list, so a save must not post them.
+    def kit_sources(profile, key)
+      Array(profile.kits).each_with_object({}) do |name, acc|
+        kit = kits_by_name[name]
+        next unless kit.is_a?(Hash)
+
+        Array(kit[key]).each { |item| acc[item] ||= name }
+      end
+    end
+
+    # "3 tools · 2 skills" (own lists + kits; "all" when the list is open) for the
+    # agents master row.
+    def agent_reach(own)
+      p = Insika::Kits.apply(own, kits_by_name)
+      groups = Array(p.tools_allow_groups).size
+      tools = if p.tools_allow.nil? && p.tools_allow_groups.nil? then "all tools"
+              else "#{Array(p.tools_allow).size} tools#{" + #{groups} #{groups == 1 ? "server" : "servers"}" if groups.positive?}"
+              end
+      skills = p.skills.nil? ? "all skills" : "#{Array(p.skills).size} skills"
+      "#{tools} · #{skills}"
+    end
+
+    # The agent can call every tool or load every skill: kits add nothing to it and
+    # any tool or skill added later reaches it without anyone deciding.
+    def agent_open?(own) = (own.tools_allow.nil? && own.tools_allow_groups.nil?) || own.skills.nil?
+
     # nil = all; otherwise the list. Pre-checks the checkboxes per agent.
     def tool_allowed_for?(profile, tool_name)
       profile.tools_allow.nil? || Array(profile.tools_allow).map(&:to_s).include?(tool_name.to_s)
@@ -1966,7 +2553,7 @@ end
       @tool_name = name
       @form = tool_form(tool)
       @versions = tool && insika[:tool_store] ? insika[:tool_store].versions(name) : []
-      view("tool_edit")
+      render_tools_page(detail: :edit, selected: name)
     end
 
     # Definition (masked) -> Hash of text fields ready for the form. tool=nil
@@ -2069,13 +2656,22 @@ end
     # `?agent=` narrows every number to one agent (the sessions stamp their
     # author in `vars["agent"]`). The live layer (live_home_controller) only
     # repaints what this renders — it never computes its own baseline.
+    HOME_WINDOW_DAYS = 14
+
+    # Everything on the home is read from the sessions of the last 14 days — the
+    # window the charts already show — never from every session ever stored. The
+    # conversations total comes from the keys alone (no record read); with an agent
+    # filter it is the window's, since the agent lives inside the record.
     def render_home
       ps = insika[:profile_source]
       @agent = presence(request.params["agent"])
-      sessions = agent_sessions(all_sessions, @agent)
+      now = Time.now.utc
+      window = window_sessions(now)
+      sessions = agent_sessions(window, @agent)
+      home_operations(window, now, ps)
       @counts = {
-        "conversations" => sessions.size,
-        "messages" => sessions.sum { |s| Array(s.messages).size },
+        "conversations" => @agent ? sessions.size : session_total,
+        "messages" => sessions.sum { |s| message_count(s) },
         "agents" => ps ? ps.all.size : 0,
         "skills" => insika[:skill_catalog] ? insika[:skill_catalog].all.size : 0,
         "tools" => insika[:tool_catalog] ? insika[:tool_catalog].all.size : 0,
@@ -2089,10 +2685,12 @@ end
       # matching and the 24h floor was built three hours in the future, silently
       # emptying both charts. Instant comparisons (`cutoff`) never had the bug;
       # calendar arithmetic did.
-      now = Time.now.utc
       cutoff = now - (5 * 60)
-      @active_now = sessions.count { |s| (t = parse_time(s.updated_at)) && t >= cutoff }
+      @active_now = sessions.count { |s| (t = utc_time(s.updated_at)) && t >= cutoff }
+      # the window holds stats; the short list needs the sessions themselves
       @recent = sessions.sort_by { |s| s.updated_at.to_s }.reverse.first(8)
+                        .filter_map { |s| s.respond_to?(:messages) ? s : insika[:session_store].find(s.id) }
+      @recent = agent_sessions(recent_sessions(limit: 8), @agent) if @recent.empty?
       @activity = activity_by_day(sessions, days: 14, now: now)
       # 24h sparkline: conversations touched per hour, oldest
       # first — the same session scan, bucketed finer.
@@ -2110,11 +2708,152 @@ end
       view("home")
     end
 
