@agentdeck/bridge 1.0.4 → 1.0.6

package/dist/daemon-server.js

@@ -22,7 +22,9 @@ import { BridgeLogStream } from './log-stream.js';
 import { PassiveSessionObserver } from './passive-observer.js';
 import { SessionTimelineRelay } from './session-timeline-relay.js';
 import { SessionFocusRelay } from './session-focus-relay.js';
-import { updatePushState } from './session-aggregator.js';
+import { SubagentTimelineTracker } from './subagent-timeline.js';
+import { getRemoteSession, getRemoteSender, listRemoteEnriched, } from './remote-sessions.js';
+import { createPushChannelHandler } from './session-push-channel.js';
 import { setAwaitingOverlay, setPermissionNotificationOverlay, setAskUserQuestionOverlay, clearAwaitingOverlay, clearAskUserQuestionOverlay, getAwaitingOverlay, isPermissionNotification, applyAwaitingOverlayToObserved, } from './awaiting-overlay.js';
 import { registerPending, resolvePending, sweepStalePending, drainAllPending, isPendingRequest } from './permission-resolver.js';
 import { shouldHoldPreToolUse, gateReleased, buildGateQuestion, consumeStop, requestStop, clearStop, STOP_DENY_REASON, queueDirective, takeDirective, clearOnUserPrompt, clearSession as clearSteeringSession, } from './observed-steering.js';
@@ -33,7 +35,7 @@ import { setSerialCommandSink, setSerialVoiceSink, setSerialQuiesceCheck, sendSe
 import { parsePeripheralMappings, resolvePeripheralAction, commandForAction } from './peripheral-mapping.js';
 import { DeviceVoiceCollector } from './device-voice.js';
 import { DevicePhotoCollector } from './device-photo.js';
-import { transcribeWithHelper, synthesizeWavWithHelper } from './foundation-models-helper.js';
+import { transcribeWithHelper, synthesizeWavWithHelper, recordWithHelper, stopHelperRecording, speakWithHelper, } from './foundation-models-helper.js';
 import { enqueueOpenCodeCommand, pollOpenCodeCommands } from './opencode-steering.js';
 import { runSessionReview, reviewSnapshot } from './review-runner.js';
 /** Observed-session device approval gate (PreToolUse hold). Default ON — the
@@ -54,13 +56,15 @@ import { loadIDotMatrixDevices } from './idotmatrix/idotmatrix-settings.js';
 import { handlePixooWake } from './pixoo/pixoo-client.js';
 import { triggerMdnsRecovery } from './mdns.js';
 import { rgbToBmp, pixooLiveHtml } from './hook-server.js';
-import { enableDebugLog, debug } from './logger.js';
+import { enableDebugLog, debug, debugThrottled } from './logger.js';
+import { CodexOtelTracker, CODEX_OTEL_TRACES_PATH, spanNameSummary } from './codex-otel.js';
+import { HookCodexSessions } from './hook-codex-sessions.js';
 import { initApme, isTimelineProjectionEnabled, loadApmeConfig } from './apme/index.js';
 import { FallbackTaskTimeline } from './fallback-task-timeline.js';
 import { handleApmeRequest } from './apme/http.js';
 import { readModelFromTranscript } from './apme/claude-transcript-reader.js';
 import { transcriptTimelineForSession, lastAssistantTextFromTranscript, lastAssistantTextForSession, } from './session-transcript-timeline.js';
-import { DeviceVoiceReplyRouter, speakableReply, } from './device-voice-reply.js';
+import { DeviceVoiceReplyRouter, speakableReply, spokenDigest, pcmFromWav, } from './device-voice-reply.js';
 import { rawSessionId } from '@agentdeck/shared';
 import { lastAgentMessageFromCodexRollout } from './codex-rollout-response.js';
 import { callFoundationModelsHelper } from './foundation-models-helper.js';
@@ -71,10 +75,16 @@ import { getConnectedAdbDevices, hasAdb, getAdbDeviceCount } from './adb-reverse
 import { getPixooDeviceDetails, pixooDeviceCount } from './pixoo/pixoo-bridge.js';
 import { loadTimeboxDevices } from './timebox/timebox-settings.js';
 import { getLanIp, stripUnsafeText, cleanRawText, prepareMarkdownDetail, normalizeCommandPrompt, formatDurationSec } from '@agentdeck/shared';
-import { injectOpenClawSession } from './openclaw-session.js';
-import { buildCardFeed, applyOutboxDecisions, FeedPullTracker, formatFeedPull, normalizeClientIp, } from './card-feed.js';
-import { CARD_FEED_PATH, CARD_OUTBOX_PATH } from '@agentdeck/shared';
-import { readFileSync, statSync } from 'fs';
+import { injectOpenClawSession, OPENCLAW_SESSION_ID } from './openclaw-session.js';
+import { buildCardFeed, buildGlance, applyOutboxDecisions, FeedPullTracker, formatFeedPull, normalizeClientIp, parsePullTelemetry, } from './card-feed.js';
+import { threadModule } from './card-modules.js';
+import { AutonomousPocketEngine, createAutonomousPocketModules, parsePocketAutonomyConfig, } from './pocket-autonomy.js';
+import { WeatherProvider, parseWeatherSettings } from './weather.js';
+import { CalendarProvider, parseCalendarSettings } from './calendar.js';
+import { renderGlanceFrame, GLANCE_FRAME_BOARDS } from './glance-frame.js';
+import { mergeRelayedSessionUsage } from './usage-event.js';
+import { CARD_FEED_PATH, CARD_OUTBOX_PATH, GLANCE_FRAME_PATH } from '@agentdeck/shared';
+import { readFileSync, statSync, writeFileSync, appendFileSync } from 'fs';
 import { readFile, rm } from 'fs/promises';
 import { tmpdir } from 'os';
 import { join } from 'path';
@@ -121,6 +131,76 @@ function listWifiEsp32Devices() {
  *  other observable — a battery client with an empty outbox never identifies
  *  itself and never opens a socket. */
 const feedPulls = new FeedPullTracker();
+/** Daemon-owned personal feed. It persists aggregate bandit state only — no
+ *  card copy, session names, calendar titles or weather locations. */
+const pocketAutonomy = new AutonomousPocketEngine({ onError: (message) => log(`[agentdeck] ${message}`) });
+const pocketCardModules = [threadModule, ...createAutonomousPocketModules(pocketAutonomy)];
+// THREAD is a live AgentDeck session digest. It remains available to legacy
+// feed consumers, while the dedicated Pocket surface receives only portable,
+// daemon-authored reading cards.
+const pocketReaderModules = pocketCardModules.filter((module) => module.id !== 'thread');
+/** Glance weather for the card-feed sleep dashboard. Config is read from
+ *  settings.json per pull (cheap; honors edits without a restart); the
+ *  provider caches the upstream fetch itself. */
+const glanceWeather = new WeatherProvider();
+/** Glance schedule (today's ICS events) — same config/caching contract as
+ *  weather: settings.json `calendar: {ics}`, 30 min cache, never throws. */
+const glanceCalendar = new CalendarProvider();
+const stagedFwByBoard = new Map();
+const stagedFwStatePath = () => join(homedir(), '.agentdeck', 'staged-fw.json');
+function loadStagedFw() {
+    try {
+        const raw = JSON.parse(readFileSync(stagedFwStatePath(), 'utf8'));
+        for (const [board, s] of Object.entries(raw)) {
+            if (s && typeof s.firmwarePath === 'string' && typeof s.md5 === 'string' && typeof s.size === 'number') {
+                stagedFwByBoard.set(board, s);
+            }
+        }
+    }
+    catch { /* no staging file — nothing staged */ }
+}
+loadStagedFw();
+function saveStagedFw() {
+    try {
+        writeFileSync(stagedFwStatePath(), JSON.stringify(Object.fromEntries(stagedFwByBoard), null, 2));
+    }
+    catch (err) {
+        log(`[agentdeck] staged-fw persist failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/** Stage a build for a board. Reads the file once to fingerprint it; the file
+ *  itself is re-read at device download time (a rebuild at the same path is
+ *  re-fingerprinted by re-staging). */
+function stageEsp32Fw(board, firmwarePath) {
+    const firmware = readFileSync(firmwarePath);
+    const md5 = createHash('md5').update(firmware).digest('hex');
+    stagedFwByBoard.set(board, { firmwarePath, md5, size: firmware.length, stagedAt: Date.now() });
+    saveStagedFw();
+    log(`[agentdeck] staged firmware for ${board}: ${firmware.length} bytes md5=${md5} — installs on its next feed pull`);
+    return { board, bytes: firmware.length, md5 };
+}
+/** The staged advert for a feed response, re-validated against the file on
+ *  disk so a rebuilt-in-place binary never adverts a stale md5. */
+function stagedFwAdvert(board) {
+    if (!board)
+        return undefined;
+    const staged = stagedFwByBoard.get(board);
+    if (!staged)
+        return undefined;
+    try {
+        const firmware = readFileSync(staged.firmwarePath);
+        const md5 = createHash('md5').update(firmware).digest('hex');
+        if (md5 !== staged.md5 || firmware.length !== staged.size) {
+            stagedFwByBoard.set(board, { ...staged, md5, size: firmware.length });
+            saveStagedFw();
+            return { size: firmware.length, md5 };
+        }
+        return { size: staged.size, md5: staged.md5 };
+    }
+    catch {
+        return undefined; // file gone — advert nothing rather than a dead download
+    }
+}
 /** Name a pulling client from the WiFi WS roster. A board that has been
  *  deep-sleeping may have aged out of that roster, which is why the tracker
  *  keeps its own IP→board memory once it has learned one. */
@@ -219,6 +299,12 @@ function registerWifiEsp32(d, ws) {
     if (previous?.uptimeSec != null && uptimeSec != null && uptimeSec + 10 < previous.uptimeSec) {
         log(`[agentdeck] ESP32 reboot observed: ${key} uptime ${previous.uptimeSec}s -> ${uptimeSec}s reset=${resetReason ?? 'unknown'} code=${resetReasonCode ?? 'unknown'}`);
     }
+    // Plain-log a board APPEARING on WS (absent or stale before) — a sleeping
+    // battery board's brief interactive window is exactly when a WS OTA can
+    // land, and this line is the only wake signal an operator/script can tail.
