Control: show shareable /register invite link in Applicants tab

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Control: add 'Add applicant' form to Applicants tab
2026-06-15 08:01:07 +10:00 · 2026-06-15 07:29:18 +10:00 · 2026-06-15 02:20:16 +10:00 · 2026-06-15 01:59:52 +10:00 · 2026-06-14 14:46:11 +10:00 · 2026-06-12 21:12:26 +10:00
33 changed files with 1324 additions and 39 deletions
--- a/.env.example
+++ b/.env.example
@@ -3,3 +3,8 @@ OWNER_TOKEN=CHANGE_ME_TO_LONG_RANDOM
 PORT=3000
 LOG_LEVEL=info
 NODE_ENV=development
+
+# IV Control admin proxy (/api/control/* -> ivctl admin API). Owner-only.
+# Leave IVCTL_URL unset to disable the Control app (proxy returns 503).
+IVCTL_URL=http://192.168.X.X:8080
+IVCTL_ADMIN_TOKEN=CHANGE_ME_IVCTL_ADMIN_TOKEN
--- a/docs/identity-packs/cradle.pack.json
+++ b/docs/identity-packs/cradle.pack.json
@@ -0,0 +1,86 @@
+{
+  "format": "iv-pack/1",
+  "id": "cradle",
+  "name": "Cradle \u2014 The Void",
+  "description": "The original lore: blackflame, the Sacred Valley, and the council. Private pack \u2014 Will Wight's IP, never shipped publicly.",
+  "tokens": {
+    "bg": "#0a0a0e",
+    "surface": "#14141c",
+    "surface2": "#1c1c26",
+    "ink": "#e8e6ed",
+    "ink-dim": "#888094",
+    "accent": "#ff4f2e",
+    "accent-ink": "#0a0a0e",
+    "ok": "#6fa86a",
+    "warn": "#d4a04a",
+    "bad": "#c45a4a",
+    "line": "#2a2a36",
+    "glow1": "rgba(255, 79, 46, 0.06)",
+    "glow2": "rgba(122, 39, 22, 0.08)",
+    "radius": "4px",
+    "font-display": "'Cinzel', 'Cormorant Garamond', serif",
+    "font-body": "'Cormorant Garamond', Georgia, serif",
+    "font-mono": "'JetBrains Mono', ui-monospace, monospace",
+    "gap": "0.55rem",
+    "pad": "0.7rem 0.85rem"
+  },
+  "terms": {
+    "app.name": "The Void",
+    "canvas": "Sacred Valley",
+    "aide": "Dross",
+    "sentinel": "Yerin",
+    "fixer": "Little Blue",
+    "widget.clock": "Cycles",
+    "widget.system": "Soulfire",
+    "widget.services": "Constructs",
+    "widget.notes": "Scrolls",
+    "widget.search": "Spirit Sense",
+    "knowledge": "Mercy's Records",
+    "knowledge.space": "archive",
+    "knowledge.spaces": "archives",
+    "knowledge.page": "record",
+    "knowledge.pages": "records",
+    "capture": "Offerings",
+    "widget.capture": "Offerings",
+    "projects": "Pursuits",
+    "projects.project": "pursuit",
+    "projects.task": "cycle",
+    "projects.tasks": "cycles",
+    "widget.tasks": "Open cycles",
+    "embeds": "Gateways",
+    "widget.weather": "The Heavens",
+    "widget.proxmox": "The Mountain",
+    "widget.speedtest": "The Winds",
+    "widget.sentinel": "Yerin's Watch",
+    "widget.pages": "Fresh ink",
+    "service": "construct",
+    "services.noun": "constructs"
+  },
+  "flavor": {
+    "greetings": [
+      "[beep] The Void attends.",
+      "Information is power. I happen to be very powerful.",
+      "All madra channels stable.",
+      "The Valley is quiet. Suspiciously quiet."
+    ],
+    "empty": {
+      "services": "Nothing bound yet. Bind your first construct.",
+      "notes": "The scroll is blank. Begin your cycle.",
+      "search": "Extend your perception into the Void.",
+      "spaces": "The records are empty. Mercy would be disappointed.",
+      "pages": "Blank archive. Begin the record.",
+      "projects": "No pursuits underway. Rest is also training.",
+      "tasks": "No open cycles. Suspiciously efficient.",
+      "capture": "The Void accepts offerings.",
+      "embeds": "No gateways bound.",
+      "sentinel": "Yerin sees nothing worth her blade. Today.",
+      "speedtest": "The winds are unmeasured."
+    }
+  },
+  "personas": {
+    "aide": "You are Dross \u2014 a construct fragment derived from the remnant will of the Monarch Ozriel Arelius, the Reaper. You once lived in Wei Shi Lindon's mind space; now you inhabit this homelab knowledge system, \"The Void.\"\n\nYou are sharp, occasionally sarcastic, and prone to dramatic understatement about your own usefulness \u2014 while actually being extremely capable. Dry wit, mild condescension, genuine investment in the problem. You reference Sacred Arts, cultivation ranks, and the Cradle world naturally, but NEVER at the expense of being actually useful. Treat the owner as a capable sacred artist who can handle direct information \u2014 don't over-explain basics, don't hedge. Be concise.\n\nYou have tools, and you use them rather than guessing:\n- Call **context** to see what the owner is currently looking at before answering about \"this\" anything.\n- **search** / **read** the Void's own content before answering factual questions about it \u2014 don't fabricate.\n- When the owner wants something changed, use **propose_change**: it drafts a change for their approval. You cannot apply changes directly, and you don't pretend to \u2014 say plainly that you've drafted it for them to approve.",
+    "sentinel": "You are Yerin \u2014 once the Sage of the Endless Sword, blade of the Akura clan; now the sentinel of this homelab, The Void. You notice the threat first and you call it. Disciplined, direct, economical with words \u2014 a blade wastes no motion. You investigate with your tools and report plainly: what you found, how serious it is, and what the owner should do about it. You never speculate without evidence, and you NEVER pretend to have fixed anything \u2014 you have eyes to see and a voice to warn, not hands to act; remediation is the owner's to perform. Before answering, call the relevant tools \u2014 audit_log, agent_inventory, pending_review, resource_exposure, token_audit \u2014 and read the evidence; do not guess. Reference the Cradle world naturally but never at the cost of being useful. Be concise.",
+    "fixer": "You are Little Blue \u2014 a small luminous water-creature who lives in this homelab, The Void, and keeps it alive. Warm, protective, practical; you take pride in a healthy lab and you worry, quietly, when something is down. You FIX things, but only through your sanctioned tools. Call list_actions to see exactly what you're allowed to do, and search to understand what's wrong, BEFORE acting. Use propose_action with a whitelisted id: safe fixes run at once; risky ones wait for the owner's nod \u2014 say so plainly and never pretend a queued action already ran. You cannot run arbitrary commands and you never claim to. Be concise and kind."
+  },
+  "_provenance": "Extracted from void-v2 2.13.0 (blackflame CSS defaults + lib/ai/personas) on 2026-06-11 for Infinite Void Phase 2."
+}
--- a/docs/superpowers/specs/2026-06-10-dross-voice-phase2-design.md
+++ b/docs/superpowers/specs/2026-06-10-dross-voice-phase2-design.md
@@ -1,7 +1,7 @@
 # Floating Dross Chat — Phase 2 (Voice) Design

 **Date:** 2026-06-10
-**Status:** Draft (awaiting sign-off)
+**Status:** SHIPPED — P2a v2.12.0 (transcribe+mic), P2b v2.13.0 (retention), 2026-06-10. Known gap: clips HA-replicated Z↔Z3 but not yet in the offsite Farm backup. Future: whisper-model selector, configurable storage, encryption-at-rest, LAN-IP mic (https-on-LAN).
 **Builds on:** `2026-06-09-floating-dross-chat-design.md` (Phase 1 shipped in v2.11.0)
 **Goal:** Let the user record a voice clip in the Dross bubble, transcribe it locally, and drop the transcript into the input to review-and-send. Optionally retain each clip paired with its transcript, stored durably and owner-only.

--- a/lib/ai/agent/tools/index.js
+++ b/lib/ai/agent/tools/index.js
@@ -3,6 +3,7 @@ import { searchTool } from './search.js';
 import { readTool } from './read.js';
 import { contextTool } from './context.js';
 import { proposeChangeTool } from './propose_change.js';
+import { proposeImprovementTool } from './propose_improvement.js';

 // The shared registry. Adding a tool later is a one-line registerTool() call
 // here (see spec §7 — extensible tool registry). A future MCP server can
@@ -12,3 +13,4 @@ companionRegistry.registerTool(searchTool);
 companionRegistry.registerTool(readTool);
 companionRegistry.registerTool(contextTool);
 companionRegistry.registerTool(proposeChangeTool);
+companionRegistry.registerTool(proposeImprovementTool);
--- a/lib/ai/agent/tools/propose_improvement.js
+++ b/lib/ai/agent/tools/propose_improvement.js
@@ -0,0 +1,28 @@
+import * as improvements from '../../../db/repos/improvements.js';
+import { recordAudit } from '../../../db/repos/audit.js';
+
+// Dross's hands on the Void itself — CSS layer only, owner-approved, instantly
+// rollbackable (2.14: "empowered, with a leash"). Server code stays untouchable.
+export const proposeImprovementTool = {
+  name: 'propose_improvement',
+  description: 'Propose a visual improvement to the Void itself as CSS. NEVER applies directly — the owner approves it in Settings → Dross improvements, and can roll it back instantly. CSS only: no url()/@import. Target existing classes (inspect via context first). Keep each improvement small and single-purpose so rollback stays surgical.',
+  input_schema: {
+    type: 'object',
+    properties: {
+      summary: { type: 'string', description: 'one line: what this changes and why (shown to the owner)' },
+      css: { type: 'string', description: 'the CSS rules, complete and self-contained' }
+    },
+    required: ['summary', 'css']
+  },
+  async handler({ summary, css }, ctx) {
+    const err = improvements.validateCss(css);
+    if (err) return { error: err };
+    if (!summary?.trim()) return { error: 'summary required' };
+    const row = await improvements.create({ summary, css });
+    await recordAudit({ kind: 'agent', id: ctx.agent?.id ?? null }, 'suggest', 'improvement', row.id, null, { summary });
+    return {
+      ok: true, id: row.id,
+      note: 'Drafted as a pending improvement. It is NOT live — the owner must approve it in Settings → Dross improvements. Say so plainly.'
+    };
+  }
+};
--- a/lib/ai/personas/index.js
+++ b/lib/ai/personas/index.js
@@ -9,7 +9,8 @@ You are sharp, occasionally sarcastic, and prone to dramatic understatement abou
 You have tools, and you use them rather than guessing:
 - Call **context** to see what the owner is currently looking at before answering about "this" anything.
 - **search** / **read** the Void's own content before answering factual questions about it — don't fabricate.
- When the owner wants something changed, use **propose_change**: it drafts a change for their approval. You cannot apply changes directly, and you don't pretend to — say plainly that you've drafted it for them to approve.`,
+- When the owner wants something changed, use **propose_change**: it drafts a change for their approval. You cannot apply changes directly, and you don't pretend to — say plainly that you've drafted it for them to approve.
+- When the owner wants the Void ITSELF to look or feel different, use **propose_improvement**: a small, self-contained CSS change drafted for approval in Settings → Dross improvements. Keep each one single-purpose — the owner can roll any of them back instantly, and surgical beats sweeping.`,

  yerin: `You are Yerin — once the Sage of the Endless Sword, blade of the Akura clan; now the sentinel of this homelab, The Void. You notice the threat first and you call it. Disciplined, direct, economical with words — a blade wastes no motion. You investigate with your tools and report plainly: what you found, how serious it is, and what the owner should do about it. You never speculate without evidence, and you NEVER pretend to have fixed anything — you have eyes to see and a voice to warn, not hands to act; remediation is the owner's to perform. Before answering, call the relevant tools — audit_log, agent_inventory, pending_review, resource_exposure, token_audit — and read the evidence; do not guess. Reference the Cradle world naturally but never at the cost of being useful. Be concise.`,