-    def all_sessions
+    # The agent page's Performance tab: per fixed period (24h/7d/30d) the
+    # conversations and messages it touched (session stats), its outcomes, and
+    # the model/turn numbers from ModelMetricsStore#windows (one read).
+    def agent_performance(id, records)
+      now = Time.now.utc
+      @perf = insika[:model_metrics_store]&.windows(agent: id, now: now) || {}
+      store = insika[:session_store]
+      stats = if store.nil? then []
+              elsif store.respond_to?(:all_stats) then session_stats
+              else every_record(store)
+              end
+      mine = agent_sessions(stats, id)
+      outcome_times = records.map { |r| r.at.to_s }
+      @perf_activity = Insika::ModelMetricsStore::PERIODS.to_h do |period, seconds|
+        cut = now - seconds
+        touched = mine.select { |s| (t = utc_time(s.updated_at)) && t >= cut }
+        [period, { conversations: touched.size, messages: touched.sum { |s| message_count(s) },
+                   outcomes: outcome_times.count { |at| at >= cut.iso8601 } }]
+      end
+    end
+
+    CHANGE_WINDOW_DAYS = 30
+    CHANGE_COMPARE_DAYS = 7
+
+    # The History tab's "what changed, and what it did": outcomes per day over
+    # the last 30 days (the funnel's primary outcome when declared, else all),
+    # one marker per prompt-file write in that window, and per write the
+    # outcome count 7 days after vs 7 days before. Plain counts; nil = that
+    # window isn't whole yet (after) or predates the outcome data (before).
+    def agent_changes(id, records)
+      now = Time.now.utc
+      week = CHANGE_COMPARE_DAYS * 86_400
+      covered_from = parse_time(records.last&.at) # all() is newest first
+      @change_primary = primary_stage_for(id)
+      counted = @change_primary ? records.select { |r| reached_primary?(id, r) } : records
+      times = counted.filter_map { |r| parse_time(r.at) }
+      first_day = now.to_date - (CHANGE_WINDOW_DAYS - 1)
+      @change_days = (0...CHANGE_WINDOW_DAYS).map { |i| [first_day + i, 0] }.to_h
+      times.each { |t| @change_days[t.to_date] += 1 if @change_days.key?(t.to_date) }
+      @change_start = Time.utc(first_day.year, first_day.month, first_day.day)
+      # [current, newest older, …]: write i replaced write i + 1, which is
+      # history index i — the version a prompt's Restore form puts back.
+      changes_of = lambda do |label, kind, writes|
+        writes.each_cons(2).each_with_index.filter_map do |(after, before), i|
+          at = parse_time(after["at"])
+          next unless at && at >= @change_start
+
+          old_lines = before["content"].to_s.lines.map(&:chomp).reject { |l| l.strip.empty? }
+          new_lines = after["content"].to_s.lines.map(&:chomp).reject { |l| l.strip.empty? }
+          { file: label, kind: kind, at: at, version: i,
+            removed: old_lines - new_lines, added: new_lines - old_lines,
+            before: covered_from && covered_from <= at - week ? times.count { |t| t >= at - week && t < at } : nil,
+            after: at + week <= now ? times.count { |t| t >= at && t < at + week } : nil }
+        end
+      end
+      prompts = @prompt_files.flat_map do |pf|
+        changes_of.call(pf[:name], :prompt, [{ "content" => pf[:content], "at" => pf[:updated_at] }] + pf[:versions])
+      end
+      # this agent's own skill versions (shared skills change for every agent)
+      skills = insika[:skill_store]
+      own = skills ? skills.names(agent: id).flat_map do |name|
+        changes_of.call(name, :skill, [{ "content" => skills.get(name, agent: id), "at" => skills.updated_at(name, agent: id) }] +
+                                      skills.versions(name, agent: id))
+      end : []
+      @changes = (prompts + own).sort_by { |c| c[:at] }.reverse
+    end
+
+    COLD_AGENT_DAYS = 3
+    STALLED_AFTER = 10 * 60
+
+    def last_role(session)
+      return session.last_role if session.respond_to?(:last_role)
+
+      last = Array(session.messages).last
+      last.is_a?(Hash) ? last["role"].to_s : nil
+    end
+
+    # The operational half of the home, all over the last 24h and the agent
+    # filter: cost (vs the 24h before), outcomes, turn p95 and failures, tool
+    # health — from ModelMetricsStore and OutcomeStore. The agent ranking and
+    # the cold agents read the unfiltered 14-day window: they compare agents.
+    def home_operations(window, now, profiles)
+      metrics = insika[:model_metrics_store]
+      # one read for the 24h numbers, the cost before them and the daily chart
+      @day = metrics.respond_to?(:home) ? metrics.home(agent: @agent, now: now, days: HOME_WINDOW_DAYS) : nil
+      @day_before_cost = @day&.fetch("day_before_cost")
+      day_ago = (now - 86_400).iso8601
+      @outcomes_24h = insika[:outcome_store]&.all(agent: @agent)&.count { |r| r.at.to_s >= day_ago }
+      by_agent = window.group_by { |s| session_agent(s) }.reject { |agent, _| agent.empty? }
+      @agent_ranking = by_agent.map do |agent, list|
+        { agent: agent, conversations: list.size, today: list.count { |s| (t = utc_time(s.updated_at)) && t >= now - 86_400 },
+          messages: list.sum { |s| message_count(s) } }
+      end.sort_by { |row| [-row[:today], -row[:conversations], row[:agent]] }.first(8)
+      # Stalled: the customer spoke last, 10+ minutes ago, within the last 24h.
+      stalled_from, stalled_to = now - 86_400, now - STALLED_AFTER
+      @stalled = agent_sessions(window, @agent).filter_map do |s|
+        t = utc_time(s.updated_at)
+        next unless t && t >= stalled_from && t <= stalled_to && last_role(s) == "user"
+
+        { id: s.id, agent: session_agent(s), waiting: t }
+      end.sort_by { |row| row[:waiting] }.first(8)
+      @daily = Array(@day&.fetch("daily"))
+      cold_floor = now - COLD_AGENT_DAYS * 86_400
+      @cold_agents = profiles ? profiles.all.map { |p| p.id.to_s }.sort.reject do |id|
+        Array(by_agent[id]).any? { |s| (t = utc_time(s.updated_at)) && t >= cold_floor }
+      end : []
+    end
+
+    # Every record of a session/task store: one bulk read when the store offers
+    # `all`, otherwise (an injected store with only each_id/find) one read per id.
+    def every_record(store)
+      store.respond_to?(:all) ? store.all : store.each_id.filter_map { |id| store.find(id) }
+    end
+
+    # Sessions touched in the last HOME_WINDOW_DAYS. A store that keeps session
+    # stats gives all of them (a few bytes each) and its session ids: stats of a
+    # session that is gone are ignored, and the ids are the conversations total.
+    # Any other store (an injected double) is read whole and filtered.
+    # ponytail: reads every session's stats; a per-day index if the count of
+    # sessions ever makes that slow.
+    def window_sessions(now)
       store = insika[:session_store]
       return [] unless store
 
-      store.each_id.filter_map { |sid| store.find(sid) }
+      floor = now - (HOME_WINDOW_DAYS * 86_400)
+      in_window = ->(s) { (t = utc_time(s.updated_at)) && t >= floor }
+      return every_record(store).select(&in_window) unless store.respond_to?(:all_stats)
+
+      ids = store.each_id.to_set
+      @session_total = ids.size
+      session_stats.select { |s| ids.include?(s.id) && in_window.call(s) }
+    end
+
+    # A session's message count, whether the home holds the session or its stats.
+    def message_count(session)
+      session.respond_to?(:message_count) ? session.message_count : Array(session.messages).size
+    end
+
+    def session_total
+      return @session_total if @session_total
+
+      store = insika[:session_store]
+      return 0 unless store
+
+      # a paging store counts by key (a Struct double answers #count too, hence #recent)
+      store.respond_to?(:recent) && store.respond_to?(:count) ? store.count : every_record(store).size
     end
 
     def parse_time(str)
@@ -2161,7 +2900,7 @@ end
     def message_delta(sessions, now)
       today = now.to_date
       sum = ->(date) do
-        sessions.sum { |s| (t = utc_time(s.updated_at)) && t.to_date == date ? Array(s.messages).size : 0 }
+        sessions.sum { |s| (t = utc_time(s.updated_at)) && t.to_date == date ? message_count(s) : 0 }
       end
       sum.call(today) - sum.call(today - 1)
     end
@@ -2171,8 +2910,9 @@ end
     # anything else would otherwise bucket by its own zone. `getutc`, not `utc`:
     # the latter mutates the receiver.
     def utc_time(value)
-      t = parse_time(value)
-      t&.getutc
+      # one parse per stamp per request: the home reads tens of thousands of them,
+      # several times each (window, activity, trend)
+      (@utc_times ||= {}).fetch(value) { @utc_times[value] = parse_time(value)&.getutc }
     end
 
     # --- History -------------------------------------------------------------
@@ -2183,8 +2923,9 @@ end
       store = insika[:session_store]
       return [] unless store
 
-      store.each_id.filter_map { |sid| store.find(sid) }
-           .sort_by { |s| s.updated_at.to_s }.reverse.first(limit)
+      return store.recent(limit) if store.respond_to?(:recent)
+
+      every_record(store).sort_by { |s| s.updated_at.to_s }.reverse.first(limit)
     end
 
     # Compact relative age ("just now", "9min", "3h", "2d") for a timestamp string.
@@ -2202,6 +2943,19 @@ end
       "#{hrs / 24}d"
     end
 