+    if (!previous || Date.now() - previous.lastSeenMs > 90_000) {
+        log(`[agentdeck] ESP32 WiFi registered: ${key}`);
+    }
     debug('daemon', `WiFi ESP32 registered: ${key} v${String(d.version ?? '')} build=${String(d.buildHash ?? '')} uptime=${String(uptimeSec ?? '')} reset=${String(resetReason ?? '')}`);
 }
 function touchWifiEsp32Socket(ws) {
@@ -563,6 +649,7 @@ async function fetchUsageViaWs(siblings) {
                                 extraUsageMonthlyLimit: evt.extraUsageMonthlyLimit ?? null,
                                 extraUsageUsedCredits: evt.extraUsageUsedCredits ?? null,
                                 extraUsageUtilization: evt.extraUsageUtilization ?? null,
+                                scopedLimits: Array.isArray(evt.scopedLimits) ? evt.scopedLimits : [],
                                 inferredBillingType: null,
                             });
                         }
@@ -579,7 +666,8 @@ async function fetchUsageViaWs(siblings) {
     }
     return null;
 }
-async function fetchUsageRelayed(selfPort) {
+/** @internal Exported for the relay-fallback regression test. */
+export async function fetchUsageRelayed(selfPort) {
     const sessions = listActiveSessions();
     const siblings = sessions.filter(s => s.port !== selfPort && s.agentType !== 'daemon');
     if (siblings.length > 0) {
@@ -589,8 +677,15 @@ async function fetchUsageRelayed(selfPort) {
         const wsResult = await fetchUsageViaWs(siblings);
         if (wsResult)
             return wsResult;
-        debug('daemon', 'Siblings exist but relay failed — skipping direct API');
-        return null;
+        // Relay is only an optimization to avoid multiple API pollers. A PTY session
+        // bridge only refreshes usage when it has *direct* inbound WS clients, but
+        // dashboards/Stream Deck connect to the daemon (sole entry point) — so a
+        // sibling with no direct clients never populates its /usage and the relay
+        // yields null forever, freezing the daemon's usage at its startup value.
+        // Fall back to the direct API; the shared usage-cache.json (120s TTL) dedupes
+        // so this can't cause a 429 storm even if a sibling is also actively fetching.
+        debug('daemon', 'Siblings exist but relay yielded nothing fresh — falling back to direct API (shared file cache dedupes)');
+        return fetchUsageFromApi();
     }
     debug('daemon', 'No siblings, using direct API');
     return fetchUsageFromApi();
@@ -610,6 +705,11 @@ export function enrichGatewayTimelineEntry(entry) {
         ...entry,
         agentType: entry.agentType ?? 'openclaw',
         projectName: entry.projectName ?? 'OpenClaw',
+        // Devices and the voice-reply router address the gateway session as
+        // 'openclaw-gateway'; without this stamp its chat_response rows carry no
+        // sessionId, so a board armed for a spoken reply never matches the turn
+        // completion and the reply silently never plays (observed 2026-07-31).
+        sessionId: entry.sessionId ?? 'openclaw-gateway',
     };
 }
 /**
@@ -638,6 +738,9 @@ export function enrichGatewayTimelineEntry(entry) {
  * daemon change.
  */
 export function classifyObservedHookEvent(eventName, mapped) {
+    if (eventName === 'codex_subagent_start' || eventName === 'codex_subagent_stop') {
+        return { boundary: eventName, agentType: 'codex-cli' };
+    }
     const prefixed = /^(codex|opencode|antigravity)_(session_start|session_end|user_prompt_submit|tool_start|tool_end|stop|turn_complete|notification|permission_asked|permission_replied)$/
         .exec(eventName);
     if (!prefixed)
@@ -858,6 +961,13 @@ export async function startDaemon(opts) {
     // that is provably alive (agentic turns regularly outlive any fixed age
     // threshold). Declared before the HTTP handlers that populate it.
     const hookSessionsSeen = new Set();
+    // Codex OTel span state. Declared before the HTTP server because the
+    // `/otel/v1/traces` handler closes over it — Codex's exporter can POST before
+    // the rest of daemon startup finishes.
+    const codexOtel = new CodexOtelTracker();
+    // Codex sessions known only from `codex_*` hooks — the backstop for when the
+    // process scan can't see one (lsof timeout, no rollout held open).
+    const hookCodexSessions = new HookCodexSessions();
     // Declare early — HTTP /health handler references this in its closure.
     // Must be declared before the HTTP server so it's initialized (not in TDZ)
     // when the first /health request arrives.
@@ -873,6 +983,22 @@ export async function startDaemon(opts) {
     // `gatewaySessionState` / `gatewayModelName` dedicated fields.
     let gatewaySessionState = 'idle';
     let gatewayModelName;
+    /**
+     * Snapshot for an `openclaw` state event: the global machine with the
+     * Gateway-local model pinned back on.
+     *
+     * The Gateway's `model_info` no longer writes `core.stateMachine` (see the
+     * parser branch): that machine is fed by every observed Claude/Codex/OpenCode
+     * hook, and the hub stamps its broadcasts with the user's focused session —
+     * so a model written there by a *different* agent is read as the focused
+     * session's own. That is how `GLM-5.2 (1M)` appeared as the model of a Claude
+     * session on both decks. Keeping the model out of the shared slot means the
+     * Gateway's own events have to carry it explicitly, which is what this does.
+     */
+    const gatewaySnapshot = (base) => ({
+        ...(base ?? core.stateMachine.getSnapshot()),
+        modelName: gatewayModelName ?? null,
+    });
     // Wi-Fi WebSocket e-ink panels (XTeink X3/X4 CrossPoint fork) self-register
     // their device roster via `client_register{clientType:"eink-device"}` — the
     // same volunteer model as the Stream Deck plugin. This handler lived ONLY in
@@ -937,6 +1063,9 @@ export async function startDaemon(opts) {
      * read this binding at request time rather than close over one in its TDZ.
      */
     let speakToBoard = null;
+    // Assigned after BridgeCore exists. The HTTP handler reads it only after
+    // startup; nullable keeps the tiny listen→core initialization window safe.
+    let subagentTimeline = null;
     // ===== HTTP server =====
     const httpServer = createServer((req, res) => {
         // APME routes: auth-gated (task prompts, project paths, hook payloads are sensitive).
@@ -971,6 +1100,11 @@ export async function startDaemon(opts) {
                 gateway: gatewayAdapter?.isAlive() ? 'connected' : 'disconnected',
                 uptime: process.uptime(), port, pid: process.pid,
                 pairingToken: core.authToken,
+                // Capability: this daemon drives remote sessions down their own push
+                // socket (session_focus_down / session_command_down / session_event_up).
+                // Workers require this flag before remote-attaching; the Swift daemon
+                // does not advertise it and is therefore never selected as a remote hub.
+                sameSocketControl: true,
                 modules: moduleHealthProvider(),
                 apme: apme
                     ? {
@@ -1067,7 +1201,7 @@ export async function startDaemon(opts) {
                 // Reply on the board's own transport (serial when it is cabled), the
                 // same way the chunked path did — the HTTP response only confirms
                 // receipt of the bytes.
-                await finishPhotoCapture(saved, photoResultSinkFor(board));
+                await finishPhotoCapture(saved, boardResultSinkFor(board));
                 return { ok: true, bytes: saved.bytes, path: saved.path };
             })().then((result) => {
                 res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -1078,6 +1212,113 @@ export async function startDaemon(opts) {
             });
             return;
         }
+        // Device voice upload — a whole utterance of raw PCM16LE as one request
+        // body. Live streaming lost audio on both of the ips10's transports
+        // (115200-baud serial ceiling; hosted-C6 WS stalls overflowing the DRAM
+        // ring), and transcription only starts once the utterance is complete, so
+        // buffering on-device and letting TCP handle delivery loses nothing.