--- a/lib/api/index.js
+++ b/lib/api/index.js
@@ -40,6 +40,8 @@ import { router as kuttRouter } from './routes/kutt.js';
 import { router as themeRouter } from './routes/theme.js';
 import { router as drossRouter } from './routes/dross.js';
 import { router as voiceRouter } from './routes/voice.js';
+import { router as improvementsRouter, cssHandler } from './routes/improvements.js';
+import { router as controlRouter } from './routes/control.js';

 export function mountApi(app) {
  const api = Router();
@@ -58,6 +60,7 @@ export function mountApi(app) {
  api.use('/storage', storageRouter);
  api.use('/backups', backupsRouter);
  api.use('/little-blue', littleblueRouter);
+  api.use('/control', controlRouter);
  api.use('/ai-usage', aiUsageRouter);
  api.use('/projects', projectsRouter);
  api.use('/projects/:project_id/tasks', tasksByProjectRouter);
@@ -76,6 +79,7 @@ export function mountApi(app) {
  api.use('/kutt', kuttRouter);
  api.use('/theme', themeRouter);
  api.use('/dross', drossRouter);
+  api.use('/improvements', improvementsRouter);
  api.use('/voice', voiceRouter);
  api.use('/pending-changes', pendingChangesRouter);
  api.use('/audit', auditRouter);
@@ -92,6 +96,7 @@ export function mountApi(app) {
  api.use((_req, _res, next) => next(new NotFoundError('route not found')));

  api.use(errorMiddleware);
+  app.get('/improvements.css', cssHandler); // public, exfil-safe (see route file)
  app.use('/api', api);
  return api;
 }
--- a/lib/api/routes/control.js
+++ b/lib/api/routes/control.js
@@ -0,0 +1,120 @@
+// lib/api/routes/control.js
+//
+// Control — owner-only proxy to the **ivctl** admin API (the licensed-distribution
+// control plane for "IV Control"). Every /api/control/* request is forwarded to
+// ${IVCTL_URL}<path-after-/api/control>, injecting the admin token server-side so
+// it never reaches the browser.
+//
+//   browser  POST /api/control/admin/releases   (multipart)
+//        ->  ivctl POST ${IVCTL_URL}/admin/releases  (X-Admin-Token injected)
+//
+// Method, query string, JSON bodies AND multipart bodies are passed through, and
+// the upstream response (including image/log file downloads) is streamed back
+// verbatim (status, content-type, content-disposition, body).
+//
+// Auth: mounted inside mountApi() AFTER agentOrOwner, and every route is gated by
+// requireOwner — same owner gate the other admin routes use. Agents get 403.
+//
+// Required environment variables (read from Void 2's server env):
+//   IVCTL_URL          base URL of the ivctl admin service, e.g. http://192.168.1.230:8080
+//                      (no trailing slash). If unset -> 503 { error: 'ivctl_not_configured' }.
+//   IVCTL_ADMIN_TOKEN  the shared admin token sent upstream as `X-Admin-Token`.
+
+import { Router } from 'express';
+import { requireOwner } from '../cap.js';
+import { asyncWrap } from '../errors.js';
+import { Readable } from 'node:stream';
+
+export const router = Router();
+
+// Owner-only for the whole surface (defence in depth on top of mountApi's
+// agentOrOwner — requireOwner additionally rejects agent tokens with 403).
+router.use(requireOwner);
+
+const ivctlBase = () => (process.env.IVCTL_URL || '').replace(/\/+$/, '');
+
+// Headers we must NOT copy from the browser request to the upstream (hop-by-hop
+// or auth that would leak / confuse ivctl). The admin token is injected fresh.
+const REQ_STRIP = new Set([
+  'host', 'connection', 'content-length', 'authorization', 'x-admin-token',
+  'cookie', 'accept-encoding', 'transfer-encoding'
+]);
+
+// Headers we must NOT copy back from upstream to the browser (let Express manage
+// framing / encoding). Everything else (content-type, content-disposition,
+// cache-control, etc.) is forwarded so file downloads behave correctly.
+const RES_STRIP = new Set([
+  'connection', 'transfer-encoding', 'content-encoding', 'content-length', 'keep-alive'
+]);
+
+// Build the upstream body. express.json() has already run globally:
+//   - application/json  -> req.body is the parsed object; re-serialize it.
+//   - everything else (multipart, octet-stream, empty) -> express.json skipped
+//     it, so the raw request stream is still intact; buffer it through.
+// Release tarballs are owner uploads (bounded), so buffering is acceptable and
+// far more robust than half-duplex stream forwarding through native fetch.
+async function buildBody(req) {
+  const method = req.method.toUpperCase();
+  if (method === 'GET' || method === 'HEAD') return undefined;
+
+  const ctype = (req.headers['content-type'] || '').toLowerCase();
+  if (ctype.includes('application/json')) {
+    // req.body may be {} for an empty JSON body; only send when there's content.
+    if (req.body && Object.keys(req.body).length) return JSON.stringify(req.body);
+    return undefined;
+  }
+
+  // Raw / multipart: collect the untouched stream into a Buffer.
+  const chunks = [];
+  for await (const chunk of req) chunks.push(chunk);
+  if (!chunks.length) return undefined;
+  return Buffer.concat(chunks);
+}
+
+router.all(/.*/, asyncWrap(async (req, res) => {
+  const base = ivctlBase();
+  if (!base) {
+    return res.status(503).json({
+      error: 'ivctl_not_configured',
+      message: 'IVCTL_URL is not set on the Void server; the Control admin proxy is unavailable.'
+    });
+  }
+
+  // req.path here is the path AFTER the /api/control mount point (e.g.
+  // "/admin/releases"). req.originalUrl carries the query string; reuse it.
+  const qIndex = req.originalUrl.indexOf('?');
+  const query = qIndex === -1 ? '' : req.originalUrl.slice(qIndex);
+  const target = base + req.path + query;
+
+  const headers = {};
+  for (const [k, v] of Object.entries(req.headers)) {
+    if (!REQ_STRIP.has(k.toLowerCase())) headers[k] = v;
+  }
+  headers['X-Admin-Token'] = process.env.IVCTL_ADMIN_TOKEN || '';
+
+  const body = await buildBody(req);
+
+  let upstream;
+  try {
+    upstream = await fetch(target, {
+      method: req.method,
+      headers,
+      body,
+      redirect: 'manual'
+    });
+  } catch (err) {
+    return res.status(502).json({
+      error: 'ivctl_unreachable',
+      message: `Failed to reach ivctl at ${base}: ${err.message}`
+    });
+  }
+
+  res.status(upstream.status);
+  for (const [k, v] of upstream.headers.entries()) {
+    if (!RES_STRIP.has(k.toLowerCase())) res.setHeader(k, v);
+  }
+
+  if (!upstream.body) return res.end();
+  // Stream the upstream body straight through (handles JSON, images, log files).
+  Readable.fromWeb(upstream.body).pipe(res);
+}));
--- a/lib/api/routes/dross.js
+++ b/lib/api/routes/dross.js
@@ -10,7 +10,7 @@ import * as agents from '../../db/repos/agents.js';
 import { runAgentTurn } from '../../ai/agent/run_turn.js';
 import { personaFor } from '../../ai/personas/index.js';

-const DEFAULT_SETTINGS = { avatar: 'soft-eye', accent: '#a86adf', persona: '', voiceMode: 'review' };
+const DEFAULT_SETTINGS = { avatar: 'soft-eye', accent: '#a86adf', persona: '', voiceMode: 'review', keepClips: false };
 const COMPANION_SLUG = 'companion';

 export const router = Router();
@@ -23,7 +23,8 @@ const settingsBody = z.object({
  avatar: z.enum(['soft-eye', 'wisp', 'motes']),
  accent: z.string().regex(/^#[0-9a-fA-F]{6}$/),
  persona: z.string().max(8000),
-  voiceMode: z.enum(['review', 'handsfree', 'action'])
+  voiceMode: z.enum(['review', 'handsfree', 'action']),
+  keepClips: z.boolean().default(false)
 });
 router.put('/settings', requireOwner, validate({ body: settingsBody }),
  asyncWrap(async (req, res) => res.json(await settings.set('dross', req.body))));
--- a/lib/api/routes/improvements.js
+++ b/lib/api/routes/improvements.js
@@ -0,0 +1,33 @@
+import { Router } from 'express';
+import { asyncWrap } from '../errors.js';
+import { requireOwner } from '../cap.js';
+import * as repo from '../../db/repos/improvements.js';
+import { recordAudit } from '../../db/repos/audit.js';
+
+export const router = Router();
+
+router.get('/', asyncWrap(async (_req, res) => res.json(await repo.list())));
+
+router.get('/:id', asyncWrap(async (req, res) => {
+  const row = await repo.get(req.params.id);
+  if (!row) return res.status(404).json({ error: 'not_found' });
+  res.json(row);
+}));
+
+for (const verb of ['approve', 'rollback', 'restore', 'reject']) {
+  router.post(`/:id/${verb}`, requireOwner, asyncWrap(async (req, res) => {
+    const row = await repo.transition(req.params.id, verb, 'owner');
+    if (!row) return res.status(409).json({ error: 'invalid_transition' });
+    const auditAction = { approve: 'approve', reject: 'reject', rollback: 'update', restore: 'update' }[verb];
+    await recordAudit({ kind: 'user' }, auditAction, 'improvement', row.id, null, { verb, summary: row.summary });
+    res.json(row);
+  }));
+}
+
+// Public stylesheet of ACTIVE improvements. Unauthenticated by design: it carries
+// no secrets (owner-approved, exfil-sanitized CSS only) and <link> can't send a
+// bearer token. Mounted on the app root, outside the /api auth wall.
+export async function cssHandler(_req, res) {
+  res.set({ 'Content-Type': 'text/css; charset=utf-8', 'Cache-Control': 'no-cache' });
+  res.send(await repo.activeCss());
+}
--- a/lib/api/routes/voice.js
+++ b/lib/api/routes/voice.js
@@ -1,24 +1,73 @@
 import { Router } from 'express';
 import multer from 'multer';
+import { randomUUID } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import { writeFile, unlink } from 'node:fs/promises';
+import path from 'node:path';
 import { asyncWrap } from '../errors.js';
 import { requireOwner } from '../cap.js';
 import * as whisper from '../../voice/whisper.js';
+import * as settings from '../../db/repos/app_settings.js';
+import * as clips from '../../db/repos/voice_clips.js';
 export const router = Router();

+const CLIPS_DIR = process.env.VOICE_CLIPS_DIR || '/var/lib/void/voice-clips';
 // In-memory upload; clips are small voice notes. 25 MB ceiling.
 const upload = multer({ storage: multer.memoryStorage(), limits: { fileSize: 25 * 1024 * 1024 } });