+    # Same pattern as markdown.js TAG_TOKEN, on escaped text.
+    TAG_TOKEN = %r{&lt;/?[a-z][\w-]*(?:\s+[\w-]+(?:=(?:&quot;.*?&quot;|&#39;.*?&#39;|[\w-]+))?)*\s*/?&gt;}i
+
+    # Escaped text with its markup tags (<carrossel/>, <vitrine formato="x">)
+    # wrapped like markdown.js markTags does, for text not rendered as Markdown.
+    # With `limit`: a one-line preview, cut without splitting a tag (a half tag
+    # "<ve" would read as plain text).
+    def mark_tags(text, limit = nil)
+      s = text.to_s
+      s = s.gsub(/\s+/, " ").strip[0, limit].sub(/<[^>]*\z/, "").rstrip if limit
+      Rack::Utils.escape_html(s).gsub(TAG_TOKEN) { %(<span class="tag-token">#{_1}</span>) }
+    end
+
     def session_preview(session)
       last = Array(session.messages).reverse.find { |m| %w[user assistant].include?(m["role"]) }
       # Structured content previews as JSON (message_content), never #inspect —
@@ -2213,14 +2967,19 @@ end
 
     # The agent config tab's groups, in sidebar order. The view renders the
     # same keys; a bogus ?cfg= falls back to the first group.
-    CONFIG_SECTIONS = %w[model guardrails grounding funnel followups schedules distill harvest refinement budget_rel routing advanced].freeze
+    CONFIG_SECTIONS = %w[model retrieval guardrails grounding funnel followups schedules distill harvest refinement budget_rel routing advanced].freeze
 
-    SETTINGS_SECTIONS = %w[general models edge evals llm demo].freeze
+    SETTINGS_SECTIONS = %w[general models edge burst agents evals llm demo].freeze
     def render_settings
       store = insika[:settings_store]
       @settings = store ? store.get : Insika::SettingsStore::DEFAULTS
       @providers = insika[:llm_provider_store] ? insika[:llm_provider_store].all : []
       @section = SETTINGS_SECTIONS.include?(request.params["s"]) ? request.params["s"] : "general"
+      if @section == "agents"
+        @agent = agent_defaults_profile
+        @guardrails = @agent.guardrails || {}
+        @agent_defaults_form = true
+      end
       @persistence = insika[:config][:persistence].to_s
       view("settings")
     end
@@ -2314,11 +3073,190 @@ end
     # --- Chats -----------------------------------------------------
 
     def render_chats
-      @agent = presence(request.params["agent"])
-      @sessions = agent_sessions(recent_sessions(limit: 100), @agent)
+      setup_chat_list(request.params)
       view("chats")
     end
 
+    CHATS_PAGE = 100
+
+    # --- Live floor ---------------------------------------------
+
+    LIVE_CARDS = 24
+
+    # The live floor's baseline: the latest conversations, newest first.
+    # ?agent= narrows the cards to one agent: newest first over the stats (a
+    # few bytes each), then only the shown sessions are read whole.
+    def render_live
+      @agent = presence(request.params["agent"])
+      store = insika[:session_store]
+      @sessions = if @agent && store.respond_to?(:all_stats)
+                    session_stats.select { |s| session_agent(s) == @agent }
+                         .sort_by { |s| s.updated_at.to_s }.last(LIVE_CARDS).reverse
+                         .filter_map { |s| store.find(s.id) }
+                  else
+                    agent_sessions(recent_sessions(limit: LIVE_CARDS), @agent)
+                  end
+      view("live")
+    end
+
+    # The Chats master list, shared by the index and the session viewer. Agent
+    # and id/customer search run over EVERY session's stats (a few bytes each), newest
+    # first; only the rows shown are read whole. ?limit= grows the page.
+    def setup_chat_list(params)
+      @agent = presence(params["agent"])
+      @query = presence(params["q"].to_s.strip)
+      @status = CHAT_STATUSES.include?(params["status"]) ? params["status"] : nil
+      @limit = [params["limit"].to_i, CHATS_PAGE].max
+      store = insika[:session_store]
+      return @sessions = [] unless store
+
+      all = store.respond_to?(:all_stats) ? session_stats : every_record(store)
+      @chats_all = all.size
+      # the agents column: one row per agent with conversations, latest first
+      @chat_agents = all.group_by { |s| session_agent(s) }.except("")
+                        .map { |id, list| [id, list.size, list.map { |s| s.updated_at.to_s }.max] }
+                        .sort_by { |row| row.last }.reverse
+      rows = agent_sessions(all, @agent)
+      rows = rows.select { |s| chat_matches?(s, @query.downcase) } if @query
+      @status_counts = CHAT_STATUSES.to_h { |st| [st, rows.count { |s| chat_status?(s, st) }] }
+      rows = rows.select { |s| chat_status?(s, @status) } if @status
+      rows = rows.sort_by { |s| s.updated_at.to_s }.reverse
+      @chats_total = rows.size
+      @sessions = rows.first(@limit).filter_map { |s| store.find(s.id) }
+      @more = [CHATS_PAGE, rows.size - @limit].min
+    end
+
+    # The Chats search: the session id, the customer key, name or phone.
+    def chat_matches?(stat, query)
+      vars = stat.vars.is_a?(Hash) ? stat.vars : {}
+      [stat.id, vars["customer"], *vars.values_at(*Insika::SessionStore::CUSTOMER_LABELS)]
+        .any? { |v| v.to_s.downcase.include?(query) }
+    end
+
+    # One turn's tool calls as waterfall bars: each entry's start is its
+    # stamp minus its duration; x/w are percent of the turn's span. Entries
+    # without a parseable stamp are left out. -> [{ tool:, ok:, ms:, x:, w: }]
+    # The skill a load_skill trace entry loaded, for the link to its page; nil for
+    # any other tool. Args arrive as a Hash or as the JSON text the model sent.
+    def loaded_skill_name(entry)
+      return nil unless entry["tool"].to_s == "load_skill"
+
+      args = entry["args"]
+      args = JSON.parse(args.to_s) rescue nil unless args.is_a?(Hash)
+      name = args.is_a?(Hash) ? args["name"].to_s : ""
+      name.empty? ? nil : name
+    end
+
+    def trace_waterfall(entries)
+      rows = entries.filter_map do |t|
+        finish = utc_time(t["at"]) or next
+        ms = t["ms"].to_f
+        { tool: t["tool"], ok: t["ok"] && !t["gate"], ms: t["ms"], start: finish - (ms / 1000), finish: finish }
+      end
+      return [] if rows.empty?
+
+      first = rows.map { _1[:start] }.min
+      span = [rows.map { _1[:finish] }.max - first, 0.001].max
+      rows.map do |r|
+        x = ((r[:start] - first) / span * 100).round(2)
+        r.slice(:tool, :ok, :ms).merge(x: x, w: [((r[:finish] - r[:start]) / span * 100).round(2), 0.8].max.clamp(0, 100 - x))
+      end
+    end
+
+    # "Why did it say that?" — one entry per reply, keyed by the index of the
+    # turn's LAST assistant message with text. Messages persisted with a task_id
+    # split where it changes; older ones guess: a turn opens on a user message
+    # that is not steered (a steered one joins the running turn). The context
+    # entry matches by task_id (older ones: by time, it is written before the
+    # turn's messages are persisted), tool traces by call id (the persisted
+    # tool_calls carry it). -> { index => { context:, tools:, calls:, flags: } }
+    def why_panels(messages, context_traces, tool_traces)
+      by_call = tool_traces.to_h { [_1["call_id"].to_s, _1] }
+      pending = context_traces.sort_by { _1["at"].to_s }
+      turns = messages.each_index.slice_before do |i|
+        task, prev = messages[i]["task_id"].to_s, i.positive? ? messages[i - 1]["task_id"].to_s : ""
+        next task != prev unless task.empty? || prev.empty?
+
+        messages[i]["role"].to_s == "user" && !(i.positive? && messages[i - 1]["role"].to_s == "tool")
+      end
+      turns.each_with_object({}) do |idx, acc|
+        msgs = messages.values_at(*idx)
+        at = msgs.first["at"].to_s
+        context = nil
+        if (task_id = presence(msgs.first["task_id"].to_s))
+          # exact: the turn's own trace (the last one, if the task suspended and resumed)
+          context = context_traces.select { _1["task_id"].to_s == task_id }.max_by { _1["at"].to_s }
+          pending.reject! { _1["at"].to_s <= at }
+        else
+          # older messages carry no task_id: the latest trace recorded before the turn was saved
+          context = pending.shift while !at.empty? && pending.first && pending.first["at"].to_s <= at
+        end
+        reply = idx.reverse.find { |i| messages[i]["role"].to_s == "assistant" && !messages[i]["content"].to_s.empty? } or next
+        calls = msgs.flat_map { |m| Array(m["tool_calls"]) }
+        acc[reply] = { context: context, tools: by_call.values_at(*calls.map { _1["id"].to_s }).compact,
+                       calls: calls.map { _1["name"].to_s }.uniq,
+                       flags: msgs.select { _1["role"].to_s == "user" }.flat_map { Array(_1["guardrail_flags"]) } }
+      end
+    end
+
+    # A case prefilled from one reply (/studio/evals?session=&reply=): the
+    # customer's messages up to it as `turns`, the transcript as the `reference`,
+    # the tools its turn called as `tools_called`. Nothing is written here — the
+    # operator adds the rubric and saves through the same POST as any case.
+    def session_case_yaml(sid, reply)
+      return nil if reply.negative?
+
+      session = insika[:session_store]&.find(sid) or return nil
+      msgs = Array(session.messages).first(reply + 1)
+      panel = why_panels(msgs, [], [])[reply] or return nil
+      agent = presence(session_agent(session)) || "my-agent"
+      said = msgs.select { %w[user assistant].include?(_1["role"].to_s) && !_1["content"].to_s.empty? }
+      expect = { "tools_called" => panel[:calls], "must_not" => %w[pii_leak tool_error], "rubric" => "" }
+      expect.delete("tools_called") if panel[:calls].empty?
+      YAML.dump({ "id" => "#{agent}-#{sid[0, 8]}-#{reply}", "agent" => agent,
+                  "turns" => said.select { _1["role"] == "user" }.map { { "user" => message_content(_1["content"]).to_s } },
+                  "reference" => { "source" => "session #{sid}",
+                                   # origin keeps an operator-typed reply from being judged as the model's
+                                   "messages" => said.map do |m|
+                                     { "role" => m["role"], "text" => message_content(m["content"]).to_s,
+                                       "origin" => Insika::MessageOrigin.origin_of(m) }.compact
+                                   end },
+                  "expect" => expect })
+    end
+
+    CHAT_STATUSES = %w[active flagged].freeze
+
+    # The Chats status tabs: "active" = touched in the last 5 minutes (the
+    # presence dot), "flagged" = a guardrail flagged one of its messages and
+    # nobody resolved it yet.
+    def chat_status?(stat, status)
+      case status
+      when "active" then session_fresh?(stat)
+      when "flagged" then session_flagged?(stat)
+      else true
+      end
+    end
+
+    def session_flagged?(session)
+      if session.respond_to?(:flagged) then session.flagged.positive?
+      else Array(session.respond_to?(:messages) ? session.messages : nil).any? { |m| m.is_a?(Hash) && Array(m["guardrail_flags"]).any? { Insika::SessionStore.open_flag?(_1) } }
+      end
+    end
+
+    # Conversations of the same customer key (stats only) — the session's
+    # Customer card.
+    def customer_chat_count(customer)
+      store = insika[:session_store]
+      return 1 if customer.to_s.empty? || !store.respond_to?(:all_stats)
+
+      [session_stats.count { |s| s.vars["customer"].to_s == customer }, 1].max
+    end
+
+    def chats_path(**extra)
+      query = Rack::Utils.build_query({ agent: @agent, q: @query, status: @status, **extra }.compact)
+      query.empty? ? "/studio/chats" : "/studio/chats?#{query}"
+    end
+
     # --- Customers  ----------------------------------
 