+        // Mirrors /esp32/photo, including replying on the board's own transport.
+        if (req.method === 'POST' && pathname === '/esp32/voice') {
+            const ip = req.socket.remoteAddress ?? '';
+            if (!isLocalConnection(ip)) {
+                const token = parsedUrl.searchParams.get('token') ?? '';
+                if (!validateToken(token)) {
+                    res.writeHead(401, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'Unauthorized' }));
+                    return;
+                }
+            }
+            (async () => {
+                const chunks = [];
+                let total = 0;
+                for await (const chunk of req) {
+                    const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                    total += buf.length;
+                    // 16 kHz mono PCM16 for the firmware's 30 s runaway cap is 960 KB.
+                    if (total > 2 * 1024 * 1024)
+                        throw new Error('utterance_too_large');
+                    chunks.push(buf);
+                }
+                if (total === 0)
+                    throw new Error('empty_body');
+                const board = parsedUrl.searchParams.get('board') ?? 'esp32';
+                const saved = deviceVoice.saveDirect(Buffer.concat(chunks), {
+                    board,
+                    sessionId: parsedUrl.searchParams.get('sessionId') ?? '',
+                    sampleRate: Number(parsedUrl.searchParams.get('rate') ?? 0) || 16000,
+                    durationMs: Number(parsedUrl.searchParams.get('ms') ?? 0) || 0,
+                });
+                // The HTTP response only confirms receipt of the bytes; the
+                // transcript/outcome goes to the board as a voice_result frame.
+                await finishVoiceCapture(saved, boardResultSinkFor(board));
+                return { ok: true, bytes: total };
+            })().then((result) => {
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify(result));
+            }).catch((err) => {
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ ok: false, error: err instanceof Error ? err.message : String(err) }));
+            });
+            return;
+        }
+        // Staged spoken reply for an `audio_http_pull` board — raw PCM16LE body.
+        // The board fetches at its own pace (TCP flow control), which is what
+        // keeps the hosted-C6 RX path from being burst-fed and asserting.
+        if (req.method === 'GET' && pathname === '/esp32/voice-reply') {
+            const ip = req.socket.remoteAddress ?? '';
+            if (!isLocalConnection(ip)) {
+                const token = parsedUrl.searchParams.get('token') ?? '';
+                if (!validateToken(token)) {
+                    res.writeHead(401, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'Unauthorized' }));
+                    return;
+                }
+            }
+            const board = parsedUrl.searchParams.get('board') ?? '';
+            const staged = board ? stagedVoiceReplies.get(board) : undefined;
+            if (!staged) {
+                res.writeHead(404, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'no_staged_reply' }));
+                return;
+            }
+            // Kept until TTL rather than deleted here: an aborted download may retry.
+            res.writeHead(200, {
+                'Content-Type': 'application/octet-stream',
+                'Content-Length': staged.pcm.length,
+                'X-Sample-Rate': String(staged.sampleRate),
+            });
+            // Paced writes, NOT res.end(pcm): a single end() hands the whole body
+            // to the kernel, which blasts a TCP-initial-window-sized segment burst.
+            // TCP flow control lives in lwIP — it cannot protect the hosted C6→P4
+            // handoff underneath it, whose RX pool exhausted and ASSERTED the board
+            // one second into the first pull (`sdio_rx_get_buffer (*buf)`,
+            // 2026-07-31 12:06). 2 KB per 15 ms ≈ 133 KB/s keeps at most a couple
+            // of segments in flight while still beating playback rate 4x.
+            {
+                // 8 KB / 10 ms ≈ 800 KB/s — a 2 MB answer lands in ~2.5 s. The
+                // original 2 KB / 15 ms (~133 KB/s) predated the PSRAM-mempool core
+                // fix and made long replies take 15+ s to start, which read as "no
+                // playback"; with the hosted mempool in PSRAM the burst constraint is
+                // gone and only gentle pacing is kept as hygiene.
+                const CHUNK = 8192;
+                const GAP_MS = 10;
+                let off = 0;
+                const writeNext = () => {
+                    if (res.destroyed)
+                        return;
+                    if (off >= staged.pcm.length) {
+                        res.end();
+                        return;
+                    }
+                    const end = Math.min(off + CHUNK, staged.pcm.length);
+                    res.write(staged.pcm.subarray(off, end));
+                    off = end;
+                    setTimeout(writeNext, GAP_MS).unref?.();
+                };
+                writeNext();
+            }
+            return;
+        }
         if (req.method === 'POST' && pathname === '/esp32/ota') {
             (async () => {
                 const body = await readJsonBody(req);
@@ -1086,6 +1327,11 @@ export async function startDaemon(opts) {
                 if (!target || !firmwarePath) {
                     throw new Error('target and firmwarePath are required');
                 }
+                // Pull-OTA staging: remember the build; the board installs it on its
+                // next feed pull (no live WS needed). See stagedFwByBoard.
+                if (body.stage === true) {
+                    return { ok: true, staged: true, ...stageEsp32Fw(target, firmwarePath) };
+                }
                 return performWifiEsp32Ota(core, target, firmwarePath);
             })().then((result) => {
                 res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -1096,10 +1342,118 @@ export async function startDaemon(opts) {
             });
             return;
         }
+        // ===== Pull OTA (feed-carried) — staged firmware download =====
+        // The board saw `fw: {size, md5}` on its feed pull and fetches the image
+        // here. Auth mirrors the feed routes (LAN needs the pairing token).
+        if (req.method === 'GET' && pathname === '/esp32/fw') {
+            const ip = req.socket.remoteAddress ?? '';
+            if (!isLocalConnection(ip)) {
+                const token = parsedUrl.searchParams.get('token') ?? '';
+                if (!validateToken(token)) {
+                    res.writeHead(401, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'Unauthorized — token required for firmware download' }));
+                    return;
+                }
+            }
+            const board = parsedUrl.searchParams.get('board') ?? '';
+            const staged = stagedFwByBoard.get(board);
+            if (!staged) {
+                res.writeHead(404, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: `nothing staged for board "${board}"` }));
+                return;
+            }
+            try {
+                const firmware = readFileSync(staged.firmwarePath);
+                // Resumable download: `?from=<offset>` serves the remainder. A 5 MB
+                // image over a marginal link never survives one connection (this
+                // bridge host's two-NICs-on-one-subnet setup black-holes full-MTU
+                // segments in one direction, and a restart-from-zero download can
+                // never converge there). The device appends whatever arrives and
+                // re-asks from where it stopped, so partial transfers accumulate.
+                const fromRaw = Number(parsedUrl.searchParams.get('from') ?? 0);
+                const from = Number.isFinite(fromRaw) && fromRaw > 0 ? Math.min(Math.floor(fromRaw), firmware.length) : 0;
+                const body = from > 0 ? firmware.subarray(from) : firmware;
+                log(`[agentdeck] pull-OTA download: ${board} (${ip}) ← ${body.length} bytes`
+                    + (from > 0 ? ` (resume from ${from}/${firmware.length})` : ''));
+                res.writeHead(from > 0 ? 206 : 200, {
+                    'Content-Type': 'application/octet-stream',
+                    'Content-Length': String(body.length),
+                    ...(from > 0
+                        ? { 'Content-Range': `bytes ${from}-${Math.max(from, firmware.length - 1)}/${firmware.length}` }
+                        : {}),
+                    'X-FW-MD5': staged.md5,
+                    'Cache-Control': 'no-store',
+                });
+                res.end(body);
+            }
+            catch (err) {
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }));
+            }
+            return;
+        }
         // ===== Card Feed pull sync (M6) — wake-sync-sleep battery clients =====
         // Auth mirrors /apme: local connections are free; anything else needs the
         // pairing token (?token=). Devices hold it from provisioning; /health
         // exposes it for LAN pairing.
+        // ===== Glance Frame (M8) — daemon-rendered pixels of the glance =====
+        // The device-side glance renderer is the offline fallback; this is the
+        // rich face. `?format=png` returns the exact dithered panel pixels, so a
+        // browser preview IS the production frame (protocol.ts § Glance Frame).
