diff --git a/.github/workflows/_build-release.yml b/.github/workflows/_build-release.yml
index 545eb51d..9645e5db 100644
--- a/.github/workflows/_build-release.yml
+++ b/.github/workflows/_build-release.yml
@@ -168,14 +168,14 @@ jobs:
             --include "robotd/systemd/robotd.service=systemd/robotd.service" \
             --include "hooks/postinstall=hooks/postinstall" \
             --include "scripts/setup-gstreamer.sh=scripts/setup-gstreamer.sh" \
-            --include "duck-detect/models/duck_detect.rknn=models/duck_detect.rknn" \
-            --include "duck-detect/models/duck_detect.onnx=models/duck_detect.onnx" \
             --include "scripts/setup-npu.sh=scripts/setup-npu.sh" \
             --include "deploy/overlays/rk3568-npu-enable.dts=deploy/overlays/rk3568-npu-enable.dts" \
             --include "scripts/setup-rkaiq.sh=scripts/setup-rkaiq.sh" \
             --include "scripts/rkaiq-modinfo-shim.c=scripts/rkaiq-modinfo-shim.c" \
             --include "scripts/setup-login.sh=scripts/setup-login.sh" \
+            --include "scripts/setup-quiet-boot.sh=scripts/setup-quiet-boot.sh" \
             --include "scripts/seed-policies.sh=scripts/seed-policies.sh" \
+            --include "scripts/seed-detector.sh=scripts/seed-detector.sh" \
             --include "scripts/robot-rescue=scripts/robot-rescue" \
             --include "scripts/robot-boot-check=scripts/robot-boot-check" \
             --include "updater/systemd/robot-boot-check.service=systemd/robot-boot-check.service" \
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9a78882c..270242ec 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -102,7 +102,7 @@ jobs:
       # a bashism would work on a dev box and fail on the board.
       - name: Lint the installer
         run: |
-          for script in scripts/install.sh scripts/setup-board.sh scripts/setup-gstreamer.sh scripts/setup-login.sh scripts/migrate-network.sh scripts/provision.sh scripts/provision-board.sh scripts/ci-release-notes.sh scripts/robot-rescue scripts/dev-push.sh scripts/pad-link-test.sh scripts/pad-stack-report.sh scripts/seed-policies.sh; do
+          for script in scripts/install.sh scripts/setup-board.sh scripts/setup-gstreamer.sh scripts/setup-login.sh scripts/setup-quiet-boot.sh scripts/migrate-network.sh scripts/provision.sh scripts/provision-board.sh scripts/ci-release-notes.sh scripts/robot-rescue scripts/dev-push.sh scripts/pad-link-test.sh scripts/pad-stack-report.sh scripts/seed-policies.sh scripts/seed-detector.sh; do
             sh -n "$script"
             shellcheck --shell=sh "$script"
             # The one-liner is only correct if the file is executable and self-contained.
diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index da20d356..52b039d9 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -154,14 +154,14 @@ jobs:
             --include "robotd/systemd/robotd.service=systemd/robotd.service" \
             --include "hooks/postinstall=hooks/postinstall" \
             --include "scripts/setup-gstreamer.sh=scripts/setup-gstreamer.sh" \
-            --include "duck-detect/models/duck_detect.rknn=models/duck_detect.rknn" \
-            --include "duck-detect/models/duck_detect.onnx=models/duck_detect.onnx" \
             --include "scripts/setup-npu.sh=scripts/setup-npu.sh" \
             --include "deploy/overlays/rk3568-npu-enable.dts=deploy/overlays/rk3568-npu-enable.dts" \
             --include "scripts/setup-rkaiq.sh=scripts/setup-rkaiq.sh" \
             --include "scripts/rkaiq-modinfo-shim.c=scripts/rkaiq-modinfo-shim.c" \
             --include "scripts/setup-login.sh=scripts/setup-login.sh" \
+            --include "scripts/setup-quiet-boot.sh=scripts/setup-quiet-boot.sh" \
             --include "scripts/seed-policies.sh=scripts/seed-policies.sh" \
+            --include "scripts/seed-detector.sh=scripts/seed-detector.sh" \
             --include "scripts/robot-rescue=scripts/robot-rescue" \
             --include "scripts/robot-boot-check=scripts/robot-boot-check" \
             --include "updater/systemd/robot-boot-check.service=systemd/robot-boot-check.service" \
diff --git a/.github/workflows/turn-endpoint.yml b/.github/workflows/turn-endpoint.yml
new file mode 100644
index 00000000..9f805ac7
--- /dev/null
+++ b/.github/workflows/turn-endpoint.yml
@@ -0,0 +1,77 @@
+# Does the relay credentials endpoint still answer?
+#
+# `mediad::turn` fetches short-lived Cloudflare credentials so a robot can offer a `relay`
+# candidate to a consumer that cannot reach it directly. The endpoint it used before
+# 2026-09 had been dead since June — a dangling Route53 delegation — and **nothing
+# noticed for three months**, because the only symptom is a warning in a journal nobody
+# reads and a candidate type nobody counts. Every other check in this repository passes
+# regardless: they pair two peers on one network, which never looks at a relay.
+#
+# So this is the one check that would have caught it, and it is deliberately *not* on
+# `pull_request`. The failure being guarded against is "nobody touched this for months",
+# which a PR trigger cannot see; and a third party's outage must never block work that has
+# nothing to do with it. A scheduled failure mails whoever owns the repository, which is
+# the right blast radius for "an upstream service went away".
+name: turn-endpoint
+
+on:
+  schedule:
+    # Daily. The endpoint is somebody else's Space, and a week of relay coverage lost
+    # before anybody hears about it is most of the damage already done.
+    - cron: "41 5 * * *"
+  workflow_dispatch:
+
+jobs:
+  credentials:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # **Read the URL out of the source rather than repeating it here.** A check with its
+      # own copy of the endpoint tests whatever it was last told, which can drift from what
+      # the daemon compiles in — and a green check on an endpoint no robot uses is worse
+      # than no check, because it reads as proof.
+      - name: Ask the endpoint the daemon uses
+        env:
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          url=$(sed -n 's/^pub const DEFAULT_TURN_ENDPOINT: &str = "\(.*\)";$/\1/p' \
+              mediad/src/turn.rs)
+          [ -n "$url" ] || {
+              echo "::error::could not read DEFAULT_TURN_ENDPOINT from mediad/src/turn.rs"
+              exit 1
+          }
+          echo "endpoint: $url"
+
+          # No token means this cannot check anything. Failing is the point: a check that
+          # skips itself into permanent silence is the failure mode this workflow exists
+          # to end.
+          [ -n "${HF_TOKEN:-}" ] || {
+              echo "::error::no HF_TOKEN secret. Add a Hugging Face token with no scopes" \
+                   "beyond sign-in; it is used only to mint TURN credentials."
+              exit 1
+          }
+
+          code=$(curl -sS -o body.json -w '%{http_code}' --max-time 30 \
+              -H "Authorization: Bearer $HF_TOKEN" "$url?ttl=600")
+          [ "$code" = "200" ] || {
+              echo "::error::$url answered HTTP $code, not 200"
+              head -c 400 body.json || true
+              exit 1
+          }
+
+          # A 200 carrying no relay is still a robot with no relay candidate to offer —
+          # which is the outage, not a milder version of it. `stun:` entries do not count:
+          # `webrtcbin` takes a STUN server through its own property, and this is about the
+          # thing STUN cannot do.
+          relays=$(jq '[.iceServers[]? | .urls] | flatten
+                       | map(select(startswith("turn:") or startswith("turns:")))
+                       | length' body.json)
+          echo "relay servers offered: $relays"
+          [ "$relays" -gt 0 ] || {
+              echo "::error::$url answered 200 with no turn:/turns: entries"
+              head -c 400 body.json || true
+              exit 1
+          }
diff --git a/.gitignore b/.gitignore
index 8bc02f5f..ad6ab663 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,3 +20,11 @@ secret*
 
 # Playground and scratch state (see updater/examples/playground.rs).
 /verify
+
+# Python bytecode from the demo Space, which is source rather than a build here.
+__pycache__/
+
+# A venv beside a Space's source, for running one locally. `uv venv` writes its own `.gitignore`
+# holding `*` so it self-ignores; this is for the person who reaches for `python -m venv`, which
+# does not, and it is the same accident `__pycache__` above was added for.
+.venv/
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 00000000..7ddaf1b1
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,41 @@
+# Working in this repository
+
+`CONTRIBUTING.md` is the reference: building, testing, layout, conventions, releasing. This page
+is the short list of things that are easy to get backwards, and where the answer lives when they
+are not here.
+
+## Docs own mechanisms; one page each
+
+`docs/README.md` assigns every mechanism to one design doc. When a fact belongs to a page listed
+there, every other page says one sentence and links. When two pages disagree, the one that does
+not own the mechanism is the bug — and when behaviour and a design doc disagree, the doc is the
+bug. [`docs/faq.md`](docs/faq.md) is the task-shaped front door for someone building against a
+robot rather than changing it.
+
+## A consumer uses WebRTC. `media.stream` is the fallback
+
+The robot publishes H.264 over WebRTC, and that is the default for anything consuming a duck's
+camera — it is encrypted end to end, it carries the control channel on the same session, and it
+has a return path. It works from a data centre because the robot offers a relay candidate
+(`remote-access-design.md` §6).
+
+`media.stream` — the robot dialling an outbound WebSocket and pushing frames to you — is the
+fallback for a **program** consuming **frames only** on a **long-running** stream, where relay
+metering is the thing that matters. It has no return path and no control channel.
+
+This is worth stating because the repository reads the other way round if you only follow the
+code: `media.stream` was built when the relay endpoint was dead and WebRTC genuinely could not
+connect from a data centre, so its module doc argues its own case at length. That endpoint is
+fixed. Do not conclude from the volume of prose that it is the preferred path.
+
+## Never design around a version difference
+
+One user, one robot. An old component's limits are a question to raise, not something to route
+around — bump `API_VERSION` and name the install consequence. A version skew is logged and served,
+never refused; only a genuinely missing route or an unknown parameter may refuse.
+
+## Releases are how a fix reaches a robot
+
+`main` being fixed is not a robot being fixed. Robots on the stable channel move when a release is
+cut, and a dev build from a branch is superseded by the next `daemon-dev-main` the board's
+six-hourly check finds. `docs/design/updater-design.md` owns the mechanism.
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 120000
index 00000000..47dc3e3d
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1 @@
+AGENTS.md
\ No newline at end of file
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 2546aa05..f1036e4a 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -100,6 +100,7 @@ hooks/          preinstall · postinstall — what runs inside an update, from t
 scripts/        provision-board.sh · dev-push.sh + dev-build.Dockerfile (from your machine) ·
                 provision.sh → setup-board.sh → setup-gstreamer.sh · setup-rkaiq.sh ·
                 migrate-network.sh · install.sh (on the board) ·
+                setup-login.sh · setup-quiet-boot.sh (install.sh and postinstall both run these) ·
                 robot-boot-check · robot-rescue (recovery, installed to /usr/local/sbin) ·
                 pad-link-test.sh · pad-stack-report.sh (gamepad radio, on the board) ·
                 board-test.sh · systemd-test.sh (CI) · cross-sysroot.sh (cross-builds) ·
diff --git a/Cargo.lock b/Cargo.lock
index f115c255..93bc8c5d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2,6 +2,12 @@
 # It is not intended for manual editing.
 version = 4
 
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
 [[package]]
 name = "aho-corasick"
 version = "1.1.4"
@@ -11,6 +17,17 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "ahrs"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4060d852f1a761d677c6f50499475735d8619f622a5d32b9fa8044e349827aef"
+dependencies = [
+ "nalgebra",
+ "num-traits",
+ "simba",
+]
+
 [[package]]
 name = "allocator-api2"
 version = "0.2.21"
@@ -205,6 +222,28 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "async-stream"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b5a71a6f37880a80d1d7f19efd781e4b5de42c88f0722cc13bcb6cc2cfe8476"
+dependencies = [
+ "async-stream-impl",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-stream-impl"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "async-task"
 version = "4.7.1"
@@ -270,6 +309,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
 dependencies = [
  "axum-core",
+ "base64",
  "bytes",
  "form_urlencoded",
  "futures-util",
@@ -288,8 +328,10 @@ dependencies = [
  "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
+ "sha1 0.10.7",
  "sync_wrapper",
  "tokio",
+ "tokio-tungstenite 0.29.0",
  "tower",
  "tower-layer",
  "tower-service",
@@ -443,9 +485,19 @@ dependencies = [
  "dbus",
 ]
 
+[[package]]
+name = "bmi088"
+version = "0.1.2"
+source = "git+https://github.com/pollen-robotics/bmi088-rs?tag=v0.1.2#bd113f317b14923f50f9a12a06678fe162b7fe06"
+dependencies = [
+ "ahrs",
+ "embedded-hal",
+ "nalgebra",
+]
+
 [[package]]
 name = "btd"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
  "bluer",
  "clap",
@@ -506,6 +558,12 @@ version = "1.25.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797"
 
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
 [[package]]
 name = "byteorder-lite"
 version = "0.1.0"
@@ -518,6 +576,12 @@ version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
+[[package]]
+name = "cast"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
+
 [[package]]
 name = "castaway"
 version = "0.2.4"
@@ -575,7 +639,7 @@ checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",
- "rand_core",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -687,7 +751,7 @@ dependencies = [
 
 [[package]]
 name = "configd"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
  "async-trait",
  "clap",
@@ -753,6 +817,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "crc32fast"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8498c871161e1742aaa9d52551b2d6ebdd4c3d45a3be423e3728f33b955be550"
+dependencies = [
+ "cfg-if",
+]
+
 [[package]]
 name = "critical-section"
 version = "1.2.0"
@@ -935,6 +1008,12 @@ dependencies = [
  "parking_lot_core",
 ]
 
+[[package]]
+name = "data-encoding"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
+
 [[package]]
 name = "dbus"
 version = "0.9.12"
@@ -1050,21 +1129,23 @@ dependencies = [
 
 [[package]]
 name = "duck-control"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
  "duck-ipc-proto",
  "libloading 0.8.9",
  "ort",
  "rustypot",
  "serde",
+ "serde_json",
  "serialport",
+ "sha2 0.11.0",
  "thiserror 2.0.19",
  "tracing",
 ]
 
 [[package]]
 name = "duck-detect"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
  "anyhow",
  "clap",
@@ -1075,10 +1156,24 @@ dependencies = [
  "tracing-subscriber",
 ]
 
