infinicode 2.8.36 → 2.8.38

package/packages/robopark/scheduler/main.py

@@ -5,11 +5,14 @@ Manages robot fleet, LiveKit servers, and session orchestration
 
 import os
 import asyncio
+import contextvars
+import json
 import logging
 import re
 import secrets
 import hashlib
 import hmac
+import time
 from datetime import datetime, timedelta
 from typing import Optional, List
 from contextlib import asynccontextmanager
@@ -31,6 +34,32 @@ DB_PATH = os.path.join(os.getenv("SCHEDULER_DATA_DIR", "/app/data"), "scheduler.
 # Path to a ROBOVOICE-style settings file the scheduler reads for characters.
 # In production this should be a bind-mount to ROBOVOICE-main/settings.json (or .default.json).
 ROBOVOICE_SETTINGS_PATH = os.path.join(os.getenv("SCHEDULER_DATA_DIR", "/app/data"), "robovoice_settings.json")
+# Shared credential used only by the ROBOVOICE worker to refresh an active
+# RoboPark session. Device endpoints continue to require device tokens. If the
+# environment does not provide it, lifespan() creates/loads this local secret
+# file so a bare `robopark serve` is safe to run without manual secret wiring.
+ROBOPARK_AGENT_TOKEN = os.getenv("ROBOPARK_AGENT_TOKEN", "").strip()
+ROBOPARK_AGENT_TOKEN_FILE = os.getenv(
+    "ROBOPARK_AGENT_TOKEN_FILE",
+    os.path.join(os.getenv("SCHEDULER_DATA_DIR", "/app/data"), ".robopark-agent-token"),
+)
+
+# ElevenLabs credentials used by the /api/voices/elevenlabs endpoint. We accept
+# both the long-form ELEVENLABS_API_KEY and a shorter ELEVENLABS_KEY alias so
+# operators can drop in whichever naming their tooling already exports. Either
+# may be set in the scheduler's environment.
+ELEVENLABS_API_KEY = (
+    os.getenv("ELEVENLABS_API_KEY", "").strip()
+    or os.getenv("ELEVENLABS_KEY", "").strip()
+    or os.getenv("ELEVEN_API_KEY", "").strip()
+)
+ELEVENLABS_BASE_URL = os.getenv("ELEVENLABS_BASE_URL", "https://api.elevenlabs.io").rstrip("/")
+
+# Optional base URL of a local Kokoro TTS server. When set, /api/voices/kokoro
+# will proxy its /v1/audio/voices endpoint to return the dynamic list of voices
+# the server actually has installed; otherwise we fall back to a curated static
+# list of the canonical Kokoro-82M voices.
+KOKORO_BASE_URL = os.getenv("KOKORO_BASE_URL", "").strip().rstrip("/")
 
 # Session end_reasons considered "abnormal" for drop-rate telemetry. A session
 # that ended with one of these reasons is counted as a dropped session; anything
@@ -106,6 +135,15 @@ class WebhookEvent(BaseModel):
     event: str
     data: dict
 
+class ServiceStatus(BaseModel):
+    name: str
+    enabled: bool
+    running: bool
+    pid: Optional[int] = None
+    uptime_seconds: Optional[float] = None
+    failure_count: int = 0
+    last_exit_code: Optional[int] = None
+
 class Device(BaseModel):
     id: str
     name: str
@@ -116,6 +154,12 @@ class Device(BaseModel):
     livekit_url: Optional[str] = None
     video_device: Optional[str] = None
     audio_device: Optional[str] = None
+    audio_output_device: Optional[str] = None
+    greeting_phrases: List[str] = []
+    device_inventory: Optional[dict] = None
+    production_mode: bool = False
+    supervisor_status: Optional[List[ServiceStatus]] = None
+    supervisor_status_at: Optional[str] = None
     status: str = "enrolled"  # enrolled, online, offline, disabled
     last_heartbeat: Optional[datetime] = None
     enrolled_at: Optional[datetime] = None
@@ -132,6 +176,7 @@ class DeviceCreate(BaseModel):
     livekit_url: Optional[str] = None
     video_device: Optional[str] = None
     audio_device: Optional[str] = None
+    greeting_phrases: Optional[List[str]] = None
     notes: Optional[str] = None
     enrollment_token: Optional[str] = None  # if omitted, one is auto-generated
 
@@ -156,6 +201,10 @@ class DeviceHeartbeat(BaseModel):
     ip: Optional[str] = None
     uptime_seconds: Optional[int] = None
     production_mode: Optional[bool] = None
+    device_inventory: Optional[dict] = None
+
+class SupervisorStatusReport(BaseModel):
+    services: List[ServiceStatus] = []
 
 class SettingsPayload(BaseModel):
     production_mode: bool
@@ -194,14 +243,14 @@ async def _seed_voice_stacks_and_characters(db):
         (
             "english-default", "English Default",
             "speaches", "Systran/faster-whisper-small", "en",
-            "ollama", "gemma4:e4b",
+            "ollama", "gemma3:27b",
             "elevenlabs", "21m00Tcm4TlvDq8ikWAM", "en",
             1, 0.7, 20, 0,
         ),
         (
             "hebrew-default", "Hebrew Default",
             "speaches", "ivrit-ai/whisper-large-v3-turbo-ct2", "he",
-            "ollama", "gemma4:e4b",
+            "ollama", "gemma3:27b",
             "elevenlabs", "21m00Tcm4TlvDq8ikWAM", "he",
             1, 0.7, 20, 0,
         ),
@@ -297,9 +346,11 @@ async def init_db():
                 motor_server_url TEXT,
                 character_id TEXT,
                 livekit_url TEXT,
-                video_device TEXT,
-                audio_device TEXT,
-                token_hash TEXT,
+                 video_device TEXT,
+                  audio_device TEXT,
+                  audio_output_device TEXT,
+                  device_inventory TEXT,
+                 token_hash TEXT,
                 enrollment_token_hash TEXT,
                 status TEXT DEFAULT 'enrolled',
                 last_heartbeat TEXT,
@@ -323,6 +374,51 @@ async def init_db():
                 created_at TEXT DEFAULT CURRENT_TIMESTAMP
             );
 
+            CREATE TABLE IF NOT EXISTS trigger_commands (
+                robot_id TEXT PRIMARY KEY,
+                source TEXT NOT NULL DEFAULT 'dashboard',
+                requested_at TEXT NOT NULL
+            );
+
+            -- One pending remote-control command per (device, service): an
+            -- operator clicking "restart" in the dashboard queues a row here;
+            -- robot_supervisor.py polls GET .../supervisor-commands (same
+            -- request that carries its status report) and executes+clears it.
+            -- A second click before the robot polls just overwrites the row
+            -- rather than queuing duplicates.
+            CREATE TABLE IF NOT EXISTS supervisor_commands (
+                device_id TEXT NOT NULL,
+                service_name TEXT NOT NULL,
+                action TEXT NOT NULL DEFAULT 'restart',
+                requested_at TEXT NOT NULL,
+                PRIMARY KEY (device_id, service_name)
+            );
+
+            -- ── Operator shell (C1 gap-fill) ──
+            -- When the operator clicks "Tail logs" or runs a diagnostic
+            -- command in the dashboard, we insert a row here. The robot
+            -- supervisor's next status-report poll receives the row in
+            -- its `commands` response, runs the request on a background
+            -- thread, and POSTs the result back to /api/devices/{id}/
+            -- supervisor-output which updates the `result` column. The
+            -- dashboard polls GET /api/robots/{id}/shell/result/{req_id}
+            -- for the response, with an 8s budget.
+            --
+            -- `kind` discriminates: tail_logs (read log file) vs
+            -- shell_run (execute an allowlisted diagnostic command).
+            CREATE TABLE IF NOT EXISTS shell_requests (
+                id TEXT PRIMARY KEY,
+                device_id TEXT NOT NULL,
+                service_name TEXT,
+                kind TEXT NOT NULL,
+                params TEXT NOT NULL DEFAULT '{}',
+                requested_at TEXT NOT NULL,
+                completed_at TEXT,
+                result_ok INTEGER,
+                result_payload TEXT
+            );
+            CREATE INDEX IF NOT EXISTS idx_shell_requests_device ON shell_requests(device_id, requested_at);
+
             CREATE TABLE IF NOT EXISTS history_log (
                 id INTEGER PRIMARY KEY AUTOINCREMENT,
                 timestamp TEXT DEFAULT CURRENT_TIMESTAMP,
@@ -342,7 +438,7 @@ async def init_db():
                 stt_model TEXT DEFAULT 'Systran/faster-whisper-small',
                 stt_language TEXT DEFAULT 'en',
                 llm_provider TEXT DEFAULT 'ollama',
-                llm_model TEXT DEFAULT 'gemma4:e4b',
+                llm_model TEXT DEFAULT 'gemma3:27b',
                 tts_provider TEXT DEFAULT 'elevenlabs',
                 tts_voice TEXT DEFAULT '21m00Tcm4TlvDq8ikWAM',
                 tts_language TEXT DEFAULT 'en',
@@ -398,6 +494,22 @@ async def init_db():
             ("sessions", "joined_at", "TEXT"),
             ("devices", "video_device", "TEXT"),
             ("devices", "audio_device", "TEXT"),
+            ("devices", "device_inventory", "TEXT"),
+            ("devices", "audio_output_device", "TEXT"),
+            ("devices", "greeting_phrases", "TEXT DEFAULT '[]'"),
+            # Per-robot production mode: an additional, more specific gate on
+            # top of the global settings.production_mode switch. When on for
+            # a given device, that robot keeps re-arming its motion-triggered
+            # session loop indefinitely (device_heartbeat below returns the
+            # AND of global+per-device as the effective flag the Pi acts on)
+            # and the dashboard keeps that robot's camera panel live.
+            ("devices", "production_mode", "INTEGER DEFAULT 0"),
+            # robot_supervisor.py's own periodic self-report: which services
+            # it's managing on this robot (preview_agent, vision_app,
+            # motor_server) and each one's up/down state, pid, uptime, and
+            # failure count. JSON blob; see POST .../supervisor-status.
+            ("devices", "supervisor_status", "TEXT"),
+            ("devices", "supervisor_status_at", "TEXT"),
             # Silence-based session end (see POST /api/sessions/{id}/keepalive
             # and GET /api/sessions/{id}/status): tracks the last time some
             # caller signaled this session was still active. Defaults to
@@ -481,8 +593,30 @@ async def init_db():
 # =============================================================================
 
 @asynccontextmanager
-async def lifespan(app: FastAPI):
-    await init_db()
+async def lifespan(app: FastAPI):
+    await init_db()
+    global ROBOPARK_AGENT_TOKEN
+    if not ROBOPARK_AGENT_TOKEN:
+        try:
+            if os.path.isfile(ROBOPARK_AGENT_TOKEN_FILE):
+                with open(ROBOPARK_AGENT_TOKEN_FILE, "r", encoding="utf-8") as f:
+                    ROBOPARK_AGENT_TOKEN = f.read().strip()
+            if not ROBOPARK_AGENT_TOKEN:
+                ROBOPARK_AGENT_TOKEN = secrets.token_urlsafe(32)
+                os.makedirs(os.path.dirname(ROBOPARK_AGENT_TOKEN_FILE) or ".", exist_ok=True)
+                with open(ROBOPARK_AGENT_TOKEN_FILE, "w", encoding="utf-8") as f:
+                    f.write(ROBOPARK_AGENT_TOKEN + "\n")
+                try:
+                    os.chmod(ROBOPARK_AGENT_TOKEN_FILE, 0o600)
+                except OSError:
+                    pass
+                logger.info("Generated RoboPark agent secret in the scheduler data directory")
+        except OSError as exc:
+            logger.error("Could not load/create RoboPark agent secret: %s", exc)
+    if not ROBOPARK_AGENT_TOKEN:
+        logger.warning(
+            "RoboPark agent secret is unavailable; voice-agent keepalive calls will 401."
+        )
     asyncio.create_task(metrics_collector())
     asyncio.create_task(health_checker())
     yield
@@ -507,8 +641,60 @@ app.add_middleware(
     allow_credentials=_allow_credentials,
     allow_methods=["*"],
     allow_headers=["*"],
+    # X-Operator carries the per-action attribution. CORS preflight
+    # must allow it or the dashboard's rpAction() fetches will fail.
+    expose_headers=["X-Operator"],
 )
 
+
+# ── Operator-actor middleware (C3) ──
+# Reads the X-Operator header on every request and stores a sanitized
+# version in a contextvar. The header is informational only — the
+# scheduler is a single-tenant surface; the actor is recorded in the
+# audit log so "who clicked End-session?" is answerable. The header
+# value is sanitized at this boundary (trimmed, control chars stripped,
+# capped at 64 chars) so the value reaching the database is always a
+# safe printable string. An absent or invalid header leaves the
+# contextvar unset; _log_history then uses the call-site default
+# (usually "operator").
+class _OperatorActorMiddleware:
+    def __init__(self, app):
+        self.app = app
+    async def __call__(self, scope, receive, send):
+        if scope.get("type") == "http":
+            raw = None
+            # ASGI scope headers is a list of (name, value) tuples where
+            # value is bytes — except when a header has been repeated, in
+            # which case some servers emit (name, [b"a", b"b"]). Build a
+            # case-insensitive map that flattens both shapes.
+            for k, v in (scope.get("headers") or []):
+                if not isinstance(k, (bytes, bytearray)):
+                    continue
+                if k.lower() != b"x-operator":
+                    continue
+                if isinstance(v, (list, tuple)):
+                    v = b", ".join(bytes(x) for x in v if isinstance(x, (bytes, bytearray)))
+                if not isinstance(v, (bytes, bytearray)):
+                    continue
+                raw = bytes(v)
+                break
+            actor = None
+            if raw is not None:
+                try:
+                    actor = _sanitize_actor_name(raw.decode("utf-8", errors="replace"))
+                except Exception:
+                    actor = None
+            token = _current_actor_override.set(actor)
+            try:
+                await self.app(scope, receive, send)
+            finally:
+                _current_actor_override.reset(token)
+        else:
+            await self.app(scope, receive, send)
+
+
+app.add_middleware(_OperatorActorMiddleware)
+
 # WebSocket clients for real-time updates
 ws_clients: List[WebSocket] = []
 
@@ -603,15 +789,17 @@ async def robot_heartbeat(robot_id: str, ip_address: Optional[str] = None):
     return {"status": "ok"}
 
 @app.post("/api/robots/{robot_id}/request-session")
-async def request_session(robot_id: str,
-                          authorization: Optional[str] = Header(default=None)):
+async def request_session(robot_id: str,
+                          authorization: Optional[str] = Header(default=None)):
     """Robot requests a session after scene detection.
 