+        if (req.method === 'GET' && pathname === GLANCE_FRAME_PATH) {
+            const ip = req.socket.remoteAddress ?? '';
+            if (!isLocalConnection(ip)) {
+                const token = parsedUrl.searchParams.get('token') ?? '';
+                if (!validateToken(token)) {
+                    res.writeHead(401, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'Unauthorized — token required for glance frame' }));
+                    return;
+                }
+            }
+            (async () => {
+                const board = parsedUrl.searchParams.get('board') ?? 'xteink_x3';
+                const preset = GLANCE_FRAME_BOARDS[board];
+                const w = Number(parsedUrl.searchParams.get('w'));
+                const h = Number(parsedUrl.searchParams.get('h'));
+                const geometry = Number.isFinite(w) && Number.isFinite(h) && w >= 128 && h >= 128 && w <= 1600 && h <= 1600
+                    ? { width: Math.round(w), height: Math.round(h), landscape: w > h }
+                    : preset ?? GLANCE_FRAME_BOARDS.xteink_x3;
+                const sessions = await core.buildSessionsSnapshot();
+                const glance = buildGlance({
+                    sessions: sessions,
+                    usage: core.buildUsage(),
+                    weather: await glanceWeather.get(parseWeatherSettings(loadDaemonSettings())),
+                    events: await glanceCalendar.get(parseCalendarSettings(loadDaemonSettings())),
+                });
+                const d = new Date();
+                const serverHm = `${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}`;
+                const frame = await renderGlanceFrame({ glance, serverHm, geometry });
+                const headers = {
+                    'X-Frame-Width': String(frame.width),
+                    'X-Frame-Height': String(frame.height),
+                    'X-Frame-Sig': frame.sig,
+                    'Cache-Control': 'no-store',
+                };
+                // Conditional fetch, one layer down from the feed's deckSig: matching
+                // sig → 304, no body, the panel keeps holding the frame it has.
+                if (parsedUrl.searchParams.get('sig') === frame.sig) {
+                    res.writeHead(304, headers);
+                    res.end();
+                    return;
+                }
+                if (parsedUrl.searchParams.get('format') === 'png') {
+                    res.writeHead(200, { ...headers, 'Content-Type': 'image/png' });
+                    res.end(await frame.png());
+                    return;
+                }
+                res.writeHead(200, { ...headers, 'Content-Type': 'application/octet-stream' });
+                res.end(frame.packed);
+            })().catch((err) => {
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }));
+            });
+            return;
+        }
         if ((req.method === 'GET' && pathname === CARD_FEED_PATH)
             || (req.method === 'POST' && pathname === CARD_OUTBOX_PATH)) {
             const ip = req.socket.remoteAddress ?? '';
@@ -1114,7 +1468,33 @@ export async function startDaemon(opts) {
             (async () => {
                 if (req.method === 'GET') {
                     const sessions = await core.buildSessionsSnapshot();
-                    const feed = buildCardFeed(sessions);
+                    const settings = loadDaemonSettings();
+                    pocketAutonomy.configure(parsePocketAutonomyConfig(settings));
+                    // Sleep-dashboard glance: provider quota + work wrap-up + weather.
+                    // Weather resolves from cache almost always (30 min window) and is
+                    // bounded by its own fetch timeout, so the pull stays fast.
+                    const glance = buildGlance({
+                        sessions: sessions,
+                        usage: core.buildUsage(),
+                        weather: await glanceWeather.get(parseWeatherSettings(settings)),
+                        events: await glanceCalendar.get(parseCalendarSettings(settings)),
+                    });
+                    const now = Date.now();
+                    const pocketReader = parsedUrl.searchParams.get('surface') === 'pocket-reader';
+                    const feed = buildCardFeed(sessions, now, pocketReader ? pocketReaderModules : pocketCardModules, {
+                        glance,
+                        echoSig: parsedUrl.searchParams.get('sig') ?? undefined,
+                        includeSessions: !pocketReader,
+                    });
+                    // Pull-OTA advert: rides full AND `unchanged` responses, so a
+                    // sleeping board learns about a staged build on any pull. Board
+                    // identity from the query (newer firmware) or the IP memory.
+                    const pullBoard = parsedUrl.searchParams.get('board') ?? boardForClientIp(ip);
+                    if (!feed.unchanged)
+                        pocketAutonomy.observeDelivery(feed.cards, now, pullBoard ?? undefined);
+                    const fwAdvert = stagedFwAdvert(pullBoard ?? undefined);
+                    if (fwAdvert)
+                        feed.fw = fwAdvert;
                     // A sleeping client's whole visit is this one request: no body, no
                     // board id, nothing pushed. Record it, because the gap between two
                     // pulls is the only evidence that the timer wake fired at all.
@@ -1122,6 +1502,8 @@ export async function startDaemon(opts) {
                     log(`[agentdeck] ${formatFeedPull(feedPulls.record(ip, {
                         cards: feed.cards.length,
                         nextPullSec: feed.nextPullSec,
+                        unchanged: feed.unchanged === true,
+                        telemetry: parsePullTelemetry(parsedUrl.searchParams),
                     }))}`);
                     return feed;
                 }
@@ -1136,6 +1518,7 @@ export async function startDaemon(opts) {
                     sessions: sessions,
                     isPendingRequest,
                     dispatch: (cmd) => handleDeviceCommand(cmd),
+                    modules: pocketCardModules,
                 });
                 const applied = result.results.filter((r) => r.status === 'applied').length;
                 if (result.results.length > 0) {
@@ -1175,6 +1558,12 @@ export async function startDaemon(opts) {
                     billingType: snap.billingType,
                 },
                 wsClients: core.wsServer.getClientCount(),
+                // Codex observation backstops — which sessions each source believes in.
+                // A session present here but absent from sessions_list means the ps
+                // observer found it too and won, which is the expected steady state.
+                hookCodexSessions: hookCodexSessions.snapshot(),
+                codexOtelThreads: codexOtel.snapshot(),
+                pocketAutonomy: pocketAutonomy.diagnostics(),
                 recentJournal: [],
                 ptyTail: '',
                 journalDir: join(homedir(), '.agentdeck'),
@@ -1272,6 +1661,41 @@ export async function startDaemon(opts) {
                 // codex/opencode *state* is owned by the passive observer's turn
                 // semantics, not these hooks.
                 const { boundary, agentType: hookAgentType } = classifyObservedHookEvent(eventName, mapped);
+                const earlyHookSid = typeof json.session_id === 'string' && json.session_id
+                    ? json.session_id : 'daemon-hook';
+                const earlyHookCwd = (typeof json.cwd === 'string' ? json.cwd
+                    : (typeof json.project_path === 'string' ? json.project_path : '')) || '';
+                const earlyHookProject = (typeof json.project_name === 'string' && json.project_name)
+                    ? json.project_name
+                    : (earlyHookCwd ? earlyHookCwd.split('/').filter(Boolean).pop() : undefined);
+                const childHook = subagentTimeline?.handle({
+                    eventName,
+                    payload: json,
+                    sessionId: earlyHookSid,
+                    agentType: hookAgentType,
+                    projectName: earlyHookProject,
+                }).childOnly === true;
+                if (childHook) {
+                    // Child activity is observation-only. Never let child PreToolUse
+                    // reach the parent's approval, STOP, state, or APME paths.
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(eventName === 'PreToolUse' || eventName === 'Stop'
+                        ? ''
+                        : JSON.stringify({ received: true }));
+                    return;
+                }
+                // Hook-derived Codex session rows. Placed after the child-hook return so
+                // subagent lifecycle never drives the parent row, and kept independent
+                // of the state machine: this only decides whether a Codex the process
+                // scan can't see still has a session. See bridge/src/hook-codex-sessions.ts.
+                if (eventName.startsWith('codex_')) {
+                    hookCodexSessions.note(eventName, {
+                        sessionId: typeof json.session_id === 'string' ? json.session_id : undefined,
+                        cwd: earlyHookCwd || undefined,
+                        projectName: earlyHookProject,
+                        toolName: typeof json.tool_name === 'string' ? json.tool_name : undefined,
+                    });
+                }
                 // State machine
                 if (mapped === 'session_start')
                     core.stateMachine.handleHookEvent('SessionStart', json);
@@ -1724,6 +2148,42 @@ export async function startDaemon(opts) {
             });
             return;
         }
+        // Codex OTel exporter target. Codex (CLI and the ChatGPT.app desktop app)
+        // POSTs OTLP/HTTP JSON spans here when `[otel.trace_exporter.otlp-http]`
+        // points at the daemon. Only the Swift daemon used to implement this, so a
+        // Node-daemon host answered 404 and dropped every span. Always 200: an OTel
+        // exporter that sees errors backs off, and nothing here is worth telling
+        // Codex about. See bridge/src/codex-otel.ts.
+        if (req.method === 'POST' && (pathname === CODEX_OTEL_TRACES_PATH || pathname === '/v1/traces')) {
+            let body = '';
+            req.on('data', (c) => { body += c; if (body.length > 8_000_000)
+                req.destroy(); });
+            req.on('end', () => {
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end('{}');
+                try {
+                    const json = body ? JSON.parse(body) : {};
+                    // Dev capture. Codex's span vocabulary is not a stable API, so when it
+                    // shifts the only way to re-derive the dispatch table is to look at
+                    // real batches: `AGENTDECK_CODEX_OTEL_DUMP=/tmp/otel.jsonl agentdeck
+                    // daemon start`. Bodies are pretty-printed and large — point it at a
+                    // scratch path and delete it afterwards.