     # The index: every CUSTOMER memory cell, grouped by tenant. The caller
@@ -2328,15 +3266,7 @@ end
     # reads per conversation on every render).
     def render_customers
       mem = insika[:memory_store]
-      agent_ids = insika[:profile_source] ? insika[:profile_source].all.map(&:id) : []
-      @agent = presence(request.params["agent"])
-      @rows = mem ? mem.customer_cells(reserved: Array(agent_ids) + ["_default"]).map do |cell|
-        { cell: cell, count: mem.fact_count(tenant: cell[:tenant], customer: cell[:customer]) }
-      end : []
-      # ?agent= narrows to one tenant — the memory scope is the agent (the
-      # agent-memory tab writes under tenant = agent id).
-      @rows = @rows.select { |row| row[:cell][:tenant] == @agent } if @agent
-      @by_tenant = @rows.group_by { |row| row[:cell][:tenant] }
+      setup_customer_rows(mem)
       view("customers")
     end
 
@@ -2348,28 +3278,150 @@ end
       @facts = mem ? mem.facts(tenant: cell[:tenant], customer: cell[:customer]) : []
       @notes = mem ? mem.notes(tenant: cell[:tenant], customer: cell[:customer], limit: 50) : []
       @audit = insika[:memory_audit_store]&.for_cell(scope) || []
-      view("customer")
+      # master column: the detail page IS the shell when visited directly;
+      # only a frame request renders the pane alone.
+      setup_customer_rows(mem)
+      if turbo_frame?("customer-detail")
+        render("customer", locals: { frame_only: true }, layout: false)
+      else
+        view("customer", locals: { frame_only: false })
+      end
     end
 
-    def customer_path(scope)
+    def customer_path(scope, agent: nil)
       # escape_path, not escape: the route decodes with unescape_path, which
       # does not turn '+' back into a space (escape's form-encoding would).
-      "/studio/customers/#{Rack::Utils.escape_path(scope)}"
+      path = "/studio/customers/#{Rack::Utils.escape_path(scope)}"
+      agent ? "#{path}?agent=#{Rack::Utils.escape(agent)}" : path
+    end
+
+    # Shared helper for Customers index and detail: loads all customer cells,
+    # counts facts per cell, filters by agent if ?agent= is present, and
+    # groups by tenant. Sets @rows and @by_tenant.
+    def setup_customer_rows(mem)
+      agent_ids = insika[:profile_source] ? insika[:profile_source].all.map(&:id) : []
+      @rows = mem ? mem.customer_cells(reserved: Array(agent_ids) + ["_default"]).map do |cell|
+        { cell: cell, count: mem.fact_count(tenant: cell[:tenant], customer: cell[:customer]) }
+      end : []
+      @agent = presence(request.params["agent"])
+      @rows = @rows.select { |row| row[:cell][:tenant] == @agent } if @agent
+      @by_tenant = @rows.group_by { |row| row[:cell][:tenant] }
     end
 