     Requires a valid enrolled-device Bearer token. The response never contains
     the LiveKit api_key/api_secret; instead the scheduler mints a short-lived
     JWT the robot uses to join the room."""
-    if not await _authorize_fleet(authorization):
-        raise HTTPException(401, "Invalid or missing device token")
+    if not await _authorize_fleet(authorization):
+        raise HTTPException(401, "Invalid or missing device token")
+    if not await get_production_mode():
+        raise HTTPException(403, "production_mode_off")
     async with aiosqlite.connect(DB_PATH) as db:
         db.row_factory = aiosqlite.Row
 
@@ -732,9 +920,10 @@ async def end_session(robot_id: str, reason: str = "silence"):
             robot = await cursor.fetchone()
             if not robot or not robot["current_session_id"]:
                 raise HTTPException(400, "No active session")
+            current_session_id = robot["current_session_id"]
         
         # Update session
-        async with db.execute("SELECT * FROM sessions WHERE id = ?", (robot["current_session_id"],)) as cursor:
+        async with db.execute("SELECT * FROM sessions WHERE id = ?", (current_session_id,)) as cursor:
             session = await cursor.fetchone()
             if session:
                 started = datetime.fromisoformat(session["started_at"])
@@ -759,9 +948,97 @@ async def end_session(robot_id: str, reason: str = "silence"):
         await db.commit()
     
     await broadcast("session_ended", {"robot_id": robot_id, "reason": reason})
-    await _log_history("session", "robot", robot_id, "session_ended", "robot", f"reason={reason}, session_id={robot.get('current_session_id')}")
+    await _log_history("session", "robot", robot_id, "session_ended", "robot", f"reason={reason}, session_id={current_session_id}")
     return {"status": "ok"}
 
+@app.post("/api/robots/{robot_id}/simulate-trigger")
+async def simulate_trigger(robot_id: str):
+    """Queue a dashboard motion event for the enrolled robot."""
+    if not await get_production_mode():
+        return {"queued": False, "reason": "production_mode_off"}
+    async with aiosqlite.connect(DB_PATH) as db:
+        db.row_factory = aiosqlite.Row
+        async with db.execute(
+            "SELECT id, current_session_id FROM robots WHERE id = ?", (robot_id,)
+        ) as c:
+            robot = await c.fetchone()
+        if not robot:
+            async with db.execute("SELECT id, name, character_id FROM devices WHERE id = ?", (robot_id,)) as c:
+                device = await c.fetchone()
+            if not device:
+                raise HTTPException(404, "Robot not found")
+            await db.execute(
+                "INSERT OR IGNORE INTO robots (id, name, character_id, status) VALUES (?, ?, ?, 'idle')",
+                (device["id"], device["name"], device["character_id"]),
+            )
+            await db.commit()
+            robot = {"id": device["id"], "current_session_id": None}
+        if not await _effective_device_production_mode(db, robot_id):
+            return {"queued": False, "reason": "device_production_mode_off"}
+        if robot["current_session_id"]:
+            return {"queued": False, "reason": "session_active"}
+        await db.execute(
+            "INSERT INTO trigger_commands (robot_id, source, requested_at) VALUES (?, ?, ?) "
+            "ON CONFLICT(robot_id) DO UPDATE SET source = excluded.source, requested_at = excluded.requested_at",
+            (robot_id, "dashboard", datetime.utcnow().isoformat()),
+        )
+        await db.commit()
+    await broadcast("robot_triggered", {"robot_id": robot_id, "source": "dashboard"})
+    await _log_history("robot", "robot", robot_id, "simulate_trigger", "operator")
+    return {"queued": True, "source": "dashboard"}
+
+@app.post("/api/robots/{robot_id}/simulate-stop")
+async def simulate_stop(robot_id: str):
+    """Stop a simulated or production conversation and release the robot."""
+    async with aiosqlite.connect(DB_PATH) as db:
+        db.row_factory = aiosqlite.Row
+        async with db.execute(
+            "SELECT current_session_id FROM robots WHERE id = ?", (robot_id,)
+        ) as c:
+            robot = await c.fetchone()
+        if not robot:
+            raise HTTPException(404, "Robot not found")
+        await db.execute("DELETE FROM trigger_commands WHERE robot_id = ?", (robot_id,))
+        await db.commit()
+    stopped = False
+    if robot["current_session_id"]:
+        try:
+            await end_session(robot_id, "operator_stop")
+            stopped = True
+        except HTTPException:
+            pass
+    await _log_history("robot", "robot", robot_id, "simulate_stop", "operator")
+    return {"stopped": stopped}
+
+@app.post("/api/robots/{robot_id}/recover")
+async def recover_robot(robot_id: str):
+    """Clear this robot's stale session/trigger state and return it to idle.
+
+    This is intentionally scoped to one robot. It does not restart workers or
+    touch other robots, and is safe to repeat after a failed LiveKit teardown.
+    """
+    now = datetime.utcnow().isoformat()
+    async with aiosqlite.connect(DB_PATH) as db:
+        db.row_factory = aiosqlite.Row
+        async with db.execute("SELECT id, current_session_id FROM robots WHERE id = ?", (robot_id,)) as c:
+            robot = await c.fetchone()
+        if not robot:
+            raise HTTPException(404, "Robot not found")
+        await db.execute(
+            "UPDATE sessions SET ended_at = COALESCE(ended_at, ?), end_reason = COALESCE(end_reason, 'operator_recovery') "
+            "WHERE robot_id = ? AND ended_at IS NULL",
+            (now, robot_id),
+        )
+        await db.execute("DELETE FROM trigger_commands WHERE robot_id = ?", (robot_id,))
+        await db.execute(
+            "UPDATE robots SET status = 'idle', current_session_id = NULL, connected_server_id = NULL WHERE id = ?",
+            (robot_id,),
+        )
+        await db.commit()
+    await broadcast("robot_recovered", {"robot_id": robot_id})
+    await _log_history("robot", "robot", robot_id, "recovered", "operator")
+    return {"status": "ok", "robot_id": robot_id, "previous_session_id": robot["current_session_id"]}
+
 @app.post("/api/robots/{robot_id}/trigger")
 async def robot_trigger(robot_id: str,
                         authorization: Optional[str] = Header(default=None)):
@@ -1047,7 +1324,8 @@ async def session_joined(session_id: str,
 
 @app.post("/api/sessions/{session_id}/keepalive")
 async def session_keepalive(session_id: str,
-                            authorization: Optional[str] = Header(default=None)):
+                            authorization: Optional[str] = Header(default=None),
+                            agent_token: Optional[str] = Header(default=None, alias="X-RoboPark-Agent-Token")):
     """Silence-based session extension signal.
 
     INTEGRATION POINT (out of scope here — lives in a different repo): the
@@ -1066,7 +1344,13 @@ async def session_keepalive(session_id: str,
     ceiling regardless of activity, so a misbehaving/stuck caller can never
     hold the publisher forever even if it calls this endpoint continuously.
     """
-    if not await _authorize_fleet(authorization):
+    device_authorized = await _authorize_fleet(authorization)
+    agent_authorized = bool(
+        ROBOPARK_AGENT_TOKEN
+        and agent_token
+        and hmac.compare_digest(agent_token.strip(), ROBOPARK_AGENT_TOKEN)
+    )
+    if not device_authorized and not agent_authorized:
         raise HTTPException(401, "Invalid or missing device token")
     now = datetime.utcnow().isoformat()
     async with aiosqlite.connect(DB_PATH) as db:
@@ -1248,6 +1532,11 @@ async def metrics_collector():
                     try:
                         async with httpx.AsyncClient(timeout=5.0) as client:
                             resp = await client.get(f"{server['webhook_url']}/metrics")
+                            if resp.status_code == 404:
+                                # Bare LiveKit servers do not expose the agent metrics endpoint.
+                                logger.debug(f"Metrics endpoint unavailable for {server['id']}")
+                                continue
+                            resp.raise_for_status()
                             data = resp.json()
                             
                             # Store in history
@@ -1323,6 +1612,33 @@ async def health_checker():
                     await db.execute("UPDATE devices SET status = 'offline' WHERE id = ?", (did,))
                     await broadcast("device_status_changed", {"device_id": did, "status": "offline"})
 
+                # Reap sessions leaked by a crashed worker or broken LiveKit
+                # disconnect. Normal sessions are closed by the worker, but
+                # this prevents stale rooms consuming server capacity forever.
+                session_cutoff = (datetime.utcnow() - timedelta(seconds=120)).isoformat()
+                async with db.execute(
+                    "SELECT id, robot_id FROM sessions "
+                    "WHERE ended_at IS NULL AND COALESCE(last_activity_at, started_at) < ?",
+                    (session_cutoff,),
+                ) as c:
+                    stale_sessions = await c.fetchall()
+                for session in stale_sessions:
+                    await db.execute(
+                        "UPDATE sessions SET ended_at = ?, end_reason = 'silence' "
+                        "WHERE id = ? AND ended_at IS NULL",
+                        (datetime.utcnow().isoformat(), session["id"]),
+                    )
+                    await db.execute(
+                        "UPDATE robots SET status = 'idle', current_session_id = NULL, "
+                        "connected_server_id = NULL WHERE id = ? AND current_session_id = ?",
+                        (session["robot_id"], session["id"]),
+                    )
+                    await broadcast("session_expired", {
+                        "session_id": session["id"],
+                        "robot_id": session["robot_id"],
+                        "reason": "silence",
+                    })
+
                 await db.commit()
         
         except Exception as e:
@@ -1335,31 +1651,73 @@ async def health_checker():
 # =============================================================================
 
 @app.get("/api/settings")
-async def get_settings():
-    """Public settings (production mode + whether default enrollment token exists)."""
-    pm = await get_production_mode()
-    has_default_token = bool(await get_setting("default_enrollment_token"))
-    return {
-        "production_mode": pm,
-        "default_enrollment_token_set": has_default_token,
-    }
+async def get_settings():
+    """Public settings with secret values reduced to status only."""
+    pm = await get_production_mode()
+    has_default_token = bool(await get_setting("default_enrollment_token"))
+    return {
+        "production_mode": pm,
+        "default_enrollment_token_set": has_default_token,
+        "agent_token_configured": bool(ROBOPARK_AGENT_TOKEN),
+        "agent_token_source": "environment" if os.getenv("ROBOPARK_AGENT_TOKEN", "").strip() else "scheduler_secret_file",
+    }
 
 @app.put("/api/settings")
 async def update_settings(payload: SettingsPayload):
     """Update scheduler settings (production mode, etc.)."""
     await set_setting("production_mode", "true" if payload.production_mode else "false")
+    if not payload.production_mode:
+        async with aiosqlite.connect(DB_PATH) as db:
+            async with db.execute(
+                "SELECT id FROM robots WHERE current_session_id IS NOT NULL"
+            ) as c:
+                active_robot_ids = [row[0] for row in await c.fetchall()]
+            await db.execute("DELETE FROM trigger_commands")
+            await db.execute("DELETE FROM previews")
+            await db.commit()
+        for robot_id in active_robot_ids:
+            try:
+                await end_session(robot_id, "production_mode_off")
+            except HTTPException:
+                pass
     await broadcast("settings_changed", {"production_mode": payload.production_mode})
     await _log_history("settings", "settings", "production_mode", "updated", "operator", f"value={payload.production_mode}")
     return {"status": "ok", "production_mode": payload.production_mode}
 
-@app.post("/api/settings/enrollment-token/rotate")
-async def rotate_enrollment_token():
+@app.post("/api/settings/enrollment-token/rotate")
+async def rotate_enrollment_token():
     """Generate a fresh default enrollment token (rotates the secret)."""
     token = secrets.token_urlsafe(24)
     await set_setting("default_enrollment_token", _hash(token))
     logger.info("Default enrollment token rotated")
     await _log_history("settings", "settings", "default_enrollment_token", "rotated", "operator")
-    return {"enrollment_token": token}
+    return {"enrollment_token": token}
+
+@app.post("/api/settings/agent-token/provision")
+async def provision_agent_token(payload: Optional[dict] = None):
+    """Return the worker secret once so the UI/CLI can provision ROBOVOICE.
+
+    The value is never included in normal settings responses or logs. Rotation
+    is explicit because existing workers would otherwise lose connectivity.
+    """
+    global ROBOPARK_AGENT_TOKEN
+    rotate = bool((payload or {}).get("rotate"))
+    if rotate or not ROBOPARK_AGENT_TOKEN:
+        ROBOPARK_AGENT_TOKEN = secrets.token_urlsafe(32)
+        os.makedirs(os.path.dirname(ROBOPARK_AGENT_TOKEN_FILE) or ".", exist_ok=True)
+        temp_path = ROBOPARK_AGENT_TOKEN_FILE + ".tmp"
+        with open(temp_path, "w", encoding="utf-8") as f:
+            f.write(ROBOPARK_AGENT_TOKEN + "\n")
+        os.replace(temp_path, ROBOPARK_AGENT_TOKEN_FILE)
+        try:
+            os.chmod(ROBOPARK_AGENT_TOKEN_FILE, 0o600)
+        except OSError:
+            pass
+        await _log_history("settings", "settings", "agent_token", "rotated", "operator")
+    return {
+        "agent_token": ROBOPARK_AGENT_TOKEN,
+        "warning": "Shown once by this response. Store it only in the ROBOVOICE worker environment.",
+    }
 
 @app.get("/api/history")
 async def get_history(category: Optional[str] = None, limit: int = 200):
@@ -1589,6 +1947,27 @@ async def robot_stream(robot_id: str,
 PREVIEW_TTL_SECONDS = 45  # preview auto-expires this long after the last keepalive
 DEFAULT_VISION_PORT = 5000  # RoboVisionAI_PI's default Flask port (/video_feed, /api/motion/*)
 