+                    if (process.env.AGENTDECK_CODEX_OTEL_DUMP) {
+                        try {
+                            appendFileSync(process.env.AGENTDECK_CODEX_OTEL_DUMP, `${body}\n`);
+                        }
+                        catch { /* dev only */ }
+                    }
+                    if (codexOtel.ingest(json) === 0) {
+                        debugThrottled('codex-otel', 'no-recognized-spans', 60_000, `no recognized spans; len=${body.length} names=${spanNameSummary(json)}`);
+                    }
+                }
+                catch {
+                    debugThrottled('codex-otel', 'unparsable-body', 60_000, `unparsable body len=${body.length}`);
+                }
+            });
+            return;
+        }
         // OpenCode observer-plugin steering: the plugin long-polls here and
         // executes returned commands via its in-process SDK client (abort /
         // prompt). See bridge/src/opencode-steering.ts.
@@ -1955,6 +2415,9 @@ export async function startDaemon(opts) {
         httpServer,
         isDaemon: true,
     });
+    subagentTimeline = new SubagentTimelineTracker((entry) => {
+        core.bridgeTimeline.addEntry(entry, { bypassSuppression: true });
+    });
     // Hooks resolve a fallback daemon port through daemon.json. Another process
     // can delete that file while this daemon remains healthy, which makes every
     // standalone Claude/Codex hook silently fall back to an empty :9120. Mirror
@@ -2028,6 +2491,24 @@ export async function startDaemon(opts) {
     core.wireDisplayMonitor();
     let lastStateEvent = null;
     let userFocusedSessionId = null;
+    /**
+     * Stamp the focused session onto a hub `state_update`.
+     *
+     * This field carries two jobs, and both are load-bearing, which is why it
+     * cannot simply be narrowed:
+     *  - attribution: `buildStateEvent` sets no `sessionId` at all, so a
+     *    hook-observed session's AWAITING_PERMISSION options reach the decks
+     *    attributed only by this field (see session-deck-awaiting tests).
+     *  - focus ack: the Apple app toggles creature focus against it and needs it
+     *    even for a session that emits nothing of its own.
+     *
+     * The consequence is a standing invariant on the payload: whatever rides along
+     * here is read as the focused session's own. So nothing may write a *different*
+     * agent's per-session field into `core.stateMachine` — the Gateway's model went
+     * in and came out as a Claude session's model. Gateway-specific state lives in
+     * `gatewaySessionState` / `gatewayModelName` and is re-attached by
+     * `gatewaySnapshot()`.
+     */
     const attachFocusedSessionId = (event) => {
         if (event.type !== 'state_update')
             return event;
@@ -2036,6 +2517,28 @@ export async function startDaemon(opts) {
             focusedSessionId: userFocusedSessionId ?? '',
         };
     };
+    /**
+     * Stamp a *Gateway-specific* state event — one whose payload really is the
+     * Gateway's (its parser events, its connection transitions), as opposed to the
+     * hub broadcasts above that merely get labelled `openclaw` while the Gateway is
+     * alive.
+     *
+     * These name their own row (`sessionId`), which is the honest attribution and
+     * the reason a client never has to guess: an event carrying the Gateway's model
+     * now says so. The focus ack rides only when the Gateway IS the focused row —
+     * otherwise this event would claim to describe a Claude session, which is
+     * precisely how `GLM-5.2 (1M)` became that session's model on both decks. The
+     * ack still reaches the Apple app through every hub broadcast.
+     */
+    const attachGatewayEvent = (event) => {
+        if (event.type !== 'state_update')
+            return event;
+        return {
+            ...event,
+            sessionId: OPENCLAW_SESSION_ID,
+            focusedSessionId: userFocusedSessionId === OPENCLAW_SESSION_ID ? OPENCLAW_SESSION_ID : '',
+        };
+    };
     const broadcastFocusedState = () => {
         const gwAlive = gatewayAdapter?.isAlive() ?? false;
         const stateEvent = attachFocusedSessionId(core.buildStateEvent({
@@ -2097,6 +2600,12 @@ export async function startDaemon(opts) {
     timelineRelay.start();
     // Session focus relay — allows SD plugin to interact with a specific session via daemon
     const focusRelay = new SessionFocusRelay();
+    // Remote (cross-machine) sessions aren't in sessions.json. Their only
+    // reverse path is same-socket: drive the session down the live push socket
+    // it opened — no inbound dial, so NAT'd / SSH-only workers just work.
+    focusRelay.setSameSocketResolver((sessionId) => getRemoteSender(sessionId) ?? null);
+    // Push-channel frames from session bridges (register / state / reverse events).
+    const handlePushChannelMessage = createPushChannelHandler({ core, focusRelay });
     focusRelay.setEventHandler((evt) => {
         if (evt.type === 'state_update') {
             const focusedId = focusRelay.getFocusedSessionId();
@@ -2121,14 +2630,43 @@ export async function startDaemon(opts) {
         else if (evt.type === 'usage_update') {
             // Sync daemon cache with relay's already-adjusted values (prevents oscillation)
             const u = evt;
+            const hasClaudeData = u.fiveHourPercent != null || u.sevenDayPercent != null;
             if (core.cachedApiUsage && u.fiveHourPercent != null) {
                 core.cachedApiUsage.fiveHourPercent = u.fiveHourPercent;
                 core.cachedApiUsage.fiveHourResetsAt = u.fiveHourResetsAt ?? null;
                 core.cachedApiUsage.sevenDayPercent = u.sevenDayPercent ?? core.cachedApiUsage.sevenDayPercent;
                 core.cachedApiUsage.sevenDayResetsAt = u.sevenDayResetsAt ?? core.cachedApiUsage.sevenDayResetsAt ?? null;
+                // Scoped caps ride the same relay snapshot. The Swift daemon syncs them on
+                // its equivalent live-update path; leaving them out here made the daemon's
+                // own next broadcastUsage re-emit a stale scoped set until the next full
+                // fetch — the exact drift DaemonServer.swift documents.
+                core.cachedApiUsage.scopedLimits = Array.isArray(u.scopedLimits) ? u.scopedLimits : [];
                 core.apiUsagePreAdjusted = true;
             }
-            core.wsServer.broadcast(evt);
+            // A session bridge broadcasts usage on EVERY state change. In daemon-first
+            // mode its snapshot usually has no model context, so the Claude quota model
+            // gate (isClaudeSubscriptionModel) yields no percents and the event carries
+            // usageStale=true. Forwarding that bare event verbatim clobbered the daemon's
+            // own authoritative aggregate on the dashboard: the Claude gauge blanked to
+            // "No usage data" on every state tick (the Codex gauge, which ignores global
+            // staleness, stayed put — hence the Claude-only flicker).
+            //
+            // Suppressing the relay instead is NOT an option: usage_update is the ONLY
+            // carrier of per-session tokens / cost / duration (state_update has none of
+            // those fields), and the daemon's own buildUsage() reads a UsageTracker that
+            // no PTY ever feeds, so its session half is zeros. Dropping the event would
+            // blank the session numbers for every focus that legitimately carries no
+            // Claude quota — Codex, OpenCode, API billing.
+            //
+            // So split the event by half instead of by event: the ACCOUNT half (quota,
+            // scoped caps, extra usage, subscriptions, Codex/Ollama, usageStale) comes
+            // from the daemon's authoritative aggregate, the SESSION half from the relay.
+            if (hasClaudeData) {
+                core.wsServer.broadcast(evt);
+            }
+            else {
+                core.wsServer.broadcast(mergeRelayedSessionUsage(core.buildUsage(), u));
+            }
         }
         else {
             // prompt_options — relay as-is
@@ -2333,6 +2871,11 @@ export async function startDaemon(opts) {
     // immediately). When a scan lands fresh observations, push them out via
     // the debounced broadcast so clients don't wait for the next 10 s poll.
     passiveSessionObserver.onRefreshed = () => core.maybeBroadcastSessionsList();
+    // OTel turn boundaries arrive in milliseconds where the observer only re-reads
+    // the rollout tail every scan interval, so a span that changed thread state is
+    // worth a broadcast of its own.
+    codexOtel.onChanged = () => core.maybeBroadcastSessionsList();
+    hookCodexSessions.onChanged = () => core.maybeBroadcastSessionsList();
     // ===== Gateway adapter lifecycle =====
     // (gatewayAdapter + gatewayConnecting declared earlier, before HTTP server)
     // Inject OpenClaw virtual session only after Gateway authentication succeeds.
@@ -2344,7 +2887,11 @@ export async function startDaemon(opts) {
         // the 5s-throttled observer, so a Notification arriving mid-window still
         // surfaces within one frame. Key = the Claude session UUID embedded in
         // `observed:claude:<uuid>`.
-        const observed = applyAwaitingOverlayToObserved(passiveSessionObserver.collect(sessions))
+        // Codex OTel spans overlay state/tool onto the matching ps-observed row and
+        // synthesize a `codex-app` row for any thread the process scan missed —
+        // Swift's only Codex-app source, here a second opinion on top of the
+        // observer. See bridge/src/codex-otel.ts.