+[[package]]
+name = "duck-ether"
+version = "0.12.0"
+dependencies = [
+ "clap",
+ "duck-ipc-proto",
+ "serde_json",
+ "thiserror 2.0.19",
+ "tokio",
+ "tracing",
+ "tracing-subscriber",
+]
+
 [[package]]
 name = "duck-ipc-proto"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
+ "libc",
  "semver",
  "serde",
  "serde_json",
@@ -1087,7 +1182,7 @@ dependencies = [
 
 [[package]]
 name = "duckctl"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
  "btd",
  "btleplug",
@@ -1111,6 +1206,22 @@ version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"
 
+[[package]]
+name = "embedded-hal"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "361a90feb7004eca4019fb28352a9465666b24f840f5c3cddf0ff13920590b89"
+
+[[package]]
+name = "embedded-hal-nb"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fba4268c14288c828995299e59b12babdbe170f6c6d73731af1b4648142e8605"
+dependencies = [
+ "embedded-hal",
+ "nb",
+]
+
 [[package]]
 name = "encoding_rs"
 version = "0.8.35"
@@ -1208,12 +1319,32 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "eventsource-stream"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74fef4569247a5f429d9156b9d0a2599914385dd189c539334c625d8099d90ab"
+dependencies = [
+ "futures-core",
+ "nom",
+ "pin-project-lite",
+]
+
 [[package]]
 name = "fastrand"
 version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
 
+[[package]]
+name = "fdeflate"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
+dependencies = [
+ "simd-adler32",
+]
+
 [[package]]
 name = "filetime"
 version = "0.2.29"
@@ -1230,6 +1361,17 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 
+[[package]]
+name = "flate2"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide 0.9.1",
+ "zlib-rs",
+]
+
 [[package]]
 name = "fnv"
 version = "1.0.7"
@@ -1397,6 +1539,18 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.4.3"
@@ -1406,8 +1560,8 @@ dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
- "r-efi",
- "rand_core",
+ "r-efi 6.0.0",
+ "rand_core 0.10.1",
  "wasm-bindgen",
 ]
 
@@ -1458,6 +1612,114 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "glam"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "333928d5eb103c5d4050533cec0384302db6be8ef7d3cebd30ec6a35350353da"
+
+[[package]]
+name = "glam"
+version = "0.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3abb554f8ee44336b72d522e0a7fe86a29e09f839a36022fa869a7dfe941a54b"
+
+[[package]]
+name = "glam"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4126c0479ccf7e8664c36a2d719f5f2c140fbb4f9090008098d2c291fa5b3f16"
+
+[[package]]
+name = "glam"
+version = "0.17.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e01732b97afd8508eee3333a541b9f7610f454bb818669e66e90f5f57c93a776"
+
+[[package]]
+name = "glam"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "525a3e490ba77b8e326fb67d4b44b4bd2f920f44d4cc73ccec50adc68e3bee34"
+
+[[package]]
+name = "glam"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b8509e6791516e81c1a630d0bd7fbac36d2fa8712a9da8662e716b52d5051ca"
+
+[[package]]
+name = "glam"
+version = "0.20.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f43e957e744be03f5801a55472f593d43fabdebf25a4585db250f04d86b1675f"
+
+[[package]]
+name = "glam"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "518faa5064866338b013ff9b2350dc318e14cc4fcd6cb8206d7e7c9886c98815"
+
+[[package]]
+name = "glam"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f597d56c1bd55a811a1be189459e8fad2bbc272616375602443bdfb37fa774"
+
+[[package]]
+name = "glam"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e4afd9ad95555081e109fe1d21f2a30c691b5f0919c67dfa690a2e1eb6bd51c"
+
+[[package]]
+name = "glam"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5418c17512bdf42730f9032c74e1ae39afc408745ebb2acf72fbc4691c17945"
+
+[[package]]
+name = "glam"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "151665d9be52f9bb40fc7966565d39666f2d1e69233571b71b87791c7e0528b3"
+
+[[package]]
+name = "glam"
+version = "0.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e05e7e6723e3455f4818c7b26e855439f7546cf617ef669d1adedb8669e5cb9"
+
+[[package]]
+name = "glam"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "779ae4bf7e8421cf91c0b3b64e7e8b40b862fba4d393f59150042de7c4965a94"
+
+[[package]]
+name = "glam"
+version = "0.29.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8babf46d4c1c9d92deac9f7be466f76dfc4482b6452fc5024b5e8daf6ffeb3ee"
+
+[[package]]
+name = "glam"
+version = "0.30.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19fc433e8437a212d1b6f1e68c7824af3aed907da60afa994e7f542d18d12aa9"
+
+[[package]]
+name = "glam"
+version = "0.31.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "556f6b2ea90b8d15a74e0e7bb41671c9bdf38cd9f78c284d750b9ce58a2b5be7"
+
+[[package]]
+name = "glam"
+version = "0.32.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f70749695b063ecbf6b62949ccccde2e733ec3ecbbd71d467dca4e5c6c97cca0"
+
 [[package]]
 name = "glib"
 version = "0.21.5"
@@ -1513,6 +1775,17 @@ dependencies = [
  "system-deps",
 ]
 
+[[package]]
+name = "gpio-cdev"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09831ec59b80be69e75d29cf36e16afbbe5fd1af9c1bf4689ad91c77db5aa6a6"
+dependencies = [
+ "bitflags 2.13.1",
+ "libc",
+ "nix 0.27.1",
+]
+
 [[package]]
 name = "gstreamer"
 version = "0.24.5"
@@ -1750,6 +2023,21 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
+[[package]]
+name = "hf-robot-account"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8f937783a058985f73be1663ef122f19682723c7504ff32ea10879c1ce9bef4"
+dependencies = [
+ "libc",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.19",
+ "tokio",
+ "tracing",
+]
+
 [[package]]
 name = "hmac"
 version = "0.12.1"
@@ -1895,6 +2183,18 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "i2cdev"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b940f7497c4f95b863b21cd34c3737b53a67d80d94cf29055d7f7eeca6ffdb4"
+dependencies = [
+ "bitflags 2.13.1",
+ "byteorder",
+ "libc",
+ "nix 0.26.4",
+]
+
 [[package]]
 name = "icu_collections"
 version = "2.2.0"
@@ -2014,6 +2314,7 @@ dependencies = [
  "byteorder-lite",
  "moxcms",
  "num-traits",
+ "png",
  "zune-core",
  "zune-jpeg",
 ]
@@ -2248,7 +2549,7 @@ dependencies = [
 
 [[package]]
 name = "kinematics"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
  "roxmltree",
  "serde",
@@ -2332,6 +2633,24 @@ dependencies = [
  "bitflags 2.13.1",
 ]
 
+[[package]]
+name = "linux-embedded-hal"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a8a605c95f708c78554738a12153b213f107d3bd5323f7ce32d6deb3faafb40"
+dependencies = [
+ "cast",
+ "embedded-hal",
+ "embedded-hal-nb",
+ "gpio-cdev",
+ "i2cdev",
+ "nb",
+ "nix 0.27.1",
+ "serialport",
+ "spidev",
+ "sysfs_gpio",
+]
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.12.1"
@@ -2422,24 +2741,35 @@ dependencies = [
 
 [[package]]
 name = "mediad"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
  "anyhow",
+ "async-stream",
  "axum",
  "clap",
  "duck-detect",
  "duck-ipc-proto",
+ "eventsource-stream",
+ "futures-util",
  "glib",
  "gstreamer",
  "gstreamer-app",
  "gstreamer-video",
  "gstreamer-webrtc",
+ "hf-robot-account",
+ "image",
+ "libc",
+ "rand 0.10.2",
+ "reqwest",
  "robotd-params",
+ "serde",
  "serde_json",
  "tempfile",
  "tokio",
+ "tokio-tungstenite 0.30.0",
  "tracing",
  "tracing-subscriber",
+ "url",
 ]
 
 [[package]]
@@ -2448,6 +2778,24 @@ version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
+[[package]]
+name = "memoffset"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5aa361d4faea93603064a027415f07bd8e1d5c88c9fbf68bf56a285428fd79ce"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "memoffset"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4"
+dependencies = [
+ "autocfg",
+]
+
 [[package]]
 name = "memoffset"
 version = "0.9.1"
@@ -2463,6 +2811,12 @@ version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
 [[package]]
 name = "minisign"
 version = "0.9.1"
@@ -2481,6 +2835,26 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "22f9645cb765ea72b8111f36c522475d2daa0d22c957a9826437e97534bc4e9e"
 
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "miniz_oxide"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
 [[package]]
 name = "mio"
 version = "1.2.2"
@@ -2509,6 +2883,57 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "956787520e75e9bd233246045d19f42fb73242759cc57fba9611d940ae96d4b0"
 
+[[package]]
+name = "nalgebra"
+version = "0.34.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df76ea0ff5c7e6b88689085804d6132ded0ddb9de5ca5b8aeb9eeadc0508a70a"
+dependencies = [
+ "approx",
+ "glam 0.14.0",
+ "glam 0.15.2",
+ "glam 0.16.0",
+ "glam 0.17.3",
+ "glam 0.18.0",
+ "glam 0.19.0",
+ "glam 0.20.5",
+ "glam 0.21.3",
+ "glam 0.22.0",
+ "glam 0.23.0",
+ "glam 0.24.2",
+ "glam 0.25.0",
+ "glam 0.27.0",
+ "glam 0.28.0",
+ "glam 0.29.3",
+ "glam 0.30.10",
+ "glam 0.31.1",
+ "glam 0.32.1",
+ "matrixmultiply",
+ "nalgebra-macros",
+ "num-complex",
+ "num-rational",
+ "num-traits",
+ "simba",
+ "typenum",
+]
+
+[[package]]
+name = "nalgebra-macros"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "973e7178a678cfd059ccec50887658d482ce16b0aa9da3888ddeab5cd5eb4889"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "nb"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d5439c4ad607c3c23abf66de8c8bf57ba8adcd1f129e699851a6e43935d339d"
+
 [[package]]
 name = "ndarray"
 version = "0.17.2"
@@ -2530,6 +2955,19 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b"
 
+[[package]]
+name = "nix"
+version = "0.23.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f3790c00a0150112de0f4cd161e3d7fc4b2d8a5542ffc35f099a2562aecb35c"
+dependencies = [
+ "bitflags 1.3.2",
+ "cc",
+ "cfg-if",
+ "libc",
+ "memoffset 0.6.5",
+]
+
 [[package]]
 name = "nix"
 version = "0.26.4"
@@ -2539,6 +2977,19 @@ dependencies = [
  "bitflags 1.3.2",
  "cfg-if",
  "libc",
+ "memoffset 0.7.1",
+ "pin-utils",
+]
+
+[[package]]
+name = "nix"
+version = "0.27.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
+dependencies = [
+ "bitflags 2.13.1",
+ "cfg-if",
+ "libc",
 ]
 
 [[package]]
@@ -2565,6 +3016,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.3"
@@ -2574,6 +3035,16 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "num-bigint"
+version = "0.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c89e69e7e0f03bea5ef08013795c25018e101932225a656383bd384495ecc367"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
 [[package]]
 name = "num-complex"
 version = "0.4.6"
@@ -2615,6 +3086,7 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
 dependencies = [
+ "num-bigint",
  "num-integer",
  "num-traits",
 ]
@@ -2759,7 +3231,7 @@ dependencies = [
 
 [[package]]
 name = "odometry"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
  "duck-ipc-proto",
  "kinematics",
@@ -2821,18 +3293,27 @@ version = "2.0.0-rc.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06503bb33f294c5f1ba484011e053bfa6ae227074bdb841e9863492dc5960d4b"
 
+[[package]]
+name = "pad-imu"
+version = "0.12.0"
+dependencies = [
+ "duck-ipc-proto",
+]
+
 [[package]]
 name = "padd"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
  "clap",
  "duck-ipc-proto",
  "evdev",
  "gilrs",
  "libc",
+ "pad-imu",
  "robotd-params",
  "serde",
  "serde_json",
+ "tempfile",
  "tracing",
  "tracing-subscriber",
 ]
@@ -2929,7 +3410,7 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "pet-detect"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
  "anyhow",
  "clap",
@@ -2965,6 +3446,12 @@ version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
 [[package]]
 name = "piper"
 version = "0.2.5"
@@ -2982,6 +3469,19 @@ version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
 
+[[package]]
+name = "png"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
+dependencies = [
+ "bitflags 2.13.1",
+ "crc32fast",
+ "fdeflate",
+ "flate2",
+ "miniz_oxide 0.8.9",
+]
+
 [[package]]
 name = "polling"
 version = "3.11.0"
@@ -3026,6 +3526,15 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
 [[package]]
 name = "primal-check"
 version = "0.3.4"
@@ -3089,7 +3598,7 @@ dependencies = [
  "bytes",
  "getrandom 0.4.3",
  "lru-slab",
- "rand",
+ "rand 0.10.2",
  "rand_pcg",
  "ring",
  "rustc-hash",
@@ -3125,6 +3634,12 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
 [[package]]
 name = "r-efi"
 version = "6.0.0"
@@ -3137,6 +3652,16 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
 
+[[package]]
+name = "rand"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
+dependencies = [
+ "rand_chacha",
+ "rand_core 0.9.5",
+]
+
 [[package]]
 name = "rand"
 version = "0.10.2"
@@ -3145,7 +3670,26 @@ checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
  "chacha20",
  "getrandom 0.4.3",
- "rand_core",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
 ]
 
 [[package]]
@@ -3160,7 +3704,7 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
 dependencies = [
- "rand_core",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -3334,13 +3878,14 @@ dependencies = [
 
 [[package]]
 name = "robotctl"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
  "clap",
  "clap_complete",
  "duck-ipc-proto",
  "kinematics",
  "libc",
+ "pad-imu",
  "ratatui",
  "robotd-params",
  "semver",
@@ -3353,7 +3898,7 @@ dependencies = [
 
 [[package]]
 name = "robotd"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
  "arc-swap",
  "clap",
@@ -3384,7 +3929,7 @@ dependencies = [
 
 [[package]]
 name = "robotd-params"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
  "duck-ipc-proto",
  "kinematics",
@@ -3572,6 +4117,15 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
+[[package]]
+name = "safe_arch"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96b02de82ddbe1b636e6170c21be622223aea188ef2e139be0a5b219ec215323"
+dependencies = [
+ "bytemuck",
+]
+
 [[package]]
 name = "salsa20"
 version = "0.10.2"
@@ -3765,6 +4319,28 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "sha1"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a978451301f4db1d02937a4ab3ccce137717b81826e79b7d49ffe3244a13c3b8"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha1"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
+]
+
 [[package]]
 name = "sha2"
 version = "0.10.9"
@@ -3833,6 +4409,26 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "simba"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c99284beb21666094ba2b75bbceda012e610f5479dfcc2d6e2426f53197ffd95"
+dependencies = [
+ "approx",
+ "libm",
+ "num-complex",
+ "num-traits",
+ "paste",
+ "wide",
+]
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
+
 [[package]]
 name = "simd_cesu8"
 version = "1.2.0"
@@ -3873,7 +4469,7 @@ dependencies = [
 