+async def _mirror_device_to_robot(db, device_id: str):
+    """Ensure a `robots` row exists for an enrolled device, so id-keyed routes
+    (/stream, /preview/*) work even before the device's first real voice
+    session (device_request_session normally creates this mirror, but only on
+    first request-session — operator "Go live" should work before that too)."""
+    async with db.execute("SELECT * FROM robots WHERE id = ?", (device_id,)) as c:
+        robot = await c.fetchone()
+    if robot:
+        return robot
+    async with db.execute("SELECT * FROM devices WHERE id = ?", (device_id,)) as c:
+        device = await c.fetchone()
+    if not device:
+        return None
+    await db.execute(
+        "INSERT OR IGNORE INTO robots (id, name, character_id) VALUES (?, ?, ?)",
+        (device_id, device["name"] or device_id, device["character_id"]),
+    )
+    await db.commit()
+    async with db.execute("SELECT * FROM robots WHERE id = ?", (device_id,)) as c:
+        return await c.fetchone()
+
 async def _pick_preview_server(db, prefer_id: Optional[str] = None):
     """Return a LiveKit server row for a preview: a preferred one if still present,
     else the least-loaded online server, else any configured server."""
@@ -1638,9 +2017,8 @@ async def preview_start(robot_id: str):
         return {"active": False, "reason": "production_mode_off"}
     async with aiosqlite.connect(DB_PATH) as db:
         db.row_factory = aiosqlite.Row
-        async with db.execute("SELECT * FROM robots WHERE id = ?", (robot_id,)) as c:
-            if not await c.fetchone():
-                raise HTTPException(404, "Robot not found")
+        if not await _mirror_device_to_robot(db, robot_id):
+            raise HTTPException(404, "Robot not found")
         async with db.execute("SELECT * FROM previews WHERE robot_id = ?", (robot_id,)) as c:
             existing = await c.fetchone()
         server = await _pick_preview_server(db, existing["server_id"] if existing else None)
@@ -1724,6 +2102,26 @@ def _device_row_to_model(row) -> Device:
     d = dict(row)
     d.pop("token_hash", None)
     d.pop("enrollment_token_hash", None)
+    inventory = d.get("device_inventory")
+    if isinstance(inventory, str):
+        try:
+            d["device_inventory"] = json.loads(inventory)
+        except json.JSONDecodeError:
+            d["device_inventory"] = None
+    greetings = d.get("greeting_phrases")
+    if isinstance(greetings, str):
+        try:
+            d["greeting_phrases"] = [str(p) for p in json.loads(greetings) if str(p).strip()]
+        except (json.JSONDecodeError, TypeError):
+            d["greeting_phrases"] = []
+    elif not isinstance(greetings, list):
+        d["greeting_phrases"] = []
+    sup = d.get("supervisor_status")
+    if isinstance(sup, str):
+        try:
+            d["supervisor_status"] = json.loads(sup)
+        except json.JSONDecodeError:
+            d["supervisor_status"] = None
     return Device(**d)
 
 @app.get("/api/devices", response_model=List[Device])
@@ -1782,15 +2180,24 @@ class DeviceUpdate(BaseModel):
     livekit_url: Optional[str] = None
     video_device: Optional[str] = None
     audio_device: Optional[str] = None
+    audio_output_device: Optional[str] = None
+    greeting_phrases: Optional[List[str]] = None
     tailscale_ip: Optional[str] = None
     lan_ip: Optional[str] = None
     notes: Optional[str] = None
     status: Optional[str] = None
+    production_mode: Optional[bool] = None
 
 @app.patch("/api/devices/{device_id}", response_model=Device)
 async def update_device(device_id: str, payload: DeviceUpdate):
     """Partial update for a device (character binding, addresses, notes, status)."""
     fields = {k: v for k, v in payload.model_dump(exclude_none=True).items()}
+    if "greeting_phrases" in fields:
+        fields["greeting_phrases"] = json.dumps(
+            [str(p).strip() for p in fields["greeting_phrases"] if str(p).strip()][:20]
+        )
+    if "production_mode" in fields:
+        fields["production_mode"] = 1 if fields["production_mode"] else 0
     if not fields:
         return await get_device(device_id)
     set_clause = ", ".join(f"{k} = ?" for k in fields)
@@ -1847,13 +2254,13 @@ async def create_device(payload: DeviceCreate):
             """INSERT INTO devices
                (id, name, tailscale_ip, lan_ip, motor_server_url, character_id,
                 livekit_url, video_device, audio_device, enrollment_token_hash,
-                status, enrolled_at, notes, created_at)
-               VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'enrolled', ?, ?, ?)""",
+                greeting_phrases, status, enrolled_at, notes, created_at)
+               VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'enrolled', ?, ?, ?)""",
             (
                 device_id, payload.name.strip(), payload.tailscale_ip, payload.lan_ip,
                 payload.motor_server_url, payload.character_id, payload.livekit_url,
                 payload.video_device, payload.audio_device,
-                enrollment_hash, now, payload.notes, now,
+                enrollment_hash, json.dumps(payload.greeting_phrases or []), now, payload.notes, now,
             ),
         )
         await db.commit()
@@ -1911,18 +2318,63 @@ async def _authorize_device(device_id: str, authorization: Optional[str]) -> boo
 
 async def _log_history(category: str, entity_type: Optional[str] = None, entity_id: Optional[str] = None,
                        action: Optional[str] = None, actor: Optional[str] = None, details: Optional[str] = None):
-    """Append an immutable audit/history record."""
+    """Append an immutable audit/history record.
+
+    The actor argument is overridden by `_current_actor_override` (a
+    contextvar set by the FastAPI middleware from the X-Operator
+    header) when present. The middleware is the only writer to the
+    contextvar, so an untrusted caller cannot impersonate another
+    operator by setting it directly. Falls back to the call-site
+    `actor` argument when no override is set (e.g. system events)."""
+    final_actor = _current_actor_override.get() or actor
     try:
         async with aiosqlite.connect(DB_PATH) as db:
             await db.execute(
                 """INSERT INTO history_log (timestamp, category, entity_type, entity_id, action, actor, details)
                    VALUES (?, ?, ?, ?, ?, ?, ?)""",
-                (datetime.utcnow().isoformat(), category, entity_type, entity_id, action, actor, details),
+                (datetime.utcnow().isoformat(), category, entity_type, entity_id, action, final_actor, details),
             )
             await db.commit()
     except Exception as e:
         logger.warning(f"history log failed: {e}")
 
+
+# Per-request operator name. Set by the operator_actor_middleware (which
+# reads the X-Operator header) and read by _log_history. Sanitized at
+# the middleware boundary so the value reaching the database is always
+# a safe printable string.
+_current_actor_override: contextvars.ContextVar[Optional[str]] = contextvars.ContextVar("current_actor", default=None)
+
+
+def _sanitize_actor_name(name: Optional[str]) -> Optional[str]:
+    """Trim, strip control chars, cap at 64 chars. Returns None if the
+    result is empty so the caller can fall back to the default actor."""
+    if not name:
+        return None
+    s = str(name).strip()
+    if not s:
+        return None
+    # Allow printable ASCII + tab; strip everything else. Newlines and
+    # CR would split a single history row into two display lines, so
+    # we collapse them to a single space.
+    out = []
+    for c in s:
+        if c == "\t" or c == " ":
+            out.append(c)
+        elif 0x20 <= ord(c) < 0x7f:
+            out.append(c)
+        else:
+            # collapse any other whitespace-ish char to a space
+            if c in ("\n", "\r", "\v", "\f"):
+                out.append(" ")
+            # drop anything else silently
+    cleaned = "".join(out).strip()
+    if not cleaned:
+        return None
+    if len(cleaned) > 64:
+        cleaned = cleaned[:64]
+    return cleaned
+
 async def _authorize_fleet(authorization: Optional[str]) -> bool:
     """Verify a Bearer token matches ANY enrolled device token (fleet auth).
 
@@ -2051,35 +2503,412 @@ async def enroll_device(payload: DeviceEnrollRequest):
     scheduler_url = os.getenv("SCHEDULER_PUBLIC_URL", f"http://localhost:{os.getenv('SCHEDULER_PORT', '8080')}")
     return DeviceEnrollResponse(device_id=device_id, device_token=new_token, scheduler_url=scheduler_url)
 
+async def _effective_device_production_mode(db, device_id: str) -> bool:
+    """Global master switch AND this robot's own toggle. Used everywhere a
+    robot decides whether to auto-trigger/stay in its motion-triggered loop."""
+    if not await get_production_mode():
+        return False
+    db.row_factory = aiosqlite.Row
+    async with db.execute("SELECT production_mode FROM devices WHERE id = ?", (device_id,)) as c:
+        row = await c.fetchone()
+    return bool(row["production_mode"]) if row else False
+
+@app.get("/api/devices/{device_id}/trigger-command")
+async def device_trigger_command(device_id: str,
+                                 authorization: Optional[str] = Header(default=None)):
+    """Authenticated robot poll for dashboard-simulated motion events."""
+    if not await _authorize_device(device_id, authorization):
+        raise HTTPException(401, "Invalid device token")
+    async with aiosqlite.connect(DB_PATH) as db:
+        if not await _effective_device_production_mode(db, device_id):
+            return {"trigger": False, "production_mode": False}
+        db.row_factory = aiosqlite.Row
+        async with db.execute(
+            "SELECT source FROM trigger_commands WHERE robot_id = ?", (device_id,)
+        ) as c:
+            command = await c.fetchone()
+        if not command:
+            return {"trigger": False, "production_mode": True}
+        await db.execute("DELETE FROM trigger_commands WHERE robot_id = ?", (device_id,))
+        await db.commit()
+    return {"trigger": True, "source": command["source"], "production_mode": True}
+
 @app.post("/api/devices/{device_id}/heartbeat")
 async def device_heartbeat(device_id: str, payload: DeviceHeartbeat,
                             authorization: Optional[str] = Header(default=None)):
     if not await _authorize_device(device_id, authorization):
         raise HTTPException(401, "Invalid device token")
     async with aiosqlite.connect(DB_PATH) as db:
+        db.row_factory = aiosqlite.Row
         async with db.execute(
             """UPDATE devices
-               SET status = ?, last_heartbeat = ?, last_seen_ip = COALESCE(?, last_seen_ip)
+               SET status = ?, last_heartbeat = ?,
+                   lan_ip = COALESCE(?, lan_ip),
+                   last_seen_ip = COALESCE(?, last_seen_ip),
+                   device_inventory = COALESCE(?, device_inventory)
                WHERE id = ?""",
             (
                 payload.status or "online",
                 datetime.utcnow().isoformat(),
                 payload.ip,
+                payload.ip,
+                json.dumps(payload.device_inventory) if payload.device_inventory is not None else None,
                 device_id,
             ),
         ) as cur:
             await db.commit()
             if cur.rowcount == 0:
                 raise HTTPException(404, "Device not found")
+        effective_pm = await _effective_device_production_mode(db, device_id)
     await broadcast("device_heartbeat", {"device_id": device_id, "status": payload.status})
     await _log_history("device", "device", device_id, "heartbeat", "pi", f"status={payload.status or 'online'}, ip={payload.ip}")
-    # Tell the Pi whether production mode is on (so it can decide to join LiveKit or stand by)
+    # Effective production mode = the global master switch AND this specific
+    # robot's own toggle. A robot with its own toggle off never auto-triggers
+    # sessions from motion, even while the fleet-wide switch is on.
     return {
         "status": "ok",
-        "production_mode": await get_production_mode(),
+        "production_mode": effective_pm,
         "server_time": datetime.utcnow().isoformat(),
     }
 