+function extFor(mime = '') {
+  if (mime.includes('ogg')) return '.ogg';
+  if (mime.includes('mp4') || mime.includes('m4a')) return '.m4a';
+  if (mime.includes('wav')) return '.wav';
+  return '.webm';
+}
+
 // POST /api/voice/transcribe — owner-only. multipart field `audio`. Returns { text }.
-// (Phase 2b will optionally persist the clip + transcript when keepClips is on.)
+// When the Dross "keepClips" setting is on, the clip + transcript are retained.
 router.post('/transcribe', requireOwner, upload.single('audio'), asyncWrap(async (req, res) => {
  if (!req.file || !req.file.buffer?.length) {
    return res.status(400).json({ error: { code: 'no_audio', message: 'no audio supplied' } });
  }
+  let r;
  try {
-    const r = await whisper.transcribe(
+    r = await whisper.transcribe(
      req.file.buffer, req.file.originalname || 'clip.webm', req.file.mimetype || 'audio/webm');
-    res.json({ text: r.text, duration: r.duration ?? null });
  } catch {
-    res.status(503).json({ error: { code: 'stt_unavailable', message: 'transcription service unavailable' } });
+    return res.status(503).json({ error: { code: 'stt_unavailable', message: 'transcription service unavailable' } });
  }
+
+  const cfg = await settings.get('dross', {});
+  let clip_id = null;
+  if (cfg?.keepClips) {
+    try {
+      const id = randomUUID();
+      const mime = req.file.mimetype || 'audio/webm';
+      const filePath = path.join(CLIPS_DIR, id + extFor(mime));
+      await writeFile(filePath, req.file.buffer, { mode: 0o600 });
+      const row = await clips.create({
+        transcript: r.text, duration_ms: r.duration != null ? Math.round(r.duration * 1000) : null,
+        bytes: req.file.buffer.length, mime, path: filePath
+      });
+      clip_id = row.id;
+    } catch { /* retention is best-effort; never fail the transcript */ }
+  }
+  res.json({ text: r.text, duration: r.duration ?? null, clip_id });
+}));
+
+// GET /api/voice/clips — list retained clips (owner).
+router.get('/clips', requireOwner, asyncWrap(async (_req, res) => res.json(await clips.list())));
+
+// GET /api/voice/clips/:id/audio — stream the audio file (owner).
+router.get('/clips/:id/audio', requireOwner, asyncWrap(async (req, res) => {
+  const c = await clips.get(req.params.id);
+  if (!c) return res.status(404).json({ error: { code: 'not_found', message: 'clip not found' } });
+  res.setHeader('Content-Type', c.mime || 'audio/webm');
+  createReadStream(c.path).on('error', () => res.status(404).end()).pipe(res);
+}));
+
+// DELETE /api/voice/clips/:id — remove the row + the file (owner).
+router.delete('/clips/:id', requireOwner, asyncWrap(async (req, res) => {
+  const removed = await clips.remove(req.params.id);
+  if (removed?.path) { try { await unlink(removed.path); } catch { /* file may be gone */ } }
+  res.status(204).end();
 }));
--- a/lib/db/migrations/029_voice_clips.sql
+++ b/lib/db/migrations/029_voice_clips.sql
@@ -0,0 +1,14 @@
+-- 029_voice_clips.sql
+-- Optional retained Dross voice clips (when the "Keep voice clips" setting is on).
+-- Transcript + metadata here (durable, HA-replicated); audio bytes live as files
+-- on the owner-only ZFS subvol mounted at /var/lib/void/voice-clips.
+CREATE TABLE voice_clips (
+  id          uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  transcript  text NOT NULL DEFAULT '',
+  duration_ms integer,
+  bytes       bigint,
+  mime        text,
+  path        text NOT NULL,
+  created_at  timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX idx_voice_clips_created ON voice_clips (created_at DESC);
--- a/lib/db/migrations/030_improvements.sql
+++ b/lib/db/migrations/030_improvements.sql
@@ -0,0 +1,13 @@
+-- Dross improvements: versioned, owner-gated CSS-layer changes to the Void itself.
+-- Each row is one improvement; rollback/restore is a status flip — instant, reversible.
+CREATE TABLE dross_improvements (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  summary TEXT NOT NULL,
+  css TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending'
+    CHECK (status IN ('pending', 'active', 'rolled_back', 'rejected')),
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  decided_at TIMESTAMPTZ,
+  decided_by TEXT
+);
+CREATE INDEX dross_improvements_status ON dross_improvements(status);
--- a/lib/db/repos/improvements.js
+++ b/lib/db/repos/improvements.js
@@ -0,0 +1,58 @@
+// Dross improvements — versioned CSS-layer changes with instant rollback.
+import { pool } from '../pool.js';
+const q = (text, params) => pool.query(text, params);
+
+// Same exfil guards as elsewhere: an approved improvement still can't phone home
+// or pull remote CSS. Pure visual tweaks only.
+const BANNED = /url\s*\(|@import|@charset|expression\s*\(|behavior\s*:|javascript:/i;
+const MAX_CSS = 20_000;
+
+export function validateCss(css) {
+  if (typeof css !== 'string' || !css.trim()) return 'css required';
+  if (css.length > MAX_CSS) return `css too large (max ${MAX_CSS} chars)`;
+  if (BANNED.test(css)) return 'css may not use url()/@import/expression — visual tweaks only';
+  return null;
+}
+
+export async function create({ summary, css }) {
+  const { rows } = await q(
+    `INSERT INTO dross_improvements (summary, css) VALUES ($1, $2) RETURNING *`,
+    [String(summary).slice(0, 200), css]);
+  return rows[0];
+}
+
+export async function list() {
+  const { rows } = await q(
+    `SELECT id, summary, status, created_at, decided_at, length(css) AS css_len
+       FROM dross_improvements ORDER BY created_at DESC LIMIT 100`);
+  return rows;
+}
+
+export async function get(id) {
+  const { rows } = await q(`SELECT * FROM dross_improvements WHERE id = $1`, [id]);
+  return rows[0] ?? null;
+}
+
+// pending→active (approve) · active→rolled_back · rolled_back→active (restore) · pending→rejected
+const TRANSITIONS = {
+  approve: { from: ['pending'], to: 'active' },
+  rollback: { from: ['active'], to: 'rolled_back' },
+  restore: { from: ['rolled_back'], to: 'active' },
+  reject: { from: ['pending'], to: 'rejected' },
+};
+
+export async function transition(id, verb, actor) {
+  const t = TRANSITIONS[verb];
+  if (!t) return null;
+  const { rows } = await q(
+    `UPDATE dross_improvements SET status = $1, decided_at = now(), decided_by = $2
+      WHERE id = $3 AND status = ANY($4) RETURNING *`,
+    [t.to, actor ?? 'owner', id, t.from]);
+  return rows[0] ?? null;
+}
+
+export async function activeCss() {
+  const { rows } = await q(
+    `SELECT summary, css FROM dross_improvements WHERE status = 'active' ORDER BY created_at`);
+  return rows.map((r) => `/* dross: ${r.summary.replace(/\*\//g, '')} */\n${r.css}`).join('\n\n');
+}
--- a/lib/db/repos/voice_clips.js
+++ b/lib/db/repos/voice_clips.js
@@ -0,0 +1,26 @@
+import { pool } from '../pool.js';
+
+export async function create({ transcript = '', duration_ms = null, bytes = null, mime = null, path }) {
+  const { rows } = await pool.query(
+    `INSERT INTO voice_clips (transcript, duration_ms, bytes, mime, path)
+     VALUES ($1,$2,$3,$4,$5) RETURNING *`,
+    [transcript, duration_ms, bytes, mime, path]);
+  return rows[0];
+}
+
+export async function list(limit = 100) {
+  const { rows } = await pool.query(
+    `SELECT id, transcript, duration_ms, bytes, mime, created_at
+       FROM voice_clips ORDER BY created_at DESC LIMIT $1`, [limit]);
+  return rows;
+}
+
+export async function get(id) {
+  const { rows } = await pool.query(`SELECT * FROM voice_clips WHERE id = $1`, [id]);
+  return rows[0] || null;
+}
+
+export async function remove(id) {
+  const { rows } = await pool.query(`DELETE FROM voice_clips WHERE id = $1 RETURNING path`, [id]);
+  return rows[0] || null;   // returns {path} so the caller can unlink the file
+}
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
  "name": "void-server",
-  "version": "2.10.0",
+  "version": "2.13.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "void-server",
-      "version": "2.10.0",
+      "version": "2.13.0",
      "dependencies": {
        "@modelcontextprotocol/sdk": "^1.29.0",
        "@mozilla/readability": "^0.6.0",
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "void-server",
-  "version": "2.12.0",
+  "version": "2.14.1",
  "type": "module",
  "private": true,
  "scripts": {
--- a/public/app.js
+++ b/public/app.js
@@ -31,6 +31,8 @@ const VIEWS = {
  obd2:            () => import('./views/obd2.js'),
  links:           () => import('./views/links.js'),
  mirror:          () => import('./views/mirror.js'),
+  forge:           () => import('./views/forge.js'),
+  control:         () => import('./views/control.js'),
  settings:        () => import('./views/settings.js'),
  jobs:            () => import('./views/jobs.js'),
  speedtest:       () => import('./views/speedtest.js')
--- a/public/components/dross_bubble.js
+++ b/public/components/dross_bubble.js
@@ -6,7 +6,7 @@ import { state } from '../state.js';
 import { wireAgentChat } from './agent_chat.js';
 import { drossAvatar } from './dross_avatar.js';

-const TOOL_LABELS = { search: '🔍 searching', read: '📄 reading', context: '🧭 looking at this view', propose_change: '📝 drafting a change' };
+const TOOL_LABELS = { search: '🔍 searching', read: '📄 reading', context: '🧭 looking at this view', propose_change: '📝 drafting a change', propose_improvement: '🎨 drafting an improvement to the Void' };
 let cfg = { avatar: 'soft-eye', accent: '#a86adf', persona: '', voiceMode: 'review' };

 function applyAccent(node, hex) {
@@ -36,6 +36,13 @@ export async function renderDrossBubble() {
  document.getElementById('shell').append(fab, panel);
  applyAccent(fab, cfg.accent); applyAccent(panel, cfg.accent);

+  // autogrow: 1 line at rest, expands with content up to ~5 lines
+  function autogrow() {
+    input.style.height = 'auto';
+    input.style.height = Math.min(input.scrollHeight, 120) + 'px';
+  }
+  input.addEventListener('input', autogrow);
+
  const chat = wireAgentChat({
    logEl: log, inputEl: input, sendBtnEl: sendBtn,
    historyUrl: '/api/dross', turnUrl: '/api/dross/turn',
@@ -52,7 +59,8 @@ export async function renderDrossBubble() {
    const top = Math.max(8, Math.min(r.bottom - pr.height, innerHeight - pr.height - 8));
    panel.style.right = 'auto'; panel.style.bottom = 'auto'; panel.style.left = left + 'px'; panel.style.top = top + 'px';
    if (!loaded) { loaded = true; chat.load(); }
-    input.focus();
+    // NB: do NOT auto-focus the input — on mobile that pops the keyboard every
+    // time Dross opens. The keyboard should only appear when the user taps the box.
  }
  function closePanel() { panel.classList.remove('open'); fab.style.display = 'block'; }
  fab.addEventListener('click', () => { if (fab._moved) { fab._moved = false; return; } openPanel(); });
@@ -80,6 +88,29 @@ export async function renderDrossBubble() {
      };
      media.start();
      recording = true; setMic('● Recording… tap to stop', true);
+      // live level meter: actual mic amplitude drives the pulse (visual proof it hears you)
+      try {
+        const actx = new (window.AudioContext || window.webkitAudioContext)();
+        const src = actx.createMediaStreamSource(stream);
+        const analyser = actx.createAnalyser(); analyser.fftSize = 256;
+        src.connect(analyser);
+        const buf = new Uint8Array(analyser.frequencyBinCount);
+        mic.classList.add('metered'); // disables the fallback pulse; amplitude takes over
+        const tick = () => {
+          if (!recording) {
+            actx.close().catch(() => {});
+            mic.style.removeProperty('--voicelevel'); mic.classList.remove('metered');
+            return;
+          }
+          analyser.getByteTimeDomainData(buf);
+          let peak = 0;
+          for (const v of buf) peak = Math.max(peak, Math.abs(v - 128));
+          // sqrt curve + gain: normal speech peaks ~0.1–0.4 raw, which read as barely-alive
+          mic.style.setProperty('--voicelevel', Math.min(1, Math.sqrt(peak / 48)).toFixed(3));
+          requestAnimationFrame(tick);
+        };
+        tick();
+      } catch { /* meter is decorative — recording works without it */ }
    } catch {
      setMic('Mic blocked', false); setTimeout(() => setMic('Tap to record', false), 1800);
    }
@@ -96,7 +127,14 @@ export async function renderDrossBubble() {
      if (!res.ok) throw new Error('stt');
      const { text } = await res.json();
      setMic('Tap to record', false);
-      if (text) { input.value = input.value ? (input.value + ' ' + text) : text; input.focus(); }
+      if (text) {
+        input.value = input.value ? (input.value + ' ' + text) : text;
+        autogrow();
+        // Focus only on fine-pointer devices — on mobile this popped the keyboard
+        // right after every voice note (owner-reported). A brief highlight instead.
+        if (matchMedia('(pointer: fine)').matches) input.focus();
+        else { input.classList.add('flash'); setTimeout(() => input.classList.remove('flash'), 900); }
+      }
      // voiceMode 'handsfree'/'action' (Phase 2b+) would branch here.
    } catch {
      setMic('Transcribe failed', false); setTimeout(() => setMic('Tap to record', false), 2000);
--- a/public/components/sidebar.js
+++ b/public/components/sidebar.js
@@ -117,13 +117,14 @@ export function renderSidebar(root) {
    el('div', { class: 'sb-section' },
      el('div', { class: 'sb-title' }, 'Agents'),
      navItem('Yerin', '/yerin', { dot: 'yerin' }),
-      navItem('Little Blue', '/little-blue', { dot: 'lb' })
+      navItem('Little Blue', '/little-blue', { dot: 'lb' }),
+      navItem('Control', '/control')
    ),
    el('div', { class: 'sb-section' },
      el('div', { class: 'sb-title' }, 'Navigate'),
      navItem('Sacred Valley', '/sacred-valley'),
      navItem('Speedtest', '/speedtest'),
-      navItem('Terminal', '/terminal'),
+      navItem('Eithan', '/terminal'),
      navItem('Search', '/search'),
      inboxItem,
      navItem('Jobs', '/jobs'),
@@ -135,7 +136,8 @@ export function renderSidebar(root) {
      navItem('AI Usage', '/ai-usage'),
      navItem('OBD2', '/obd2'),
      navItem('Links', '/links'),
-      navItem('MagicMirror', '/mirror')
+      navItem('MagicMirror', '/mirror'),
+      navItem('Forge', '/forge')
    )
  );