+        const observed = applyAwaitingOverlayToObserved(hookCodexSessions.applyTo(codexOtel.applyTo(passiveSessionObserver.collect(sessions))))
             .map((s) => {
             // Steering feedback for observed Claude sessions: devices render
             // "stopping at next tool" / queued-directive badges from these.
@@ -2363,10 +2910,15 @@ export async function startDaemon(opts) {
                 ...(snap.queuedDirectives > 0 ? { queuedDirectives: snap.queuedDirectives } : {}),
             };
         });
+        // Sessions that attached from another machine over the push channel. They
+        // aren't in this daemon's sessions.json, so inject them here (dedup against
+        // any id already present from the local registry).
+        const localIds = new Set(sessions.map((s) => s.id));
+        const remote = listRemoteEnriched().filter((s) => !localIds.has(s.id));
         // Derive per-session elapsed seconds from startedAt so NTP-less devices
         // (ESP32 IPS10 mosaic) render an elapsed value per cell without a wall clock.
         const now = Date.now();
-        const enrichedSessions = [...sessions, ...observed].map((s) => {
+        const enrichedSessions = [...sessions, ...observed, ...remote].map((s) => {
             // On-demand review badge (REVIEW tile verdict / REVIEWING state) —
             // applies to every session type, managed included.
             const review = reviewSnapshot(s.id);
@@ -2436,7 +2988,14 @@ export async function startDaemon(opts) {
                         core.stateMachine.handleHookEvent('SessionEnd', {});
                     break;
                 case 'parser':
-                    core.stateMachine.handleParserEvent(evt.event, evt.data);
+                    // `model_info` is deliberately NOT forwarded: the global machine holds
+                    // one modelName for the whole hub, fed by every observed hook session,
+                    // and its broadcasts are stamped with the user's focused session — so a
+                    // model written here by the Gateway is read as that session's own
+                    // (GLM on a Claude row). It lives in `gatewayModelName` instead, and
+                    // `gatewaySnapshot()` puts it back on the Gateway's own events.
+                    if (evt.event !== 'model_info')
+                        core.stateMachine.handleParserEvent(evt.event, evt.data);
                     // Gateway-local activity state for the virtual session row (mirror of
                     // Swift `gatewaySessionState`). Kept separate from the global
                     // `core.stateMachine` above so the OpenClaw row reflects only the
@@ -2465,10 +3024,10 @@ export async function startDaemon(opts) {
                         if (models) {
                             core.cachedModelCatalog = models;
                             const snap = core.stateMachine.getSnapshot();
-                            const stateEvent = attachFocusedSessionId(core.buildStateEvent({
+                            const stateEvent = attachGatewayEvent(core.buildStateEvent({
                                 agentType: 'openclaw',
                                 agentCapabilities: OPENCLAW_CAPABILITIES,
-                                snapshot: snap,
+                                snapshot: gatewaySnapshot(snap),
                             }));
                             lastStateEvent = stateEvent;
                             core.broadcast(stateEvent);
@@ -2521,10 +3080,10 @@ export async function startDaemon(opts) {
                         }
                         // Force full state broadcast
                         const snap = core.stateMachine.getSnapshot();
-                        const gwStateEvent = attachFocusedSessionId(core.buildStateEvent({
+                        const gwStateEvent = attachGatewayEvent(core.buildStateEvent({
                             agentType: 'openclaw',
                             agentCapabilities: OPENCLAW_CAPABILITIES,
-                            snapshot: snap,
+                            snapshot: gatewaySnapshot(snap),
                         }));
                         lastStateEvent = gwStateEvent;
                         core.wsServer.broadcast(gwStateEvent);
@@ -2736,24 +3295,10 @@ export async function startDaemon(opts) {
         if (handleEsp32OtaReply(msg)) {
             return true;
         }
-        if (msg.type === 'session_push_register') {
-            const { sessionId, port: sessionPort, agentType: at, projectName: pn } = msg;
-            debug('daemon', `session_push_register: ${sessionId} port=${sessionPort} agent=${at}`);
-            // Acknowledge registration
-            try {
-                sender.send(JSON.stringify({ type: 'session_push_ack', sessionId }));
-            }
-            catch { /* client disconnecting */ }
-            return true; // consumed
-        }
-        if (msg.type === 'session_push_state') {
-            const { sessionId, state, modelName, effortLevel, permissionMode } = msg;
-            if (sessionId && state) {
-                updatePushState(sessionId, state, modelName, effortLevel, permissionMode);
-                // Trigger sessions list broadcast so clients get fresh state
-                core.maybeBroadcastSessionsList();
-            }
-            return true; // consumed
+        // Push-channel frames (session_push_register / session_push_state /
+        // session_event_up) — extracted handler, integration-tested directly.
+        if (handlePushChannelMessage(msg, sender)) {
+            return true;
         }
         if (msg.type === 'deck_slot_map') {
             // Plugin pushed its keypad layout. Forward to other viewers (extra
@@ -2770,8 +3315,24 @@ export async function startDaemon(opts) {
         }
         if (msg.type === 'voice_end') {
             const captured = deviceVoice.end(sender, msg);
-            if (captured)
+            if (captured) {
                 void finishVoiceCapture(captured, stableSink(sender));
+            }
+            else if (msg.cancel !== true) {
+                // Nothing was captured but the user did hold the button — answer
+                // anyway, or the board's "Sending…" state has nothing to resolve it.
+                try {
+                    sender.send(JSON.stringify({ type: 'voice_result', text: '', error: 'empty_capture' }));
+                }
+                catch { /* client disconnecting */ }
+            }
+            return true; // consumed
+        }
+        if (msg.type === 'voice_abort') {
+            // The board tried to upload an utterance over HTTP and failed; the
+            // reason would otherwise only exist on its serial console.
+            log(`[agentdeck] voice: device upload aborted (${String(msg.reason ?? 'unknown')}, `
+                + `${String(msg.total ?? '?')} bytes)`);
             return true; // consumed
         }
         if (msg.type === 'photo_begin') {
@@ -2895,6 +3456,13 @@ export async function startDaemon(opts) {
     }
     const handleDeviceCommand = (cmd) => {
         debug('daemon', `cmd: ${cmd.type}`);
+        // Host push-to-talk is the daemon's own capability (host mic + speakers),
+        // so claim it ahead of the gateway-first-dibs routing below — it must not
+        // depend on what any adapter chooses to do with the legacy `voice` shape.
+        if (cmd.type === 'voice') {
+            handleHostVoicePtt(cmd);
+            return;
+        }
         // Session-scoped commands are NEVER OpenClaw's to consume: a device
         // answering a named session (select_option{sessionId}) must reach the
         // session routing below — the gateway swallowing it as an exec-approval
@@ -2929,10 +3497,10 @@ export async function startDaemon(opts) {
             if (target === 'openclaw' && gatewayAdapter?.isAlive()) {
                 // Force broadcast OpenClaw state to all clients
                 const snap = core.stateMachine.getSnapshot();
-                const gwStateEvent = attachFocusedSessionId(core.buildStateEvent({
+                const gwStateEvent = attachGatewayEvent(core.buildStateEvent({
                     agentType: 'openclaw',
                     agentCapabilities: OPENCLAW_CAPABILITIES,
-                    snapshot: snap,
+                    snapshot: gatewaySnapshot(snap),
                 }));
                 lastStateEvent = gwStateEvent;
                 core.wsServer.broadcast(gwStateEvent);
@@ -3049,6 +3617,16 @@ export async function startDaemon(opts) {
             if (!rawSessionId || !command)
                 return;
             const sessionId = resolveDeviceSessionId(rawSessionId);
+            // The gateway session has no bridge port — the focus-relay path below
+            // would connect to nothing and silently drop the command. Hand it to
+            // the adapter, the same way the wake-word assistant does.
+            if (sessionId === 'openclaw-gateway') {
+                if (gatewayAdapter?.isAlive())
+                    gatewayAdapter.handleCommand(command);
+                else
+                    debug('daemon', 'session_command for openclaw-gateway but gateway not alive');
+                return;
+            }
             // Observed Claude sessions have no bridge/PTY — route to the hook-based
             // steering primitives instead (soft STOP, turn-end directive queue,
             // gate approval). This replaces the old silent drop.
@@ -3070,7 +3648,7 @@ export async function startDaemon(opts) {
                 return;
             }
             const sessions = listActiveSessions();
-            const target = sessions.find(s => s.id === sessionId);
+            const target = sessions.find(s => s.id === sessionId) ?? getRemoteSession(sessionId);
             if (!target) {
                 debug('daemon', `session_command: session ${sessionId} not found`);
                 return;
@@ -3096,7 +3674,7 @@ export async function startDaemon(opts) {
                 handleObservedClaudeCommand(sessionId.slice('observed:claude:'.length), cmd);
                 return;
             }
-            const target = listActiveSessions().find(s => s.id === sessionId);
+            const target = listActiveSessions().find(s => s.id === sessionId) ?? getRemoteSession(sessionId);
             if (target) {
                 userFocusedSessionId = sessionId;
                 broadcastFocusedState();
@@ -3180,20 +3758,46 @@ export async function startDaemon(opts) {
      * drops the WebSocket it dictated over, and the answer must still arrive.