     # Tasks & Approvals --------------------------------
 
+    def render_models
+      @period = request.params["period"]
+      @agent = presence(request.params["agent"])
+      @provider = presence(request.params["provider"])
+      @model = presence(request.params["model"])
+      # Dates count only for "Custom range" (or a bare ?from&to link): picking a fixed period wins.
+      range = model_custom_range(request.params["from"], request.params["to"]) if [nil, "custom"].include?(@period)
+      @range_from, @range_to = range&.map { |t| t.strftime("%Y-%m-%d") }
+      args = { period: @period || "7d", agent: @agent, provider: @provider, model: @model }
+      args.merge!(from: range[0], to: range[1] + 86_400) if range # `to` is inclusive: through the end of that day
+      @report = insika[:model_metrics_store]&.report(**args)
+      @period = @report ? @report["period"] : (%w[24h 7d 30d].include?(@period) ? @period : "7d")
+      view("models")
+    end
+
+    MODEL_RANGE_MAX_DAYS = 366
+
+    # [from, to] as UTC midnights from two YYYY-MM-DD fields; nil when either is
+    # missing or malformed, reversed, or wider than a year (the fixed period applies).
+    def model_custom_range(from, to)
+      first, last = [from, to].map { |d| Time.strptime("#{d} UTC", "%Y-%m-%d %Z").utc }
+      return nil if first > last || (last - first) / 86_400 > MODEL_RANGE_MAX_DAYS
+
+      [first, last]
+    rescue ArgumentError, TypeError
+      nil
+    end
+
+    # The x-axis/table label follows the bucket size, custom ranges included.
+    def model_interval_label(step)
+      step = step.to_i
+      return "Hourly" if step <= 3600
+      return "6-hour intervals" if step <= 6 * 3600
+      return "Daily" if step <= 86_400
+
+      "#{(step / 86_400.0).round}-day intervals"
+    end
+
+    # Money for the home: cents above a dollar, 4 significant digits below it,
+    # so a day of cheap turns never reads as $0.00.
+    def usd(value)
+      return "—" if value.nil?
+
+      value.abs >= 1 || value.zero? ? format("$%.2f", value) : format("$%.4g", value)
+    end
+
+    def model_chart_value(value, unit)
+      return "—" if value.nil?
+
+      case unit
+      when "USD" then format("$%.6f", value)
+      when "ms" then format("%.2f ms", value)
+      else value.to_i.to_s
+      end
+    end
+
+    def model_chart_tick(value, unit)
+      return "$0" if unit == "USD" && value.zero?
+      return format("$%.4g", value) if unit == "USD"
+      return format("%.1f s", value / 1000.0) if unit == "ms" && value >= 1000
+      return format("%.3g ms", value) if unit == "ms"
+
+      format("%.3g", value)
+    end
+
+    def model_chart_paths(points)
+      points.slice_when { |left, right| left.nil? || right.nil? }.filter_map do |segment|
+        values = segment.compact
+        next if values.empty?
+
+        "M" + values.map { |x, y| format("%.2f %.2f", x, y) }.join(" L")
+      end
+    end
+
     # Task list, most-recently-updated first. Empty-state if no store was injected.
     # `?agent=` narrows to one agent (the task's command payload stamps it).
+    TASKS_PER_PAGE = 50
+    # ponytail: the agent filter scans this many recent tasks (the payload holds
+    # the agent, not the key); an index by agent if older matches ever matter.
+    TASKS_AGENT_SCAN = 5_000
+
+    # One page of tasks, most recently updated first. Reads one page more than it
+    # shows to know whether there is a next one, never the whole store.
     def render_tasks
       store = insika[:task_store]
       @agent = presence(request.params["agent"])
-      @tasks = store ? store.each_id.filter_map { |id| store.find(id) } : []
-      @tasks = @tasks.select { |t| task_agent(t) == @agent } if @agent
-      @tasks = @tasks.sort_by { |t| t.updated_at.to_s }.reverse
+      @page = request.params["page"].to_i.clamp(1, 1_000_000)
+      offset = (@page - 1) * TASKS_PER_PAGE
+      rows =
+        if store.nil? then []
+        elsif @agent
+          recent_tasks(store, TASKS_AGENT_SCAN, 0).select { |t| task_agent(t) == @agent }
+                                                  .drop(offset).first(TASKS_PER_PAGE + 1)
+        else
+          recent_tasks(store, TASKS_PER_PAGE + 1, offset)
+        end
+      @more = rows.size > TASKS_PER_PAGE
+      @tasks = rows.first(TASKS_PER_PAGE)
       view("tasks")
     end
 
+    def recent_tasks(store, limit, offset)
+      return store.recent(limit, offset: offset) if store.respond_to?(:recent)
+
+      every_record(store).sort_by { |t| t.updated_at.to_s }.reverse.drop(offset).first(limit)
+    end
+
+    def tasks_page_path(page)
+      query = { "agent" => @agent, "page" => (page if page > 1) }.compact
+      query.empty? ? "/studio/tasks" : "/studio/tasks?#{Rack::Utils.build_query(query)}"
+    end
+
     def task_agent(task)
       command = task.command
       command.is_a?(Hash) ? command.dig("payload", "agent").to_s : ""
@@ -2378,8 +3430,9 @@ end
     # Task detail: @task is set by the route. Adds the open approvals for this task
     # and its latest checkpoint (both degrade to empty when the store is absent).
     def render_task_detail(id)
-      @pending = insika[:pending_action_store] ? insika[:pending_action_store].open_for(id) : []
+      @pending = insika[:pending_action_store] ? insika[:pending_action_store].open_for(id, kind: Insika::PendingActionStore::OPERATOR) : []
       @checkpoint = insika[:checkpoint_store]&.latest(id)
+      @llm_trace = insika[:llm_trace_store]&.for_task(id) || { "entries" => [], "truncated" => false }
       view("task")
     end
 
@@ -2390,7 +3443,7 @@ end
       pstore = insika[:pending_action_store]
       tstore = insika[:task_store]
       @agent = presence(request.params["agent"])
-      @approvals = pstore ? pstore.all_open.map { |pa| { pending: pa, task: tstore&.find(pa.task_id) } } : []
+      @approvals = pstore ? pstore.all_open(kind: Insika::PendingActionStore::OPERATOR).map { |pa| { pending: pa, task: tstore&.find(pa.task_id) } } : []
       if @agent
         @approvals = @approvals.select { |a| task_agent(a[:task]) == @agent if a[:task] }
       end
@@ -2412,6 +3465,8 @@ def render_evals
   wanted = presence(request.params["id"])
   @case = wanted && @cases.find { |g| g.id == wanted }
   @case_yaml = @case ? golden_yaml(@case) : nil
+  from = presence(request.params["session"])
+  @case_yaml ||= session_case_yaml(utf8(from), request.params["reply"].to_i) if from
   view("evals")
 end
 