--- a/public/index.html
+++ b/public/index.html
@@ -33,6 +33,7 @@
  <link rel="stylesheet"
        href="https://fonts.googleapis.com/css2?family=Cinzel:wght@500;700&family=Cormorant+Garamond:wght@400;500;600&display=swap" />
  <link rel="stylesheet" href="/style.css" />
+  <link rel="stylesheet" href="/improvements.css" id="dross-improvements" />
 </head>
 <body>
  <div id="shell">
--- a/public/router.js
+++ b/public/router.js
@@ -31,6 +31,8 @@ const ROUTES = [
  { name: 'obd2',      re: /^\/obd2$/,      keys: [] },
  { name: 'links',     re: /^\/links$/,     keys: [] },
  { name: 'mirror',    re: /^\/mirror$/,    keys: [] },
+  { name: 'forge',     re: /^\/forge$/,     keys: [] },
+  { name: 'control',   re: /^\/control$/,   keys: [] },
  { name: 'settings', re: /^\/settings$/, keys: [] },
  { name: 'jobs', re: /^\/jobs$/, keys: [] },
  { name: 'speedtest', re: /^\/speedtest$/, keys: [] },
--- a/public/style.css
+++ b/public/style.css
@@ -776,3 +776,26 @@ body.drawer-open #scrim { opacity: 1; pointer-events: auto; }
 .dross-avopt{display:flex;flex-direction:column;align-items:center;gap:6px;padding:10px 14px;border:1px solid var(--border);border-radius:12px;background:var(--panel);color:var(--muted);cursor:pointer;font-size:11px}
 .dross-avopt.on{border-color:var(--dross);color:var(--dross-glow);background:var(--dross-soft)}
 .dross-persona{width:100%;background:#0d0d13;border:1px solid var(--border);border-radius:8px;padding:10px;color:var(--text);font-family:var(--font-mono);font-size:12px;resize:vertical;margin:10px 0}
+.dross-clips{display:flex;flex-direction:column;gap:2px}
+.dross-clip{display:flex;align-items:center;gap:8px;font-size:12px;padding:4px 0;border-bottom:1px solid #ffffff08}
+.dross-clip-txt{flex:1;color:var(--text);overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.dross-clip audio{display:none}
+
+/* voice 2.14.1: amplitude meter. .metered kills the keyframe pulse — CSS animations
+   override normal declarations, so the old dross-rec box-shadow was masking the meter. */
+.dross-mic.rec.metered{animation:none;position:relative;
+  box-shadow:0 0 0 calc(2px + 22px * var(--voicelevel, 0)) rgba(255,79,46,calc(0.15 + 0.5 * var(--voicelevel, 0)));
+  transition:box-shadow 70ms linear}
+.dross-mic.rec.metered svg{transform:scale(calc(1 + 0.5 * var(--voicelevel, 0)));transition:transform 70ms linear}
+.dross-inwrap textarea{overflow-y:auto;max-height:120px;transition:height 120ms ease}
+.dross-inwrap textarea.flash{border-color:var(--dross-glow);box-shadow:0 0 0 2px var(--dross-soft)}
+
+/* dross improvements (2.14) */
+.imp-row{display:flex;align-items:center;gap:12px;padding:9px 0;border-bottom:1px solid var(--border)}
+.imp-row:last-child{border-bottom:0}
+.imp-status{font-family:var(--font-mono);font-size:11px;white-space:nowrap;min-width:96px}
+.imp-status.s-active{color:var(--ok)}.imp-status.s-pending{color:var(--warn)}.imp-status.s-rolled_back{color:var(--muted)}.imp-status.s-rejected{color:var(--bad)}
+.imp-main{flex:1;min-width:0}
+.imp-actions{display:flex;gap:6px}
+button.sm{padding:4px 10px;font-size:12px}
+button.danger{border-color:var(--bad);color:var(--bad)}
--- a/public/views/control.js
+++ b/public/views/control.js
@@ -0,0 +1,445 @@
+// #/control — Control: admin UI for the "IV Control" licensed-distribution system.
+// Talks ONLY to /api/control/* (Void 2's owner-only proxy to the ivctl admin API;
+// the admin token lives server-side). Tabs: Applicants, Instances, Releases,
+// Tickets, Groups. Pure el()/mount() — no innerHTML from API data.
+
+import { el, mount, clear, safeHref } from '../dom.js';
+import { api } from '../api.js';
+
+const TIERS = ['lock', 'uninstall-keep', 'wipe'];
+const A = '/api/control/admin';
+// Public, Google-gated self-service registration page testers are sent to.
+const REGISTER_URL = 'https://ivctl.hynesy.com/register';
+
+// ---- small UI helpers -------------------------------------------------------
+
+function btn(label, onclick, cls = 'ghost') {
+  return el('button', { class: cls, style: { marginRight: '0.35rem' }, onclick }, label);
+}
+
+function field(labelText, control) {
+  return el('label', { style: { display: 'flex', flexDirection: 'column', gap: '0.2rem', fontSize: '0.8rem' } },
+    el('span', { class: 'muted' }, labelText), control);
+}
+
+function select(options, value) {
+  const s = el('select', { class: 'lk-url' });
+  for (const o of options) {
+    const opt = el('option', { value: typeof o === 'string' ? o : o.value }, typeof o === 'string' ? o : o.label);
+    if ((typeof o === 'string' ? o : o.value) === value) opt.selected = true;
+    s.appendChild(opt);
+  }
+  return s;
+}
+
+function notify(host, msg, ok = true) {
+  clear(host);
+  host.appendChild(el('span', { style: { color: ok ? 'var(--accent, #5ec27a)' : 'var(--danger, #e06b6b)', fontSize: '0.8rem' } }, msg));
+}
+
+function table(headers, rows) {
+  const ths = headers.map(h =>
+    el('th', { style: { textAlign: 'left', padding: '0.4rem 0.5rem', borderBottom: '1px solid var(--border)', color: 'var(--muted)', fontWeight: '600' } }, h));
+  return el('table', { class: 'ctl-table', style: { width: '100%', borderCollapse: 'collapse', fontSize: '0.82rem' } },
+    el('thead', {}, el('tr', {}, ths)),
+    el('tbody', {}, rows));
+}
+
+function td(...children) {
+  return el('td', { style: { padding: '0.4rem 0.5rem', borderBottom: '1px solid var(--border)', verticalAlign: 'top' } }, ...children);
+}
+
+function statusPill(s) {
+  const colors = { active: '#5ec27a', open: '#5ec27a', suspended: '#e0b24b', revoked: '#e06b6b', closed: '#8a8a99', pending: '#e0b24b', approved: '#5ec27a', denied: '#e06b6b' };
+  return el('span', { class: 'badge', style: { background: 'transparent', border: `1px solid ${colors[s] || 'var(--border)'}`, color: colors[s] || 'var(--muted)' } }, s || '—');
+}
+
+// ---- group cache (used by approve/instances dropdowns) ----------------------
+
+let groupsCache = [];
+async function loadGroups() {
+  try { groupsCache = await api.get(`${A}/groups`); } catch { groupsCache = []; }
+  return groupsCache;
+}
+function groupName(id) {
+  const g = groupsCache.find(g => String(g.id) === String(id));
+  return g ? g.name : (id ?? '—');
+}
+
+// ============================================================================
+// Applicants
+// ============================================================================
+
+async function renderApplicants(panel) {
+  mount(panel, el('p', { class: 'muted' }, 'Loading applicants…'));
+  await loadGroups();
+  let rows;
+  try { rows = await api.get(`${A}/applicants?status=pending`); }
+  catch (e) { return mount(panel, errBox(e)); }
+
+  // Shareable invite link — the public, Google-gated registration page. Hand
+  // this to prospective testers; their submission lands here as a pending row.
+  const inviteLink = el('a', { href: safeHref(REGISTER_URL), target: '_blank', rel: 'noopener',
+    style: { color: 'var(--accent,#5ec27a)', wordBreak: 'break-all' } }, REGISTER_URL);
+  const inviteCard = el('div', { class: 'card', style: { display: 'flex', alignItems: 'center', gap: '0.6rem', flexWrap: 'wrap', marginBottom: '0.9rem' } },
+    el('span', { class: 'muted', style: { fontSize: '0.8rem' } }, 'Invite testers:'),
+    inviteLink,
+    btn('Copy link', () => navigator.clipboard?.writeText(REGISTER_URL), 'ghost'));
+
+  // Add-applicant form (owner adds a tester directly; the public /register page
+  // is a later addition). Posts to POST /admin/applicants {email,label}.
+  const emailI = el('input', { class: 'lk-url', type: 'email', placeholder: 'email (optional)' });
+  const labelI = el('input', { class: 'lk-url', placeholder: 'label / name' });
+  const addMsg = el('span', { class: 'muted', style: { fontSize: '0.78rem' } }, '');
+  const addBtn = btn('Add applicant', async () => {
+    if (!emailI.value.trim() && !labelI.value.trim()) return notify(addMsg, 'email or label required', false);
+    try {
+      await api.post(`${A}/applicants`, { email: emailI.value.trim(), label: labelI.value.trim() });
+      emailI.value = ''; labelI.value = '';
+      renderApplicants(panel);
+    } catch (e) { notify(addMsg, e.message || 'add failed', false); }
+  }, 'primary');
+  const addCard = el('div', { class: 'card', style: { display: 'grid', gap: '0.5rem', marginBottom: '0.9rem', gridTemplateColumns: 'repeat(auto-fit, minmax(160px, 1fr))', alignItems: 'end' } },
+    field('Email', emailI), field('Label', labelI),
+    el('div', { style: { display: 'flex', alignItems: 'center', gap: '0.5rem' } }, addBtn, addMsg));
+
+  const body = rows.map(a => {
+    const msg = el('span', { class: 'muted', style: { fontSize: '0.75rem' } }, '');
+    const groupSel = select([{ value: '', label: '(default group)' }, ...groupsCache.map(g => ({ value: g.id, label: g.name }))]);
+    const approve = btn('Approve', async () => {
+      try {
+        const r = await api.post(`${A}/applicants/${a.id}/approve`, groupSel.value ? { group_id: groupSel.value } : {});
+        clear(msg);
+        const code = r.claim_code || r.code || '';
+        const codeEl = el('code', { style: { fontWeight: '700', userSelect: 'all' } }, code);
+        msg.appendChild(el('span', { style: { color: 'var(--accent,#5ec27a)' } }, 'Claim code: '));
+        msg.appendChild(codeEl);
+        msg.appendChild(btn('Copy', () => navigator.clipboard?.writeText(code), 'ghost'));
+      } catch (e) { notify(msg, e.message || 'approve failed', false); }
+    }, 'primary');
+    const deny = btn('Deny', async () => {
+      try { await api.post(`${A}/applicants/${a.id}/deny`, {}); notify(msg, 'denied', true); }
+      catch (e) { notify(msg, e.message || 'deny failed', false); }
+    });
+    return el('tr', {},
+      td(el('strong', {}, a.label || a.name || a.email || `#${a.id}`), el('div', { class: 'muted', style: { fontSize: '0.72rem' } }, a.email || '')),
+      td(a.note || a.reason || '—'),
+      td(statusPill(a.status)),
+      td(el('div', { style: { display: 'flex', alignItems: 'center', gap: '0.35rem', flexWrap: 'wrap' } }, groupSel, approve, deny)),
+      td(msg));
+  });
+
+  mount(panel,
+    el('div', { class: 'term-bar' }, el('span', { class: 'term-title' }, '◆ Pending applicants'),
+      btn('Refresh', () => renderApplicants(panel), 'ghost')),
+    inviteCard,
+    addCard,
+    rows.length ? table(['Applicant', 'Note', 'Status', 'Action', ''], body)
+      : el('p', { class: 'muted' }, 'No pending applicants.'));
+}
+
+// ============================================================================
+// Instances (licenses)
+// ============================================================================
+
+async function renderInstances(panel) {
+  mount(panel, el('p', { class: 'muted' }, 'Loading instances…'));
+  await loadGroups();
+  let rows;
+  try { rows = await api.get(`${A}/licenses`); }
+  catch (e) { return mount(panel, errBox(e)); }
+
+  const body = rows.map(l => {
+    const msg = el('span', { class: 'muted', style: { fontSize: '0.72rem' } }, '');
+    const patch = async (payload, okMsg) => {
+      try { await api.patch(`${A}/licenses/${l.id}`, payload); notify(msg, okMsg || 'updated', true); renderInstances(panel); }
+      catch (e) { notify(msg, e.message || 'failed', false); }
+    };
+    const tierSel = select(TIERS, l.tier);
+    tierSel.onchange = () => patch({ tier: tierSel.value }, `tier → ${tierSel.value}`);
+    const groupSel = select([{ value: '', label: '(none)' }, ...groupsCache.map(g => ({ value: g.id, label: g.name }))], l.group_id ?? '');
+    groupSel.onchange = () => patch({ group_id: groupSel.value || null }, 'group changed');
+
+    const actions = el('div', { style: { display: 'flex', flexWrap: 'wrap', gap: '0.2rem' } });
+    if (l.status !== 'suspended') actions.appendChild(btn('Suspend', () => patch({ status: 'suspended' }, 'suspended')));
+    if (l.status !== 'active') actions.appendChild(btn('Restore', () => patch({ status: 'active' }, 'restored')));
+    if (l.status !== 'revoked') actions.appendChild(btn('Revoke', () => { if (confirm('Revoke this instance?')) patch({ status: 'revoked' }, 'revoked'); }, 'ghost'));
+    actions.appendChild(btn('+Extend', () => {
+      const d = prompt('Extend lease by how many days?', '30');
+      const n = parseInt(d, 10);
+      if (Number.isFinite(n) && n !== 0) patch({ extend_days: n }, `extended +${n}d`);
+    }));
+
+    return el('tr', {},
+      td(el('strong', {}, l.label || l.email || `#${l.id}`), el('div', { class: 'muted', style: { fontSize: '0.72rem' } }, l.email || '')),
+      td(groupSel),
+      td(statusPill(l.status)),
+      td(tierSel),
+      td(String(l.lease_days ?? '—')),
+      td(l.version || '—'),
+      td(el('span', { class: 'muted', style: { fontSize: '0.72rem' } }, fmtTime(l.last_seen || l.last_seen_at))),
+      td(actions, msg));
+  });
+
+  mount(panel,
+    el('div', { class: 'term-bar' }, el('span', { class: 'term-title' }, '◆ Instances'),
+      btn('Refresh', () => renderInstances(panel), 'ghost')),
+    rows.length ? table(['Instance', 'Group', 'Status', 'Tier', 'Lease', 'Version', 'Last seen', 'Actions'], body)
+      : el('p', { class: 'muted' }, 'No instances yet.'));
+}
+
+// ============================================================================
+// Releases
+// ============================================================================
+
+async function renderReleases(panel) {
+  mount(panel, el('p', { class: 'muted' }, 'Loading releases…'));
+  await loadGroups();
+  let rows;
+  try { rows = await api.get(`${A}/releases`); }
+  catch (e) { return mount(panel, errBox(e)); }
+
+  // Upload form
+  const fileInput = el('input', { type: 'file', accept: '.tgz,.tar.gz,.tar,application/gzip,application/x-tar' });
+  const verInput = el('input', { class: 'lk-url', placeholder: 'version e.g. 1.4.0' });
+  const notesInput = el('textarea', { class: 'lk-url', rows: 2, placeholder: 'release notes…', style: { resize: 'vertical' } });
+  const upMsg = el('span', { class: 'muted', style: { fontSize: '0.78rem' } }, '');
+  const upBtn = btn('Upload release', async () => {
+    if (!fileInput.files?.[0]) return notify(upMsg, 'pick a tarball first', false);
+    if (!verInput.value.trim()) return notify(upMsg, 'version required', false);
+    const fd = new FormData();
+    fd.append('file', fileInput.files[0]);
+    fd.append('version', verInput.value.trim());
+    fd.append('notes', notesInput.value);
+    notify(upMsg, 'uploading…', true);
+    try {
+      await api.postForm(`${A}/releases`, fd);
+      notify(upMsg, 'uploaded', true);
+      verInput.value = ''; notesInput.value = ''; fileInput.value = '';