+@app.post("/api/devices/{device_id}/supervisor-status")
+async def device_supervisor_status(device_id: str, payload: SupervisorStatusReport,
+                                    authorization: Optional[str] = Header(default=None)):
+    """robot_supervisor.py's periodic self-report: which services it's
+    managing on this robot and each one's current up/down state. Reported
+    independently of device_heartbeat (which comes from preview_agent.py --
+    if preview_agent itself is down, it can't report that fact, only the
+    supervisor watching it from outside can)."""
+    if not await _authorize_device(device_id, authorization):
+        raise HTTPException(401, "Invalid device token")
+    blob = json.dumps([s.model_dump() for s in payload.services])
+    now = datetime.utcnow().isoformat()
+    async with aiosqlite.connect(DB_PATH) as db:
+        db.row_factory = aiosqlite.Row
+        cur = await db.execute(
+            "UPDATE devices SET supervisor_status = ?, supervisor_status_at = ? WHERE id = ?",
+            (blob, now, device_id),
+        )
+        await db.commit()
+        if cur.rowcount == 0:
+            raise HTTPException(404, "Device not found")
+        # Piggyback any pending remote-control commands (operator clicked
+        # "restart" on a service) onto this same request/response cycle --
+        # the robot already calls this every 10s, no separate poll needed.
+        # Consumed immediately: read then delete, so a command fires once.
+        # Backward-compat: rows may or may not have a `kind` column on
+        # older DBs. Default to the original "supervisor_action" kind
+        # (treated as restart / start / stop on the service) when missing.
+        pending = []
+        try:
+            async with db.execute(
+                "SELECT service_name, action, kind, params, id FROM shell_requests "
+                "WHERE device_id = ? AND completed_at IS NULL ORDER BY requested_at",
+                (device_id,),
+            ) as c:
+                shell_rows = [dict(r) for r in await c.fetchall()]
+            for r in shell_rows:
+                pending.append({
+                    "service_name": r.get("service_name") or "",
+                    "action": "run",
+                    "kind": r.get("kind") or "shell_run",
+                    "params": json.loads(r["params"]) if r.get("params") else {},
+                    "id": r["id"],
+                })
+        except Exception:
+            shell_rows = []
+        try:
+            async with db.execute(
+                "SELECT service_name, action FROM supervisor_commands WHERE device_id = ?", (device_id,)
+            ) as c:
+                for r in await c.fetchall():
+                    pending.append({"service_name": r["service_name"], "action": r["action"], "kind": "supervisor_action"})
+        except Exception:
+            pass
+        if pending:
+            # Mark shell requests as "in flight" so the dashboard can
+            # distinguish "queued" from "still queued" (the row is read
+            # but not yet completed). supervisor_commands rows are
+            # one-shot and are deleted to mirror the previous behavior.
+            try:
+                ids = [p["id"] for p in pending if p.get("id")]
+                if ids:
+                    placeholders = ",".join("?" for _ in ids)
+                    await db.execute(
+                        f"UPDATE shell_requests SET requested_at = requested_at "
+                        f"WHERE id IN ({placeholders})",
+                        ids,
+                    )
+            except Exception:
+                pass
+            try:
+                await db.execute("DELETE FROM supervisor_commands WHERE device_id = ?", (device_id,))
+            except Exception:
+                pass
+            await db.commit()
+    await broadcast("supervisor_status", {"device_id": device_id, "services": blob})
+    return {"status": "ok", "commands": pending}
+
+@app.post("/api/devices/{device_id}/services/{service_name}/restart")
+async def restart_device_service(device_id: str, service_name: str):
+    """Operator dashboard: queue a restart for one service on one robot's
+    supervisor. Picked up on the robot's next status-report poll (up to
+    ~10s later, not instant -- there's no persistent connection to the
+    robot, only its periodic check-ins)."""
+    now = datetime.utcnow().isoformat()
+    async with aiosqlite.connect(DB_PATH) as db:
+        cur = await db.execute("SELECT 1 FROM devices WHERE id = ?", (device_id,))
+        if not await cur.fetchone():
+            raise HTTPException(404, "Device not found")
+        await db.execute(
+            """INSERT INTO supervisor_commands (device_id, service_name, action, requested_at)
+               VALUES (?, ?, 'restart', ?)
+               ON CONFLICT(device_id, service_name) DO UPDATE SET
+                   action='restart', requested_at=excluded.requested_at""",
+            (device_id, service_name, now),
+        )
+        await db.commit()
+    await _log_history("device", "device", device_id, "service_restart_queued", "operator", f"service={service_name}")
+    return {"status": "queued", "service": service_name}
+
+
+# ── Operator shell (C1) ──
+# Endpoints the dashboard calls to tail logs and run a small allowlisted
+# set of diagnostic commands on a specific robot. Commands are queued in
+# the `shell_requests` table; the robot's supervisor picks them up on its
+# next status-report poll, runs them, and POSTs results back to
+# /api/devices/{id}/supervisor-output. The dashboard polls
+# /api/robots/{id}/shell/result/{request_id} with an 8s budget.
+
+class ShellRequest(BaseModel):
+    kind: str  # "tail_logs" | "shell_run"
+    service: Optional[str] = None
+    params: Optional[dict] = None
+
+
+async def _queue_shell_request_async(device_id: str, kind: str, service: Optional[str], params: dict) -> str:
+    """Insert a shell request row and return its id. Picked up by the
+    robot's supervisor on its next status-report poll."""
+    request_id = secrets.token_urlsafe(12)
+    now = datetime.utcnow().isoformat()
+    async with aiosqlite.connect(DB_PATH) as db:
+        await db.execute(
+            """INSERT INTO shell_requests
+               (id, device_id, service_name, kind, params, requested_at)
+               VALUES (?, ?, ?, ?, ?, ?)""",
+            (request_id, device_id, service, kind, json.dumps(params or {}), now),
+        )
+        await db.commit()
+    return request_id
+
+
+@app.post("/api/robots/{robot_id}/shell/tail")
+async def robot_shell_tail(robot_id: str, payload: ShellRequest):
+    """Queue a tail-logs request for a robot. Returns a request_id the
+    dashboard polls to get the result.
+
+    robot_id == device_id in this codebase (the dashboard's "robot" id is
+    the same value as /api/devices rows)."""
+    device_id = robot_id
+    params = dict(payload.params or {})
+    if "lines" not in params:
+        params["lines"] = 200
+    request_id = await _queue_shell_request_async(device_id, "tail_logs", payload.service, params)
+    return {"status": "queued", "request_id": request_id, "device_id": device_id}
+
+
+@app.post("/api/robots/{robot_id}/shell/exec")
+async def robot_shell_exec(robot_id: str, payload: ShellRequest):
+    """Queue a shell-run request for a robot. Returns a request_id the
+    dashboard polls to get the result."""
+    device_id = robot_id
+    params = dict(payload.params or {})
+    if not params.get("name"):
+        raise HTTPException(400, "params.name is required (e.g. 'uptime', 'free', 'ps', 'tail')")
+    request_id = await _queue_shell_request_async(device_id, "shell_run", payload.service, params)
+    return {"status": "queued", "request_id": request_id, "device_id": device_id}
+
+
+@app.get("/api/robots/{robot_id}/shell/result/{request_id}")
+async def robot_shell_result(robot_id: str, request_id: str):
+    """Return the result of a previously-queued shell request. The
+    dashboard polls this with an 8s budget; we reply as soon as the
+    robot has reported the result back."""
+    async with aiosqlite.connect(DB_PATH) as db:
+        db.row_factory = aiosqlite.Row
+        async with db.execute("SELECT * FROM shell_requests WHERE id = ?", (request_id,)) as c:
+            r = await c.fetchone()
+        if not r or r["device_id"] != robot_id:
+            raise HTTPException(404, "No such shell request for this robot")
+        out = {
+            "request_id": r["id"],
+            "device_id": r["device_id"],
+            "service": r["service_name"],
+            "kind": r["kind"],
+            "params": json.loads(r["params"]) if r["params"] else {},
+            "requested_at": r["requested_at"],
+            "completed": r["completed_at"] is not None,
+            "completed_at": r["completed_at"],
+            "result": None,
+        }
+        if r["completed_at"] is not None:
+            try:
+                out["result"] = json.loads(r["result_payload"]) if r["result_payload"] else {"ok": bool(r["result_ok"])}
+            except Exception:
+                out["result"] = {"ok": bool(r["result_ok"]), "error": "(result payload not parseable)"}
+        return out
+
+
+# Long-poll variant: holds the connection open until the result arrives
+# (or the 8s budget elapses), so the dashboard can wait without polling
+# in a tight loop.
+@app.get("/api/robots/{robot_id}/shell/wait/{request_id}")
+async def robot_shell_wait(robot_id: str, request_id: str, timeout: float = 8.0):
+    deadline = asyncio.get_event_loop().time() + max(0.5, min(15.0, timeout))
+    while True:
+        async with aiosqlite.connect(DB_PATH) as db:
+            db.row_factory = aiosqlite.Row
+            async with db.execute("SELECT * FROM shell_requests WHERE id = ?", (request_id,)) as c:
+                r = await c.fetchone()
+        if not r or r["device_id"] != robot_id:
+            raise HTTPException(404, "No such shell request for this robot")
+        if r["completed_at"] is not None:
+            try:
+                payload = json.loads(r["result_payload"]) if r["result_payload"] else {"ok": bool(r["result_ok"])}
+            except Exception:
+                payload = {"ok": bool(r["result_ok"]), "error": "(result payload not parseable)"}
+            return {"request_id": request_id, "completed": True, "result": payload}
+        if asyncio.get_event_loop().time() >= deadline:
+            return {"request_id": request_id, "completed": False, "timed_out": True}
+        await asyncio.sleep(0.4)
+
+
+@app.post("/api/devices/{device_id}/supervisor-output")
+async def device_supervisor_output(device_id: str, payload: dict, authorization: Optional[str] = Header(default=None)):
+    """Robot supervisor posts back the result of a tail_logs or shell_run
+    request. We just record it on the shell_requests row; the dashboard
+    picks it up via /api/robots/{id}/shell/result/{request_id}."""
+    if not await _authorize_device(device_id, authorization):
+        raise HTTPException(401, "Invalid device token")
+    request_id = payload.get("request_id")
+    if not request_id:
+        raise HTTPException(400, "request_id is required")
+    now = datetime.utcnow().isoformat()
+    result_payload = payload.get("payload") or {}
+    ok = 1 if result_payload.get("ok") else 0
+    async with aiosqlite.connect(DB_PATH) as db:
+        db.row_factory = aiosqlite.Row
+        async with db.execute("SELECT device_id FROM shell_requests WHERE id = ?", (request_id,)) as c:
+            r = await c.fetchone()
+        if not r:
+            raise HTTPException(404, "No such shell request")
+        if r["device_id"] != device_id:
+            raise HTTPException(403, "request_id does not belong to this device")
+        await db.execute(
+            """UPDATE shell_requests SET completed_at = ?, result_ok = ?, result_payload = ?
+               WHERE id = ?""",
+            (now, ok, json.dumps(result_payload), request_id),
+        )
+        await db.commit()
+    kind = payload.get("kind") or "shell"
+    service = payload.get("service") or ""
+    await _log_history("device", "device", device_id, f"shell_{kind}_completed", "operator",
+                       f"service={service}, request_id={request_id}, ok={bool(ok)}")
+    return {"status": "ok"}
+
+
+# Endpoint the dashboard uses to list the available shell commands
+# (allowlist) so the UI can populate a picker instead of typing names.
+# The list mirrors the SHELL_ALLOWLIST in robot_supervisor.py — that
+# file is the authoritative source for what's actually allowed at
+# run time. Keep these two lists in sync when adding/removing commands.
+SHELL_DASHBOARD_ALLOWLIST = [
+    {"name": "uptime",        "argv": ["uptime"]},
+    {"name": "free",          "argv": ["free", "-m"]},
+    {"name": "df",            "argv": ["df", "-h"]},
+    {"name": "ps",            "argv": ["ps", "aux"]},
+    {"name": "uname",         "argv": ["uname", "-a"]},
+    {"name": "date",          "argv": ["date"]},
+    {"name": "whoami",        "argv": ["whoami"]},
+    {"name": "hostname",      "argv": ["hostname"]},
+    {"name": "ip",            "argv": ["ip", "addr"]},
+    {"name": "ss",            "argv": ["ss", "-tlnp"]},
+    {"name": "os-release",    "argv": ["cat", "/etc/os-release"]},
+    {"name": "ls-logs",       "argv": ["ls", "-la", "<dir>"]},
+    {"name": "systemctl-status", "argv": ["systemctl", "status", "<name>", "--no-pager", "-n", "30"]},
+    {"name": "journalctl",    "argv": ["journalctl", "-u", "<name>", "-n", "200", "--no-pager"]},
+    {"name": "tail",          "argv": ["tail", "-n", "<n>", "<path>"]},
+]
+SHELL_DASHBOARD_OUTPUT_MAX = 64 * 1024
+SHELL_DASHBOARD_TIMEOUT = 8.0
+
+@app.get("/api/shell/allowlist")
+async def shell_allowlist():
+    """Return the list of shell command names the robot's supervisor
+    supports. The dashboard uses this to populate the picker; the
+    robot side does the actual allowlist enforcement at run time."""
+    return {
+        "commands": [
+            {"name": s["name"], "argv": s["argv"]}
+            for s in SHELL_DASHBOARD_ALLOWLIST
+        ],
+        "max_output_bytes": SHELL_DASHBOARD_OUTPUT_MAX,
+        "timeout_seconds": SHELL_DASHBOARD_TIMEOUT,
+    }
+
+
+# ── Speaker roundtrip test (C2) ──
+# The dashboard's "Test speaker" button hits this. We queue a
+# speaker_test request on the robot's shell_requests table; the
+# robot's next status-report poll runs the round-trip (play tone,
+# record mic) and POSTs the result back via /supervisor-output.
+# The dashboard polls the same /shell/wait endpoint used for the
+# other shell commands (the supervisor treats speaker_test as
+# just another request kind).
+
+class SpeakerTestRequest(BaseModel):
+    frequency: Optional[float] = None
+    duration: Optional[float] = None
+    amplitude: Optional[float] = None
+    threshold_db: Optional[float] = None
+    output: Optional[str] = None
+    input: Optional[str] = None
+    sample_rate: Optional[int] = None
+
+
+@app.post("/api/robots/{robot_id}/shell/speaker-test")
+async def robot_speaker_test(robot_id: str, payload: SpeakerTestRequest):
+    """Queue a speaker + mic round-trip test on the robot. Returns a
+    request_id; poll /api/robots/{id}/shell/wait/{rid} for the result."""
+    device_id = robot_id
+    params = payload.model_dump(exclude_none=True)
+    request_id = await _queue_shell_request_async(device_id, "speaker_test", None, params)
+    return {"status": "queued", "request_id": request_id, "device_id": device_id}
+
+
+# ── Incident acknowledgement (C4) ──
+# The dashboard's Incidents sub-tab lets an operator acknowledge an
+# active incident (a robot stuck in stuck_session, server_unavailable,
+# etc). The acknowledgement is stored client-side (localStorage) so
+# each operator on their own browser gets their own list; this
+# endpoint is the "central log" mirror so the ack also shows up in
+# the audit history with the operator's name (via X-Operator).
+class IncidentAck(BaseModel):
+    robot_id: str
+    code: str
+    message: Optional[str] = None
+
+@app.post("/api/incidents/ack")
+async def incidents_ack(payload: IncidentAck, x_operator: Optional[str] = Header(default=None, alias="X-Operator")):
+    """Log an operator ack of an active incident. The dashboard
+    stores its own list; this endpoint mirrors the ack in the audit
+    log so the action is visible centrally with the operator's name."""
+    actor = _sanitize_actor_name(x_operator) or 'operator'
+    await _log_history("incident", "robot", payload.robot_id, "acked", actor,
+                       f"code={payload.code}, message={payload.message or ''}")
+    return {"status": "ok", "robot_id": payload.robot_id, "code": payload.code, "by": actor, "at": datetime.utcnow().isoformat()}
+
+
 @app.get("/api/devices/{device_id}/config")
 async def device_config(device_id: str, authorization: Optional[str] = Header(default=None)):
     """Pi polls this to learn current production_mode + assigned character, etc."""
@@ -2088,19 +2917,25 @@ async def device_config(device_id: str, authorization: Optional[str] = Header(de
     async with aiosqlite.connect(DB_PATH) as db:
         db.row_factory = aiosqlite.Row
         async with db.execute(
-            "SELECT id, name, character_id, motor_server_url, livekit_url FROM devices WHERE id = ?",
+            "SELECT id, name, character_id, motor_server_url, livekit_url, video_device, audio_device, audio_output_device, device_inventory, greeting_phrases FROM devices WHERE id = ?",
             (device_id,),
         ) as c:
             row = await c.fetchone()
             if not row:
                 raise HTTPException(404, "Device not found")
+        effective_pm = await _effective_device_production_mode(db, device_id)
     return {
         "device_id": row["id"],
         "name": row["name"],
         "character_id": row["character_id"],
         "motor_server_url": row["motor_server_url"],
         "livekit_url": row["livekit_url"],
-        "production_mode": await get_production_mode(),
+        "video_device": row["video_device"],
+        "audio_device": row["audio_device"],
+        "audio_output_device": row["audio_output_device"],
+        "greeting_phrases": _device_row_to_model(row).greeting_phrases,
+        "device_inventory": json.loads(row["device_inventory"]) if row["device_inventory"] else None,
+        "production_mode": effective_pm,
     }
 
 @app.post("/api/devices/{device_id}/request-session")
@@ -2134,10 +2969,14 @@ async def device_request_session(device_id: str,
         db.row_factory = aiosqlite.Row
 
         # Resolve the enrolled device.
-        async with db.execute("SELECT * FROM devices WHERE id = ?", (device_id,)) as c:
-            device = await c.fetchone()
-            if not device:
-                raise HTTPException(404, "Device not found")
+        async with db.execute("SELECT * FROM devices WHERE id = ?", (device_id,)) as c:
+            device = await c.fetchone()
+            if not device:
+                raise HTTPException(404, "Device not found")
+        if not await get_production_mode():
+            raise HTTPException(403, "production_mode_off")
+        if not bool(device["production_mode"]):
+            raise HTTPException(403, "device_production_mode_off")
 