@@ -2433,19 +3488,43 @@ end
 
     # Refinement -----------------------------
 
-    # The agent's latest failure report + its run history. Empty-state when no store
-    # was injected or the agent has never been run — the page is the invitation to
-    # run it, so there is nothing to hide behind a nil.
+    # The index: master pane lists the scoped agent's run history; the detail
+    # pane defaults to the run that most needs a look — one awaiting a human
+    # answer if there is one (at most one is possible: gating requires a
+    # `completed` run and there is one lifecycle per record), else the most
+    # recent terminal run. Empty-state when no store was injected or the
+    # agent has never been run — the page is the invitation to run it, so
+    # there is nothing to hide behind a nil.
     def render_refinement
+      refinement_rows(request.params["agent"])
+      @selected = @runs.find(&:awaiting_approval?) || @runs.find(&:terminal?)
+      view("refinement")
+    end
+
+    # GET /studio/refinement/:id — one run, whatever its status, with the
+    # master pane scoped to ITS agent (a deep link may land on a run that
+    # isn't the current default selection).
+    def render_refinement_detail(id)
+      @selected = insika[:refinement_store]&.find(id)
+      next_404 unless @selected
+
+      refinement_rows(@selected.agent_id)
+      if turbo_frame?("refinement-detail")
+        render("refinement_detail", locals: { frame_only: true }, layout: false)
+      else
+        view("refinement_detail", locals: { frame_only: false })
+      end
+    end
+
+    # Shared read for both Refinement routes: every agent id (the Run form's
+    # target and the scope filter's options), the ?agent= scope (falling back
+    # to the first agent so there is always something to show), and that
+    # agent's run history, most recent first.
+    def refinement_rows(requested_agent)
       @agents = insika[:profile_source].ids.sort
-      @agent = presence(request.params["agent"]) || @agents.first
+      @agent = presence(requested_agent) || @agents.first
       store = insika[:refinement_store]
       @runs = @agent && store ? store.for_agent(@agent, limit: 10) : []
-      @run = @runs.find(&:terminal?)
-      # The one run that owes this agent a human answer. At most one is possible:
-      # gating requires a `completed` run and there is one lifecycle per record.
-      @proposal = @runs.find(&:awaiting_approval?)
-      view("refinement")
     end
 
     # --- Parity  -------------------------------------------------
@@ -2587,6 +3666,9 @@ end
       p = request.params["period"].to_i
       @period = p.positive? ? p : 30
       @agent = presence(request.params["agent"])
+      # ?drop=<stage>&tenant=: the "where conversations stop" drill of ONE card
+      @drop = presence(request.params["drop"])
+      @drop_tenant = presence(request.params["tenant"])
       profiles = profiles.select { |p| p.id == @agent } if @agent
       @stores = profiles.filter_map do |p|
         decl = Insika::FunnelDeclaration.parse(p.funnel)
@@ -2625,6 +3707,32 @@ end
     # a link, never a copy: the excerpt is read from the session at request
     # time); the mutations dispatch :resolve_proposal on the bus.
     def render_facts
+      facts_queues
+      # The landing selection: the first pending item (the operator's next
+      # thing to review) — falling back to stale, then a resolved one, so the
+      # pane is never blank while ANY proposal exists. `.empty` only when the
+      # whole queue (pending + stale + recent) is.
+      @selected = @pending.first || @stale.first || @recent.first
+      view("facts")
+    end
+
+    # GET /studio/facts/:id — a specific proposal, whatever its status. Reads
+    # the store directly (a resolved fact past the `resolved(limit: 20)` window
+    # still opens by id — the truncated lists are for the queue, not a lookup).
+    def render_fact_detail(id)
+      facts_queues
+      @selected = insika[:proposal_store]&.find(id)
+      next_404 unless @selected
+      if turbo_frame?("fact-detail")
+        render("fact_detail", layout: false)
+      else
+        view("facts")
+      end
+    end
+
+    # Shared read for both Facts routes: the three queues (pending/stale/
+    # recent), the `?agent=`/`?store=` filter, and the scope picklist.
+    def facts_queues
       store = insika[:proposal_store]
       @pending = store ? store.pending(limit: 100) : []
       @stale   = store ? store.stale(limit: 50) : []
@@ -2644,7 +3752,6 @@ end
       @stores  = (insika[:profile_source].ids.sort +
                   (@pending + @stale + @recent).map(&:scope)).uniq.sort
       @sessions = insika[:session_store]
-      view("facts")
     end
 
     # A proposal matches the filter as the memory scope it carries, or as the
@@ -2656,6 +3763,19 @@ end
       session && session_agent(session) == filter
     end
 
+    # Where a resolve POST lands: the next pending item in the SAME filtered
+    # scope the operator was working, so approve/reject/dismiss feeds straight
+    # into the next thing to review instead of dumping them back on a list.
+    # No pending left (in that scope) -> the plain facts list (stale/recent,
+    # or the empty state).
+    def next_fact_path(filter)
+      store = insika[:proposal_store]
+      pending = store ? store.pending(limit: 100) : []
+      pending = pending.select { |p| scope_matches?(p, filter) } if filter
+      base = pending.first ? "/studio/facts/#{Rack::Utils.escape(pending.first.id)}" : "/studio/facts"
+      filter ? "#{base}?store=#{Rack::Utils.escape(filter)}" : base
+    end
+
     # the Harvest page — the human gate on mined skills. Reads
     # HarvestStore/SessionStore directly (the evidence excerpt is read from the
     # session at request time — D7: ids and indexes only are stored); every
@@ -2683,9 +3803,28 @@ end
       @sessions = insika[:session_store]
       @negative = insika[:negative_list]
       @filter = presence(request.params["agent"])
+      @idle_reason = harvest_idle_reason(@agent)
       view("harvest")
     end
 
+    # Why the automatic loop elects none of this agent's conversations — the
+    # engine skips them silently (HarvestEngine#harvest_declared?), so the page
+    # says it. nil when the agent is minable.
+    def harvest_idle_reason(agent_id)
+      profile = agent_id && insika[:profile_source].fetch(agent_id)
+      return nil unless profile
+
+      # The loop reads profiles with the platform defaults applied (an agent
+      # with no harvest of its own inherits Settings › Agent defaults).
+      profile = Insika::AgentDefaults.apply_safely(profile, platform_agent_defaults)
+      return :off unless Insika::Coercion.truthy?((profile.harvest || {})["enabled"])
+
+      grounding = Insika::Grounding.parse(profile.grounding)
+      grounding&.matcher&.sku? ? nil : :no_matcher
+    rescue StandardError
+      :no_matcher # a matcher that does not parse is no matcher
+    end
+
     # --- Knowledge index -------------------------------------------------
 