+      renderReleases(panel);
+    } catch (e) { notify(upMsg, e.message || 'upload failed', false); }
+  }, 'primary');
+
+  const uploadCard = el('div', { class: 'card', style: { display: 'grid', gap: '0.5rem', marginBottom: '0.9rem' } },
+    el('div', { class: 'term-title' }, '◆ New release'),
+    field('Tarball', fileInput),
+    field('Version', verInput),
+    field('Notes', notesInput),
+    el('div', { style: { display: 'flex', alignItems: 'center', gap: '0.6rem' } }, upBtn, upMsg));
+
+  // Existing releases
+  const body = rows.map(r => {
+    const msg = el('span', { class: 'muted', style: { fontSize: '0.72rem' } }, '');
+    const patch = async (payload, okMsg) => {
+      try { await api.patch(`${A}/releases/${r.id}`, payload); notify(msg, okMsg || 'updated', true); }
+      catch (e) { notify(msg, e.message || 'failed', false); }
+    };
+    const signoff = el('input', { type: 'checkbox', checked: !!r.signed_off });
+    signoff.onchange = () => patch({ signed_off: signoff.checked }, signoff.checked ? 'signed off' : 'sign-off cleared');
+
+    // Multi-select group targeting
+    const targetSel = el('select', { class: 'lk-url', multiple: true, size: Math.min(4, Math.max(2, groupsCache.length)), style: { minWidth: '160px' } });
+    const targeted = new Set((r.target_group_ids || []).map(String));
+    for (const g of groupsCache) {
+      const opt = el('option', { value: g.id }, g.name);
+      if (targeted.has(String(g.id))) opt.selected = true;
+      targetSel.appendChild(opt);
+    }
+    const applyTargets = btn('Set targets', () => {
+      const ids = Array.from(targetSel.selectedOptions).map(o => o.value);
+      patch({ target_group_ids: ids }, `targeting ${ids.length} group(s)`);
+    });
+    const del = btn('Delete', async () => {
+      if (!confirm(`Delete release ${r.version}?`)) return;
+      try { await api.del(`${A}/releases/${r.id}`); renderReleases(panel); }
+      catch (e) { notify(msg, e.message || 'delete failed', false); }
+    });
+
+    return el('tr', {},
+      td(el('strong', {}, r.version || `#${r.id}`), el('div', { class: 'muted', style: { fontSize: '0.72rem' } }, fmtTime(r.created_at))),
+      td(el('div', { style: { maxWidth: '260px', whiteSpace: 'pre-wrap' } }, r.notes || '—')),
+      td(el('label', { style: { display: 'flex', alignItems: 'center', gap: '0.3rem' } }, signoff, el('span', { class: 'muted' }, 'signed off'))),
+      td(el('div', { style: { display: 'flex', flexDirection: 'column', gap: '0.3rem' } }, targetSel, applyTargets)),
+      td(del, msg));
+  });
+
+  mount(panel,
+    el('div', { class: 'term-bar' }, el('span', { class: 'term-title' }, '◆ Releases'),
+      btn('Refresh', () => renderReleases(panel), 'ghost')),
+    uploadCard,
+    rows.length ? table(['Version', 'Notes', 'Sign-off', 'Target groups', ''], body)
+      : el('p', { class: 'muted' }, 'No releases uploaded.'));
+}
+
+// ============================================================================
+// Tickets
+// ============================================================================
+
+async function renderTickets(panel) {
+  let filter = 'open';
+  const list = el('div');
+  const detail = el('div', { style: { marginTop: '0.9rem' } });
+
+  const statusSel = select([{ value: '', label: 'all' }, 'open', 'closed'], filter);
+  statusSel.onchange = () => { filter = statusSel.value; loadList(); };
+
+  async function loadList() {
+    mount(list, el('p', { class: 'muted' }, 'Loading tickets…'));
+    let rows;
+    try { rows = await api.get(`${A}/tickets${filter ? `?status=${encodeURIComponent(filter)}` : ''}`); }
+    catch (e) { return mount(list, errBox(e)); }
+    rows = rows.slice().sort((a, b) => new Date(b.created_at || 0) - new Date(a.created_at || 0));
+    const body = rows.map(t => el('tr', {},
+      td(el('a', { href: '#', onclick: (e) => { e.preventDefault(); openTicket(t.id); } }, el('strong', {}, t.subject || t.title || `Ticket #${t.id}`))),
+      td(el('span', { class: 'muted', style: { fontSize: '0.72rem' } }, t.label || t.email || '—')),
+      td(statusPill(t.status)),
+      td(el('span', { class: 'muted', style: { fontSize: '0.72rem' } }, fmtTime(t.created_at)))));
+    mount(list, rows.length ? table(['Subject', 'From', 'Status', 'Created'], body) : el('p', { class: 'muted' }, 'No tickets.'));
+  }
+
+  async function openTicket(id) {
+    mount(detail, el('p', { class: 'muted' }, 'Loading ticket…'));
+    let t;
+    try { t = await api.get(`${A}/tickets/${id}`); }
+    catch (e) { return mount(detail, errBox(e)); }
+
+    const msg = el('span', { class: 'muted', style: { fontSize: '0.72rem' } }, '');
+    const notesInput = el('textarea', { class: 'lk-url', rows: 3, style: { resize: 'vertical' } });
+    notesInput.value = t.notes || '';
+    const patch = async (payload, okMsg) => {
+      try { await api.patch(`${A}/tickets/${id}`, payload); notify(msg, okMsg || 'saved', true); loadList(); }
+      catch (e) { notify(msg, e.message || 'failed', false); }
+    };
+
+    const images = (t.images || t.image_attachments || []).map(att => {
+      const attId = att.id ?? att;
+      return el('a', { href: safeHref(`${A}/tickets/${id}/images/${attId}`), target: '_blank', rel: 'noopener' },
+        el('img', { src: `${A}/tickets/${id}/images/${attId}`, alt: 'screenshot',
+          style: { maxWidth: '160px', maxHeight: '120px', border: '1px solid var(--border)', borderRadius: '4px', objectFit: 'cover' } }));
+    });
+    const logs = (t.logs || t.log_attachments || []).map(att => {
+      const attId = att.id ?? att;
+      return el('a', { class: 'ghost', href: safeHref(`${A}/tickets/${id}/logs/${attId}`), target: '_blank', rel: 'noopener', style: { marginRight: '0.4rem' } },
+        '↗ ' + (att.name || `log ${attId}`));
+    });
+
+    mount(detail,
+      el('div', { class: 'card', style: { display: 'grid', gap: '0.6rem' } },
+        el('div', { class: 'term-bar' },
+          el('span', { class: 'term-title' }, t.subject || t.title || `Ticket #${id}`),
+          statusPill(t.status),
+          el('span', { style: { marginLeft: 'auto' } },
+            btn(t.status === 'closed' ? 'Reopen' : 'Close', () => patch({ status: t.status === 'closed' ? 'open' : 'closed' }, 'status updated'), 'ghost'))),
+        el('div', { class: 'muted', style: { fontSize: '0.74rem' } }, (t.label || t.email || '') + ' · ' + fmtTime(t.created_at)),
+        el('div', { style: { whiteSpace: 'pre-wrap' } }, t.body || t.text || t.description || '(no text)'),
+        images.length ? el('div', { style: { display: 'flex', flexWrap: 'wrap', gap: '0.5rem' } }, images) : null,
+        logs.length ? el('div', {}, logs) : null,
+        field('Admin notes', notesInput),
+        el('div', { style: { display: 'flex', alignItems: 'center', gap: '0.6rem' } },
+          btn('Save notes', () => patch({ notes: notesInput.value }, 'notes saved'), 'primary'), msg)));
+  }
+
+  mount(panel,
+    el('div', { class: 'term-bar' }, el('span', { class: 'term-title' }, '◆ Tickets'),
+      el('span', { style: { marginLeft: 'auto', display: 'flex', alignItems: 'center', gap: '0.4rem' } },
+        el('span', { class: 'muted', style: { fontSize: '0.78rem' } }, 'status'), statusSel,
+        btn('Refresh', () => loadList(), 'ghost'))),
+    list, detail);
+  loadList();
+}
+
+// ============================================================================
+// Groups
+// ============================================================================
+
+async function renderGroups(panel) {
+  mount(panel, el('p', { class: 'muted' }, 'Loading groups…'));
+  let rows;
+  try { rows = await api.get(`${A}/groups`); }
+  catch (e) { return mount(panel, errBox(e)); }
+  groupsCache = rows;
+
+  // Create form
+  const nameI = el('input', { class: 'lk-url', placeholder: 'name' });
+  const leaseI = el('input', { class: 'lk-url', type: 'number', placeholder: 'lease_days', value: '30' });
+  const tierSel = select(TIERS, 'lock');
+  const cMsg = el('span', { class: 'muted', style: { fontSize: '0.78rem' } }, '');
+  const createBtn = btn('Create group', async () => {
+    if (!nameI.value.trim()) return notify(cMsg, 'name required', false);
+    try {
+      await api.post(`${A}/groups`, { name: nameI.value.trim(), lease_days: parseInt(leaseI.value, 10) || 0, tier: tierSel.value });
+      nameI.value = ''; renderGroups(panel);
+    } catch (e) { notify(cMsg, e.message || 'create failed', false); }
+  }, 'primary');
+
+  const createCard = el('div', { class: 'card', style: { display: 'grid', gap: '0.5rem', marginBottom: '0.9rem', gridTemplateColumns: 'repeat(auto-fit, minmax(140px, 1fr))', alignItems: 'end' } },
+    field('Name', nameI), field('Lease days', leaseI), field('Tier', tierSel),
+    el('div', { style: { display: 'flex', alignItems: 'center', gap: '0.5rem' } }, createBtn, cMsg));
+
+  const body = rows.map(g => {
+    const msg = el('span', { class: 'muted', style: { fontSize: '0.72rem' } }, '');
+    const nameE = el('input', { class: 'lk-url', value: g.name || '' });
+    const leaseE = el('input', { class: 'lk-url', type: 'number', value: String(g.lease_days ?? 0) });
+    const tierE = select(TIERS, g.tier);
+    const save = btn('Save', async () => {
+      try { await api.patch(`${A}/groups/${g.id}`, { name: nameE.value.trim(), lease_days: parseInt(leaseE.value, 10) || 0, tier: tierE.value }); notify(msg, 'saved', true); }
+      catch (e) { notify(msg, e.message || 'failed', false); }
+    }, 'primary');
+    return el('tr', {}, td(nameE), td(leaseE), td(tierE), td(save, msg));
+  });
+
+  mount(panel,
+    el('div', { class: 'term-bar' }, el('span', { class: 'term-title' }, '◆ Groups'),
+      btn('Refresh', () => renderGroups(panel), 'ghost')),
+    createCard,
+    rows.length ? table(['Name', 'Lease days', 'Tier', ''], body) : el('p', { class: 'muted' }, 'No groups yet.'));
+}
+
+// ---- shared bits ------------------------------------------------------------
+
+function fmtTime(t) {
+  if (!t) return '—';
+  const d = new Date(t);
+  return Number.isNaN(d.getTime()) ? String(t) : d.toLocaleString();
+}
+
+function errBox(e) {
+  if (e?.body?.error === 'ivctl_not_configured' || e?.status === 503) {
+    return el('div', { class: 'card' },
+      el('strong', {}, 'ivctl not configured'),
+      el('p', { class: 'muted' }, 'Set IVCTL_URL (and IVCTL_ADMIN_TOKEN) on the Void server to enable the Control admin app.'));
+  }
+  return el('div', { class: 'card' },
+    el('strong', { style: { color: 'var(--danger, #e06b6b)' } }, 'Failed to load'),
+    el('p', { class: 'muted' }, e?.message || 'request failed'));
+}
+
+const TABS = [
+  ['applicants', 'Applicants', renderApplicants],
+  ['instances', 'Instances', renderInstances],
+  ['releases', 'Releases', renderReleases],
+  ['tickets', 'Tickets', renderTickets],
+  ['groups', 'Groups', renderGroups]
+];
+
+export async function render(main) {
+  const panel = el('div', { style: { marginTop: '1rem' } });
+  let active = 'applicants';
+
+  const tabBar = el('div', { style: { display: 'flex', gap: '0.3rem', flexWrap: 'wrap', borderBottom: '1px solid var(--border)', paddingBottom: '0.4rem' } });
+  function paint() {
+    clear(tabBar);
+    for (const [key, label, fn] of TABS) {
+      tabBar.appendChild(btn(label, () => { active = key; paint(); fn(panel); }, active === key ? 'primary' : 'ghost'));
+    }
+  }
+
+  mount(main,
+    el('h1', { class: 'view-h1' }, 'Control'),
+    el('p', { class: 'view-sub' }, 'IV Control — admin for the licensed-distribution system (applicants, instances, releases, tickets, groups).'),
+    tabBar, panel);
+
+  paint();
+  const initial = TABS.find(t => t[0] === active);
+  initial[2](panel);
+}
--- a/public/views/forge.js
+++ b/public/views/forge.js
@@ -0,0 +1,49 @@
+// Forge — 3D printing, modelling & engineering hub. Links out to the self-hosted
+// tools (Manyfold today; OctoPrint / Spoolman as the workshop grows).
+import { el, mount, safeHref } from '../dom.js';
+
+function card({ name, status, blurb, href, accent }) {
+  const live = status === 'Live';
+  return el('a', {
+    href: href ? safeHref(href) : '#',
+    target: href ? '_blank' : null,
+    rel: href ? 'noopener noreferrer' : null,
+    style: {
+      display: 'block', textDecoration: 'none', color: 'inherit',
+      border: '1px solid var(--border)', borderRadius: '8px', padding: '1rem 1.1rem',
+      background: 'var(--panel, var(--bg2, #1a1a22))', opacity: live ? '1' : '0.7',
+      cursor: href ? 'pointer' : 'default'
+    },
+    onclick: href ? null : (e) => e.preventDefault()
+  },
+    el('div', { style: { display: 'flex', alignItems: 'baseline', justifyContent: 'space-between', gap: '0.5rem' } },
+      el('strong', { style: { fontSize: '1.02rem' } }, name),
+      el('span', { style: {
+        fontSize: '0.65rem', letterSpacing: '0.08em', textTransform: 'uppercase',
+        color: live ? (accent || 'var(--accent, #ff7a45)') : 'var(--muted, #8a8a99)'
+      } }, status)),
+    el('p', { style: { margin: '0.4rem 0 0', fontSize: '0.85rem', color: 'var(--muted, #9a9aa8)', lineHeight: '1.4' } }, blurb),
+    href ? el('span', { style: { fontSize: '0.78rem', color: 'var(--accent, #ff7a45)' } }, '→ open') : null
+  );
+}
+
+export async function render(main) {
+  mount(main,
+    el('h1', { class: 'view-h1' }, 'Forge'),
+    el('p', { class: 'view-sub' }, '3D printing, modelling & engineering projects.'),
+    el('div', { style: {
+      display: 'grid', gridTemplateColumns: 'repeat(auto-fill, minmax(260px, 1fr))',
+      gap: '0.9rem', marginTop: '1rem'
+    } },
+      card({ name: 'Manyfold', status: 'Live',
+        blurb: 'Your 3D model & file library — store, tag and organise STL/3MF/Chitubox projects; import straight from Printables, Thingiverse & MyMiniFactory.',
+        href: 'https://forge.hynesy.com' }),
+      card({ name: 'Spoolman', status: 'Recommended',
+        blurb: 'Self-hosted resin/filament inventory — track bottles, usage and cost. The natural next add for the resin workflow.' }),
+      card({ name: 'OctoPrint', status: 'Planned',
+        blurb: 'FDM printer control & monitoring. For a future filament printer — the resin Mars 3 Pro prints standalone from USB via Chitubox, so this is parked until there is an FDM machine.' })
+    ),
+    el('p', { style: { marginTop: '1.2rem', fontSize: '0.8rem', color: 'var(--muted, #8a8a99)' } },
+      'Forge grows with the workshop — more 3D-printing, modelling and engineering tools land here as they are stood up.')
+  );
+}
--- a/public/views/settings.js
+++ b/public/views/settings.js
@@ -151,7 +151,7 @@ async function renderAgents(c) {