 [[package]]
 name = "sounds"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
  "anyhow",
  "clap",
@@ -3881,6 +4477,17 @@ dependencies = [
  "sha2 0.11.0",
 ]
 
+[[package]]
+name = "spidev"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32dadd0a877f0652fa52dbc4d2ed9f4877bea5cd30725507b36e1970a5ef0519"
+dependencies = [
+ "bitflags 2.13.1",
+ "libc",
+ "nix 0.26.4",
+]
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.1"
@@ -3996,6 +4603,15 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "sysfs_gpio"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8808c55bc926565c62ef7838bcaa8add51585236803e2bdfa1472e3a3ab5e17"
+dependencies = [
+ "nix 0.23.2",
+]
+
 [[package]]
 name = "system-deps"
 version = "7.0.8"
@@ -4056,7 +4672,7 @@ dependencies = [
 
 [[package]]
 name = "test-support"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
  "clap",
  "minisign",
@@ -4165,15 +4781,19 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tof"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
  "anyhow",
+ "bmi088",
  "cc",
  "clap",
  "duck-ipc-proto",
  "libc",
+ "linux-embedded-hal",
+ "robotd-params",
  "serde",
  "serde_json",
+ "tempfile",
  "tokio",
  "tracing",
  "tracing-subscriber",
@@ -4228,6 +4848,34 @@ dependencies = [
  "tokio-util",
 ]
 
+[[package]]
+name = "tokio-tungstenite"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f72a05e828585856dacd553fba484c242c46e391fb0e58917c942ee9202915c"
+dependencies = [
+ "futures-util",
+ "log",
+ "tokio",
+ "tungstenite 0.29.0",
+]
+
+[[package]]
+name = "tokio-tungstenite"
+version = "0.30.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17a073bfed563fa236697a068031408a93cd9522e08abf9933ead3e73411bd71"
+dependencies = [
+ "futures-util",
+ "log",
+ "rustls",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tungstenite 0.30.0",
+ "webpki-roots 0.26.11",
+]
+
 [[package]]
 name = "tokio-util"
 version = "0.7.19"
@@ -4454,6 +5102,40 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
+[[package]]
+name = "tungstenite"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c01152af293afb9c7c2a57e4b559c5620b421f6d133261c60dd2d0cdb38e6b8"
+dependencies = [
+ "bytes",
+ "data-encoding",
+ "http",
+ "httparse",
+ "log",
+ "rand 0.9.5",
+ "sha1 0.10.7",
+ "thiserror 2.0.19",
+]
+
+[[package]]
+name = "tungstenite"
+version = "0.30.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e48ac77174b19c110a50ab2128b24215ac9cb40e0e12e093fb602d175c569d22"
+dependencies = [
+ "bytes",
+ "data-encoding",
+ "http",
+ "httparse",
+ "log",
+ "rand 0.10.2",
+ "rustls",
+ "rustls-pki-types",
+ "sha1 0.11.0",
+ "thiserror 2.0.19",
+]
+
 [[package]]
 name = "typenum"
 version = "1.20.1"
@@ -4466,7 +5148,7 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
 dependencies = [
- "memoffset",
+ "memoffset 0.9.1",
  "tempfile",
  "windows-sys 0.61.2",
 ]
@@ -4517,7 +5199,7 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "updater"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
  "async-trait",
  "axum",
@@ -4525,6 +5207,7 @@ dependencies = [
  "duck-ipc-proto",
  "fs4",
  "futures-util",
+ "hf-robot-account",
  "humantime-serde",
  "libc",
  "minisign",
@@ -4631,6 +5314,15 @@ version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen",
+]
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.126"
@@ -4744,6 +5436,34 @@ dependencies = [
  "rustls-pki-types",
 ]
 
+[[package]]
+name = "webpki-roots"
+version = "0.26.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
+dependencies = [
+ "webpki-roots 1.0.8",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf85cb06032201fa7c6f829d7db5a7e5aa45bcc0655327713065f6f0576731bf"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "wide"
+version = "0.7.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ce5da8ecb62bcd8ec8b7ea19f69a51275e91299be594ea5cc6ef7819e16cd03"
+dependencies = [
+ "bytemuck",
+ "safe_arch",
+]
+
 [[package]]
 name = "winapi"
 version = "0.3.9"
@@ -5083,6 +5803,12 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
 [[package]]
 name = "writeable"
 version = "0.6.3"
@@ -5116,7 +5842,7 @@ checksum = "636f85e5ca6488e96401b61eb7de54f4e44755c988af0f52cf90230c312a1a89"
 
 [[package]]
 name = "xtask"
-version = "0.10.0"
+version = "0.12.0"
 dependencies = [
  "clap",
  "minisign",
@@ -5215,6 +5941,26 @@ dependencies = [
  "zvariant",
 ]
 
+[[package]]
+name = "zerocopy"
+version = "0.8.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "556764e583adb45a9f8d413c2a147fa7e8d821e48e12b14fd560b607998b75eb"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2ab42fc20575779bd240faa45f94a74256f755c0fa9e89f0ede20d91d0cdfc1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "zerofrom"
 version = "0.1.8"
@@ -5275,6 +6021,12 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "zlib-rs"
+version = "0.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34b31d188d9d685a4f9c7b46d6e36631b07058d2cfe190267adce54dc230bf12"
+
 [[package]]
 name = "zmij"
 version = "1.0.23"
diff --git a/Cargo.toml b/Cargo.toml
index a2923286..d2a050ab 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,7 +4,7 @@
 # docs/design/architecture.md §1. `robotd`, `btd` and `mediad` are all siblings now.
 [workspace]
 resolver = "3"
-members = ["btd", "configd", "duck-control", "duck-detect", "duck-ipc-proto", "duckctl", "kinematics", "mediad", "odometry", "padd", "pet-detect", "sounds", "tof", "updater", "robotctl", "robotd", "robotd-params", "test-support", "xtask"]
+members = ["btd", "configd", "duck-control", "duck-detect", "duck-ether", "duck-ipc-proto", "duckctl", "kinematics", "mediad", "odometry", "pad-imu", "padd", "pet-detect", "sounds", "tof", "updater", "robotctl", "robotd", "robotd-params", "test-support", "xtask"]
 
 # Everything except `duckctl`, and that exception is the whole reason this key exists.
 #
@@ -18,7 +18,7 @@ members = ["btd", "configd", "duck-control", "duck-detect", "duck-ipc-proto", "d
 # writing down. One list here, and a new daemon is picked up by both without anybody remembering.
 #
 # `--workspace` is unaffected, so CI still lints and tests `duckctl` exactly as before.
-default-members = ["btd", "configd", "duck-control", "duck-detect", "duck-ipc-proto", "kinematics", "mediad", "odometry", "padd", "pet-detect", "sounds", "tof", "updater", "robotctl", "robotd", "robotd-params", "test-support", "xtask"]
+default-members = ["btd", "configd", "duck-control", "duck-detect", "duck-ipc-proto", "kinematics", "mediad", "odometry", "pad-imu", "padd", "pet-detect", "sounds", "tof", "updater", "robotctl", "robotd", "robotd-params", "test-support", "xtask"]
 
 # ONNX Runtime, which robotd dlopens to run a policy. One source of truth: `xtask package`
 # bakes these into the release's preinstall hook, and a test asserts scripts/setup-board.sh
@@ -49,12 +49,23 @@ runtime = "v2.3.2"
 # inside a release and cannot read this file, so it carries the literals and a test asserts the
 # two agree.
 #
-# `version` is a tag in the Hub repo, and it is a *floor*: it decides what a freshly provisioned
-# board installs, not what every board runs. Moving past it is `robotctl policy update`, which
-# needs no daemon release — bumping this does, since it ships inside one.
+# `version` is a tag in the Hub repo, and it is a *minimum*: what a freshly provisioned board
+# installs, and the oldest official set this daemon's defaults load — a board below it is moved
+# up to it by the post-install hook, one past it is left alone. Moving past it is `robotctl
+# policy update`, which needs no daemon release — bumping this does, since it ships inside one,
+# and it is bumped when a slot's default names a file only the new set carries.
 [workspace.metadata.policies]
 repo    = "pollen-robotics/microduck-policies"
-version = "v1"
+version = "v5"
+
+# The duck detector, the same way: trained in pollen-robotics/duck_detector, published on the Hub,
+# and seeded onto a board by `scripts/seed-detector.sh` from this pin — a floor, moved past with
+# `robotctl duck-detector update`. The model repo shares its name with the *dataset* repo; the robot only
+# ever addresses the model (`huggingface.co/<repo>/resolve/…`, `api/models/<repo>`), and the
+# dataset lives under `datasets/`, so the shared name cannot be confused on the wire.
+[workspace.metadata.detector]
+repo    = "pollen-robotics/microduck-duck-detector"
+version = "duck-v1"
 
 # The prebuilt GStreamer plugins `mediad` needs, built in CI from pinned upstream sources at
 # https://github.com/pollen-robotics/microduck-gst-plugins — `mpph264enc` (hardware H.264 through
@@ -69,7 +80,7 @@ repo    = "pollen-robotics/microduck-gst-plugins"
 version = "v3"
 
 [workspace.package]
-version = "0.10.0"
+version = "0.12.0"
 edition = "2024"
 # 1.89 for `std::fs::File::try_lock`, which is how the single-flight update lock works
 # without a dependency (updater/src/journal.rs). Edition 2024 needs 1.85, so this covers
@@ -90,6 +101,7 @@ tracing = "0.1"
 tracing-subscriber = "0.3"
 tokio-util = "0.7"
 async-trait = "0.1"
+url = "2"
 
 # No custom [profile.release]. Binary size is not worth optimising for: model artifacts
 # will dwarf a few MB of binary, and the tuning cost more than it bought —
diff --git a/README.md b/README.md
index d5dae0ad..2aef6df3 100644
--- a/README.md
+++ b/README.md
@@ -85,6 +85,7 @@ It also sits, kicks a ball, rolls forward on command, and quacks in a voice that
 | [Set up a dev board](docs/robot/install-dev.md) | From a blank board to a robot that takes branch builds. |
 | [Dev cheat sheet](docs/robot/cheatsheet-dev.md) | Branch builds, release candidates, driving from a laptop, and the restart traps after an update. |
 | [Push your branch](docs/robot/dev-push.md) | Build on your machine, install over ssh, about a minute. |
+| [The simulated duck](docs/robot/simulation.md) | No robot on the desk? `scripts/duck-sim` runs the real daemons against a body in MuJoCo — one duck in a window, or four as machines you log into. |
 | [CONTRIBUTING.md](CONTRIBUTING.md) | Building, testing, layout, conventions, releasing. |
 | [Docs index](docs/README.md) | Everything, including the design pages and the open problems. |
 
diff --git a/btd/src/bluez.rs b/btd/src/bluez.rs
index 900be631..86742986 100644
--- a/btd/src/bluez.rs
+++ b/btd/src/bluez.rs
@@ -20,8 +20,13 @@
 //! So: one session for the service's lifetime, one notify pump, and a write callback that pushes
 //! bytes into it.
 //!
-//! **Untested against hardware.** It type-checks for aarch64 and has never met a real central.
-//! Treat what follows as intent until someone connects a phone.
+//! **What the callback model costs is flow control**, and that bill came due the first time a
+//! reply was more than a few kilobytes. `notify` hands a D-Bus signal to the connection and
+//! returns; nothing here can ask BlueZ whether the radio has caught up, and nothing reports the
+//! notification MTU either. Both gaps are worked around rather than solved: the payload is taken
+//! from what BlueZ reports on inbound writes (one ATT MTU serves both directions), and the pump
+//! pauses every [`NOTIFY_BURST`] chunks. The IO model has the readiness signal this wants and
+//! still cannot be used, for the reason above — it serves only the `Acquire*` paths.
 
 use std::net::Ipv4Addr;
 use std::sync::Arc;
@@ -34,11 +39,13 @@ use bluer::agent::Agent;
 // which is how it first presented.
 use bluer::gatt::local::ReqError as GattError;
 use bluer::gatt::local::{
-    Application, Characteristic, CharacteristicNotify, CharacteristicNotifyMethod,
-    CharacteristicRead, CharacteristicWrite, CharacteristicWriteMethod, Service,
+    Application, Characteristic, CharacteristicNotifier, CharacteristicNotify,
+    CharacteristicNotifyMethod, CharacteristicRead, CharacteristicWrite, CharacteristicWriteMethod,
+    Service,
 };
 use futures::FutureExt;
 use std::sync::Mutex as StdMutex;
+use std::sync::atomic::{AtomicUsize, Ordering};
 
 use tokio::sync::mpsc;
 
@@ -47,13 +54,46 @@ use crate::link::Link;
 use crate::session;
 use crate::upstream::{NameChoice, Sockets};
 
-/// Notification payload assumed for outbound chunks.
+/// Notification payload a session starts with, before any write has reported the negotiated one.
 ///
-/// The write side learns the negotiated MTU (BlueZ reports it per request); the notify side has no
-/// way to ask. So chunks are sized for 20 bytes — the payload every BLE link is required to
-/// support — which is slower than necessary on a good link and correct on every link.
+/// 20 bytes is what every BLE link is required to support, so it is the only safe *first* guess.
+/// It used to be the guess for the whole session — the notify side has no way to ask BlueZ, which
+/// remains true — and that was wrong in two ways. Tenfold more notifications than the link needed
+/// was the visible half; the other half is that a reply above roughly 5 KiB tore the session down
+/// (see [`NOTIFY_BURST`]). The write side does learn the real MTU, BlueZ reports it on every
+/// inbound write, and both directions share one ATT MTU — so the floor now lasts until the
+/// client's first write, which is always `system.authenticate`.
 const FLOOR_MTU: usize = 20;
 