      * Serial first, mirroring the single-path dedup policy used elsewhere.
      */
+    /**
+     * Replies staged for `audio_http_pull` boards, keyed by device (board id) —
+     * the board fetches via GET /esp32/voice-reply at its own pace. Swept by
+     * TTL: a board that reboots before fetching must not hear a stale answer
+     * minutes later.
+     */
+    const stagedVoiceReplies = new Map();
+    const STAGED_REPLY_TTL_MS = 2 * 60_000;
+    const stagedReplySweep = setInterval(() => {
+        const cutoff = Date.now() - STAGED_REPLY_TTL_MS;
+        for (const [key, entry] of stagedVoiceReplies) {
+            if (entry.ts < cutoff)
+                stagedVoiceReplies.delete(key);
+        }
+    }, 30_000);
+    stagedReplySweep.unref?.();
     const voiceReply = new DeviceVoiceReplyRouter(() => Date.now(), (ms) => new Promise((r) => setTimeout(r, ms)), (deviceKey) => {
+        // This resolver serves the spoken-reply router only, so unlike the
+        // general serial-first dedup it prefers whichever live transport can
+        // actually PLAY audio (advertises audio_out): a CH340 serial link
+        // physically cannot carry PCM even when it is the primary state path.
+        const candidates = [];
         const serialPort = liveSerialPortForBoard(deviceKey);
-        if (serialPort) {
-            log(`[agentdeck] voice: routing reply for ${deviceKey} over serial ${serialPort}`);
-            return serialSinkFor(serialPort);
-        }
+        if (serialPort)
+            candidates.push(serialSinkFor(serialPort));
         for (const [key, sock] of wifiEsp32Sockets) {
             if (sock.readyState !== WebSocket.OPEN)
                 continue;
             const board = wifiEsp32Devices.get(key)?.board;
-            if (board === deviceKey || key === deviceKey) {
-                log(`[agentdeck] voice: routing reply for ${deviceKey} over ws ${key}`);
-                return stableSink(sock);
-            }
+            if (board === deviceKey || key === deviceKey)
+                candidates.push(stableSink(sock));
+        }
+        const pick = candidates.find((s) => {
+            const caps = s.capabilities();
+            return caps.includes('audio_out') || caps.includes('audio_http_pull');
+        }) ?? candidates[0];
+        if (pick) {
+            log(`[agentdeck] voice: routing reply for ${deviceKey} via ${pick.describe()}`
+                + ` (caps=${pick.capabilities().join('|') || 'none'})`);
+            return pick;
         }
         log(`[agentdeck] voice: no live transport for ${deviceKey}`
             + ` (serial boards: ${serialBoardsAttached().join(',') || 'none'})`);
@@ -3258,7 +3862,18 @@ export async function startDaemon(opts) {
         const voiceCfg = loadDaemonSettings().voice;
         if (voiceCfg?.speakReplies === false)
             return; // opt-out, default on
-        const spoken = speakableReply(text);
+        // Speech gets the lead, not the transcript: an explicit summary line if the
+        // answer has one, else its first sentence. The full answer is already on the
+        // screen the user is sitting at, where it can be skimmed — read aloud it is
+        // a minute of monologue nobody can skip. `voice.speakFullReply` opts back in.
+        const full = voiceCfg?.speakFullReply === true;
+        const spoken = spokenDigest(text, { full });
+        if (!full) {
+            const readable = speakableReply(text, Number.MAX_SAFE_INTEGER);
+            if (spoken && readable.length > spoken.length) {
+                log(`[agentdeck] voice: reply digested ${readable.length} -> ${spoken.length} chars`);
+            }
+        }
         if (!spoken) {
             // A code-only answer has nothing worth reading aloud; say that instead of
             // spelling out punctuation, so the user still knows the turn finished.
@@ -3276,12 +3891,59 @@ export async function startDaemon(opts) {
         }
         const locale = typeof voiceCfg?.locale === 'string' && voiceCfg.locale
             ? voiceCfg.locale : undefined;
+        // Host-armed dictations (deck push-to-talk) play through the host's own
+        // speakers — AVSpeechSynthesizer speaks directly, no WAV/PCM streaming
+        // detour. Split them out before synthesis so a host-only reply skips the
+        // file round trip entirely.
+        const hostTargets = targets.filter((s) => s.capabilities().includes('audio_host'));
+        const boardTargets = targets.filter((s) => !s.capabilities().includes('audio_host'));
+        if (hostTargets.length > 0) {
+            for (const sink of hostTargets)
+                voiceReply.disarm(sink);
+            void (async () => {
+                try {
+                    await speakWithHelper(spoken, locale ? { locale } : {});
+                    log(`[agentdeck] voice: spoke reply on host speakers (${spoken.length} chars)`);
+                }
+                catch (err) {
+                    log(`[agentdeck] voice: host speak failed: ${String(err).slice(0, 140)}`);
+                }
+            })();
+        }
+        if (boardTargets.length === 0)
+            return;
         void (async () => {
             const out = join(tmpdir(), `agentdeck-reply-${process.pid}-${Date.now()}.wav`);
             try {
                 await synthesizeWavWithHelper(spoken, out, locale ? { locale } : {});
                 const wav = await readFile(out);
-                for (const sink of targets) {
+                for (const sink of boardTargets) {
+                    // Pull-capable boards fetch the audio themselves over HTTP — the WS
+                    // push stream both stuttered and could crash the hosted-link RX
+                    // path (pkt_rxbuff assert). Stage the PCM, send a tiny notify
+                    // frame, and let TCP flow control pace the transfer.
+                    if (sink.capabilities().includes('audio_http_pull')) {
+                        const parsed = pcmFromWav(wav);
+                        if (parsed) {
+                            stagedVoiceReplies.set(sink.deviceKey(), {
+                                pcm: parsed.pcm, sampleRate: parsed.sampleRate, ts: Date.now(),
+                            });
+                            try {
+                                sink.send(JSON.stringify({
+                                    type: 'audio_reply_ready',
+                                    bytes: parsed.pcm.length,
+                                    sampleRate: parsed.sampleRate,
+                                    durationMs: Math.round((parsed.pcm.length / 2) / parsed.sampleRate * 1000),
+                                    text: spoken.slice(0, 120),
+                                }));
+                                log(`[agentdeck] voice: staged reply for ${sink.deviceKey()}`
+                                    + ` (${parsed.pcm.length}B pull, ${spoken.length} chars)`);
+                            }
+                            catch { /* sink closing — TTL sweep reclaims the staging */ }
+                            voiceReply.disarm(sink);
+                            continue;
+                        }
+                    }
                     const ok = await voiceReply.stream(sink, wav, spoken);
                     log(`[agentdeck] voice: ${ok ? 'spoke' : 'FAILED to speak'} reply`
                         + ` (${wav.length}B, ${spoken.length} chars)`);
@@ -3451,7 +4113,7 @@ export async function startDaemon(opts) {
      * no socket to answer on, so resolve the board's live transport the same
      * way a queued voice reply does (serial first, then its WiFi socket).
      */
-    const photoResultSinkFor = (board) => {
+    const boardResultSinkFor = (board) => {
         const port = liveSerialPortForBoard(board);
         if (port)
             return serialSinkFor(port);
@@ -3482,8 +4144,19 @@ export async function startDaemon(opts) {
         }
         else if (msg.type === 'voice_end') {
             const captured = deviceVoice.end(port, msg);
-            if (captured)
+            if (captured) {
                 void finishVoiceCapture(captured, serialSinkFor(port));
+            }
+            else if (msg.cancel !== true) {
+                try {
+                    serialSinkFor(port).send(JSON.stringify({ type: 'voice_result', text: '', error: 'empty_capture' }));
+                }
+                catch { /* port closing */ }
+            }
+        }
+        else if (msg.type === 'voice_abort') {
+            log(`[agentdeck] voice: device upload aborted (${String(msg.reason ?? 'unknown')}, `
+                + `${String(msg.total ?? '?')} bytes) [serial ${port}]`);
         }
         else if (msg.type === 'photo_begin') {
             // Photo over USB: the strip is a desk fixture and usually powered from
@@ -3519,8 +4192,38 @@ export async function startDaemon(opts) {
      * like the same board on WiFi, which is only true if there is one
      * implementation.
      */
+    /**
+     * The sink to ARM for the spoken reply, which is not always the sink the
+     * result JSON goes to: an HTTP-uploaded utterance resolves its result sink
+     * serial-first (guaranteed delivery), but the ips10 advertises `audio_out`
+     * on its WiFi device_info only — its 115200-baud serial physically cannot
+     * carry PCM, so arming the serial sink would make voiceReply.arm() decline
+     * and the reply silently never play. Prefer the sink itself when it can
+     * play audio; otherwise find the board's live WS socket that can.