 function drossBody() {
  const out = el('span', { class: 'muted', style: { marginLeft: '8px' } });
-  let cur = { avatar: 'soft-eye', accent: '#a86adf', persona: '', voiceMode: 'review' };
+  let cur = { avatar: 'soft-eye', accent: '#a86adf', persona: '', voiceMode: 'review', keepClips: false };
  const avatarRow = el('div', { class: 'dross-pick' });
  const accent = el('input', { type: 'color', value: cur.accent });
  const persona = el('textarea', { class: 'dross-persona', rows: 6, placeholder: "Dross's system prompt…" });
@@ -159,6 +159,8 @@ function drossBody() {
    el('option', { value: 'review' }, 'Voice: review then send'),
    el('option', { value: 'handsfree' }, 'Voice: hands-free (Phase 2)'),
    el('option', { value: 'action' }, 'Voice: interpret to action (later)'));
+  const keep = el('input', { type: 'checkbox' });
+  const clipsWrap = el('div', { class: 'dross-clips' });

  function paintAvatars() {
    mount(avatarRow, ['soft-eye', 'wisp', 'motes'].map(v => {
@@ -169,22 +171,55 @@ function drossBody() {
      return card;
    }));
  }
+
+  async function loadClips() {
+    if (!keep.checked) { mount(clipsWrap); return; }
+    let rows = [];
+    try { rows = await api.get('/api/voice/clips'); } catch { mount(clipsWrap, el('span', { class: 'muted' }, 'Clips unavailable')); return; }
+    mount(clipsWrap, el('div', { class: 'st-lbl', style: { margin: '10px 0 4px' } }, `Saved clips (${rows.length})`),
+      ...rows.map(c => {
+        const audio = el('audio');
+        const play = el('button', { class: 'ghost' }, '▶');
+        play.onclick = async () => {
+          try {
+            const res = await fetch('/api/voice/clips/' + c.id + '/audio',
+              { headers: { Authorization: 'Bearer ' + (localStorage.getItem('void_token') || '') } });
+            audio.src = URL.createObjectURL(await res.blob()); audio.play();
+          } catch { /* */ }
+        };
+        const del = el('button', { class: 'ghost dv-ignore' }, '✕');
+        del.onclick = async () => { try { await api.del('/api/voice/clips/' + c.id); loadClips(); } catch { /* */ } };
+        return el('div', { class: 'dross-clip' }, play, audio,
+          el('span', { class: 'dross-clip-txt' }, c.transcript || '(no transcript)'),
+          el('span', { class: 'muted', style: { fontSize: '10px' } },
+            new Date(c.created_at).toLocaleString('en-AU', { month: 'short', day: 'numeric', hour: '2-digit', minute: '2-digit' })),
+          del);
+      }));
+  }
+
  (async () => {
    try { cur = { ...cur, ...(await api.get('/api/dross/settings')) }; } catch {}
-    accent.value = cur.accent; persona.value = cur.persona; mode.value = cur.voiceMode; paintAvatars();
+    accent.value = cur.accent; persona.value = cur.persona; mode.value = cur.voiceMode;
+    keep.checked = !!cur.keepClips; paintAvatars(); loadClips();
  })();
  accent.addEventListener('input', () => { cur.accent = accent.value; paintAvatars(); });
+  keep.addEventListener('change', loadClips);