+/// How many notifications to queue before pausing to let the radio drain.
+///
+/// **This is the only backpressure the callback model offers, and it has to exist.**
+/// `CharacteristicNotifier::notify` emits a D-Bus `PropertiesChanged` signal and returns as soon
+/// as the signal is queued on the connection — it does not wait for BlueZ, let alone for the
+/// controller — so an unpaced pump queues a whole reply in microseconds. Measured on the board:
+/// a ~5 KiB reply at the 20-byte floor (≈265 notifications) got through in 1.8 s, and a ~7 KiB one
+/// (≈350) killed the notification session 150 ms in, leaving the client waiting out its idle
+/// timeout against a robot that had already torn down the session. `bluer`'s IO model has a real
+/// readiness signal for this and cannot be used here — it serves only the `Acquire*` fd paths,
+/// which a CoreBluetooth central never drives (see this module's header).
+///
+/// Sixteen chunks is what a connection interval can plausibly carry, so a small reply — an
+/// authentication answer is four chunks — never pauses at all.
+const NOTIFY_BURST: usize = 16;
+
+/// How long to pause between bursts. Roughly one connection interval.
+const NOTIFY_PAUSE: Duration = Duration::from_millis(20);
+
+/// How many times to re-send a chunk the D-Bus connection would not take, and how long to wait
+/// between attempts.
+///
+/// A `notify` that fails while the session is *not* stopped is a queue that is momentarily full,
+/// which is recoverable and was being treated as the central having left — the session was torn
+/// down mid-reply and the client learned nothing at all. Only an exhausted budget, or a genuinely
+/// stopped session, ends the session now.
+const NOTIFY_RETRIES: u32 = 5;
+const NOTIFY_RETRY_BACKOFF: Duration = Duration::from_millis(20);
+
 /// How often to advertise, and this is the difference between a robot that is found and one that is
 /// not.
 ///
@@ -313,6 +353,13 @@ async fn serve_on_an_adapter(
     let for_write = current.clone();
     let for_notify = current.clone();
 
+    // The negotiated payload, written by the write callback and read by the session when it sizes
+    // a reply. An atomic rather than a channel or the mutex above, because the write callback may
+    // not await and may not block: a yield point there lets two chunks swap places. See
+    // [`crate::link::Link::mtu`].
+    let mtu = Arc::new(AtomicUsize::new(FLOOR_MTU));
+    let write_mtu = mtu.clone();
+
     // The notify callback below takes ownership of `sockets` for the sessions it spawns, and the
     // reconcile loop at the end outlives it.
     let for_reconcile = sockets.clone();
@@ -364,6 +411,15 @@ async fn serve_on_an_adapter(
                             String::from_utf8_lossy(&value[..value.len().min(8)]).to_string();
                         let sender = for_write.lock().expect("write slot poisoned").clone();
 
+                        // What BlueZ says this link negotiated, minus the three bytes of ATT
+                        // header a notification cannot use. Stored on every write because it is
+                        // free to do so and a central may renegotiate; logged only when it moves,
+                        // because the value that matters is the one a reply gets chunked for and
+                        // that number had never appeared in the journal at all.
+                        let payload = usize::from(req.mtu).saturating_sub(3).max(FLOOR_MTU);
+                        let previous = write_mtu.swap(payload, Ordering::Relaxed);
+                        let learned = (previous != payload).then_some(payload);
+
                         let result = match sender {
                             None => {
                                 // Nowhere to send an answer, so accepting the request would be a
@@ -394,6 +450,12 @@ async fn serve_on_an_adapter(
                         };
 
                         async move {
+                            if let Some(payload) = learned {
+                                tracing::info!(
+                                    payload,
+                                    "negotiated notification payload; replies are sized for this"
+                                );
+                            }
                             // Eight bytes of the chunk, so a reordering is visible in the journal
                             // rather than inferred from a parse error three layers up. Truncated
                             // because a request may carry a wifi passphrase.
@@ -416,12 +478,17 @@ async fn serve_on_an_adapter(
                     method: CharacteristicNotifyMethod::Fun(Box::new(move |mut notifier| {
                         let slot = for_notify.clone();
                         let sockets = sockets.clone();
+                        let mtu = mtu.clone();
                         async move {
                             tokio::spawn(async move {
                                 // A fresh session, so nothing from a previous central can leak
                                 // into this one.
+                                // Back to the floor for a new central: the previous one's MTU is
+                                // not this one's, and the first write will report the real value
+                                // before any reply is chunked.
+                                mtu.store(FLOOR_MTU, Ordering::Relaxed);
                                 let (link, inbound, mut outbound) =
-                                    Link::pair(FLOOR_MTU, "central");
+                                    Link::pair_sharing_mtu(mtu.clone(), "central");
                                 let mine = inbound.clone();
                                 {
                                     let mut slot = slot.lock().expect("write slot poisoned");
@@ -438,6 +505,11 @@ async fn serve_on_an_adapter(
                                 let session = tokio::spawn(session::run(link, sockets));
                                 tracing::info!("central subscribed");
 
+                                // Notifications queued since the last pause. See `NOTIFY_BURST`
+                                // for why a pump with no readiness signal has to pace itself.
+                                let mut queued = 0usize;
+                                let mut gone = false;
+
                                 loop {
                                     tokio::select! {
                                         // Biased so a central that has gone away is noticed before
@@ -448,16 +520,22 @@ async fn serve_on_an_adapter(
                                         // when a notify fails — which needs a reply to send, so a
                                         // client that disconnects while idle would hold the slot
                                         // until the next request arrives for nobody.
-                                        () = notifier.stopped() => break,
+                                        () = notifier.stopped() => {
+                                            gone = true;
+                                            break;
+                                        }
                                         chunk = outbound.recv() => match chunk {
                                             None => break,
                                             Some(chunk) => {
-                                                if let Err(e) = notifier.notify(chunk).await {
-                                                    tracing::debug!(
-                                                        error = %e, "notify failed; central gone"
-                                                    );
+                                                if !notify_chunk(&mut notifier, chunk).await {
+                                                    gone = true;
                                                     break;
                                                 }
+                                                queued += 1;
+                                                if queued >= NOTIFY_BURST {
+                                                    queued = 0;
+                                                    tokio::time::sleep(NOTIFY_PAUSE).await;
+                                                }
                                             }
                                         },
                                     }
@@ -474,7 +552,20 @@ async fn serve_on_an_adapter(
                                         // its reassembly buffer and its upstream connections.
                                         slot.take();
                                         session.abort();
-                                        tracing::info!("central unsubscribed; session discarded");
+                                        // Which of the two it was, because they need different
+                                        // next moves and the old line said "unsubscribed" for
+                                        // both — including for a reply this pump could not
+                                        // deliver, which is a robot problem wearing a client's
+                                        // clothes.
+                                        if gone {
+                                            tracing::info!(
+                                                "the central is gone; session discarded"
+                                            );
+                                        } else {
+                                            tracing::info!(
+                                                "the outbound queue closed; session discarded"
+                                            );
+                                        }
                                     } else {
                                         tracing::debug!(
                                             "a newer session holds the slot; leaving it alone"
@@ -531,6 +622,46 @@ async fn serve_on_an_adapter(
     Ok(())
 }
 
+/// Send one chunk, retrying a queue that is momentarily full. `false` means give up on the session.
+///
+/// **The distinction this function exists to draw**: `notify` returns the same error for "the
+/// central unsubscribed" and "the D-Bus connection would not take this signal", and the pump used
+/// to read both as the central having left. So a reply too big for one burst tore down the session
+/// mid-line, and the client — still connected, as far as CoreBluetooth was concerned — waited out
+/// its idle timeout with no error to report and half an answer in its reassembler. That was
+/// diagnosed from a board, not from the journal, because the only line it left was a `debug` one
+/// blaming the central.
+///
+/// `is_stopped` tells them apart: it is closed only when the notification session really has
+/// ended. Anything else is retried, and the chunk is cloned because `notify` consumes it and a
+/// dropped chunk corrupts the line rather than failing it.
+async fn notify_chunk(notifier: &mut CharacteristicNotifier, chunk: Vec<u8>) -> bool {
+    for attempt in 1..=NOTIFY_RETRIES {
+        match notifier.notify(chunk.clone()).await {
+            Ok(()) => return true,
+            Err(_) if notifier.is_stopped() => {
+                tracing::debug!("the notification session ended mid-reply");
+                return false;
+            }
+            Err(e) => {
+                tracing::warn!(
+                    attempt,
+                    error = %e,
+                    "the notification queue would not take a chunk; retrying"
+                );
+                tokio::time::sleep(NOTIFY_RETRY_BACKOFF).await;
+            }
+        }
+    }
+    // A warning rather than a silence, which is the whole point: this ends a session, and
+    // whoever is holding the client deserves to find out why from the robot's own journal.
+    tracing::warn!(
+        retries = NOTIFY_RETRIES,
+        "gave up on a notification chunk; ending the session rather than sending a corrupt line"
+    );
+    false
+}
+
 /// What the advertisement says about the robot: what it is called, and where it is on the network.
 ///
 /// One struct rather than two arguments threaded through the reconcile loop, so that "has anything
diff --git a/btd/src/framing.rs b/btd/src/framing.rs
index f48474d1..fe305f38 100644
--- a/btd/src/framing.rs
+++ b/btd/src/framing.rs
@@ -21,20 +21,50 @@
 /// and it is reachable by anyone in radio range. Generous next to any real request — the
 /// largest is an `update.apply` with a long ref — and far below `updaterd`'s own 1 MiB line
 /// limit, because nothing that big has any business arriving over BLE.
+///
+/// **This bounds what a peer may send, not what the robot may answer.** The two are not the
+/// same size and were one constant until a reply outgrew it: see [`MAX_REPLY_LINE`].
 pub const MAX_LINE: usize = 8 * 1024;
 
+/// Longest line a *client* will reassemble from the robot.
+///
+/// The other direction, and it needs its own number. [`MAX_LINE`] is a security bound — the
+/// peer it limits is anyone in radio range, so it is deliberately tight — whereas this limits
+/// the robot a client chose to connect to and already trusts. Reusing the tight one here made
+/// every reply over 8 KiB unreadable, which quietly took `update.show` (kilobytes for an
+/// ordinary run) and `system.logs` (a screenful of journal) out of reach of `duckctl` while
+/// `btd` served both correctly.
+///
+/// 64 KiB, and the real limit on a reply is smaller still and lives elsewhere: `proto`'s
+/// `MAX_LOG_BYTES` keeps the journal tail well inside this, because at a typical ATT MTU
+/// 64 KiB is a minute on the air and no answer should take that long.
+pub const MAX_REPLY_LINE: usize = 64 * 1024;
+
 /// Reassembles inbound chunks into whole lines.
-#[derive(Debug, Default)]
+#[derive(Debug)]
 pub struct Reassembler {
     buf: Vec<u8>,
+    /// What "too long" means for this direction. See [`MAX_LINE`] and [`MAX_REPLY_LINE`].
+    limit: usize,
+}
+
+/// The robot's side: [`MAX_LINE`], the tight bound, because the default must be the safe one.
+impl Default for Reassembler {
+    fn default() -> Self {
+        Self {
+            buf: Vec::new(),
+            limit: MAX_LINE,
+        }
+    }
 }
 
 /// Why a peer's bytes were rejected. Both cases mean "drop the connection", but they are
 /// logged differently: one is a client that cannot frame, the other may be an attack.
 #[derive(Debug, PartialEq, Eq)]
 pub enum FramingError {
-    /// No newline within [`MAX_LINE`].
-    LineTooLong,
+    /// No newline within this reassembler's limit, which the variant carries because the two
+    /// directions have different ones and the message must say which was hit.
+    LineTooLong { limit: usize },
     /// Not valid UTF-8, so it cannot be JSON either.
     NotUtf8,
 }
@@ -42,7 +72,7 @@ pub enum FramingError {
 impl std::fmt::Display for FramingError {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         match self {
-            Self::LineTooLong => write!(f, "no newline within {MAX_LINE} bytes"),
+            Self::LineTooLong { limit } => write!(f, "no newline within {limit} bytes"),
             Self::NotUtf8 => write!(f, "not valid UTF-8"),
         }
     }
@@ -57,17 +87,28 @@ impl Reassembler {
         Self::default()
     }
 
+    /// A reassembler for the answers coming *back*, bounded by [`MAX_REPLY_LINE`].
+    ///
+    /// Named for the direction rather than taking a number, so that a client reading replies
+    /// cannot pick the wrong bound and `btd` cannot accidentally be given the loose one.
+    pub fn for_replies() -> Self {
+        Self {
+            buf: Vec::new(),
+            limit: MAX_REPLY_LINE,
+        }
+    }
+
     /// Feed one chunk; get back every complete line it completed.
     ///
     /// Returns a `Vec` because one write can legitimately carry several short lines — a
     /// client that batches `hello` and `update.status` into one 40-byte write is being
     /// efficient, not wrong.
     pub fn push(&mut self, chunk: &[u8]) -> Result<Vec<String>, FramingError> {
-        if self.buf.len() + chunk.len() > MAX_LINE {
+        if self.buf.len() + chunk.len() > self.limit {
             // Clear rather than keep the partial line: whatever follows is unparseable
             // anyway, and holding it would let a peer pin the memory.
             self.buf.clear();
-            return Err(FramingError::LineTooLong);
+            return Err(FramingError::LineTooLong { limit: self.limit });
         }
         self.buf.extend_from_slice(chunk);
 
@@ -165,11 +206,35 @@ mod tests {
     fn a_line_without_a_newline_is_refused_at_the_cap() {
         let mut r = Reassembler::new();
         let big = vec![b'x'; MAX_LINE + 1];
-        assert_eq!(r.push(&big), Err(FramingError::LineTooLong));
+        assert_eq!(
+            r.push(&big),
+            Err(FramingError::LineTooLong { limit: MAX_LINE })
+        );
         // And the buffer was released, so the peer cannot pin memory by retrying.
         assert_eq!(r.pending(), 0);
     }
 
+    /// A reply larger than the request cap must reassemble on the client side.
+    ///
+    /// The regression this pins is one constant serving both directions: with a single 8 KiB
+    /// cap, a `system.logs` answer arrived intact from the robot and died in `duckctl` as
+    /// "no newline within 8192 bytes", which reads like a broken robot and is not one.
+    #[test]
+    fn a_reply_bigger_than_the_request_cap_is_accepted_by_a_client() {
+        let reply = format!("{{\"result\":\"{}\"}}\n", "x".repeat(32 * 1024));
+
+        let mut robot_side = Reassembler::new();
+        assert!(matches!(
+            robot_side.push(reply.as_bytes()),
+            Err(FramingError::LineTooLong { limit: MAX_LINE })
+        ));
+
+        let mut client_side = Reassembler::for_replies();
+        let lines = client_side.push(reply.as_bytes()).expect("under the cap");
+        assert_eq!(lines.len(), 1);
+        assert_eq!(lines[0].len(), reply.len() - 1);
+    }
+
     #[test]
     fn invalid_utf8_is_refused() {
         let mut r = Reassembler::new();
diff --git a/btd/src/link.rs b/btd/src/link.rs
index 83b9fb65..c4228931 100644
--- a/btd/src/link.rs
+++ b/btd/src/link.rs
@@ -11,6 +11,9 @@
 //! goes away. What happens between those two channels is [`crate::session`], and it never
 //! learns whether a radio is involved.
 