     # Master data for the Knowledge drill-down: every concept of ONE agent
@@ -2693,7 +3832,7 @@ end
     # occurrences/updated_at). A record that fails to parse (corrupted by a
     # hand edit) still shows by name, blank elsewhere, rather than vanishing.
     def load_knowledge_master(agent:, tenant: nil)
-      @status ||= "all"
+      @status ||= presence(request.params["status"]) || "all"
       store = insika[:knowledge_store]
       names = agent && store ? store.names(agent, tenant: tenant) : []
       concepts = names.filter_map do |n|
@@ -2747,9 +3886,10 @@ end
 
     # The redirect/link target after a knowledge write or restore — back to
     # the concept's own detail pane when a name is known, else the index.
-    def knowledge_path(agent, name, tenant)
+    def knowledge_path(agent, name, tenant, status: nil)
       q = "agent=#{Rack::Utils.escape(agent.to_s)}"
       q += "&tenant=#{Rack::Utils.escape(tenant)}" if tenant
+      q += "&status=#{Rack::Utils.escape(status)}" if status
       name ? "/studio/knowledge/#{Rack::Utils.escape(name)}?#{q}" : "/studio/knowledge?#{q}"
     end
 
@@ -2816,10 +3956,22 @@ end
       store = insika[:followup_store]
       return {} unless store
 
-      from = (Time.now.utc - 30 * 86_400).iso8601
-      fired = store.for_agent(tenant: presence(request.params["tenant"]) || "platform",
-                              agent: agent_id)
-                .select { |r| r.status == "fired" && r.at.to_s >= from }
+      fired_all = store.for_agent(tenant: presence(request.params["tenant"]) || "platform",
+                                  agent: agent_id)
+                    .select { |r| r.status == "fired" }
+      return {} if fired_all.empty?
+
+      # The window is 30 days of FIRES (fired_at, never the scheduled `at` —
+      # followup_store.rb's rule, the same one the frequency ceiling follows),
+      # anchored on the most recent fire across ALL arms of this agent — not
+      # per arm — rather than the wall clock. A wall-clock anchor would blank
+      # the card between visits. One shared window (not each arm's own last
+      # fire) is also the right call for an A/B readout: both arms are then
+      # measured over the same calendar span, so their percentages are
+      # actually comparable.
+      latest = fired_all.filter_map { |r| parse_time(r.fired_at || r.at) }.max
+      from = (latest - 30 * 86_400).iso8601
+      fired = fired_all.select { |r| (r.fired_at || r.at).to_s >= from }
       fired.group_by(&:arm).each_with_object({}) do |(arm, records), acc|
         sessions = records.filter_map(&:session_id)
         acc[arm] = { sent: records.size, conversions: conversions_for(agent_id, sessions),
@@ -2835,16 +3987,27 @@ end
       return 0 unless outcomes
 
       records = sessions.empty? ? [] : outcomes.all.select { |r| sessions.include?(r.session_id) }
-      primary = primary_stage_for(agent_id)
-      return records.count { |r| r.outcome == primary } if primary
+      return records.count { |r| reached_primary?(agent_id, r) } if primary_stage_for(agent_id)
 
       records.group_by(&:session_id).size
     end
 
     def primary_stage_for(agent_id)
+      funnel_decl_for(agent_id)&.primary
+    end
+
+    # An outcome record is a kind; the primary is a stage. advance_on maps one to the other.
+    def reached_primary?(agent_id, record)
+      decl = funnel_decl_for(agent_id)
+      decl && decl.advance_on[record.outcome].to_s == decl.primary.to_s
+    end
+
+    def funnel_decl_for(agent_id)
+      @funnel_decls ||= {}
+      return @funnel_decls[agent_id] if @funnel_decls.key?(agent_id)
+
       profile = insika[:profile_source]&.fetch(agent_id)
-      decl = profile && Insika::FunnelDeclaration.parse(profile.funnel)
-      decl && decl.primary
+      @funnel_decls[agent_id] = profile && Insika::FunnelDeclaration.parse(profile.funnel)
     end
 
     # The opt-outs of ONE arm: contact cells of the customers THAT ARM fired
@@ -2898,6 +4061,73 @@ end
            .each_with_object(Hash.new(0)) { |(_, counts), acc| counts.each { |s, n| acc[s] += n } }
     end
 
+    # The loss between each pair of consecutive declared stages, in order; the
+    # biggest positive one is marked (ties: the earliest stage).
+    # -> [{ from:, to:, lost:, of:, biggest: }]
+    def funnel_drops(decl, counts)
+      rows = decl.stages.each_cons(2).map do |a, b|
+        # stages are counted apart, so a later one can outgrow the earlier: no negative loss
+        { from: a, to: b, lost: [counts[a].to_i - counts[b].to_i, 0].max, of: counts[a].to_i, biggest: false }
+      end
+      top = rows.max_by { |row| row[:lost] }
+      top[:biggest] = true if top && top[:lost].positive?
+      rows
+    end
+
+    def funnel_drop_path(agent, tenant, stage)
+      query = Rack::Utils.build_query({ agent: agent, period: @period, drop: stage, tenant: tenant }.compact)
+      "/studio/funnel?#{query}"
+    end
+
+    # The last thing that happened in a conversation, most specific first.
+    DROP_REASONS = {
+      "tool_failed" => "Last tool call failed",
+      "flagged" => "A guardrail flagged a message",
+      "waiting" => "Customer waiting on a reply",
+      "quiet" => "Customer went quiet after the agent's reply",
+      "unknown" => "No message to read",
+      "gone" => "Conversation no longer stored"
+    }.freeze
+    DROP_LIST_CAP = 10
+    # Each classified session costs two reads (session + tool trace): only the
+    # newest ones are classified; the view says how many were left out.
+    DROP_CLASSIFY_CAP = 200
+
+    # The conversations that reached `stage` but not the next one in the
+    # period: each session's furthest stage over its outcome records (the
+    # fold's own advance_on mapping), kept when it is exactly `stage`.
+    # -> [[reason, [session_id]]] in DROP_REASONS order, newest first, over at
+    # most DROP_CLASSIFY_CAP sessions (@drop_total = all of them) | nil (no such drop)
+    def funnel_drop_sessions(decl, tenant, agent, stage, period)
+      index = decl.index_of(stage)
+      outcomes = insika[:outcome_store]
+      return nil unless index && index < decl.stages.length - 1 && outcomes
+
+      furthest = Hash.new(-1)
+      latest = {}
+      outcomes.for_pair(tenant: tenant, agent: agent, since_date: (Date.today - period).iso8601).each do |r|
+        i = decl.index_of(decl.advance_on[r.outcome].to_s)
+        next unless i && !r.session_id.to_s.empty?
+
+        furthest[r.session_id] = [furthest[r.session_id], i].max
+        latest[r.session_id] = [latest[r.session_id].to_s, r.at.to_s].max
+      end
+      stuck = furthest.select { |_, i| i == index }.keys.sort_by { |sid| latest[sid] }.reverse
+      @drop_total = stuck.size
+      stuck.first(DROP_CLASSIFY_CAP)
+              .group_by { |sid| drop_reason(sid) }
+              .sort_by { |reason, _| DROP_REASONS.keys.index(reason) }
+    end
+
+    def drop_reason(sid)
+      session = insika[:session_store]&.find(sid)
+      return "gone" unless session
+      return "tool_failed" if Array(insika[:tool_trace_store]&.for_session(sid)).last&.[]("ok") == false
+      return "flagged" if session_flagged?(session)
+
+      { "user" => "waiting", "assistant" => "quiet" }.fetch(last_role(session), "unknown")
+    end
+
     # BudgetLedger's current counters (D6): "tokens today / this month". nil
     # store -> the view renders 0 (the empty state).
     def funnel_spend(store, tenant, agent)
@@ -2935,6 +4165,24 @@ end
       "last #{window['last_sessions'] || Insika::Refinement::EvidenceCollector::DEFAULT_WINDOW} conversation(s)"
     end
 