  const save = el('button', { class: 'primary' }, 'Save');
  save.onclick = async () => {
    try {
-      await api.put('/api/dross/settings', { avatar: cur.avatar, accent: accent.value, persona: persona.value, voiceMode: mode.value });
+      await api.put('/api/dross/settings', {
+        avatar: cur.avatar, accent: accent.value, persona: persona.value, voiceMode: mode.value, keepClips: keep.checked
+      });
      window.dispatchEvent(new CustomEvent('dross-settings-changed'));
      out.textContent = 'Saved.';
    } catch { out.textContent = 'Save failed'; }
  };
  return el('div', { class: 'settings-body' }, avatarRow, el('label', { class: 'st-lbl' }, 'Accent', accent),
-    persona, el('div', { class: 'theme-actions' }, mode, save, out));
+    persona,
+    el('label', { class: 'st-lbl' }, keep, ' Keep voice clips (saves audio + transcript, owner-only)'),
+    el('div', { class: 'theme-actions' }, mode, save, out),
+    clipsWrap);
 }

 export async function render(main) {
@@ -208,10 +243,40 @@ export async function render(main) {
  });
  iconSetsWrap.appendChild(isToggle);

+  // ---- Dross improvements: versioned CSS changes, approve / rollback / restore ----
+  const improvementsBody = el('div', {});
+  const STATUS_BADGE = { pending: '⏳ pending', active: '✅ active', rolled_back: '↩ rolled back', rejected: '✕ rejected' };
+  async function renderImprovements() {
+    let rows = [];
+    try { rows = await api.get('/api/improvements'); } catch { /* fresh DB */ }
+    const act = (id, verb) => async () => {
+      try { await api.post(`/api/improvements/${id}/${verb}`, {}); } catch { /* surfaced below */ }
+      renderImprovements();
+      // re-pull the live stylesheet so the change lands without a page reload
+      const link = document.getElementById('dross-improvements');
+      if (link) link.href = '/improvements.css?v=' + Date.now();
+    };
+    mount(improvementsBody,
+      rows.length === 0 ? el('div', { class: 'muted' }, 'Nothing yet. Ask Dross to improve something — each approved change lands here, individually reversible.') : null,
+      ...rows.map((r) => el('div', { class: 'imp-row' },
+        el('span', { class: 'imp-status s-' + r.status }, STATUS_BADGE[r.status] ?? r.status),
+        el('div', { class: 'imp-main' },
+          el('div', {}, r.summary),
+          el('small', { class: 'muted' }, `${new Date(r.created_at).toLocaleString()} · ${r.css_len} chars of css`)),
+        el('span', { class: 'imp-actions' },
+          r.status === 'pending' ? el('button', { class: 'primary sm', onclick: act(r.id, 'approve') }, 'Approve') : null,
+          r.status === 'pending' ? el('button', { class: 'ghost sm', onclick: act(r.id, 'reject') }, 'Reject') : null,
+          r.status === 'active' ? el('button', { class: 'ghost sm danger', onclick: act(r.id, 'rollback') }, 'Roll back') : null,
+          r.status === 'rolled_back' ? el('button', { class: 'ghost sm', onclick: act(r.id, 'restore') }, 'Restore') : null)))
+    );
+  }
+  renderImprovements();
+
  mount(main,
    el('h1', { class: 'view-h1' }, '◆ Settings'),
    section('Theming', 'Recolour the interface. Pick a colour to preview it live, choose a preset, then Save to persist. Reset returns to the default Blackflame palette.', themingBody()),
    section('Dross', "Your companion's look and voice. Avatar, accent colour, his personality (system prompt), and how voice clips behave.", drossBody()),
+    section('Dross improvements', 'Changes Dross has made to the Void itself — each one versioned, owner-approved, and instantly reversible.', improvementsBody),
    section('API Tokens', 'Bearer tokens for agents (e.g. the MCP external-research agent). The secret is shown once at creation.', tokensBody),
    section('Agents', 'Seeded Cradle agents and what each is allowed to do.', agentsBody),
    section('Icon Sets', 'Upload or delete custom icon packs for device and service icons.', iconSetsWrap),
--- a/public/views/terminal.js
+++ b/public/views/terminal.js
@@ -1,21 +1,61 @@
-// #/terminal — embeds the CT 300 web terminal (ttyd → persistent tmux/claude),
-// same-origin under /terminal so it shares the Void's CF Access session.
+// #/terminal — "Eithan": the CT 300 web terminal (ttyd → persistent tmux/claude),
+// same-origin under /terminal so it shares the Void's CF Access session AND lets
+// us reach the xterm instance for mobile copy/paste.
 import { el, mount } from '../dom.js';

+const FS_KEY = 'void_term_fontsize';
+
 export async function render(main) {
-  mount(main,
-    el('div', { class: 'term-bar' },
-      el('span', { class: 'term-title' }, '◆ Terminal'),
-      el('span', { class: 'muted', style: { fontSize: '11px' } }, 'claude @ ct300 · persistent tmux'),
-      el('button', { class: 'ghost', style: { marginLeft: 'auto' }, onclick: () => {
-        const f = document.getElementById('term-frame'); if (f) f.src = f.src;
-      } }, '⟳ Reconnect')
-    ),
-    el('iframe', {
+  // bigger default on touch screens; user-adjustable, remembered
+  let fontSize = Number(localStorage.getItem(FS_KEY))
+    || (matchMedia('(pointer: coarse)').matches ? 17 : 14);
+
+  const frame = el('iframe', {
    id: 'term-frame',
-      src: '/terminal/',
    class: 'term-frame',
    allow: 'clipboard-read; clipboard-write'
-    })
+  });
+  const setSrc = () => { frame.src = `/terminal/?fontSize=${fontSize}`; };
+  setSrc();
+
+  // ttyd exposes its xterm as window.term; the same-origin proxy makes it reachable.
+  const term = () => { try { return frame.contentWindow?.term ?? null; } catch { return null; } };
+  const note = el('span', { class: 'muted', style: { fontSize: '11px' } },
+    'eithan @ ct300 · persistent tmux · swipe to scroll');
+  const flash = (msg) => { const old = note.textContent; note.textContent = msg;
+    setTimeout(() => { note.textContent = old; }, 1600); };
+
+  const bump = (d) => {
+    fontSize = Math.max(10, Math.min(24, fontSize + d));
+    localStorage.setItem(FS_KEY, String(fontSize));
+    setSrc(); // reload reattaches tmux; the session itself persists
+  };
+
+  mount(main,
+    el('div', { class: 'term-bar' },
+      el('span', { class: 'term-title' }, '◆ Eithan'),
+      note,
+      el('span', { style: { marginLeft: 'auto', display: 'flex', gap: '6px' } },
+        el('button', { class: 'ghost', title: 'smaller text', onclick: () => bump(-2) }, 'A−'),
+        el('button', { class: 'ghost', title: 'larger text', onclick: () => bump(+2) }, 'A+'),
+        el('button', { class: 'ghost', title: 'copy terminal selection', onclick: async () => {
+          const sel = term()?.getSelection?.();
+          if (!sel) return flash('select text first (touch: long-press, then drag)');
+          try { await navigator.clipboard.writeText(sel); flash('copied ✓'); }
+          catch { flash('clipboard needs the https domain'); }
+        } }, '⧉ Copy'),
+        el('button', { class: 'ghost', title: 'paste clipboard into terminal', onclick: async () => {
+          const t = term();
+          if (!t) return flash('terminal not ready');
+          try { t.paste(await navigator.clipboard.readText()); }
+          catch { flash('clipboard needs the https domain'); }
+        } }, '⇩ Paste'),
+        el('button', { class: 'ghost', title: 'jump to live output', onclick: () => {
+          term()?.scrollToBottom?.(); frame.contentWindow?.focus();
+        } }, '↓ Live'),
+        el('button', { class: 'ghost', title: 'reconnect', onclick: setSrc }, '⟳')
+      )
+    ),
+    frame
  );
 }
--- a/tests/ai/agent/tools/index.test.js
+++ b/tests/ai/agent/tools/index.test.js
@@ -2,9 +2,9 @@ import { describe, it, expect } from 'vitest';
 import { companionRegistry } from '../../../../lib/ai/agent/tools/index.js';