+use std::sync::Arc;
+use std::sync::atomic::{AtomicUsize, Ordering};
+
 use tokio::sync::mpsc;
 
 /// How many chunks may queue in either direction.
@@ -38,19 +41,37 @@ pub struct Link {
     pub outbound: mpsc::Sender<Vec<u8>>,
     /// Usable notification payload — `ATT_MTU - 3` — as negotiated for this connection.
     ///
-    /// Read once per session rather than per message: a central may renegotiate, but not
-    /// mid-line, and re-reading it would let a line be chunked two different ways.
-    pub mtu: usize,
+    /// **A shared cell rather than a number, because the two halves of the link learn it at
+    /// different times.** BlueZ reports the negotiated MTU on every inbound write and offers the
+    /// notify side no way to ask, so a session begins knowing only the 20-byte floor and learns
+    /// the real value from the first write a client makes — which is always `system.authenticate`,
+    /// before any reply worth chunking exists. Sizing replies for the floor for the whole session
+    /// was a tenfold cost in notifications, and above about 5 KiB it stopped being merely slow:
+    /// see the pacing in `bluez`.
+    ///
+    /// Read once per *line*, never per chunk, which is the invariant that matters — a line chunked
+    /// two different ways cannot be reassembled.
+    mtu: Arc<AtomicUsize>,
     /// The central's address, for the log line. Never used for authorization — a BLE address
     /// is trivially spoofed, and pairing is what authorizes (`architecture.md` §4.2).
     pub peer: String,
 }
 
 impl Link {
-    /// A link wired to channels the caller drives. Used by tests and by `--fake`.
+    /// A link wired to channels the caller drives, with a payload size that never changes.
+    /// Used by tests and by `--fake`.
     pub fn pair(
         mtu: usize,
         peer: impl Into<String>,
+    ) -> (Self, mpsc::Sender<Vec<u8>>, mpsc::Receiver<Vec<u8>>) {
+        Self::pair_sharing_mtu(Arc::new(AtomicUsize::new(mtu)), peer)
+    }
+
+    /// A link whose payload size is written by somebody else — the radio backend, from what
+    /// BlueZ reports on each inbound write. See [`Link::mtu`].
+    pub fn pair_sharing_mtu(
+        mtu: Arc<AtomicUsize>,
+        peer: impl Into<String>,
     ) -> (Self, mpsc::Sender<Vec<u8>>, mpsc::Receiver<Vec<u8>>) {
         let (to_robot, inbound) = mpsc::channel(QUEUE);
         let (outbound, from_robot) = mpsc::channel(QUEUE);
@@ -65,6 +86,11 @@ impl Link {
             from_robot,
         )
     }
+
+    /// The payload to size the next outbound line for.
+    pub fn mtu(&self) -> usize {
+        self.mtu.load(Ordering::Relaxed)
+    }
 }
 
 /// The queue must be deep enough that a maximal line never needs a blocking send.
diff --git a/btd/src/route.rs b/btd/src/route.rs
index 3f97f061..1eb67679 100644
--- a/btd/src/route.rs
+++ b/btd/src/route.rs
@@ -152,6 +152,25 @@ fn permits(call: &proto::Call) -> bool {
         // cannot report on this way is `btd` itself, which answering at all proves is running.
         SystemServices => true,
 
+        // The tail of one daemon's journal, and the next question after the line above: a unit
+        // reported as `failed` is a diagnosis nobody can act on without the reason it failed.
+        //
+        // Permitted because BLE is where the question is asked. A robot with no network cannot be
+        // reached by ssh, and that robot — one whose wifi never came up, whose `robotd` died on
+        // boot — is exactly the one whose journal somebody needs. Refusing here would mean the
+        // logs are readable over every transport except the one available when things are broken.
+        //
+        // Read-only, and bounded on the other side rather than trusted: `configd` picks the unit
+        // from a fixed list and refuses anything else, so this grants "the tail of a daemon this
+        // project ships", not `journalctl`. What a phone in the room learns is what that phone
+        // could already learn by watching the robot fail, in words it can put in a support ticket.
+        //
+        // The one thing worth naming as a cost: a journal line can carry more than a status. Ours
+        // are reviewed for that where it matters — `net.connect`'s passphrase is redacted by a
+        // hand-written `Debug` with a test pinning it (`proto::NetConnectParams`) — and this
+        // routing is the second reason that redaction is load-bearing rather than tidy.
+        SystemLogs(_) => true,
+
         // Rebooting is drastic but recoverable, and it is what an app offers when a robot is
         // confused — the alternative being "unplug it", which for a walking robot is worse.
         // Unlike `resetToGolden` it discards nothing.
@@ -300,6 +319,9 @@ fn permits(call: &proto::Call) -> bool {
         // of skills to assume any more, so this is how a phone knows there is a bow to ask for.
         RobotPolicies => true,
 
+        // Static geometry, read-only; the same class of read as the one above.
+        RobotModel => true,
+
         // Re-reading the slots after something else edited the config. Same blast radius as
         // `robot.loadPolicy` and the same answer, and a client that can load wants this for the
         // case where the file changed underneath it.
@@ -330,6 +352,10 @@ fn permits(call: &proto::Call) -> bool {
         // The transport is the gate here, not the credential.
         PolicyFetch(_) | PolicyInstall(_) => true,
 
+        // The detector's set, by the same argument: a read that reaches the network, and an
+        // install whoever tapped it is standing next to.
+        DetectorCheck | DetectorInstall(_) => true,
+
         // ── the account, which BLE is the right transport for ────────────────
         //
         // Signing the robot in to a Hugging Face account is what makes it reachable from outside
@@ -354,7 +380,7 @@ fn permits(call: &proto::Call) -> bool {
         // offer, and `robot.init` is its counterpart: standing a robot up moves every joint at once,
         // which wants the person doing it to be looking at the robot rather than at a screen. Both
         // are `robotctl` on the robot, deliberately.
-        RobotInit | RobotRelax => false,
+        RobotInit | RobotRelax | RobotRebootMotors(_) => false,
 
         // `robot.stop` deserves its own line, because refusing it looks wrong. An emergency stop
         // in the app is exactly what someone reaches for, and §6 does say local should preempt
@@ -386,6 +412,8 @@ fn permits(call: &proto::Call) -> bool {
         // reason to see what the robot sees, it will be through `mediad`'s video path
         // (`architecture.md` §5.2), where depth belongs next to the frame it annotates.
         TofStream => false,
+        // Same as the ToF: the head IMU is tofd's, reached over mediad's video path, not BLE.
+        HeadImuStream => false,
     }
 }
 
@@ -478,6 +506,8 @@ mod tests {
                 // the download, the shape gate at load, the clamps, the fall reflex.
                 proto::method::POLICY_INSTALL,
                 proto::method::POLICY_FETCH,
+                // Replacing the detector, by the same argument as the policy set.
+                proto::method::DETECTOR_INSTALL,
                 // Binding the robot to a Hugging Face account, and unbinding it. Provisioning,
                 // like the two below it and for the same reason: a robot out of a box has no
                 // network, so it has no console and no LAN to open one from, and this is the
@@ -664,6 +694,8 @@ mod tests {
                 query: "microduck".to_owned(),
             }),
             proto::Call::PolicyInstall(proto::PolicyInstallParams::default()),
+            proto::Call::DetectorCheck,
+            proto::Call::DetectorInstall(proto::PolicyInstallParams::default()),
         ] {
             assert_eq!(
                 upstream_for(&call),
diff --git a/btd/src/session.rs b/btd/src/session.rs
index 2b22429d..b1bf1e40 100644
--- a/btd/src/session.rs
+++ b/btd/src/session.rs
@@ -31,7 +31,8 @@ const PIN_ATTEMPTS: u32 = 3;
 /// Serve one central until it disconnects or breaks framing.
 pub async fn run(mut link: Link, sockets: Sockets) {
     let peer = link.peer.clone();
-    tracing::info!(peer = %peer, mtu = link.mtu, "session opened");
+    tracing::info!(peer = %peer, mtu = link.mtu(), "session opened; mtu is the floor \
+     until the first write reports the negotiated one");
 
     let (replies_tx, mut replies) = mpsc::channel::<String>(QUEUE);
     let config_socket = sockets.config.clone();
@@ -305,7 +306,9 @@ async fn authenticate(
 
 /// Chunk one line out to the central.
 async fn send_line(link: &Link, line: &str) -> Result<(), ()> {
-    for chunk in framing::chunks(line, link.mtu) {
+    // Read once here, so one line is chunked one way even if a write reports a new MTU
+    // meanwhile. See `Link::mtu`.
+    for chunk in framing::chunks(line, link.mtu()) {
         if link.outbound.send(chunk).await.is_err() {
             // The backend dropped its half: the central is gone.
             return Err(());
@@ -392,6 +395,22 @@ mod tests {
         }
     }
 
+    /// Like [`read_reply`], and also says how the line was cut up on the way out.
+    async fn read_reply_in_chunks(from_robot: &mut Receiver<Vec<u8>>) -> (String, Vec<usize>) {
+        let mut r = Reassembler::new();
+        let mut sizes = Vec::new();
+        loop {
+            let chunk = tokio::time::timeout(std::time::Duration::from_secs(2), from_robot.recv())
+                .await
+                .expect("client saw no reply")
+                .expect("link closed");
+            sizes.push(chunk.len());
+            if let Some(line) = r.push(&chunk).expect("framing").into_iter().next() {
+                return (line, sizes);
+            }
+        }
+    }
+
     /// The reply a fake `configd` gives to `system.pairingPin`.
     fn pin_reply(pin: &str) -> String {
         serde_json::to_string(&proto::Response::ok(
@@ -533,6 +552,71 @@ mod tests {
         );
     }
 
+    /// **A reply is sized for the MTU the link has learned, and a session starts knowing only
+    /// the floor.**
+    ///
+    /// This is the mechanism behind `bluez`'s shared MTU cell, tested here because that file needs
+    /// a radio and this one does not. What it pins is the ordering that makes the trick sound: a
+    /// central subscribes before it writes, so a session opens at the 20-byte floor and learns the
+    /// real payload from the first write — which is always `system.authenticate`, before any reply
+    /// worth chunking exists.
+    ///
+    /// Sizing every reply for the floor was not merely slow. Ten times the notifications is ten
+    /// times the queue depth in BlueZ, and past roughly 5 KiB the notification session was torn
+    /// down mid-reply — a `system.logs` tail was the first reply big enough to find it.
+    #[tokio::test]
+    async fn a_reply_is_chunked_for_the_mtu_the_link_has_learned() {
+        let dir = tempdir();
+        let (_, _) = FakeDaemon::spawn(dir.path(), "configd.sock", vec![pin_reply("424242")]);
+        let (_, _) = FakeDaemon::spawn(dir.path(), "updaterd.sock", vec![]);
+        let (_, _) = FakeDaemon::spawn(
+            dir.path(),
+            "robotd.sock",
+            vec![r#"{"jsonrpc":"2.0","id":2,"result":{"healthy":true}}"#.into()],
+        );
+
+        let mtu = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(20));
+        let (link, to_robot, mut from_robot) = Link::pair_sharing_mtu(mtu.clone(), "AA:BB");
+        tokio::spawn(run(
+            link,
+            sockets(dir.path(), "updaterd.sock", "robotd.sock"),
+        ));
+
+        // At the floor, so the authentication answer goes out in 20-byte pieces.
+        to_robot
+            .send(
+                b"{\"jsonrpc\":\"2.0\",\"id\":0,\"method\":\"system.authenticate\",\"params\":{\"pin\":\"424242\"}}\n"
+                    .to_vec(),
+            )
+            .await
+            .unwrap();
+        let (reply, sizes) = read_reply_in_chunks(&mut from_robot).await;
+        assert!(reply.contains(r#""authenticated":true"#), "{reply}");
+        assert!(
+            sizes.len() > 1,
+            "a floor-sized reply arrived whole: {sizes:?}"
+        );
+        assert!(
+            sizes.iter().all(|&n| n <= 20),
+            "a chunk exceeded the floor: {sizes:?}"
+        );
+
+        // What the write callback does on a real link, once BlueZ has reported the MTU.
+        mtu.store(182, std::sync::atomic::Ordering::Relaxed);
+
+        to_robot
+            .send(b"{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"robot.health\"}\n".to_vec())
+            .await
+            .unwrap();
+        let (reply, sizes) = read_reply_in_chunks(&mut from_robot).await;
+        assert!(reply.contains(r#""healthy":true"#), "{reply}");
+        assert_eq!(
+            sizes.len(),
+            1,
+            "the reply was still cut up for the floor: {sizes:?}"
+        );
+    }
+
     /// A subscription is a stream of notifications on an open connection, and every one has to
     /// reach the central. This is the case that would break if replies were correlated to
     /// requests rather than forwarded as they arrive.
diff --git a/btd/src/upstream.rs b/btd/src/upstream.rs
index 29f5f0b9..05ee5f46 100644
--- a/btd/src/upstream.rs
+++ b/btd/src/upstream.rs
@@ -153,30 +153,47 @@ impl Pool {
     }
 
     /// Send one line to `upstream` on `lane`'s connection, connecting first if needed.
+    ///
+    /// A daemon that restarted between two requests is ordinary here: `robotd` is the one an
+    /// update restarts, and `updaterd` restarts itself from a release's postinstall hook. The
+    /// connection from before the restart is still in the pool, its reader has already seen the
+    /// socket close, and the first write into it fails. Those bytes never left, so they are written
+    /// again on a fresh connection rather than reported. Reporting them told a phone that a daemon
+    /// listening on a fresh socket was not answering, once per lane, after every update. Once and
+    /// not in a loop: a daemon that is genuinely gone fails the reconnect, and that is the error
+    /// worth reporting.
     pub async fn send(&mut self, upstream: Upstream, lane: Lane, line: &str) -> io::Result<()> {
         let key = (upstream, lane);
+        let mut bytes = line.as_bytes().to_vec();
+        bytes.push(b'\n');
+
         if !self.conns.contains_key(&key) {
             let conn = self.open(upstream, lane).await?;
             self.conns.insert(key, conn);
         }
+        match self.write(key, &bytes).await {
+            Err(e) if peer_is_gone(&e) => {
+                let conn = self.open(upstream, lane).await?;
+                self.conns.insert(key, conn);
+                self.write(key, &bytes).await
+            }
+            done => done,
+        }
+    }
 