         # Mirror device -> robot identity (id == device_id). Additive + idempotent:
         # if the robot row already exists it is left untouched.
@@ -2150,6 +2989,21 @@ async def device_request_session(device_id: str,
             (device_id, device["name"] or device_id, device["character_id"]),
         )
 
+        # A robot can only physically be in one room at a time -- it always
+        # disconnects from its previous room before joining a new one (see
+        # preview_agent.py's _apply_state). But this endpoint deliberately
+        # never hard-fails on a prior un-ended session (see docstring), so
+        # without this, repeated presence-triggers (e.g. continuous motion
+        # detection) each leave the previous session's row with
+        # ended_at IS NULL forever -- permanently consuming a slot against
+        # the server's max_sessions capacity until every slot leaks away and
+        # every future request-session 503s. Close them out here instead.
+        await db.execute(
+            """UPDATE sessions SET ended_at = ?, end_reason = 'superseded'
+               WHERE robot_id = ? AND ended_at IS NULL""",
+            (datetime.utcnow().isoformat(), device_id),
+        )
+
         # Find least-loaded online server (identical selection to the robot path).
         async with db.execute("""
             SELECT s.*,
@@ -2287,7 +3141,7 @@ class VoiceStack(BaseModel):
     stt_model: str = "Systran/faster-whisper-small"
     stt_language: str = "en"
     llm_provider: str = "ollama"
-    llm_model: str = "gemma4:e4b"
+    llm_model: str = "gemma3:27b"
     llm_api_key: Optional[str] = None
     temperature: float = 0.7
     num_ctx: int = 8192
@@ -2311,7 +3165,7 @@ class VoiceStackCreate(BaseModel):
     stt_model: str = "Systran/faster-whisper-small"
     stt_language: str = "en"
     llm_provider: str = "ollama"
-    llm_model: str = "gemma4:e4b"
+    llm_model: str = "gemma3:27b"
     llm_api_key: Optional[str] = None
     temperature: float = 0.7
     num_ctx: int = 8192
@@ -2333,6 +3187,7 @@ class RobotVoiceConfig(BaseModel):
     system_prompt: Optional[str] = None
     voice_stack_id: Optional[str] = None
     voice_stack: Optional[VoiceStack] = None
+    greeting_phrases: List[str] = []
 
 def _load_robovoice_settings() -> dict:
     """Read the ROBOVOICE settings file. Returns {} if missing/invalid."""
@@ -2453,6 +3308,48 @@ async def _resolve_voice_stack_for_robot(db, robot_id: str) -> dict:
     return result
 
 
+_ELEVENLABS_NAME_CACHE: tuple[float, list[dict]] = (0.0, [])
+
+
+async def _auto_elevenlabs_voice(robot_name: Optional[str], current: Optional[str]) -> Optional[str]:
+    """Resolve a custom ElevenLabs voice by robot name without overwriting a manual choice."""
+    if current and current != "21m00Tcm4TlvDq8ikWAM":
+        return current
+    if not robot_name:
+        return current
+    normalized = "".join(ch for ch in robot_name.lower() if ch.isalnum())
+    try:
+        mapping = json.loads(os.getenv("ROBOPARK_ELEVENLABS_VOICE_MAP", "{}"))
+        for key, voice_id in mapping.items():
+            if "".join(ch for ch in str(key).lower() if ch.isalnum()) in (normalized, "".join(ch for ch in robot_name.lower() if ch.isalnum())):
+                return str(voice_id)
+    except Exception:
+        pass
+    global _ELEVENLABS_NAME_CACHE
+    now = time.monotonic()
+    voices = _ELEVENLABS_NAME_CACHE[1]
+    if now - _ELEVENLABS_NAME_CACHE[0] > 300 and ELEVENLABS_API_KEY:
+        try:
+            async with httpx.AsyncClient(timeout=8.0) as client:
+                response = await client.get(
+                    f"{ELEVENLABS_BASE_URL}/v1/voices",
+                    headers={"xi-api-key": ELEVENLABS_API_KEY, "Accept": "application/json"},
+                )
+            if response.status_code == 200:
+                voices = response.json().get("voices") or []
+                _ELEVENLABS_NAME_CACHE = (now, voices)
+        except Exception as e:
+            logger.debug(f"ElevenLabs voice auto-assignment unavailable: {e}")
+    aliases = {normalized}
+    if normalized == "vixenbmw":
+        aliases.add("vixen")
+    for voice in voices:
+        voice_name = "".join(ch for ch in str(voice.get("name", "")).lower() if ch.isalnum())
+        if voice_name in aliases or any(alias in voice_name for alias in aliases):
+            return str(voice.get("voice_id") or current)
+    return current
+
+
 async def _resolve_robot_voice_config(robot_id: str) -> RobotVoiceConfig:
     """Public helper to resolve the effective voice config for a robot id."""
     async with aiosqlite.connect(DB_PATH) as db:
@@ -2494,6 +3391,16 @@ async def _resolve_robot_voice_config(robot_id: str) -> RobotVoiceConfig:
                     if row:
                         character_name = row["name"]
 
+        async with db.execute("SELECT greeting_phrases FROM devices WHERE id = ?", (robot_id,)) as c:
+            device_row = await c.fetchone()
+        greeting_phrases = []
+        if device_row and device_row["greeting_phrases"]:
+            try:
+                greeting_phrases = [str(p) for p in _json.loads(device_row["greeting_phrases"]) if str(p).strip()]
+            except Exception:
+                greeting_phrases = []
+        if stack_dict:
+            stack_dict["tts_voice"] = await _auto_elevenlabs_voice(character_name or character_id, stack_dict.get("tts_voice"))
         voice_stack = VoiceStack(**stack_dict) if stack_dict else None
         return RobotVoiceConfig(
             character_id=character_id,
@@ -2501,6 +3408,7 @@ async def _resolve_robot_voice_config(robot_id: str) -> RobotVoiceConfig:
             system_prompt=system_prompt,
             voice_stack_id=voice_stack.id if voice_stack else None,
             voice_stack=voice_stack,
+            greeting_phrases=greeting_phrases,
         )
 
 
@@ -2594,6 +3502,260 @@ async def delete_voice_stack(stack_id: str):
     return {"ok": True}
 
 
+# =============================================================================
+# TTS VOICE CATALOG
+# =============================================================================
+# These endpoints let the dashboard populate its voice selector with the real
+# set of available voices per provider. ElevenLabs is fetched live from the
+# ElevenLabs REST API (using ELEVENLABS_API_KEY); Kokoro is served from a
+# curated static list (or proxied from a local Kokoro server if KOKORO_BASE_URL
+# is set). Both endpoints are public on the scheduler and require no auth —
+# the ElevenLabs key is only used server-side.
+
+class TtsVoice(BaseModel):
+    id: str
+    name: str
+    language: Optional[str] = None
+    gender: Optional[str] = None
+    description: Optional[str] = None
+    preview_url: Optional[str] = None
+    category: Optional[str] = None
+    labels: Optional[dict] = None
+
+
+class TtsVoiceList(BaseModel):
+    provider: str
+    source: str  # "api", "static", or "proxy"
+    count: int
+    voices: List[TtsVoice]
+    warning: Optional[str] = None
+
+
+# Canonical Kokoro-82M voice list. The id is the value written into
+# voice_stacks.tts_voice; name is what the dashboard shows in the dropdown.
+# Sources: https://huggingface.co/hexgrad/Kokoro-82M and the Kokoro repo
+# voices.json manifest (v1.0). Grouped by language for the dropdown label.
+KOKORO_STATIC_VOICES: List[dict] = [
+    # American English
+    {"id": "af_heart",   "name": "Heart (American English · Female)",   "language": "en-US", "gender": "female"},
+    {"id": "af_bella",   "name": "Bella (American English · Female)",   "language": "en-US", "gender": "female"},
+    {"id": "af_nicole",  "name": "Nicole (American English · Female)",  "language": "en-US", "gender": "female"},
+    {"id": "af_sarah",   "name": "Sarah (American English · Female)",   "language": "en-US", "gender": "female"},
+    {"id": "af_sky",     "name": "Sky (American English · Female)",     "language": "en-US", "gender": "female"},
+    {"id": "am_adam",    "name": "Adam (American English · Male)",      "language": "en-US", "gender": "male"},
+    {"id": "am_michael", "name": "Michael (American English · Male)",   "language": "en-US", "gender": "male"},
+    # British English
+    {"id": "bf_emma",    "name": "Emma (British English · Female)",     "language": "en-GB", "gender": "female"},
+    {"id": "bf_isabella","name": "Isabella (British English · Female)", "language": "en-GB", "gender": "female"},
+    {"id": "bm_george",  "name": "George (British English · Male)",     "language": "en-GB", "gender": "male"},
+    {"id": "bm_lewis",   "name": "Lewis (British English · Male)",      "language": "en-GB", "gender": "male"},
+    # Spanish
+    {"id": "ef_dora",    "name": "Dora (Spanish · Female)",             "language": "es",    "gender": "female"},
+    {"id": "em_alex",    "name": "Alex (Spanish · Male)",               "language": "es",    "gender": "male"},
+    {"id": "em_santa",   "name": "Santa (Spanish · Male)",              "language": "es",    "gender": "male"},
+    # French
+    {"id": "ff_siwis",   "name": "Siwis (French · Female)",             "language": "fr",    "gender": "female"},
+    # Hindi
+    {"id": "hf_alpha",   "name": "Alpha (Hindi · Female)",              "language": "hi",    "gender": "female"},
+    {"id": "hf_beta",    "name": "Beta (Hindi · Female)",               "language": "hi",    "gender": "female"},
+    {"id": "hm_omega",   "name": "Omega (Hindi · Male)",                "language": "hi",    "gender": "male"},
+    {"id": "hm_psi",     "name": "Psi (Hindi · Male)",                  "language": "hi",    "gender": "male"},
+    # Italian
+    {"id": "if_sara",    "name": "Sara (Italian · Female)",             "language": "it",    "gender": "female"},
+    {"id": "im_nicola",  "name": "Nicola (Italian · Male)",             "language": "it",    "gender": "male"},
+    # Japanese
+    {"id": "jf_alpha",   "name": "Alpha (Japanese · Female)",           "language": "ja",    "gender": "female"},
+    {"id": "jf_gongitsune","name": "Gongitsune (Japanese · Female)",    "language": "ja",    "gender": "female"},
+    {"id": "jf_nezumi",  "name": "Nezumi (Japanese · Female)",          "language": "ja",    "gender": "female"},
+    {"id": "jf_tebukuro","name": "Tebukuro (Japanese · Female)",        "language": "ja",    "gender": "female"},
+    {"id": "jm_kumo",    "name": "Kumo (Japanese · Male)",              "language": "ja",    "gender": "male"},
+    # Brazilian Portuguese
+    {"id": "pf_dora",    "name": "Dora (Brazilian Portuguese · Female)","language": "pt-BR", "gender": "female"},
+    {"id": "pm_alex",    "name": "Alex (Brazilian Portuguese · Male)",  "language": "pt-BR", "gender": "male"},
+    {"id": "pm_santa",   "name": "Santa (Brazilian Portuguese · Male)", "language": "pt-BR", "gender": "male"},
+    # Mandarin Chinese
+    {"id": "zf_xiaobei", "name": "Xiaobei (Mandarin · Female)",         "language": "zh",    "gender": "female"},
+    {"id": "zf_xiaoni",  "name": "Xiaoni (Mandarin · Female)",          "language": "zh",    "gender": "female"},
+    {"id": "zf_xiaoxiao","name": "Xiaoxiao (Mandarin · Female)",        "language": "zh",    "gender": "female"},
+    {"id": "zf_xiaoyi",  "name": "Xiaoyi (Mandarin · Female)",          "language": "zh",    "gender": "female"},
+    {"id": "zm_yunjian", "name": "Yunjian (Mandarin · Male)",           "language": "zh",    "gender": "male"},
+    {"id": "zm_yunxi",   "name": "Yunxi (Mandarin · Male)",             "language": "zh",    "gender": "male"},
+    {"id": "zm_yunyang", "name": "Yunyang (Mandarin · Male)",           "language": "zh",    "gender": "male"},
+    {"id": "zm_yunze",   "name": "Yunze (Mandarin · Male)",             "language": "zh",    "gender": "male"},
+]
+
+
+def _kokoro_static_payload() -> TtsVoiceList:
+    voices = [TtsVoice(**v) for v in KOKORO_STATIC_VOICES]
+    return TtsVoiceList(provider="kokoro", source="static", count=len(voices), voices=voices)
+
+
+def _normalize_elevenlabs_voices(raw: dict) -> List[TtsVoice]:
+    """Translate ElevenLabs' /v1/voices response into our TtsVoice shape."""
+    out: List[TtsVoice] = []
+    for v in (raw.get("voices") or []):
+        labels = v.get("labels") or {}
+        # Build a friendly display name. ElevenLabs' "name" is usually the
+        # human label (e.g. "Rachel"); we suffix the category so it's obvious
+        # whether it's premade/cloned/etc.
+        category = v.get("category") or labels.get("category") or ""
+        desc_parts = []
+        if labels.get("accent"):        desc_parts.append(str(labels["accent"]))
+        if labels.get("gender"):        desc_parts.append(str(labels["gender"]).lower())
+        if labels.get("age"):           desc_parts.append(str(labels["age"]).lower())
+        if labels.get("use_case"):      desc_parts.append("use: " + str(labels["use_case"]))
+        if labels.get("descriptive"):   desc_parts.append(str(labels["descriptive"]))
+        description = ", ".join([p for p in desc_parts if p])
+        preview = v.get("preview_url") or ""
+        out.append(TtsVoice(
+            id=str(v.get("voice_id") or ""),
+            name=str(v.get("name") or v.get("voice_id") or "voice"),
+            language=labels.get("language") or labels.get("accent") or None,
+            gender=labels.get("gender") or None,
+            description=description or None,
+            preview_url=preview or None,
+            category=str(category) if category else None,
+            labels=labels or None,
+        ))
+    # Sort: by category then by name for a stable, predictable dropdown order.
+    out.sort(key=lambda x: ((x.category or ""), (x.name or "").lower()))
+    return out
+
+
+async def _fetch_elevenlabs_voices() -> TtsVoiceList:
+    """Call the ElevenLabs /v1/voices endpoint and normalize the result.
+
+    On any failure (missing key, network error, non-2xx) we surface a clear
+    warning alongside an empty list so the dashboard can show the error in
+    the picker rather than silently showing zero voices."""
+    if not ELEVENLABS_API_KEY:
+        return TtsVoiceList(
+            provider="elevenlabs",
+            source="api",
+            count=0,
+            voices=[],
+            warning=(
+                "ELEVENLABS_API_KEY is not set on the scheduler — set it in the "
+                "scheduler's environment to fetch the live voice list."
+            ),
+        )
+    url = f"{ELEVENLABS_BASE_URL}/v1/voices"
+    headers = {"xi-api-key": ELEVENLABS_API_KEY, "Accept": "application/json"}
+    try:
+        async with httpx.AsyncClient(timeout=10.0) as client:
+            r = await client.get(url, headers=headers)
+    except Exception as e:
+        return TtsVoiceList(
+            provider="elevenlabs",
+            source="api",
+            count=0,
+            voices=[],
+            warning=f"Could not reach ElevenLabs: {e}",
+        )
+    if r.status_code != 200:
+        # Try to extract a useful message from the response body.
+        msg = (r.text or "").strip()[:200]
+        return TtsVoiceList(
+            provider="elevenlabs",
+            source="api",
+            count=0,
+            voices=[],
+            warning=f"ElevenLabs returned {r.status_code}: {msg or 'no body'}",
+        )
+    try:
+        payload = r.json()
+    except Exception as e:
+        return TtsVoiceList(
+            provider="elevenlabs",
+            source="api",
+            count=0,
+            voices=[],
+            warning=f"ElevenLabs returned non-JSON body: {e}",
+        )
+    voices = _normalize_elevenlabs_voices(payload)
+    return TtsVoiceList(provider="elevenlabs", source="api", count=len(voices), voices=voices)
+
+
+async def _fetch_kokoro_voices() -> TtsVoiceList:
+    """Return the Kokoro voice catalog.
+
+    If KOKORO_BASE_URL is set we proxy to that server's /v1/audio/voices
+    (or whatever path it exposes) and adapt the result. Otherwise we serve
+    the curated static list so the dropdown is always populated."""
+    if not KOKORO_BASE_URL:
+        return _kokoro_static_payload()
+    url = f"{KOKORO_BASE_URL}/v1/audio/voices"
+    try:
+        async with httpx.AsyncClient(timeout=6.0) as client:
+            r = await client.get(url)
+        if r.status_code != 200:
+            warning = f"Kokoro server returned {r.status_code}; falling back to static list"
+            fallback = _kokoro_static_payload()
+            return TtsVoiceList(
+                provider=fallback.provider,
+                source="static",
+                count=fallback.count,
+                voices=fallback.voices,
+                warning=warning,
+            )
+        data = r.json()
+        # Kokoro's API shape varies by server; be permissive.
+        raw_list = data.get("voices") if isinstance(data, dict) else data
+        if not isinstance(raw_list, list):
+            raw_list = []
+        voices: List[TtsVoice] = []
+        for v in raw_list:
+            if isinstance(v, str):
+                voices.append(TtsVoice(id=v, name=v))
+            elif isinstance(v, dict):
+                voices.append(TtsVoice(
+                    id=str(v.get("id") or v.get("voice_id") or v.get("name") or ""),
+                    name=str(v.get("name") or v.get("id") or v.get("voice_id") or ""),
+                    language=v.get("language") or v.get("lang"),
+                    gender=v.get("gender"),
+                ))
+        if not voices:
+            fallback = _kokoro_static_payload()
+            return TtsVoiceList(
+                provider=fallback.provider,
+                source="static",
+                count=fallback.count,
+                voices=fallback.voices,
+                warning="Kokoro server returned no voices; falling back to static list",
+            )
+        return TtsVoiceList(provider="kokoro", source="proxy", count=len(voices), voices=voices)
+    except Exception as e:
+        fallback = _kokoro_static_payload()
+        return TtsVoiceList(
+            provider=fallback.provider,
+            source="static",
+            count=fallback.count,
+            voices=fallback.voices,
+            warning=f"Could not reach Kokoro server ({KOKORO_BASE_URL}): {e}",
+        )
+
+
+@app.get("/api/voices/elevenlabs", response_model=TtsVoiceList)
+async def list_elevenlabs_voices():
+    """Return the catalog of ElevenLabs voices for the dashboard picker.
+
+    Proxies the call to ElevenLabs' /v1/voices endpoint using the scheduler's
+    ELEVENLABS_API_KEY env var. Returns a TtsVoiceList with a `warning` field
+    if the key is missing or the upstream call fails — the dashboard surfaces
+    the warning inside the picker so the operator knows what to fix."""
+    return await _fetch_elevenlabs_voices()
+
+
+@app.get("/api/voices/kokoro", response_model=TtsVoiceList)
+async def list_kokoro_voices():
+    """Return the catalog of Kokoro voices for the dashboard picker.
+
+    Served from a curated static list of the canonical Kokoro-82M voices.
+    If KOKORO_BASE_URL is set we proxy to that local server's voices endpoint
+    and surface the live set instead; the static list is the fallback."""
+    return await _fetch_kokoro_voices()
+
+
 @app.get("/api/character-presets", response_model=List[CharacterPreset])
 async def list_character_presets():
     async with aiosqlite.connect(DB_PATH) as db:
@@ -2762,13 +3924,70 @@ async def _robot_telemetry(db, robot_id: str) -> Optional[dict]:
     Returns trigger_count, sessions_total, avg_latency_ms, drop_rate, drops and
     an end_reason breakdown; None if the robot does not exist."""
     async with db.execute(
-        "SELECT trigger_count, name FROM robots WHERE id = ?", (robot_id,)
+        "SELECT trigger_count, name, status, current_session_id, connected_server_id FROM robots WHERE id = ?", (robot_id,)
     ) as c:
         robot = await c.fetchone()
     if not robot:
         return None
     trigger_count = robot["trigger_count"] or 0
 