+     */
+    const canPlayReply = (s) => {
+        const caps = s.capabilities();
+        return caps.includes('audio_out') || caps.includes('audio_http_pull');
+    };
+    const audioArmSinkFor = (sink, board) => {
+        if (canPlayReply(sink))
+            return sink;
+        for (const [key, sock] of wifiEsp32Sockets) {
+            if (sock.readyState !== WebSocket.OPEN)
+                continue;
+            if (wifiEsp32Devices.get(key)?.board === board || key === board) {
+                const s = stableSink(sock);
+                if (canPlayReply(s))
+                    return s;
+            }
+        }
+        return sink;
+    };
     const finishVoiceCapture = async (captured, sink) => {
         try {
+            if (captured.integrityError) {
+                throw new Error(captured.integrityError);
+            }
             // Locale matters: the recognizer falls back to the system locale,
             // which mangles speech in another language. settings.json
             // `voice.locale` (BCP-47, e.g. "en-US") overrides it.
@@ -3537,7 +4240,20 @@ export async function startDaemon(opts) {
             let via;
             let deliverReason;
             if (text && sessionId) {
-                if (sessionId.startsWith('observed:')) {
+                if (sessionId === 'openclaw-gateway') {
+                    // The gateway session has no bridge port: the generic
+                    // session_command path focuses a relay that can never connect
+                    // and silently drops the prompt while this function reported
+                    // delivered=true (observed 2026-07-31 — "transcript showed,
+                    // nothing answered"). Route straight to the adapter and report
+                    // what actually happened.
+                    delivered = !!(gatewayAdapter?.isAlive()
+                        && gatewayAdapter.handleCommand({ type: 'send_prompt', text }));
+                    via = 'gateway';
+                    if (!delivered)
+                        deliverReason = 'gateway_unavailable';
+                }
+                else if (sessionId.startsWith('observed:')) {
                     // Any observed agent (claude, codex, …): type the dictated line
                     // into the terminal that owns the session. session_command only
                     // knew how to route observed *Claude*, so a Codex target was
@@ -3560,15 +4276,17 @@ export async function startDaemon(opts) {
                 }
                 // Only a delivered prompt earns a spoken reply: arming on a
                 // dropped one would read out whatever that session happened to
-                // answer someone else.
-                const armed = delivered ? voiceReply.arm(sink, sessionId) : false;
+                // answer someone else. Armed on an audio-capable sink, which may
+                // differ from the result sink — see audioArmSinkFor.
+                const armSink = audioArmSinkFor(sink, captured.board);
+                const armed = delivered ? voiceReply.arm(armSink, sessionId) : false;
                 // Logged at info level rather than debug: these are rare,
                 // user-initiated events, and the silence made "the board said sent
                 // but nothing happened" undiagnosable without a rebuild.
                 log(`[agentdeck] voice: "${text.slice(0, 40)}" -> ${sessionId.slice(0, 32)}`
                     + ` delivered=${delivered}${via ? ` via ${via}` : ''}`
                     + `${deliverReason ? ` (${deliverReason})` : ''}`
-                    + ` spokenReply=${armed ? `armed(${sink.describe()})` : 'no'}`
+                    + ` spokenReply=${armed ? `armed(${armSink.describe()})` : 'no'}`
                     + ` [${sink.describe()} key=${sink.deviceKey()}`
                     + ` caps=${sink.capabilities().join('|') || 'none'}]`);
             }
@@ -3582,10 +4300,24 @@ export async function startDaemon(opts) {
             catch { /* client disconnecting */ }
         }
         catch (err) {
-            const reason = String(err).slice(0, 160);
-            debug('voice', `transcription failed: ${reason}`);
+            const reason = String(err).slice(0, 300);
+            // Voice turns are rare and user-initiated. Keep failures at info
+            // level so a board's short "Voice error" banner can always be
+            // diagnosed after the temporary WAV has been cleaned up.
+            log(`[agentdeck] voice: transcription failed on ${sink.describe()}: ${reason}`);
+            // The board renders `error` on a one-line banner at glance distance —
+            // a short stable code it can translate beats 160 chars of
+            // NSError soup. The full reason still ships as `detail` and lives in
+            // the log above.
+            const code = /No speech detected|kAFAssistantErrorDomain Code=1110/.test(reason)
+                ? 'no_speech'
+                : /audio_transport_overflow/.test(reason) ? 'audio_lost'
+                    : /audio_transport_incomplete/.test(reason) ? 'audio_incomplete'
+                        : 'voice_failed';
             try {
-                sink.send(JSON.stringify({ type: 'voice_result', text: '', error: reason }));
+                sink.send(JSON.stringify({
+                    type: 'voice_result', text: '', error: code, detail: reason.slice(0, 160),
+                }));
             }
             catch { /* client disconnecting */ }
         }
@@ -3593,6 +4325,91 @@ export async function startDaemon(opts) {
             captured.cleanup();
         }
     };
+    // ── Host push-to-talk (deck surfaces: Stream Deck, D200H) ────────────────
+    // A deck key contributes only a button; the host contributes the mic, the
+    // recognizer and the speakers. This restores the capability of the retired
+    // Voice dial (pulled pre-Marketplace because capture meant borrowing
+    // iTerm2's mic grant via AppleScript + Homebrew sox + a whisper model) on a
+    // dependency-free stack: capture, STT and TTS all live in the bundled Swift
+    // helper, and delivery/reply reuse the device-voice pipeline unchanged.
+    const HOST_SPEAKER_KEY = 'host-speaker';
+    const broadcastVoiceState = (state, extra = {}) => {
+        core.broadcast({ type: 'voice_state', state, ...extra });
+    };
+    /**
+     * ReplySink whose "board" is the host itself. `voice_result` frames become
+     * broadcast `voice_state` events so every deck surface can render the
+     * outcome; the spoken reply is played by the audio_host branch in
+     * speakReplyTo rather than streamed as PCM frames.
+     */
+    const hostSpeakerSink = {
+        send: (data) => {
+            try {
+                const msg = JSON.parse(data);
+                if (msg.type === 'voice_result') {
+                    broadcastVoiceState(msg.error ? 'error' : 'idle', {
+                        ...(msg.text ? { text: msg.text } : {}),
+                        ...(msg.error ? { error: msg.error } : {}),
+                        ...(msg.sessionId ? { sessionId: msg.sessionId } : {}),
+                    });
+                }
+            }
+            catch { /* nothing renderable */ }
+        },
+        sendBinary: () => { },
+        isOpen: () => true,
+        capabilities: () => ['audio_out', 'audio_host'],
+        describe: () => 'host:speaker',
+        deviceKey: () => HOST_SPEAKER_KEY,
+    };
+    /** One capture at a time — PTT models a single held key. */
+    let hostPttBusy = false;
+    function handleHostVoicePtt(cmd) {
+        if (process.platform !== 'darwin') {
+            broadcastVoiceState('error', { error: 'host voice capture requires macOS' });
+            return;
+        }
+        if (cmd.action === 'stop' || cmd.action === 'cancel') {
+            if (!hostPttBusy)
+                return;
+            // Resolves the in-flight recordWithHelper below; a release that races
+            // the max-duration stop is a harmless no-op.
+            void stopHelperRecording({ cancel: cmd.action === 'cancel' }).catch(() => { });
+            return;
+        }
+        if (hostPttBusy)
+            return;
+        hostPttBusy = true;
+        const sessionId = resolveDeviceSessionId(cmd.sessionId) || userFocusedSessionId || '';
+        const sessionExtra = sessionId ? { sessionId } : {};
+        const wavPath = join(tmpdir(), `agentdeck-ptt-${process.pid}-${Date.now()}.wav`);
+        broadcastVoiceState('recording', sessionExtra);
+        void (async () => {
+            try {
+                const rec = await recordWithHelper(wavPath);
+                broadcastVoiceState('transcribing', sessionExtra);
+                await finishVoiceCapture({
+                    wavPath: rec.wav,
+                    sessionId,
+                    board: HOST_SPEAKER_KEY,
+                    cleanup: () => { void rm(rec.wav, { force: true }).catch(() => { }); },
+                }, hostSpeakerSink);
+            }
+            catch (err) {
+                const reason = String(err);
+                if (/record_cancelled/.test(reason)) {
+                    broadcastVoiceState('idle', sessionExtra);
+                }
+                else {
+                    log(`[agentdeck] voice: host PTT failed: ${reason.slice(0, 200)}`);
+                    broadcastVoiceState('error', { error: reason.slice(0, 160), ...sessionExtra });
+                }
+            }
+            finally {
+                hostPttBusy = false;
+            }
+        })();
+    }
     /**
      * Finish one captured photo: build the prompt that points the target session
      * at the saved file, deliver it through the same ladder as dictated text