-        // Unwrap is sound: just inserted, or the contains_key above held.
+    /// One bounded write on the connection for `key`. Any failure drops that connection, so
+    /// nothing keeps writing into a dead socket. This lane's only: the others may be perfectly
+    /// alive, and a restart that broke one breaks the next write to each of them anyway.
+    async fn write(&mut self, key: (Upstream, Lane), bytes: &[u8]) -> io::Result<()> {
+        // Unwrap is sound: the caller inserted it, or `contains_key` held.
         let conn = self.conns.get_mut(&key).expect("connection present");
-
-        let mut bytes = line.as_bytes().to_vec();
-        bytes.push(b'\n');
-
         let write = async {
-            conn.write.write_all(&bytes).await?;
+            conn.write.write_all(bytes).await?;
             conn.write.flush().await
         };
         match tokio::time::timeout(WRITE_TIMEOUT, write).await {
             Ok(Ok(())) => Ok(()),
             Ok(Err(e)) => {
-                // A broken pipe here is ordinary — the daemon restarted. Drop the connection
-                // so the next call reconnects rather than writing into a dead socket forever.
-                // This lane's connection only: the others may be perfectly alive, and a restart
-                // that broke one breaks the next write to each of them anyway.
                 self.conns.remove(&key);
                 Err(e)
             }
@@ -233,6 +250,19 @@ impl Pool {
     }
 }
 
+/// Whether a write failed because the peer went away, rather than being slow or refusing. Only
+/// these are worth one more try, because only these mean the bytes went to a daemon that is no
+/// longer there. A timeout is a daemon that is there and stuck, and that is not retried.
+fn peer_is_gone(e: &io::Error) -> bool {
+    matches!(
+        e.kind(),
+        io::ErrorKind::BrokenPipe
+            | io::ErrorKind::ConnectionReset
+            | io::ErrorKind::ConnectionAborted
+            | io::ErrorKind::NotConnected
+    )
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -326,4 +356,64 @@ mod tests {
             .unwrap_err();
         assert!(err.contains("configd refused"), "{err}");
     }
+    /// The daemon restarted between two requests.
+    ///
+    /// The comment on the write path says a broken pipe is ordinary, the daemon restarted, and
+    /// the next call reconnects. It is the call *after* the next: the first write after a restart
+    /// went into the socket the old daemon closed, failed, and the phone was told the service was
+    /// not answering while it was listening on a fresh socket the whole time. The pool's own
+    /// reader had already seen the socket close and told nobody.
+    ///
+    /// On the BLE update path this is `updaterd` restarting itself from the release's postinstall
+    /// hook, and the phone's next `update.status` failing for it.
+    #[tokio::test]
+    async fn a_restarted_daemon_gets_the_next_request_not_the_one_after() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("updaterd.sock");
+        let sockets = Sockets {
+            updater: path.clone(),
+            robot: dir.path().join("robotd.sock"),
+            config: dir.path().join("configd.sock"),
+        };
+        let (replies, mut forwarded) = mpsc::channel(8);
+        let mut pool = Pool::new(sockets, replies);
+
+        let before = serve_once(
+            &path,
+            proto::Response::ok(Some(proto::Id::Number(1)), &serde_json::json!({})),
+        );
+        pool.send(
+            Upstream::Updater,
+            Lane::Prompt,
+            r#"{"jsonrpc":"2.0","id":1,"method":"update.status"}"#,
+        )
+        .await
+        .unwrap();
+        assert!(
+            forwarded.recv().await.is_some(),
+            "the first answer is forwarded"
+        );
+        // The daemon has answered and hung up: it is restarting.
+        before.await.unwrap();
+
+        // And it is back, listening on a fresh socket at the same path.
+        std::fs::remove_file(&path).unwrap();
+        let after = serve_once(
+            &path,
+            proto::Response::ok(Some(proto::Id::Number(2)), &serde_json::json!({})),
+        );
+        pool.send(
+            Upstream::Updater,
+            Lane::Prompt,
+            r#"{"jsonrpc":"2.0","id":2,"method":"update.status"}"#,
+        )
+        .await
+        .expect("a daemon that is back must get the request, not a broken pipe");
+        let request = after.await.unwrap();
+        assert!(request.contains(r#""id":2"#), "{request}");
+        assert!(
+            forwarded.recv().await.is_some(),
+            "and its answer is forwarded"
+        );
+    }
 }
diff --git a/configd/Cargo.toml b/configd/Cargo.toml
index 56a19096..34b125de 100644
--- a/configd/Cargo.toml
+++ b/configd/Cargo.toml
@@ -15,7 +15,9 @@ description = "Wifi and robot identity — the config service"
 duck-ipc-proto = { path = "../duck-ipc-proto" }
 serde.workspace = true
 serde_json.workspace = true
-tokio = { workspace = true, features = ["rt-multi-thread", "macros", "net", "io-util", "time", "sync", "signal"] }
+# `process` is for reading the journal: `logs` spawns `journalctl` rather than linking libsystemd
+# for one read-only query. See that module for why.
+tokio = { workspace = true, features = ["rt-multi-thread", "macros", "net", "io-util", "time", "sync", "signal", "process"] }
 clap.workspace = true
 tracing.workspace = true
 tracing-subscriber = { workspace = true, features = ["env-filter"] }
diff --git a/configd/src/bluez.rs b/configd/src/bluez.rs
index c30741d9..745faaba 100644
--- a/configd/src/bluez.rs
+++ b/configd/src/bluez.rs
@@ -6,12 +6,21 @@
 //!
 //! ## The order, and why the state decides rather than the return values
 //!
-//! `connect` **before** `pair`, and `trust` after both. Leading with `Pair()` on an Xbox controller
-//! returns `AuthenticationCanceled`; that ordering comes from `microduck_runtime`'s notes and is the
-//! one that works on this board. It used to live in a provisioning script's comments and in whoever
-//! had done it before; now it is here, once, with the reason attached.
+//! **Which order depends on the transport**, and the two are opposite:
 //!
-//! But the order is **tried, not enforced**, because BlueZ's replies do not describe what happened:
+//!  - an **LE** pad (Xbox): `connect` **before** `pair`, and `trust` after both. Leading with
+//!    `Pair()` on an Xbox controller returns `AuthenticationCanceled`; that ordering comes from
+//!    `microduck_runtime`'s notes and is the one that works on this board.
+//!  - a **BR/EDR** pad (a "Pro Controller" Switch clone, and by the specification a DualShock or a
+//!    DualSense): `pair` **before** `connect`, then `trust`. See [the transport section](#which-transport-and-what-that-leaves-untested)
+//!    for what the other order does to it.
+//!
+//! `Snapshot::is_classic` decides, on whether BlueZ reports a `Class`. The rule used to live in a
+//! provisioning script's comments and in whoever had done it before; now it is here, once, with the
+//! reason attached.
+//!
+//! On the LE path the order is **tried, not enforced**, because BlueZ's replies do not describe what
+//! happened:
 //!
 //!  - `Connect()` on a device BlueZ has never bonded with can answer
 //!    `br-connection-profile-unavailable` — there is no profile to connect to *yet*. Refusing there
@@ -103,8 +112,8 @@
 //! BR/EDR and LE together, and every property `Snapshot` reads is optional partly because the two
 //! transports present different ones.
 //!
-//! But the pad all of this has been run against is **LE-only**. Its bond stores long-term keys and no
-//! `[LinkKey]`, and BlueZ reports no `Class` for it at all:
+//! The Xbox pad is **LE-only**. Its bond stores long-term keys and no `[LinkKey]`, and BlueZ reports
+//! no `Class` for it at all:
 //!
 //! ```text
 //! # /var/lib/bluetooth/<adapter>/<pad>/info
@@ -113,14 +122,45 @@
 //! [PeripheralLongTermKey]
 //! ```
 //!
-//! So the BR/EDR half of this file comes from the specification rather than from a radio. That
-//! includes the class-of-device branch in [`looks_like_a_gamepad`], which cannot have fired — an LE
-//! pad has no class to match — and the `br-connection-profile-unavailable` soft-fail above.
+//! The first **BR/EDR** pad arrived on 2026-09-09: a no-name "Pro Controller", a clone of Nintendo's
+//! Switch Pro Controller down to the modalias (`usb:v057Ep2009`), which is what makes the kernel's
+//! `hid-nintendo` bind it and expose it as "Nintendo Switch Pro Controller" on evdev. BlueZ reports
+//! it with `Class: 0x2508` — peripheral, gamepad — and derives `Icon: input-gaming` from that, so
+//! [`looks_like_a_gamepad`] recognises it on two signals, and the class-of-device branch has now
+//! fired on hardware. Only the HID and PnP UUIDs, no LE at all.
+//!
+//! What the LE order does to it, from `configd`'s own journal (2026-09-07, an earlier unit of the
+//! same pad): `Connect()` on the unbonded pad spends ten seconds and answers
+//! `br-connection-create-socket`; the `Pair()` fallback then answers
+//! `ConnectionAttemptFailed: Page Timeout`. The pad has left pairing mode — a rejected classic
+//! connection is enough to make it stop page-scanning — and every retry repeats the pair. Reproduced
+//! by hand, the same order (`bluetoothctl connect`, which bonds as a side effect, then `trust`) goes
+//! one step further and ends in the state that is hardest to read: `Paired: yes`, `Connected: yes`,
+//! a solid light on the pad, `pad status` saying connected — and **no input device**, so `padd` waits
+//! for a pad that BlueZ insists is there. `pair` → `connect` → `trust` works every time, so that is
+//! what `bond` does when `Class` is present. A pad already in the broken state is recovered with
+//! `pad forget` and a fresh `pad pair`.
 //!
-//! Discovery stays on `auto` regardless, because the pads the heuristic names that are *not* LE — a
-//! DualShock, a DualSense — are BR/EDR HID, and filtering to LE would make hardware this claims to
-//! recognise unreachable. The thing to know is which way the risk runs: dropping BR/EDR would cost
-//! nothing yet observed, and the first classic pad to arrive exercises that path for the first time.
+//! **The clone is also two devices at once.** In pairing mode it advertises an LE face,
+//! `BLE Controller_280609` at `98:B6:ED:28:06:09` — no class, no appearance, matched by the name
+//! heuristic alone — and the BR/EDR face, `Pro Controller` at `98:B6:E9:28:06:09`. The LE face is
+//! reported first — and, after the adapter power cycle `pad pair` performs on this board, several
+//! seconds first. The first `robotctl pad pair` on this branch (2026-09-09) stopped on it, took the
+//! LE order, hung [`BOND_TIMEOUT`] in `Connect()`, and by the time `Pair()` was tried the temporary
+//! object was gone: `UnknownObject: Method "Pair" ... doesn't exist`. A two-second grace after the
+//! first match did not help; the BR/EDR face was still not in the tree. So `find` now ends the
+//! search early only on a match the radio classified — the LE face's name-only match is kept as a
+//! fallback but never stops the sweep — and `one_face_per_pad` folds candidates that share their
+//! unit octets into the classic one before the ambiguity rule sees them.
+//!
+//! Discovery stays on `auto`, so BlueZ sweeps both transports and a Pro Controller and an Xbox pad
+//! are both found by the same search.
+//!
+//! Once bonded, a classic pad's reports are the kernel's business and not bluetoothd's:
+//! `scripts/setup-board.sh` sets `UserspaceHID=false` in `input.conf`, because the default relays
+//! this pad's ~200 packets/s of IMU through bluetoothd and uhid at 16% of a core. Nothing in this
+//! file depends on which path is in use; it is noted here because it is the other half of what
+//! "supporting a classic pad" turned out to mean.
 //!
 //! ## Where this has and has not run
 //!
@@ -134,8 +174,13 @@
 //! that re-initiates: the adapter scans as a central for a bonded peripheral while `btd` advertises
 //! as a peripheral itself. Both roles at once hold on this board's radio.
 //!
-//! What has **not** been exercised on hardware: a pad that bonds over BR/EDR at all, a DualSense, two
-//! pads in pairing mode at once, and pairing by explicit address.
+//! **And against the Pro Controller clone**, 2026-09-09, on the board above: `pad pair` with the pad
+//! in pairing mode found the classic face, bonded it and connected it in eight seconds — `bonded
+//! (classic)`, `connected`, `gamepad paired and trusted` — and `padd` drove from it. An Xbox pad
+//! paired a minute later through the unchanged LE path.
+//!
+//! What has **not** been exercised on hardware: a DualSense, two pads in pairing mode at once, and
+//! pairing by explicit address.
 //!
 //! And one case that cannot be fixed from here: `pad forget` removes only the robot's half of the
 //! bond. A pad that still holds its half will not pair again until it is put back into pairing mode
@@ -149,7 +194,7 @@ use duck_ipc_proto as proto;
 use zbus::names::OwnedInterfaceName;
 use zbus::zvariant::{ObjectPath, OwnedObjectPath, OwnedValue};
 
-use crate::pad::{PadResult, Pads, looks_like_a_gamepad};
+use crate::pad::{Evidence, PadResult, Pads, gamepad_evidence, same_pad};
 
 /// Where our pairing agent lives on the bus. Any path we own will do; this one says whose it is.
 const AGENT_PATH: &str = "/com/pollenrobotics/configd/pad_agent";
@@ -177,6 +222,17 @@ const BOND_SETTLE: Duration = Duration::from_secs(5);
 /// How often to re-read `Paired` while waiting for a bond.
 const BOND_POLL: Duration = Duration::from_millis(200);
 
+/// How long to keep sweeping after the first classified, unbonded pad turns up, for the rest of it.
+///
+/// A pad can be two devices — the Pro Controller clones advertise an LE face and a BR/EDR face.
+/// The classified one is the one worth having, and this is a short courtesy for the case where the
+/// two arrive close together and the other happens to be classified too. It is **not** what
+/// protects against the LE face: that face has nothing but a name, and a name-only match never
+/// ends the search early at all — see `find`. Measured: after the adapter power cycle `pad pair`
+/// performs on this board, the LE face was in BlueZ's tree within two seconds and the BR/EDR face
+/// was not, so no grace short enough to be free would have caught it.
+const SIBLING_GRACE: Duration = Duration::from_secs(1);
+
 /// How often to re-read the object tree while looking for a pad.
 ///
 /// Polling rather than `InterfacesAdded`, which sounds like the right signal and is not: BlueZ emits
@@ -382,8 +438,18 @@ impl Snapshot {
         })
     }
 
-    fn is_gamepad(&self) -> bool {
-        looks_like_a_gamepad(
+    /// Does this pad bond over BR/EDR rather than LE?
+    ///
+    /// `Class` is the tell: it is the classic class-of-device, which an LE-only device has no way
+    /// to present, and BlueZ reports it from the inquiry response before anything else is known
+    /// about the device. `AddressType` does not separate the two — an Xbox pad's is `public` too.
+    /// The order `bond` tries depends on this, and the module docs say why.
+    fn is_classic(&self) -> bool {
+        self.class.is_some()
+    }
+
+    fn evidence(&self) -> Option<Evidence> {
+        gamepad_evidence(
             &self.name,
             self.icon.as_deref(),
             self.class,
@@ -391,6 +457,16 @@ impl Snapshot {
         )
     }
 