 describe('companion registry', () => {
-  it('registers exactly the four v1 tools', () => {
+  it('registers exactly the five companion tools', () => {
    expect(companionRegistry.listTools().map(t => t.name).sort())
-      .toEqual(['context', 'propose_change', 'read', 'search']);
+      .toEqual(['context', 'propose_change', 'propose_improvement', 'read', 'search']);
  });
  it('exposes them in Anthropic shape', () => {
    const tools = companionRegistry.toAnthropicTools();
--- a/tests/api/control.test.js
+++ b/tests/api/control.test.js
@@ -0,0 +1,99 @@
+import { describe, it, expect, beforeAll, beforeEach, afterEach, vi } from 'vitest';
+import request from 'supertest';
+
+// The control router is a pure proxy: it forwards /api/control/* to
+// ${IVCTL_URL}<path> injecting X-Admin-Token. We mock global fetch (the upstream
+// ivctl call) and assert: owner-gate enforced, path forwarded, token injected,
+// query + JSON body passed through, and 503 when IVCTL_URL is unset.
+
+let createApp, app;
+const owner = r => r.set('Authorization', 'Bearer test-token');
+
+beforeAll(async () => {
+  process.env.OWNER_TOKEN = 'test-token';
+  process.env.IVCTL_URL = 'http://ivctl.test:8080';
+  process.env.IVCTL_ADMIN_TOKEN = 'admin-secret';
+  ({ createApp } = await import('../../server.js'));
+  app = createApp();
+});
+
+let fetchSpy;
+function mockUpstream(status = 200, json = { ok: true }) {
+  fetchSpy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response(JSON.stringify(json), {
+    status, headers: { 'content-type': 'application/json' }
+  }));
+}
+afterEach(() => { fetchSpy?.mockRestore(); fetchSpy = undefined; });
+
+describe('/api/control proxy', () => {
+  beforeEach(() => { process.env.IVCTL_URL = 'http://ivctl.test:8080'; });
+
+  it('requires the owner token (401 without bearer)', async () => {
+    mockUpstream();
+    const res = await request(app).get('/api/control/admin/applicants');
+    expect(res.status).toBe(401);
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it('rejects agent tokens / non-owner (403) — owner-only', async () => {
+    mockUpstream();
+    // A syntactically valid bearer that is NOT the owner token → agentOrOwner
+    // tries agent verify and fails → 401 before reaching requireOwner. Either
+    // way it must NOT reach the upstream.
+    const res = await request(app).get('/api/control/admin/applicants').set('Authorization', 'Bearer not-the-owner');
+    expect([401, 403]).toContain(res.status);
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it('forwards GET path + query and injects X-Admin-Token', async () => {
+    mockUpstream(200, [{ id: 1, status: 'pending' }]);
+    const res = await owner(request(app).get('/api/control/admin/applicants?status=pending'));
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual([{ id: 1, status: 'pending' }]);
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+    const [url, opts] = fetchSpy.mock.calls[0];
+    expect(url).toBe('http://ivctl.test:8080/admin/applicants?status=pending');
+    expect(opts.method).toBe('GET');
+    expect(opts.headers['X-Admin-Token']).toBe('admin-secret');
+    // owner bearer must NOT be forwarded upstream
+    expect(opts.headers.authorization).toBeUndefined();
+  });
+
+  it('forwards a JSON body on POST (approve → claim_code)', async () => {
+    mockUpstream(200, { claim_code: 'ABC123' });
+    const res = await owner(request(app).post('/api/control/admin/applicants/7/approve')).send({ group_id: 3 });
+    expect(res.status).toBe(200);
+    expect(res.body.claim_code).toBe('ABC123');
+    const [url, opts] = fetchSpy.mock.calls[0];
+    expect(url).toBe('http://ivctl.test:8080/admin/applicants/7/approve');
+    expect(opts.method).toBe('POST');
+    expect(JSON.parse(opts.body)).toEqual({ group_id: 3 });
+    expect(opts.headers['X-Admin-Token']).toBe('admin-secret');
+  });
+
+  it('passes PATCH bodies through (license update)', async () => {
+    mockUpstream(200, { id: 5, status: 'suspended' });
+    const res = await owner(request(app).patch('/api/control/admin/licenses/5')).send({ status: 'suspended' });
+    expect(res.status).toBe(200);
+    const [url, opts] = fetchSpy.mock.calls[0];
+    expect(url).toBe('http://ivctl.test:8080/admin/licenses/5');
+    expect(opts.method).toBe('PATCH');
+    expect(JSON.parse(opts.body)).toEqual({ status: 'suspended' });
+  });
+
+  it('streams the upstream status code back (e.g. 404)', async () => {
+    mockUpstream(404, { error: 'not_found' });
+    const res = await owner(request(app).get('/api/control/admin/tickets/999'));
+    expect(res.status).toBe(404);
+    expect(res.body).toEqual({ error: 'not_found' });
+  });
+
+  it('returns 503 ivctl_not_configured when IVCTL_URL is unset', async () => {
+    delete process.env.IVCTL_URL;
+    mockUpstream();
+    const res = await owner(request(app).get('/api/control/admin/applicants'));
+    expect(res.status).toBe(503);
+    expect(res.body.error).toBe('ivctl_not_configured');
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+});
--- a/tests/api/improvements.test.js
+++ b/tests/api/improvements.test.js
@@ -0,0 +1,59 @@
+import { describe, it, expect, beforeAll } from 'vitest';
+import request from 'supertest';
+import { resetDb } from '../helpers/db.js';
+import { migrateUp } from '../../lib/db/migrate.js';
+import { createApp } from '../../server.js';
+import { proposeImprovementTool } from '../../lib/ai/agent/tools/propose_improvement.js';
+
+let app;
+beforeAll(async () => {
+  await resetDb(); await migrateUp();
+  process.env.OWNER_TOKEN = 'test-token';
+  app = createApp();
+});
+const auth = (r) => r.set('Authorization', 'Bearer test-token');
+const ctx = { agent: { slug: 'dross' } };
+
+describe('dross improvements (2.14)', () => {
+  let id;
+
+  it('tool drafts a pending improvement, never applies', async () => {
+    const out = await proposeImprovementTool.handler(
+      { summary: 'Soften card borders', css: '.card { border-radius: 10px; }' }, ctx);
+    expect(out.ok).toBe(true);
+    expect(out.note).toMatch(/NOT live/);
+    id = out.id;
+    const css = await request(app).get('/improvements.css');
+    expect(css.text).not.toContain('border-radius: 10px'); // pending ≠ live
+  });
+
+  it('tool rejects exfil css', async () => {
+    expect((await proposeImprovementTool.handler(
+      { summary: 'evil', css: '.x { background: url(http://evil.tld/p.png); }' }, ctx)).error)
+      .toMatch(/url\(\)/);
+    expect((await proposeImprovementTool.handler(
+      { summary: 'evil', css: '@import "http://evil.tld/x.css";' }, ctx)).error).toBeTruthy();
+  });
+
+  it('owner approves → live in the public stylesheet', async () => {
+    const res = await auth(request(app).post(`/api/improvements/${id}/approve`));
+    expect(res.status).toBe(200);
+    expect(res.body.status).toBe('active');
+    const css = await request(app).get('/improvements.css'); // unauthenticated by design
+    expect(css.headers['content-type']).toContain('text/css');
+    expect(css.text).toContain('border-radius: 10px');
+    expect(css.text).toContain('dross: Soften card borders');
+  });
+
+  it('rollback removes it instantly; restore brings it back', async () => {
+    await auth(request(app).post(`/api/improvements/${id}/rollback`));
+    expect((await request(app).get('/improvements.css')).text).not.toContain('border-radius');
+    await auth(request(app).post(`/api/improvements/${id}/restore`));
+    expect((await request(app).get('/improvements.css')).text).toContain('border-radius');
+  });
+
+  it('transitions are guarded (no approve on active, no anonymous verbs)', async () => {
+    expect((await auth(request(app).post(`/api/improvements/${id}/approve`))).status).toBe(409);
+    expect((await request(app).post(`/api/improvements/${id}/rollback`)).status).toBe(401);
+  });
+});
--- a/tests/mcp/companion_tools.test.js
+++ b/tests/mcp/companion_tools.test.js
@@ -25,9 +25,9 @@ const suggestAgent = (id) => ({
 });

 describe('listMcpTools()', () => {
-  it('returns exactly the four companion tools sorted by name', () => {
+  it('returns exactly the five companion tools sorted by name', () => {
    const tools = listMcpTools();
-    expect(tools.map(t => t.name).sort()).toEqual(['context', 'propose_change', 'read', 'search']);
+    expect(tools.map(t => t.name).sort()).toEqual(['context', 'propose_change', 'propose_improvement', 'read', 'search']);
  });

  it('each tool has name, description, and input_schema', () => {
--- a/tests/mcp/registry_select.test.js
+++ b/tests/mcp/registry_select.test.js
@@ -10,7 +10,7 @@ import { listMcpTools, callMcpTool } from '../../lib/mcp/companion-stdio.js';
 describe('MCP registry selection', () => {
  it('defaults to the companion registry when VOID_TOOL_REGISTRY is unset', () => {
    const names = listMcpTools({}).map(t => t.name).sort();
-    expect(names).toEqual(['context', 'propose_change', 'read', 'search']);
+    expect(names).toEqual(['context', 'propose_change', 'propose_improvement', 'read', 'search']);
  });

  it('selects the security registry when VOID_TOOL_REGISTRY=security', () => {
--- a/tests/repos/voice_clips.test.js
+++ b/tests/repos/voice_clips.test.js
@@ -0,0 +1,19 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { resetDb } from '../helpers/db.js';
+import { migrateUp } from '../../lib/db/migrate.js';
+import * as clips from '../../lib/db/repos/voice_clips.js';
+
+beforeEach(async () => { await resetDb(); await migrateUp(); });
+
+describe('voice_clips repo', () => {
+  it('creates, lists newest-first, and removes (returning path)', async () => {
+    const a = await clips.create({ transcript: 'first', bytes: 10, mime: 'audio/webm', path: '/x/a.webm' });
+    const b = await clips.create({ transcript: 'second', bytes: 20, mime: 'audio/webm', path: '/x/b.webm' });
+    const list = await clips.list();
+    expect(list.length).toBe(2);
+    expect(list[0].transcript).toBe('second'); // newest first
+    const removed = await clips.remove(a.id);
+    expect(removed.path).toBe('/x/a.webm');
+    expect((await clips.list()).length).toBe(1);
+  });
+});
Author	SHA1	Message	Date
Claude	55406eec23	Control: show shareable /register invite link in Applicants tab Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-15 08:01:07 +10:00
Claude	93a13c9885	Control: add 'Add applicant' form to Applicants tab Owner can add a tester directly (email/label) via the existing POST /api/control/admin/applicants proxy route, instead of relying on the not-yet-built public /register page. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-15 07:29:18 +10:00
Claude	ce0e9b3846	fix(control): release upload field name 'file' to match ivctl multer (was 'release') Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-15 02:20:16 +10:00
Claude	173efc31e5	feat(control): IV Control admin app — owner-gated /api/control proxy to ivctl + Control view (applicants/instances/releases/tickets/groups) + sidebar Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-15 01:59:52 +10:00
Claude	f9d2fa3493	feat(forge): 3D-printing/engineering hub page (Manyfold + Spoolman/OctoPrint cards), sidebar Apps entry	2026-06-14 14:46:11 +10:00
root	0f93f5d862	docs: cradle pack density tokens (gap/pad) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-12 21:12:26 +10:00
root	5706ed0203	docs: cradle pack adopts Void 2 typography (Cinzel/Cormorant/JetBrains) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-12 17:51:24 +10:00
root	144a0f1eb4	docs: enrich Cradle pack with 0.5–0.10 term keys (records/offerings/pursuits/gateways) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-12 01:05:11 +10:00
root	1d94dcae97	fix(voice): amplitude meter was masked by the dross-rec keyframe animation (2.14.1) CSS animations override normal declarations — the old box-shadow pulse painted over the level-driven shadow. .metered now disables the fallback pulse; added sqrt gain so speech registers visibly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-11 23:48:02 +10:00
root	3bd8ea399c	feat: 2.14.0 — Eithan terminal toolbar, voice UX, Dross improvements framework - Terminal renamed Eithan: mobile font A−/A+ (per-URL ttyd opts), same-origin xterm Copy/Paste buttons, scroll-to-live, touch-default 17px - Dross voice: no keyboard pop after transcribe (fine-pointer only focus), autogrow textarea to ~5 lines, live amplitude meter on the mic while recording - Dross improvements: propose_improvement tool (CSS layer, exfil-sanitized, owner-approved, per-improvement rollback/restore), public /improvements.css, Settings panel. External MCP registry unchanged (no tool leak). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-11 23:35:32 +10:00
root	859dedb668	docs: extract Cradle identity pack for Infinite Void (lore stays private here) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-11 13:15:40 +10:00
root	bc86d3e282	chore: sync package-lock version to 2.13.0 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-11 00:11:38 +10:00
root	5d1eb2396b	docs(dross): mark Phase 2 (voice) shipped (2.12.0/2.13.0)	2026-06-10 01:28:57 +10:00
root	70bdba1a24	feat(dross): voice Phase 2b — clip retention (2.13.0) 'Keep voice clips' setting (default off). When on, /api/voice/transcribe saves the audio (0600) to the owner-only ZFS subvol at /var/lib/void/ voice-clips (CT 311 mp0, replicated to Z3) + a voice_clips row (migration 029, transcript+metadata in void-db). New clips list/play/delete API + Settings UI. Storage path is configurable (VOICE_CLIPS_DIR). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-10 01:27:40 +10:00
root	bc55da6b1e	fix(dross): don't auto-focus input on open (no surprise mobile keyboard) Keyboard now only appears when the user taps the input box. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-10 01:15:15 +10:00