+    async with db.execute(
+        "SELECT status, production_mode, last_heartbeat FROM devices WHERE id = ?", (robot_id,)
+    ) as c:
+        device = await c.fetchone()
+    session = None
+    if robot["current_session_id"]:
+        async with db.execute(
+            "SELECT started_at, last_activity_at, ended_at FROM sessions WHERE id = ?",
+            (robot["current_session_id"],),
+        ) as c:
+            session = await c.fetchone()
+
+    now = datetime.utcnow()
+    session_age = None
+    activity_age = None
+    if session:
+        try:
+            session_age = max(0, int((now - datetime.fromisoformat(session["started_at"])).total_seconds()))
+            activity_age = max(0, int((now - datetime.fromisoformat(session["last_activity_at"] or session["started_at"])).total_seconds()))
+        except (TypeError, ValueError):
+            pass
+    heartbeat_age = None
+    if device and device["last_heartbeat"]:
+        try:
+            heartbeat_age = max(0, int((now - datetime.fromisoformat(device["last_heartbeat"])).total_seconds()))
+        except (TypeError, ValueError):
+            pass
+
+    server_status = None
+    if robot["connected_server_id"]:
+        async with db.execute(
+            "SELECT status FROM livekit_servers WHERE id = ?", (robot["connected_server_id"],)
+        ) as c:
+            server_row = await c.fetchone()
+        server_status = server_row["status"] if server_row else None
+
+    readiness_code = "ready"
+    readiness_message = "ready for motion trigger"
+    if not device:
+        readiness_code, readiness_message = "device_missing", "no enrolled device heartbeat"
+    elif not await get_production_mode():
+        readiness_code, readiness_message = "production_off", "global production mode is off"
+    elif not device["production_mode"]:
+        readiness_code, readiness_message = "robot_production_off", "robot production mode is off"
+    elif heartbeat_age is None or heartbeat_age > 30:
+        readiness_code, readiness_message = "heartbeat_stale", f"robot heartbeat is {heartbeat_age or 'unknown'}s old"
+    elif robot["connected_server_id"] and server_status != "online":
+        readiness_code, readiness_message = "server_unavailable", f"LiveKit server {robot['connected_server_id']} is {server_status or 'missing'}"
+    elif not robot["current_session_id"]:
+        readiness_code, readiness_message = "ready", "ready for motion trigger"
+    elif robot["status"] == "connecting" and session_age is not None and session_age > 30:
+        readiness_code, readiness_message = "stuck_session", f"joining LiveKit for {session_age}s; recover robot"
+    elif activity_age is not None and activity_age > 180:
+        readiness_code, readiness_message = "stale_session", f"no session activity for {activity_age}s; recover robot"
+    else:
+        readiness_code, readiness_message = "in_session", "conversation session is active"
+
     # Pull the device's freshest known LAN address (heartbeat > enrollment) so
     # the dashboard can reach the robot directly for e.g. the vision overlay
     # feed, which the scheduler doesn't proxy.
@@ -2819,6 +4038,17 @@ async def _robot_telemetry(db, robot_id: str) -> Optional[dict]:
         "drop_rate": drop_rate,
         "drops": drops,
         "end_reasons": end_reasons,
+        "status": robot["status"],
+        "current_session_id": robot["current_session_id"],
+        "connected_server_id": robot["connected_server_id"],
+        "server_status": server_status,
+        "session_age_seconds": session_age,
+        "session_activity_age_seconds": activity_age,
+        "heartbeat_age_seconds": heartbeat_age,
+        "device_status": device["status"] if device else None,
+        "production_mode": bool(device["production_mode"]) if device else False,
+        "readiness_code": readiness_code,
+        "readiness_message": readiness_message,
     }
 
 @app.get("/api/robots/{robot_id}/telemetry")
@@ -2930,13 +4160,18 @@ async def dashboard():
                     const connected = ref(false);
                     const serverMetrics = ref({});
                     const devices = ref([]);
-                    const settings = ref({ production_mode: false, default_enrollment_token_set: false });
+                    const settings = ref({ production_mode: false, default_enrollment_token_set: false, agent_token_configured: false, agent_token_source: null });
                     const livekit = ref({ url: null, api_key: null, has_secret: false });
-                    const showAddDevice = ref(false);
-                    const showDevices = ref(true);
+                    const showAddDevice = ref(false);
+                    const showDevices = ref(true);
+                    const showCommands = ref(false);
+                    const commandNetwork = ref('lan');
+                    const commandRobotId = ref('');
                     const newDevice = ref({ name: '', tailscale_ip: '', lan_ip: '', motor_server_url: '', character_id: '', livekit_url: '', video_device: 'auto', audio_device: 'default', notes: '' });
-                    const rotatedToken = ref(null);
+                    const rotatedToken = ref(null);
+                    const enrollmentNetwork = ref('lan');
                     const preview = ref({ robot: null, active: false, url: null, token: null, room: null, keepalive: null });
+                    const simulation = ref({ robotId: null, busy: false });
                     const deviceInventory = ref({});
                     const showLiveKitConfig = ref(false);
                     const livekitForm = ref({ url: '', api_key: '', api_secret: '' });
@@ -2948,7 +4183,7 @@ async def dashboard():
                     const editingCharacter = ref(null);
                     const voiceStackForm = ref({
                         id: '', name: '', stt_provider: 'speaches', stt_model: 'Systran/faster-whisper-small', stt_language: 'en',
-                        llm_provider: 'ollama', llm_model: 'gemma4:e4b', tts_provider: 'elevenlabs',
+                        llm_provider: 'ollama', llm_model: 'gemma3:27b', tts_provider: 'elevenlabs',
                         tts_voice: '21m00Tcm4TlvDq8ikWAM', tts_language: 'en',
                         allow_interruptions: true, min_endpointing_delay: 0.7, max_turns: 20, wake_word_enabled: false,
                     });
@@ -2992,18 +4227,25 @@ async def dashboard():
 
                     const buildDeviceInventory = () => {
                         const map = {};
-                        for (const robot of robots.value) {
-                            const device = devices.value.find(d => d.name === robot.name || d.id === robot.id);
-                            const savedVideo = device?.video_device || 'auto';
-                            const savedAudio = device?.audio_device || 'default';
-                            map[robot.id] = {
-                                deviceId: device?.id || null,
-                                robotName: robot.name,
-                                selectedVideo: savedVideo,
-                                selectedAudio: savedAudio,
-                                videoOptions: ['auto', 'none', 'picamera', '/dev/video0', '/dev/video1', '/dev/video2'],
-                                audioOptions: ['default', 'none'],
-                            };
+                        for (const robot of robots.value) {
+                            const device = devices.value.find(d => d.name === robot.name || d.id === robot.id);
+                            const savedVideo = device?.video_device || 'auto';
+                            const savedAudio = device?.audio_device || 'default';
+                            const hardware = device?.device_inventory || {};
+                            const videoOptions = (hardware.video || []).map(x => typeof x === 'string' ? x : x.id).filter(Boolean);
+                            const audioOptions = (hardware.audio_input || []).map(x => typeof x === 'string' ? x : x.id).filter(Boolean);
+                            const audioOutputOptions = (hardware.audio_output || []).map(x => typeof x === 'string' ? x : x.id).filter(Boolean);
+                            map[robot.id] = {
+                                deviceId: device?.id || null,
+                                robotName: robot.name,
+                                selectedVideo: savedVideo,
+                                selectedAudio: savedAudio,
+                                selectedAudioOutput: device?.audio_output_device || 'default',
+                                greetingText: (device?.greeting_phrases || []).join('\\n'),
+                                videoOptions: [...new Set(['auto', 'none', savedVideo, ...videoOptions])],
+                                audioOptions: [...new Set(['default', 'none', savedAudio, ...audioOptions])],
+                                audioOutputOptions: [...new Set(['default', 'none', device?.audio_output_device || 'default', ...audioOutputOptions])],
+                            };
                         }
                         deviceInventory.value = map;
                     };
@@ -3060,18 +4302,20 @@ async def dashboard():
                     const toggleProductionMode = async () => {
                         try {
                             const next = !settings.value.production_mode;
-                            await fetch('/api/settings', {
+                            const response = await fetch('/api/settings', {
                                 method: 'PUT',
                                 headers: {'Content-Type': 'application/json'},
                                 body: JSON.stringify({ production_mode: next }),
                             });
+                            if (!response.ok) throw new Error(`HTTP ${response.status}`);
                             settings.value.production_mode = next;
+                            await fetchData();
                         } catch (e) {
                             alert('Failed to toggle production mode: ' + e.message);
                         }
                     };
 