+    fn is_gamepad(&self) -> bool {
+        self.evidence().is_some()
+    }
+
+    /// Unbonded, and a pad on the radio's word rather than its name's — the only kind of match the
+    /// search ends early on.
+    fn is_fresh_and_classified(&self) -> bool {
+        !self.paired && self.evidence() == Some(Evidence::Classified)
+    }
+
     fn as_pad(&self) -> proto::Pad {
         proto::Pad {
             mac: self.mac.clone(),
@@ -497,9 +573,13 @@ impl BlueZ {
     /// first, which is the wrong shape: a robot may have several pads bonded, and `padd` drives
     /// whichever connects.
     ///
-    /// So with no address given, the sweep only ends early on a candidate that is **not yet paired**;
-    /// otherwise it runs to the deadline and reports what it has, which may be the pad already
-    /// bonded. The cost is that re-running `pad pair` with nothing new in pairing mode takes the whole
+    /// So with no address given, the sweep only ends early on a candidate that is **not yet paired
+    /// and classified by the radio** — icon, class or appearance, not its name alone. A name-only
+    /// match is kept and used if nothing better arrives by the deadline, but it does not stop the
+    /// search: the Pro Controller clone's LE face is exactly such a match, it is reported seconds
+    /// before the BR/EDR face that actually pairs, and stopping on it cost every attempt a
+    /// thirty-second hang and a dead object. Otherwise the sweep runs to the deadline and reports
+    /// what it has, which may be the pad already bonded. The cost is that re-running `pad pair` with nothing new in pairing mode takes the whole
     /// window before saying "already paired" — `--timeout` shortens it.
     ///
     /// An explicit address ends the sweep as soon as it appears, paired or not: the caller has named
@@ -512,6 +592,9 @@ impl BlueZ {
     /// no way to learn the address that `--mac` needs. So the refusal carries the list.
     async fn find(&self, mac: Option<&str>, timeout: Duration) -> PadResult<Found> {
         let deadline = tokio::time::Instant::now() + timeout;
+        // When the first classified, unbonded candidate was seen, so the sweep can run
+        // [`SIBLING_GRACE`] past it before deciding.
+        let mut first_fresh: Option<tokio::time::Instant> = None;
         loop {
             let seen = self.devices().await?;
             let matches: Vec<Snapshot> = seen
@@ -525,11 +608,19 @@ impl BlueZ {
                 .cloned()
                 .collect();
 
+            let now = tokio::time::Instant::now();
             let worth_stopping_for = match mac {
                 Some(_) => !matches.is_empty(),
-                None => matches.iter().any(|device| !device.paired),
+                None => {
+                    if matches.iter().any(Snapshot::is_fresh_and_classified) {
+                        let since = *first_fresh.get_or_insert(now);
+                        now - since >= SIBLING_GRACE
+                    } else {
+                        false
+                    }
+                }
             };
-            if worth_stopping_for || tokio::time::Instant::now() >= deadline {
+            if worth_stopping_for || now >= deadline {
                 return Ok(Found { matches, seen });
             }
             tokio::time::sleep(DISCOVERY_POLL.min(deadline - tokio::time::Instant::now())).await;
@@ -576,9 +667,52 @@ impl BlueZ {
             .await
             .map_err(|e| (proto::PadPairFailure::Other, e.to_string()))?;
 
-        if !device.paired {
-            // `Connect()` first, which is the order that works on this board — leading with `Pair()`
-            // on an Xbox controller returns `AuthenticationCanceled`.
+        if !device.paired && device.is_classic() {
+            // A BR/EDR pad: `Pair()` first, then `Connect()`. The other order — the one below, which
+            // an LE pad needs — does not work on classic HID and leaves things worse than it found
+            // them. Seen against a "Pro Controller" (a Switch Pro clone, class 0x2508):
+            // `Connect()` on the unbonded pad spends ten seconds and answers
+            // `br-connection-create-socket`, and the `Pair()` after it answers
+            // `ConnectionAttemptFailed: Page Timeout` — the pad has stopped page-scanning by then,
+            // and the person has to put it back into pairing mode. Done by hand in the same order,
+            // `bluetoothctl connect` then `trust`, the pad ends up *Paired and Connected* with no
+            // input device behind it: the light on the pad goes solid, `pad status` says connected,
+            // and `padd` has nothing to open. `pair` → `connect` → `trust` is the sequence that
+            // works, so it is the one this takes.
+            //
+            // `Pair()` on BR/EDR is synchronous and answers when the bond is done — but it is still
+            // raced against `Paired`, as below, because that property is the ground truth and the
+            // reply is only one way to learn it.
+            let paired = tokio::select! {
+                outcome = tokio::time::timeout(BOND_TIMEOUT, proxy.pair()) => match outcome {
+                    Ok(Ok(())) => { tracing::info!("bonded (classic)"); true }
+                    Ok(Err(e)) if is_already_paired(&e) => { tracing::info!("already bonded"); true }
+                    Ok(Err(e)) => return Err((proto::PadPairFailure::Rejected, e.to_string())),
+                    Err(_) => false,
+                },
+                bonded = self.wait_until_paired(&device.mac, BOND_TIMEOUT) => bonded,
+            };
+            if !paired {
+                return Err((
+                    proto::PadPairFailure::Timeout,
+                    "the pad did not finish pairing".to_owned(),
+                ));
+            }
+
+            // Now connect, which is what brings up the HID channel and hands the pad to the kernel
+            // driver — `hid-nintendo`, for the clone above — so an input device appears. Soft: a
+            // bonded and trusted pad reconnects by itself, so a refusal here is not worth failing a
+            // pairing that succeeded. Logged at warn rather than info, though, because a classic
+            // pad that bonded and will not connect is the "connected light, no input" state from
+            // the other order, and worth a line in the journal.
+            match tokio::time::timeout(BOND_TIMEOUT, proxy.connect()).await {
+                Ok(Ok(())) => tracing::info!("connected"),
+                Ok(Err(e)) => tracing::warn!(error = %e, "bonded but not connected yet"),
+                Err(_) => tracing::warn!("bonded; connect did not answer in time"),
+            }
+        } else if !device.paired {
+            // An LE pad. `Connect()` first, which is the order that works on this board — leading
+            // with `Pair()` on an Xbox controller returns `AuthenticationCanceled`.
             //
             // But **soft-failed**, deliberately. A device BlueZ has never bonded with has no known
             // profile to connect to, so `Connect()` can answer
@@ -661,6 +795,38 @@ impl BlueZ {
     }
 }
 