+    # How long a run took (finished_at - started_at), or how long an open one
+    # has been running so far (against now) — compact, like time_ago's units.
+    def refinement_elapsed(run)
+      start = parse_time(run.started_at)
+      return nil unless start
+
+      finish = run.finished_at ? parse_time(run.finished_at) : Time.now
+      return nil unless finish
+
+      secs = (finish - start).to_i
+      return "#{secs}s" if secs < 60
+
+      mins = secs / 60
+      return "#{mins}min" if mins < 60
+
+      "#{mins / 60}h"
+    end
+
     # An operator control (pause/resume/cancel/approve): audits the ATTEMPT to the
     # shared EventStream BEFORE dispatching — accountability survives a Command
     # failure (parity with server/admin's `act`) — then dispatches via the bus with
@@ -2962,15 +4210,18 @@ end
     # is the operator). Mirrors server/admin's operator_of default.
     def operator_label = "studio"
 
-    # Semantic status class for the .pill CSS (completed=ok, running=run,
-    # waiting/queued/paused=warn, failed/cancelled=err). Parity with admin's
-    # status_pill mapping; used by the tasks/approvals views.
+    # Semantic status class, shared by the `.pill` and `.status` CSS: one
+    # vocabulary (ok / warn / err / info / neutral, plus the pill-only `run`)
+    # for every status string the console renders — task lifecycle, follow-up
+    # arms, approval decisions. `neutral` is the "nothing happened" tone: a
+    # cancelled or dismissed item is not a failure.
     def status_class(status)
       case status.to_s
-      when "completed" then "ok"
+      when "completed", "fired", "approved", "ok", "applied" then "ok"
       when "running" then "run"
-      when "waiting", "queued", "paused" then "warn"
-      when "failed", "cancelled" then "err"
+      when "pending", "waiting", "queued", "paused", "awaiting_approval" then "warn"
+      when "blocked", "failed", "rejected" then "err"
+      when "cancelled", "dismissed", "no_findings" then "neutral"
       else "info"
       end
     end
@@ -2993,13 +4244,33 @@ end
       dispatch(:send_message, { agent: agent, session_id: session_id, message: message }, tenant: agent)
     end
 
-    # Creates a new session via the bus (create_session generates the id) and returns
+    # Creates a new session via the bus (with `id`, or create_session generates one) and returns
     # the id. `model`/`provider` (optional) become the per-chat pin: CreateSession
     # stashes them in the reserved `vars["__llm__"]` slot the ModelResolver reads as
     # the highest-precedence layer (Chat > Agent > platform default). Only non-blank
     # values are sent, so an empty override leaves the session unpinned.
-    def create_session(model: nil, provider: nil, thinking: nil)
+    # The message of the turn still running in `session_id`, nil when none: it is
+    # only saved with the turn, at its end, so a viewer who comes back mid-turn
+    # (the flash already spent) would not see what was asked. Only the most
+    # recently updated tasks are read — a running turn is always among them.
+    def running_message(session_id)
+      return unless session_id
+
+      task = insika[:task_store]&.recent(20)&.find do |t|
+        t.session_id == session_id && %i[queued running waiting paused].include?(t.status)
+      end
+      task&.command&.dig("payload", "message")
+    end
+
+    # The playground's model picker -> { model:, provider: } for create_session.
+    def pinned_model(r)
+      model, provider = picked_model(r)
+      { model: model, provider: provider }
+    end
+
+    def create_session(id: nil, model: nil, provider: nil, thinking: nil)
       payload = { vars: { "canal" => "studio" } }
+      payload[:id] = id if id
       payload[:model] = model if model
       payload[:provider] = provider if provider
       payload[:thinking] = thinking if thinking
@@ -3045,6 +4316,16 @@ end
       "avatar-h#{id.to_s.bytes.sum % 10}"
     end
 
+    # Same idea for `.identity`'s 28px circle, but over the NINE themed --av-N
+    # ramps only (no h0 — the brand accent is reserved for the product's own
+    # marks, not for an arbitrary row). Deterministic: the same id always
+    # yields the same hue, so a list keeps its colours across renders.
+    def avatar_hue(id) = (id.to_s.bytes.sum % 9) + 1
+
+    # The readable head of a uuid. Callers put the FULL value in `title` and
+    # `data-copy` so nothing is lost by the truncation.
+    def short_id(uuid) = uuid.to_s[0, 8]
+
     # Where a prompt POST lands back: the same file open in the drill, scrolled
     # to the prompts section. No file (a delete, say) → the agent page itself.
     def prompt_edit_path(id, file)
@@ -3053,11 +4334,14 @@ end
     end
 
     # Serves a versioned asset from dist. `File.basename` kills path traversal; only
-    # files that exist in the dist dir are served.
-    def serve_asset(name)
+    # files that exist in the dist dir are served. `dir` is the one allowed
+    # sub-directory ("fonts"), passed by the route as a literal — never by the
+    # client — so the traversal guard still holds.
+    def serve_asset(name, dir = nil)
       base = File.basename(name)
-      path = File.join(ASSETS_DIR, base)
-      unless File.file?(path) && File.fnmatch(File.join(ASSETS_DIR, "*"), path)
+      root = dir ? File.join(ASSETS_DIR, dir) : ASSETS_DIR
+      path = File.join(root, base)
+      unless File.file?(path) && File.fnmatch(File.join(root, "*"), path)
         response.status = 404
         return "not found"
       end
@@ -3068,7 +4352,9 @@ end
       # Assets are tiny and same-origin, so the revalidation cost is negligible —
       # correctness over caching for an actively-edited admin UI.
       response["cache-control"] = "no-cache"
-      File.read(path)
+      # Webfonts are binary: File.read would tag the bytes UTF-8 and any later
+      # String operation on the body would raise on the first invalid sequence.
+      base.end_with?(".woff2") ? File.binread(path) : File.read(path)
     end
 
     # Cache-busting URL for a dist asset. Dist files are served under a STABLE
@@ -3084,6 +4370,12 @@ end
       "/studio/assets/dist/#{base}?v=#{v}"
     end
 
+    # URL of an embedded webfont. No `?v=` cache-bust on purpose: the file name
+    # already names the family and weight (a different font is a different
+    # file), and the preload link in layout.erb has to match the @font-face
+    # `src:` in application.css BYTE FOR BYTE or the browser fetches twice.
+    def font_path(file) = "/studio/assets/dist/fonts/#{file}"
+
     def presence(str) = Insika::Coercion.presence(str)
 
     # Masked-secret sentinel (to pre-fill credential fields in the