-                    const rotateEnrollmentToken = async () => {
+                    const rotateEnrollmentToken = async () => {
                         if (!confirm('Rotate the global default enrollment token? Any Pi waiting to enroll with the previous token will be rejected.')) return;
                         try {
                             const r = await fetch('/api/settings/enrollment-token/rotate', { method: 'POST' }).then(r => r.json());
@@ -3080,7 +4324,23 @@ async def dashboard():
                         } catch (e) {
                             alert('Failed to rotate token: ' + e.message);
                         }
-                    };
+                    };
+
+                    const provisionAgentToken = async (rotate = false) => {
+                        if (rotate && !confirm('Rotate the ROBOVOICE authentication secret? Existing workers must be restarted after synchronization.')) return;
+                        try {
+                            const r = await fetch('/api/settings/agent-token/provision', {
+                                method: 'POST', headers: {'Content-Type': 'application/json'},
+                                body: JSON.stringify({ rotate }),
+                            }).then(r => r.json());
+                            if (!r.agent_token) throw new Error(r.detail || 'No secret returned');
+                            alert('ROBOVOICE secret (shown once):\\n\\n' + r.agent_token + '\\n\\nCopy it into the worker environment or run: robopark secrets --scheduler-url ' + window.location.origin + ' --worker-env <ROBOVOICE>/.env');
+                            settings.value.agent_token_configured = true;
+                            await fetchData();
+                        } catch (e) {
+                            alert('Failed to provision agent secret: ' + e.message);
+                        }
+                    };
 
                     const submitNewDevice = async () => {
                         try {
@@ -3100,7 +4360,7 @@ async def dashboard():
                         }
                     };
 
-                    const updateDeviceMedia = async (robotId) => {
+                    const updateDeviceMedia = async (robotId) => {
                         const inv = deviceInventory.value[robotId];
                         if (!inv || !inv.deviceId) return;
                         try {
@@ -3108,18 +4368,20 @@ async def dashboard():
                                 method: 'PATCH',
                                 headers: {'Content-Type': 'application/json'},
                                 body: JSON.stringify({
-                                    video_device: inv.selectedVideo,
-                                    audio_device: inv.selectedAudio,
-                                }),
-                            });
-                            fetchData();
+                                    video_device: inv.selectedVideo,
+                                    audio_device: inv.selectedAudio,
+                                    audio_output_device: inv.selectedAudioOutput,
+                                }),
+                            });
+                            if (!response.ok) throw new Error(`HTTP ${response.status}`);
+                            fetchData();
                         } catch (e) {
                             alert('Failed to update device media: ' + e.message);
                         }
                     };
 
-                    const startPreview = async (robot) => {
-                        stopPreview();
+                    const startPreview = async (robot) => {
+                        await stopPreview();
                         try {
                             const r = await fetch(`/api/robots/${robot.id}/preview/start`, { method: 'POST' }).then(r => r.json());
                             if (!r.active) {
@@ -3139,14 +4401,94 @@ async def dashboard():
                         }
                     };
 
-                    const stopPreview = () => {
-                        if (preview.value.keepalive) clearInterval(preview.value.keepalive);
-                        if (preview.value.room) {
-                            try { window.__lkPreviewRoom?.disconnect(); } catch (e) {}
+                    const stopPreview = async () => {
+                        const robotId = preview.value.robot?.id;
+                        if (preview.value.keepalive) clearInterval(preview.value.keepalive);
+                        if (preview.value.room) {
+                            try { window.__lkPreviewRoom?.disconnect(); } catch (e) {}
+                        }
+                        preview.value = { robot: null, active: false, url: null, token: null, room: null, keepalive: null };
+                        if (robotId) {
+                            try {
+                                await fetch(`/api/robots/${robotId}/preview/stop`, { method: 'POST' });
+                            } catch (e) { console.warn('preview stop failed', e); }
+                        }
+                    };
+
+                    const simulateTrigger = async (robot) => {
+                        if (!settings.value.production_mode || simulation.value.busy) return;
+                        simulation.value = { robotId: robot.id, busy: true };
+                        try {
+                            const response = await fetch(`/api/robots/${robot.id}/simulate-trigger`, { method: 'POST' });
+                            const result = await response.json();
+                            if (!response.ok) throw new Error(result.detail || `HTTP ${response.status}`);
+                            if (!result.queued) {
+                                alert('Trigger not queued: ' + (result.reason || 'unknown'));
+                            }
+                            await fetchData();
+                        } catch (e) {
+                            alert('Failed to simulate motion: ' + e.message);
+                        } finally {
+                            simulation.value = { robotId: null, busy: false };
                         }
-                        preview.value = { robot: null, active: false, url: null, token: null, room: null, keepalive: null };
                     };
 
+                    const stopConversation = async (robot) => {
+                        try {
+                            const response = await fetch(`/api/robots/${robot.id}/simulate-stop`, { method: 'POST' });
+                            const result = await response.json();
+                            if (!response.ok) throw new Error(result.detail || `HTTP ${response.status}`);
+                            await fetchData();
+                        } catch (e) {
+                            alert('Failed to stop conversation: ' + e.message);
+                        }
+                    };
+
+                    const recoverRobot = async (robot) => {
+                        if (!confirm(`Clear stale session state for ${robot.name}?`)) return;
+                        try {
+                            const response = await fetch(`/api/robots/${robot.id}/recover`, { method: 'POST' });
+                            const result = await response.json();
+                            if (!response.ok) throw new Error(result.detail || `HTTP ${response.status}`);
+                            await fetchData();
+                        } catch (e) {
+                            alert('Failed to recover robot: ' + e.message);
+                        }
+                    };
+
+                    const toggleDeviceProduction = async (robotId) => {
+                        const inv = deviceInventory.value[robotId];
+                        if (!inv || !inv.deviceId) return;
+                        await setDeviceProduction(inv.deviceId);
+                    };
+
+                    const setDeviceProduction = async (deviceId) => {
+                        const device = devices.value.find(d => d.id === deviceId);
+                        if (!device) return;
+                        try {
+                            const response = await fetch(`/api/devices/${deviceId}`, {
+                                method: 'PATCH', headers: {'Content-Type': 'application/json'},
+                                body: JSON.stringify({ production_mode: !device?.production_mode }),
+                            });
+                            if (!response.ok) throw new Error(`HTTP ${response.status}`);
+                            await fetchData();
+                        } catch (e) { alert('Failed to change robot production mode: ' + e.message); }
+                    };
+
+                    const saveDeviceGreetings = async (robotId) => {
+                        const inv = deviceInventory.value[robotId];
+                        if (!inv || !inv.deviceId) return;
+                        try {
+                            const greeting_phrases = inv.greetingText.split(/\\r?\\n/).map(s => s.trim()).filter(Boolean).slice(0, 20);
+                            const response = await fetch(`/api/devices/${inv.deviceId}`, {
+                                method: 'PATCH', headers: {'Content-Type': 'application/json'},
+                                body: JSON.stringify({ greeting_phrases }),
+                            });
+                            if (!response.ok) throw new Error(`HTTP ${response.status}`);
+                            await fetchData();
+                        } catch (e) { alert('Failed to save greetings: ' + e.message); }
+                    };
+
                     const connectLiveKitPreview = async (url, token) => {
                         const { Room } = LiveKitClient;
                         const room = new Room({ adaptiveStream: true });
@@ -3182,7 +4524,15 @@ async def dashboard():
                         }
                     };
 
-                    const dismissRotatedToken = () => { rotatedToken.value = null; };
+                    const dismissRotatedToken = () => { rotatedToken.value = null; };
+                    const enrollmentCommand = (token) => {
+                        if (!token) return '';
+                        const schedulerPort = window.location.port || '8080';
+                        const networkFlag = enrollmentNetwork.value === 'tailscale' ? '--tailscale' : '--lan';
+                        const hubProtocol = window.location.protocol === 'https:' ? 'https://' : 'http://';
+                        const hubUrl = `${hubProtocol}${window.location.hostname}:47913`;
+                        return `robopark setup --robot --name "${token.name || token.device_id}" --hub-url ${hubUrl} --scheduler-port ${schedulerPort} ${networkFlag} --enrollment-token ${token.token} --start --auto-start`;
+                    };
 
                     const joinConversation = async (device) => {
                         try {
@@ -3285,9 +4635,10 @@ async def dashboard():
                         setInterval(fetchData, 30000);
                     });
 
-                    onUnmounted(() => {
-                        if (ws) ws.close();
-                    });
+                    onUnmounted(() => {
+                        if (ws) ws.close();
+                        stopPreview();
+                    });
 
                     const openVoiceStackForm = (stack = null) => {
                         if (stack) {
@@ -3297,7 +4648,7 @@ async def dashboard():
                             editingVoiceStack.value = null;
                             voiceStackForm.value = {
                                 id: '', name: '', stt_provider: 'speaches', stt_model: 'Systran/faster-whisper-small', stt_language: 'en',
-                                llm_provider: 'ollama', llm_model: 'gemma4:e4b', tts_provider: 'elevenlabs',
+                                llm_provider: 'ollama', llm_model: 'gemma3:27b', tts_provider: 'elevenlabs',
                                 tts_voice: '21m00Tcm4TlvDq8ikWAM', tts_language: 'en',
                                 allow_interruptions: true, min_endpointing_delay: 0.7, max_turns: 20, wake_word_enabled: false,
                             };
@@ -3381,17 +4732,44 @@ async def dashboard():
                     const stackName = (id) => voiceStacks.value.find(s => s.id === id)?.name || '—';
                     const characterName = (id) => characterPresets.value.find(c => c.id === id)?.name || '—';
 
-                    return {
-                        robots, servers, sessions, stats, connected, serverMetrics,
-                        devices, settings, livekit, showAddDevice, showDevices, newDevice, rotatedToken,
+                    const schedulerBase = () => window.location.origin;
+                    const selectedCommandRobot = computed(() => devices.value.find(d => d.id === commandRobotId.value) || devices.value[0] || null);
+                    const commandRows = computed(() => {
+                        const base = schedulerBase();
+                        const robot = selectedCommandRobot.value;
+                        const robotId = robot?.id || '<DEVICE_ID>';
+                        const robotName = robot?.name || '<ROBOT_NAME>';
+                        const networkFlag = commandNetwork.value === 'tailscale' ? '--tailscale' : '--lan';
+                        const tokenPlaceholder = '<ENROLLMENT_TOKEN_FROM_ADD_DEVICE>';
+                        return [
+                            { group: 'Scheduler', name: 'Health check', description: 'Confirm the control center API is reachable.', command: `curl -s ${base}/api/settings` },
+                            { group: 'Scheduler', name: 'Start scheduler', description: 'Start the RoboPark scheduler and dashboard on port 8080.', command: 'robopark serve --port 8080' },
+                            { group: 'Robot', name: 'Enroll robot', description: `Generated for ${robotName} over ${commandNetwork.value}. Paste the one-time token from the Add Device dialog.`, command: `robopark setup --robot --name "${robotName}" --hub-url ${base.replace(/:\\d+$/, '')}:47913 --scheduler-port ${window.location.port || '8080'} ${networkFlag} --enrollment-token ${tokenPlaceholder} --start --auto-start` },
+                            { group: 'Robot', name: 'Simulate motion', description: 'Queue a full production trigger for the selected robot.', command: `curl -s -X POST ${base}/api/robots/${robotId}/simulate-trigger` },
+                            { group: 'Robot', name: 'Stop conversation', description: 'Stop the active conversation and clear queued trigger state.', command: `curl -s -X POST ${base}/api/robots/${robotId}/simulate-stop` },
+                            { group: 'Robot', name: 'Recover stale state', description: 'Release a robot stuck in connecting/running after a failed teardown.', command: `curl -s -X POST ${base}/api/robots/${robotId}/recover` },
+                            { group: 'Worker', name: 'Sync agent secret', description: 'Provision the scheduler-managed secret into ROBOVOICE-main.', command: `robopark secrets --scheduler-url ${base} --worker-env C:\\path\\to\\ROBOVOICE-main\\.env` },
+                            { group: 'Diagnostics', name: 'Tail agent logs', description: 'Inspect the local ROBOVOICE worker.', command: 'docker logs --tail 100 caal-agent' },
+                            { group: 'Diagnostics', name: 'Check Docker', description: 'List containers, health, ports, and networks.', command: 'docker ps -a --format "table {{.Names}}\\t{{.Status}}\\t{{.Ports}}\\t{{.Networks}}"' },
+                            { group: 'Diagnostics', name: 'Check LiveKit port', description: 'Confirm the local LiveKit listener is present.', command: 'Get-NetTCPConnection -LocalPort 7883 -ErrorAction SilentlyContinue' },
+                        ];
+                    });
+                    const copyCommand = async (command) => {
+                        try { await navigator.clipboard.writeText(command); }
+                        catch (e) { window.prompt('Copy command:', command); }
+                    };
+
+                    return {
+                        robots, servers, sessions, stats, connected, serverMetrics,
+                        devices, settings, livekit, showAddDevice, showDevices, showCommands, commandNetwork, commandRobotId, selectedCommandRobot, commandRows, copyCommand, newDevice, rotatedToken, enrollmentNetwork, enrollmentCommand, simulation,
                         showLiveKitConfig, livekitForm, preview, deviceInventory,
                         voiceStacks, characterPresets, showVoiceStackForm, showCharacterForm,
                         editingVoiceStack, editingCharacter, voiceStackForm, characterForm,
                         loadModel, unloadModel, statusColor, formatDuration, formatTime,
-                        toggleProductionMode, rotateEnrollmentToken,
+                        toggleProductionMode, rotateEnrollmentToken, provisionAgentToken,
                         submitNewDevice, deleteDevice, rotateDeviceToken, dismissRotatedToken,
                         joinConversation, saveLiveKitConfig, openLiveKitConfig,
-                        startPreview, stopPreview, updateDeviceMedia,
+                        startPreview, stopPreview, simulateTrigger, stopConversation, recoverRobot, toggleDeviceProduction, setDeviceProduction, saveDeviceGreetings, updateDeviceMedia,
                         openVoiceStackForm, saveVoiceStack, deleteVoiceStack,
                         openCharacterForm, saveCharacter, deleteCharacter,
                         assignRobotCharacter, stackName, characterName,
@@ -3405,20 +4783,30 @@ async def dashboard():
                                 <h1 class="text-3xl font-bold">🤖 RoboPark Control Center</h1>
                                 <p class="text-gray-400">Session Scheduler Dashboard — Shenzhen Bay Park (test site)</p>
                             </div>
-                            <div class="flex items-center gap-4">
-                                <button @click="openLiveKitConfig"
+                            <div class="flex items-center gap-4">
+                                <button @click="showCommands = !showCommands"
+                                        :class="showCommands ? 'bg-blue-700 hover:bg-blue-600' : 'bg-gray-700 hover:bg-gray-600'"
+                                        class="px-3 py-2 rounded-lg text-sm">Commands</button>
+                                <button @click="openLiveKitConfig"
                                         :class="livekit.url && livekit.has_secret ? 'bg-cyan-700 hover:bg-cyan-600' : 'bg-gray-700 hover:bg-gray-600'"
                                         class="px-3 py-2 rounded-lg flex items-center gap-2 text-sm"
                                         :title="livekit.url || 'Not configured'">
                                     <span class="w-2 h-2 rounded-full" :class="livekit.url && livekit.has_secret ? 'bg-cyan-200' : 'bg-yellow-400'"></span>
                                     LiveKit: <strong>{{ livekit.url && livekit.has_secret ? (livekit.url.replace(/^wss?:[/][/]/, '')) : 'NOT SET' }}</strong>
                                 </button>
-                                <button @click="toggleProductionMode"
+                                <button @click="toggleProductionMode"
                                         :class="settings.production_mode ? 'bg-green-600 hover:bg-green-700' : 'bg-gray-700 hover:bg-gray-600'"
                                         class="px-3 py-2 rounded-lg flex items-center gap-2 text-sm">
                                     <span class="w-2 h-2 rounded-full" :class="settings.production_mode ? 'bg-green-200 animate-pulse' : 'bg-gray-400'"></span>
                                     Production Mode: <strong>{{ settings.production_mode ? 'ON' : 'OFF' }}</strong>
-                                </button>
+                                </button>
+                                <button @click="provisionAgentToken(false)"
+                                        :class="settings.agent_token_configured ? 'bg-emerald-800 hover:bg-emerald-700' : 'bg-red-800 hover:bg-red-700'"
+                                        class="px-3 py-2 rounded-lg flex items-center gap-2 text-sm"
+                                        title="Provision the scheduler-managed ROBOVOICE authentication secret">
+                                    <span class="w-2 h-2 rounded-full" :class="settings.agent_token_configured ? 'bg-emerald-200' : 'bg-red-300'"></span>
+                                    Agent Secret: <strong>{{ settings.agent_token_configured ? 'SET' : 'MISSING' }}</strong>
+                                </button>
                                 <span :class="connected ? 'text-green-400' : 'text-red-400'" class="flex items-center gap-2">
                                     <span class="w-2 h-2 rounded-full" :class="connected ? 'bg-green-400' : 'bg-red-400'"></span>
                                     {{ connected ? 'Live' : 'Disconnected' }}
@@ -3426,7 +4814,38 @@ async def dashboard():
                             </div>
                         </header>
 
-                        <!-- Stats Row -->
+                        <!-- Command Center -->
+                        <section v-if="showCommands" class="bg-gray-800 rounded-lg p-5 mb-6">
+                            <div class="flex flex-wrap items-center justify-between gap-3 mb-4">
+                                <div>
+                                    <h2 class="text-xl font-semibold">Command Center</h2>
+                                    <p class="text-xs text-gray-400">Copy-ready operational commands. Secrets are never included; enrollment uses a one-time token from the Add Device dialog.</p>
+                                </div>
+                                <div class="flex gap-2 items-center">
+                                    <select v-model="commandRobotId" class="bg-gray-700 rounded px-3 py-2 text-sm">
+                                        <option value="">Select robot</option>
+                                        <option v-for="d in devices" :key="d.id" :value="d.id">{{ d.name }} ({{ d.id }})</option>
+                                    </select>
+                                    <button @click="commandNetwork = 'lan'" :class="commandNetwork === 'lan' ? 'bg-blue-600' : 'bg-gray-700'" class="px-3 py-2 rounded text-sm">LAN</button>
+                                    <button @click="commandNetwork = 'tailscale'" :class="commandNetwork === 'tailscale' ? 'bg-cyan-600' : 'bg-gray-700'" class="px-3 py-2 rounded text-sm">Tailscale</button>
+                                </div>
+                            </div>
+                            <div class="grid md:grid-cols-2 gap-3">
+                                <div v-for="cmd in commandRows" :key="cmd.group + cmd.name" class="bg-gray-900 rounded p-3">
+                                    <div class="flex items-start justify-between gap-2">
+                                        <div>
+                                            <div class="text-xs text-cyan-400">{{ cmd.group }}</div>
+                                            <div class="font-medium text-sm">{{ cmd.name }}</div>
+                                            <div class="text-xs text-gray-500 mt-1">{{ cmd.description }}</div>
+                                        </div>
+                                        <button @click="copyCommand(cmd.command)" class="shrink-0 px-2 py-1 rounded bg-gray-700 hover:bg-gray-600 text-xs">Copy</button>
+                                    </div>
+                                    <code class="block mt-2 text-xs text-green-300 break-all select-all">{{ cmd.command }}</code>
+                                </div>
+                            </div>
+                        </section>
+
+                        <!-- Stats Row -->
                         <div class="grid grid-cols-5 gap-4 mb-6">
                             <div class="bg-gray-800 rounded-lg p-4">
                                 <div class="text-2xl font-bold text-green-400">{{ stats.active_sessions || 0 }}</div>
@@ -3503,9 +4922,12 @@ async def dashboard():
                                             <td class="py-2 px-2 font-mono text-xs">{{ d.tailscale_ip || '—' }}</td>
                                             <td class="py-2 px-2 font-mono text-xs">{{ d.lan_ip || '—' }}</td>
                                             <td class="py-2 px-2 font-mono text-xs text-gray-400">{{ d.motor_server_url || '—' }}</td>
-                                            <td class="py-2 px-2 text-xs text-gray-400">{{ formatTime(d.last_heartbeat) }}</td>
-                                            <td class="py-2 px-2 text-xs space-x-2">
-                                                <button @click="joinConversation(d)"
+                                            <td class="py-2 px-2 text-xs text-gray-400">{{ formatTime(d.last_heartbeat) }}</td>
+                                            <td class="py-2 px-2 text-xs space-x-2">
+                                                <button @click="setDeviceProduction(d.id)"
+                                                        :class="d.production_mode ? 'bg-green-700 hover:bg-green-600' : 'bg-gray-700 hover:bg-gray-600'"
+                                                        class="px-2 py-1 rounded">Prod {{ d.production_mode ? 'ON' : 'OFF' }}</button>
+                                                <button @click="joinConversation(d)"
                                                         :disabled="!settings.production_mode || !livekit.url || !livekit.has_secret"
                                                         :class="(settings.production_mode && livekit.url && livekit.has_secret) ? 'bg-cyan-600 hover:bg-cyan-700' : 'bg-gray-700 cursor-not-allowed'"
                                                         class="px-2 py-1 rounded"
@@ -3586,9 +5008,18 @@ async def dashboard():
                         <div v-if="rotatedToken" class="fixed inset-0 bg-black/70 flex items-center justify-center z-50" @click.self="dismissRotatedToken">
                             <div class="bg-gray-800 rounded-lg p-6 w-full max-w-lg">
                                 <h3 class="text-lg font-semibold mb-2">⚠ Save this token now</h3>
-                                <p class="text-xs text-gray-400 mb-4">This token is shown <strong>once</strong>. Copy it to the Pi (e.g. into <code>/etc/robopark/device.json</code>) before dismissing.</p>
-                                <div class="bg-gray-900 p-3 rounded font-mono text-xs break-all select-all">{{ rotatedToken.token }}</div>
-                                <div class="flex justify-end mt-4">
+                                <p class="text-xs text-gray-400 mb-4">This token is shown <strong>once</strong>. Copy it to the Pi (e.g. into <code>/etc/robopark/device.json</code>) before dismissing.</p>
+                                <div class="bg-gray-900 p-3 rounded font-mono text-xs break-all select-all">{{ rotatedToken.token }}</div>
+                                <div class="mt-4">
+                                    <div class="text-xs text-gray-400 mb-2">Robot network for generated enrollment command</div>
+                                    <div class="flex gap-2 mb-2">
+                                        <button @click="enrollmentNetwork = 'lan'" :class="enrollmentNetwork === 'lan' ? 'bg-blue-600' : 'bg-gray-700'" class="px-3 py-1 rounded text-xs">LAN</button>
+                                        <button @click="enrollmentNetwork = 'tailscale'" :class="enrollmentNetwork === 'tailscale' ? 'bg-cyan-600' : 'bg-gray-700'" class="px-3 py-1 rounded text-xs">Tailscale</button>
+                                    </div>
+                                    <div class="bg-gray-900 p-3 rounded font-mono text-xs break-all select-all">{{ enrollmentCommand(rotatedToken) }}</div>
+                                    <p class="text-xs text-gray-500 mt-1">LAN requires the robot and scheduler on the same subnet. Tailscale requires Tailscale on both devices and a Tailscale scheduler URL/host.</p>
+                                </div>
+                                <div class="flex justify-end mt-4">
                                     <button @click="dismissRotatedToken" class="px-3 py-2 bg-blue-600 hover:bg-blue-700 rounded">I have saved it</button>
                                 </div>
                             </div>
@@ -3649,7 +5080,11 @@ async def dashboard():
                                             Character: <strong>{{ characterName(robot.character_id) }}</strong> ·
                                             Voice Stack: <strong>{{ stackName(robot.voice_stack_id) }}</strong>
                                         </div>
-                                        <div class="grid grid-cols-2 gap-2 mb-2 text-sm">
+                                        <div v-if="deviceInventory[robot.id]" class="flex items-center justify-between mb-2 text-xs">
+                                            <span>Robot production: <strong :class="devices.find(d => d.id === deviceInventory[robot.id].deviceId)?.production_mode ? 'text-green-400' : 'text-gray-400'">{{ devices.find(d => d.id === deviceInventory[robot.id].deviceId)?.production_mode ? 'ON' : 'OFF' }}</strong></span>
+                                            <button @click="toggleDeviceProduction(robot.id)" class="px-2 py-1 rounded bg-gray-600 hover:bg-gray-500">Toggle</button>
+                                        </div>
+                                        <div class="grid grid-cols-2 gap-2 mb-2 text-sm">
                                             <div>
                                                 <label class="text-xs text-gray-500">Character</label>
                                                 <select :value="robot.character_id"
@@ -3665,7 +5100,7 @@ async def dashboard():
                                             </div>
                                         </div>
                                         <div v-if="deviceInventory[robot.id]" class="space-y-2 text-sm">
-                                            <div class="grid grid-cols-2 gap-2">
+                                            <div class="grid grid-cols-3 gap-2">
                                                 <div>
                                                     <label class="text-xs text-gray-500">Camera</label>
                                                     <select v-model="deviceInventory[robot.id].selectedVideo"
@@ -3674,21 +5109,51 @@ async def dashboard():
                                                         <option v-for="opt in deviceInventory[robot.id].videoOptions" :key="opt" :value="opt">{{ opt }}</option>
                                                     </select>
                                                 </div>
-                                                <div>
-                                                    <label class="text-xs text-gray-500">Microphone</label>
+                                                <div>
+                                                    <label class="text-xs text-gray-500">Microphone</label>
                                                     <select v-model="deviceInventory[robot.id].selectedAudio"
                                                             @change="updateDeviceMedia(robot.id)"
                                                             class="w-full bg-gray-800 rounded px-2 py-1 text-xs">
                                                         <option v-for="opt in deviceInventory[robot.id].audioOptions" :key="opt" :value="opt">{{ opt }}</option>
-                                                    </select>
-                                                </div>
-                                            </div>
+                                                    </select>
+                                                </div>
+                                                <div>
+                                                    <label class="text-xs text-gray-500">Speaker</label>
+                                                    <select v-model="deviceInventory[robot.id].selectedAudioOutput"
+                                                            @change="updateDeviceMedia(robot.id)"
+                                                            class="w-full bg-gray-800 rounded px-2 py-1 text-xs">
+                                                        <option v-for="opt in deviceInventory[robot.id].audioOutputOptions" :key="opt" :value="opt">{{ opt }}</option>
+                                                    </select>
+                                                </div>
+                                            </div>
+                                            <div>
+                                                <label class="text-xs text-gray-500">Cached greeting phrases (one per line)</label>
+                                                <textarea v-model="deviceInventory[robot.id].greetingText" rows="2" class="w-full bg-gray-800 rounded px-2 py-1 text-xs" placeholder="Hello! Want to go for a ride?"></textarea>
+                                                <button @click="saveDeviceGreetings(robot.id)" class="mt-1 px-2 py-1 rounded bg-gray-600 hover:bg-gray-500 text-xs">Save Greetings</button>
+                                            </div>
                                             <button @click="startPreview(robot)"
                                                     :disabled="!settings.production_mode || !livekit.url || !livekit.has_secret || preview.active"
                                                     :class="(settings.production_mode && livekit.url && livekit.has_secret && !preview.active) ? 'bg-cyan-600 hover:bg-cyan-700' : 'bg-gray-700 cursor-not-allowed'"
                                                     class="w-full px-2 py-1 rounded text-xs">
                                                 {{ preview.active && preview.robot?.id === robot.id ? 'Preview Active' : 'Start Preview' }}
                                             </button>
+                                            <div class="grid grid-cols-2 gap-2">
+                                                <button @click="simulateTrigger(robot)"
+                                                        :disabled="!settings.production_mode || simulation.busy || robot.status === 'connecting' || robot.status === 'running'"
+                                                        :class="settings.production_mode && !simulation.busy && robot.status !== 'connecting' && robot.status !== 'running' ? 'bg-amber-600 hover:bg-amber-500' : 'bg-gray-700 cursor-not-allowed'"
+                                                        class="px-2 py-1 rounded text-xs">
+                                                    {{ simulation.robotId === robot.id ? 'Triggering…' : 'Simulate Motion' }}
+                                                </button>
+                                                <button @click="stopConversation(robot)"
+                                                        :disabled="robot.status !== 'connecting' && robot.status !== 'running'"
+                                                        :class="robot.status === 'connecting' || robot.status === 'running' ? 'bg-red-600 hover:bg-red-500' : 'bg-gray-700 cursor-not-allowed'"
+                                                        class="px-2 py-1 rounded text-xs">
+                                                    Stop Conversation
+                                                </button>
+                                            </div>
+                                            <button @click="recoverRobot(robot)" class="w-full px-2 py-1 rounded text-xs bg-gray-600 hover:bg-gray-500">
+                                                Recover Stale State
+                                            </button>
                                             <button v-if="preview.active && preview.robot?.id === robot.id"
                                                     @click="stopPreview"
                                                     class="w-full px-2 py-1 bg-red-600 hover:bg-red-700 rounded text-xs">