+/// Collapse a pad that presents as two devices into the one worth bonding.
+///
+/// Candidates that share their unit octets — [`same_pad`] — are one pad seen over two transports,
+/// and the classic face is the one to keep: it is the one that carries HID to the kernel and the one
+/// `bond` knows the order for. Among faces of the same kind the lowest address wins, for the same
+/// determinism the caller applies to bonded pads. Candidates that share nothing pass through, so a
+/// genuine second pad in pairing mode is still refused as ambiguous.
+fn one_face_per_pad(fresh: Vec<&Snapshot>) -> Vec<&Snapshot> {
+    let mut kept: Vec<&Snapshot> = Vec::new();
+    for candidate in fresh {
+        match kept.iter_mut().find(|k| same_pad(&k.mac, &candidate.mac)) {
+            Some(face) => {
+                let better = match (candidate.is_classic(), face.is_classic()) {
+                    (true, false) => true,
+                    (false, true) => false,
+                    _ => candidate.mac < face.mac,
+                };
+                if better {
+                    tracing::info!(
+                        kept = %candidate.mac,
+                        dropped = %face.mac,
+                        "one pad, two faces: keeping the classic one"
+                    );
+                    *face = candidate;
+                }
+            }
+            None => kept.push(candidate),
+        }
+    }
+    kept
+}
+
 /// Did BlueZ refuse this because the bond already exists?
 fn is_already_paired(error: &zbus::Error) -> bool {
     matches!(error, zbus::Error::MethodError(name, _, _)
@@ -770,6 +936,7 @@ impl Pads for BlueZ {
                 // Without this, adding a second pad in a room where the first is in range would be
                 // refused as ambiguous forever.
                 let fresh: Vec<&Snapshot> = several.iter().filter(|d| !d.paired).collect();
+                let fresh = one_face_per_pad(fresh);
                 match fresh.as_slice() {
                     [only] => (*only).clone(),
                     // Nothing new: report the bonded one, and let `bond` re-assert `Trusted`. This is
@@ -908,3 +1075,48 @@ impl Pads for BlueZ {
         Ok(proto::PadForgetResult { removed: true })
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn face(mac: &str, name: &str, class: Option<u32>) -> Snapshot {
+        Snapshot {
+            path: OwnedObjectPath::try_from(format!(
+                "/org/bluez/hci0/dev_{}",
+                mac.replace(':', "_")
+            ))
+            .unwrap(),
+            mac: mac.to_owned(),
+            name: name.to_owned(),
+            icon: None,
+            class,
+            appearance: None,
+            paired: false,
+            trusted: false,
+            connected: false,
+        }
+    }
+
+    /// The Pro Controller clone as the radio reports it: an LE face first, the classic one after.
+    /// One pad comes out, and it is the classic one whichever order they arrived in.
+    #[test]
+    fn a_pad_with_two_faces_is_one_candidate_and_the_classic_face_wins() {
+        let le = face("98:B6:ED:28:06:09", "BLE Controller_280609", None);
+        let classic = face("98:B6:E9:28:06:09", "Pro Controller", Some(0x2508));
+
+        for order in [vec![&le, &classic], vec![&classic, &le]] {
+            let kept = one_face_per_pad(order);
+            assert_eq!(kept.len(), 1);
+            assert_eq!(kept[0].mac, classic.mac);
+        }
+    }
+
+    /// Two different pads stay two candidates — the ambiguity refusal downstream depends on it.
+    #[test]
+    fn two_pads_stay_two_candidates() {
+        let a = face("98:B6:E9:28:06:09", "Pro Controller", Some(0x2508));
+        let b = face("78:86:2E:BB:13:28", "Xbox Wireless Controller", None);
+        assert_eq!(one_face_per_pad(vec![&a, &b]).len(), 2);
+    }
+}
diff --git a/configd/src/lib.rs b/configd/src/lib.rs
index 0bb00341..3272bb58 100644
--- a/configd/src/lib.rs
+++ b/configd/src/lib.rs
@@ -27,6 +27,7 @@
 #[cfg(target_os = "linux")]
 pub mod bluez;
 pub mod identity;
+pub mod logs;
 pub mod net;
 #[cfg(target_os = "linux")]
 pub mod nm;
diff --git a/configd/src/logs.rs b/configd/src/logs.rs
new file mode 100644
index 00000000..96a5ed9c
--- /dev/null
+++ b/configd/src/logs.rs
@@ -0,0 +1,407 @@
+//! The tail of one daemon's journal, for a client that has no shell on the robot.
+//!
+//! [`units`](crate::units) answers "is `robotd` running"; this answers the question that follows a
+//! `failed` — *why*. Until it existed the only answer was `journalctl` over ssh, which needs a
+//! network the robot may not have and an address a phone cannot reach. The robot whose journal
+//! somebody actually needs is the one whose wifi never came up.
+//!
+//! **`configd` reads it because reading the journal needs privilege**, the same reason
+//! [`units`](crate::units) is here: it runs as root (see `systemd/configd.service`), and
+//! `robotctl` does not. On the robot itself nobody should use this — `journalctl` is right there,
+//! with `-g`, `--since` and a pager. This is for the transports that have none of that.
+//!
+//! ## Why it shells out to `journalctl`
+//!
+//! Reading the journal in-process means linking `libsystemd`, which means vendored C in a
+//! cross-compiled build for one read-only query. `journalctl` is on every board this ships to,
+//! it is already how the updater talks to systemd (`updater::engine` spawns `systemctl`), and
+//! the sandbox in this service's unit permits it: `ProtectSystem=strict` leaves `/usr/bin`
+//! readable, and root can read the journal without any capability.
+//!
+//! ## Why it takes a unit name and not arguments
+//!
+//! This call is reachable from a phone in radio range (`btd::route`). `journalctl` arguments are
+//! not a language to hand such a peer — `-D` reads another journal directory, `_PID=` matches
+//! anything on the box — so the unit is chosen from a fixed list and everything else is refused
+//! by name. What that costs is the searching a person with a shell would do. What it buys is that
+//! the worst any client can ask for is the tail of a daemon this project ships.
+
+use duck_ipc_proto as proto;
+
+/// Units that are not part of a daemon release but whose journals answer *our* failures.
+///
+/// Both earn their place by being the thing that is broken when the robot cannot be reached at
+/// all: BlueZ, when no phone can see the robot, and NetworkManager, when wifi never came up.
+/// Neither is ours, which is exactly why their logs are otherwise unreachable — nothing in
+/// `system.services` reports on them either.
+pub const ALSO_LOGGABLE: [&str; 2] = ["bluetooth.service", "NetworkManager.service"];
+
+/// Every unit whose journal this service will read, in the order a reader wants them.
+///
+/// Derived from [`crate::units::MANAGED`] rather than repeated, so a unit added to a release
+/// becomes readable here without anyone remembering this file — the mistake that list's own doc
+/// records having made once.
+pub fn loggable() -> impl Iterator<Item = &'static str> {
+    crate::units::MANAGED.into_iter().chain(ALSO_LOGGABLE)
+}
+
+/// Longest single line kept, in bytes.
+//
+// Off Linux there is no `read` to call these, and only the tests do — the same shape
+// `units::describe` takes, where the Linux half is the real one and the other half exists so a
+// laptop can still build and test the crate.
+#[cfg(any(target_os = "linux", test))]
+///
+/// journald accepts a stdout line up to its own `LineMax` (48 KiB by default), so one daemon
+/// logging a serialised blob could otherwise fill a whole reply with one entry and push out the
+/// hundred lines around it — which is the opposite of what a tail is for. Truncated with an
+/// ellipsis, so a reader can see that the line went on.
+const MAX_LINE_BYTES: usize = 2 * 1024;
+
+/// Resolve a caller's unit name against [`loggable`].
+///
+/// `robotd` and `robotd.service` both work: a caller typing the daemon's name should not have to
+/// know that systemd spells it with a suffix. The answer is the canonical name, so the reply says
+/// what was actually read.
+pub fn resolve(name: &str) -> Option<&'static str> {
+    let wanted = name.trim();
+    let wanted = wanted.strip_suffix(".service").unwrap_or(wanted);
+    // Case-insensitive for `NetworkManager` alone, really: nobody types that capitalisation from
+    // memory, and refusing `networkmanager` would be a puzzle rather than a guard.
+    loggable().find(|unit| {
+        unit.strip_suffix(".service")
+            .unwrap_or(unit)
+            .eq_ignore_ascii_case(wanted)
+    })
+}
+
+/// What to tell a caller that named something else. Names the real list, the way `pad.bind`
+/// refuses an unknown skill: a typo should come back as the answer, not as a shrug.
+pub fn refusal(name: &str) -> proto::Error {
+    proto::Error::new(
+        proto::code::INVALID_PARAMS,
+        format!(
+            "no journal here for {name:?}; readable units are {}",
+            loggable().collect::<Vec<_>>().join(", ")
+        ),
+    )
+}
+
+/// Read the tail of a unit's journal.
+///
+/// `unit` must have come from [`resolve`] — that is what keeps a caller's string out of
+/// `journalctl`'s argument list.
+#[cfg(target_os = "linux")]
+pub async fn read(
+    unit: &'static str,
+    lines: usize,
+    boot: i32,
+) -> Result<proto::LogsResult, String> {
+    let lines = lines.clamp(1, proto::MAX_LOG_LINES);
+
+    let output = tokio::process::Command::new("journalctl")
+        .arg("--unit")
+        .arg(unit)
+        // `--boot=-1` as one argument rather than `-b -1`: an offset that starts with a dash is
+        // otherwise ambiguous with an option, and which of the two `journalctl` decides it is has
+        // changed between versions.
+        .arg(format!("--boot={boot}"))
+        .arg("--lines")
+        .arg(lines.to_string())
+        .arg("--no-pager")
+        // The timestamp is the point — a log line with no time answers nothing — and the
+        // `robotd[1234]:` prefix carries the PID, which is how a restart shows up in a tail.
+        // The hostname is the one field that is the same on every line and known already.
+        .arg("--output=short-iso")
+        .arg("--no-hostname")
+        .output()
+        .await
+        .map_err(|e| format!("could not run journalctl: {e}"))?;
+
+    if !output.status.success() {
+        // journalctl's own words, which for the case a caller will actually hit — a boot that is
+        // not in the journal — are already the right answer ("Data from the specified boot (-1) is
+        // not available"). Ours would be a worse paraphrase.
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        let detail = stderr.lines().next().unwrap_or("no output").trim();
+        return Err(format!("journalctl refused: {detail}"));
+    }
+
+    Ok(assemble(unit, &String::from_utf8_lossy(&output.stdout)))
+}
+
+/// Off the board there is no journal to read, and inventing one would make a laptop look like a
+/// robot. An error rather than an empty answer, for the same reason [`crate::units::describe`]
+/// reports `Unknown` off Linux: "there is nothing here to read" and "this daemon said nothing"
+/// are different answers.
+#[cfg(not(target_os = "linux"))]
+pub async fn read(
+    unit: &'static str,
+    _lines: usize,
+    _boot: i32,
+) -> Result<proto::LogsResult, String> {
+    Err(format!(
+        "no systemd journal on this host, so nothing to read for {unit}"
+    ))
+}
+
+/// The pid a line was written by, if the line is the daemon's own.
+///
+/// `short-iso` puts the writer in the second field, as `robotd[3227]:` — or as `systemd[1]:` for
+/// the lines systemd writes *about* the unit, which `journalctl -u` returns alongside it. Those
+/// are the reason this checks the identifier: `Stopping`, `Stopped` and `Started` all come from
+/// pid 1, so a bare "the pid changed" would announce a new process three times per restart and
+/// name the wrong one.
+#[cfg(any(target_os = "linux", test))]
+fn pid_of(line: &str, service: &str) -> Option<u32> {
+    let field = line.split_whitespace().nth(1)?.strip_suffix(':')?;
+    let (identifier, pid) = field.strip_suffix(']')?.split_once('[')?;
+    if identifier != service {
+        return None;
+    }
+    pid.parse().ok()
+}
+
+/// Turn `journalctl`'s output into a reply that fits the wire.
+///
+/// Split out from [`read`] so the trimming is testable without a journal, which is the half with
+/// the decisions in it: **oldest lines go first**, because the newest are the ones somebody asked
+/// for, and the budget is measured on the serialised form rather than estimated, since JSON
+/// escaping is what makes an estimate wrong.
+#[cfg(any(target_os = "linux", test))]
+fn assemble(unit: &'static str, stdout: &str) -> proto::LogsResult {
+    let service = crate::units::service_of(unit);
+    let mut lines: Vec<String> = Vec::new();
+    let mut writer: Option<u32> = None;
+
+    for line in stdout.lines().map(str::trim_end).filter(|l| !l.is_empty()) {
+        if let Some(pid) = pid_of(line, service) {
+            // The tail a person reads spans restarts without saying so: a release is installed,
+            // every daemon restarts, and forty lines carry two different builds with nothing
+            // between them. systemd's own `Started …` line is in there, but it is one line among
+            // forty identical warnings and it reads as just another one.
+            //
+            // `-- … --` is `journalctl`'s own shape for a line it inserted rather than recorded
+            // (`-- Reboot --`, `-- No entries --`), so it is the form a reader already knows not
+            // to attribute to the daemon.
+            if writer.is_some_and(|previous| previous != pid) {
+                lines.push(format!("-- new {service} process, pid {pid} --"));
+            }
+            writer = Some(pid);
+        }
+        lines.push(truncate_line(line));
+    }
+
+    let mut truncated = false;
+    while serde_json::to_string(&lines).map_or(0, |json| json.len()) > proto::MAX_LOG_BYTES
+        && !lines.is_empty()
+    {
+        lines.remove(0);
+        truncated = true;
+    }
+
+    proto::LogsResult {
+        unit: unit.to_owned(),
+        lines,
+        truncated,
+    }
+}
+
+/// One line, bounded. Cuts on a character boundary, since the reply has to be valid UTF-8.
+#[cfg(any(target_os = "linux", test))]
+fn truncate_line(line: &str) -> String {
+    if line.len() <= MAX_LINE_BYTES {
+        return line.to_owned();
+    }
+    let mut end = MAX_LINE_BYTES;
+    while end > 0 && !line.is_char_boundary(end) {
+        end -= 1;
+    }
+    format!("{}…", &line[..end])
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_daemon_is_named_with_or_without_the_suffix() {
+        assert_eq!(resolve("robotd"), Some("robotd.service"));
+        assert_eq!(resolve("robotd.service"), Some("robotd.service"));
+        assert_eq!(resolve(" btd "), Some("btd.service"));
+    }
+
+    /// Nobody types that capitalisation from memory.
+    #[test]
+    fn networkmanager_is_matched_whatever_the_case() {
+        assert_eq!(resolve("networkmanager"), Some("NetworkManager.service"));
+        assert_eq!(resolve("NetworkManager"), Some("NetworkManager.service"));
+    }
+
+    /// The guard the BLE route depends on: anything not on the list is refused, including the
+    /// shapes somebody would try if they were treating this as a `journalctl` command line.
+    #[test]
+    fn anything_else_is_refused() {
+        for name in [
+            "sshd",
+            "",
+            "robotd.service extra",
+            "--directory=/run/log/journal",
+            "_PID=1",
+            "*",
+        ] {
+            assert_eq!(resolve(name), None, "{name} resolved");
+        }
+    }
+
+    /// A unit added to a release becomes readable without touching this file.
+    #[test]
+    fn every_managed_unit_is_loggable() {
+        for unit in crate::units::MANAGED {
+            assert_eq!(resolve(unit), Some(unit), "{unit} is not loggable");
+        }
+    }
+
+    #[test]
+    fn the_refusal_names_the_units_it_would_accept() {
+        let message = refusal("sshd").message;
+        assert!(message.contains("sshd"), "{message}");
+        assert!(message.contains("robotd.service"), "{message}");
+        assert!(message.contains("NetworkManager.service"), "{message}");
+    }
+
+    #[test]
+    fn a_tail_comes_back_oldest_first_with_blank_lines_dropped() {
+        let result = assemble("robotd.service", "one\ntwo\n\nthree\n");
+        assert_eq!(result.lines, ["one", "two", "three"]);
+        assert!(!result.truncated);
+    }
+
+    /// A tail that spans a restart says so, once, naming the process that took over.
+    #[test]
+    fn a_restart_is_marked_where_it_happened() {
+        let stdout = "\
+2026-09-09T12:27:19+00:00 robotd[965]: old build, still running
+2026-09-09T12:27:20+00:00 systemd[1]: Stopping robotd.service - Robot control daemon...
+2026-09-09T12:27:20+00:00 systemd[1]: Stopped robotd.service - Robot control daemon.
+2026-09-09T12:27:20+00:00 systemd[1]: Starting robotd.service - Robot control daemon...
+2026-09-09T12:27:21+00:00 robotd[3227]: control loop running
+2026-09-09T12:27:24+00:00 robotd[3227]: bus read failed
+";
+        let lines = assemble("robotd.service", stdout).lines;
+
+        // systemd's three lines come from pid 1 and must not each announce a new process.
+        assert_eq!(
+            lines.iter().filter(|l| l.starts_with("-- ")).count(),
+            1,
+            "{lines:#?}"
+        );
+        // Immediately before the first line of the new process, not where systemd spoke.
+        let at = lines
+            .iter()
+            .position(|l| l.starts_with("-- "))
+            .expect("a marker");
+        assert_eq!(lines[at], "-- new robotd process, pid 3227 --");
+        assert!(lines[at + 1].contains("control loop running"), "{lines:#?}");
+        assert!(
+            lines[at - 1].contains("Starting robotd.service"),
+            "{lines:#?}"
+        );
+    }
+
+    /// One process for the whole tail is the ordinary case, and it gets no marker at all —
+    /// including for the very first line, whose pid this has nothing to compare against.
+    #[test]
+    fn one_process_is_not_marked() {
+        let stdout = "\
+2026-09-09T12:27:21+00:00 robotd[3227]: control loop running
+2026-09-09T12:27:24+00:00 robotd[3227]: bus read failed
+";
+        let lines = assemble("robotd.service", stdout).lines;
+        assert_eq!(lines.len(), 2, "{lines:#?}");
+        assert!(!lines.iter().any(|l| l.starts_with("-- ")), "{lines:#?}");
+    }
+
+    /// A daemon that has restarted twice in one tail is marked twice.
+    #[test]
+    fn every_restart_in_the_tail_is_marked() {
+        let stdout = "\
+2026-09-09T12:00:00+00:00 btd[1]: first
+2026-09-09T12:00:01+00:00 btd[2]: second
+2026-09-09T12:00:02+00:00 btd[3]: third
+";
+        let lines = assemble("btd.service", stdout).lines;
+        assert_eq!(
+            lines
+                .iter()
+                .filter(|l| l.starts_with("-- new btd process"))
+                .count(),
+            2,
+            "{lines:#?}"
+        );
+    }
+
+    /// The unit's *own* lines are what carry the pid. A line from anything else — systemd, or a
+    /// child process logging under its own name — cannot start a marker or the tail would be full
+    /// of them.
+    #[test]
+    fn only_the_daemons_own_lines_carry_a_pid() {
+        assert_eq!(
+            pid_of("2026-09-09T12:27:21+00:00 robotd[3227]: hello", "robotd"),
+            Some(3227)
+        );
+        for line in [
+            "2026-09-09T12:27:20+00:00 systemd[1]: Started robotd.service.",
+            "2026-09-09T12:27:20+00:00 setsid[4010]: a child of the daemon",
+            "2026-09-09T12:27:20+00:00 robotd: an identifier with no pid",
+            "not a journal line at all",
+            "",
+        ] {
+            assert_eq!(pid_of(line, "robotd"), None, "{line}");
+        }
+    }
+
+    /// Over budget, the *newest* lines survive — the ones somebody asked for.
+    #[test]
+    fn an_oversized_tail_keeps_the_end_and_says_it_was_cut() {
+        let stdout: String = (0..4000)
+            .map(|i| format!("2026-09-09T12:00:00+0200 robotd[1]: line {i}\n"))
+            .collect();
+
+        let result = assemble("robotd.service", &stdout);
+
+        assert!(result.truncated);
+        assert!(
+            serde_json::to_string(&result.lines).unwrap().len() <= proto::MAX_LOG_BYTES,
+            "reply is over the budget the transport can carry"
+        );
+        assert!(
+            result.lines.last().unwrap().ends_with("line 3999"),
+            "dropped from the wrong end: {:?}",
+            result.lines.last()
+        );
+    }
+
+    /// One daemon logging a serialised blob must not push out the lines around it.
+    #[test]
+    fn a_single_enormous_line_is_cut_rather_than_taking_the_whole_reply() {
+        let stdout = format!("prefix {}\nafter\n", "x".repeat(60 * 1024));
+        let result = assemble("robotd.service", &stdout);
+
+        assert_eq!(result.lines.len(), 2);
+        assert!(result.lines[0].len() <= MAX_LINE_BYTES + '…'.len_utf8());
+        assert!(result.lines[0].ends_with('…'));
+        assert_eq!(result.lines[1], "after");
+        assert!(!result.truncated);
+    }
+
+    /// Cutting a multi-byte character in half would make the reply invalid UTF-8, and the line
+    /// that will hit this is a log message with an arrow or an accent in it — which ours have.
+    #[test]
+    fn a_line_is_cut_on_a_character_boundary() {
+        let line = "é".repeat(MAX_LINE_BYTES);
+        let cut = truncate_line(&line);
+        assert!(cut.ends_with('…'));
+        assert!(cut.len() <= MAX_LINE_BYTES + '…'.len_utf8());
+    }
+}
diff --git a/configd/src/main.rs b/configd/src/main.rs
index 48cdeba4..1c09a845 100644
--- a/configd/src/main.rs
+++ b/configd/src/main.rs
@@ -11,7 +11,7 @@ use configd::net::{FakeNet, Net};
 use configd::pad::{FakePads, Pads};
 use configd::power;
 use configd::store::Store;
-use configd::{pad, units};
+use configd::{logs, pad, units};
 use duck_ipc_proto as proto;
 use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
 use tokio::net::{UnixListener, UnixStream};
@@ -445,6 +445,27 @@ async fn dispatch(
         // exactly the person diagnosing a robot.
         proto::Call::SystemServices => proto::Response::ok(Some(id), &units::all().await),
 
+        // Read-only, and not gated behind `may_mutate` for the same reason as the line above: the
+        // person who needs a daemon's last words is the person diagnosing a robot, and needing
+        // privilege to read them would put them out of that person's reach.
+        //
+        // The unit is resolved against a fixed list *before* it reaches `journalctl`, which is
+        // what makes this safe to route over BLE — see `logs` for the boundary and `btd::route`
+        // for the decision to route it.
+        proto::Call::SystemLogs(params) => match logs::resolve(&params.unit) {
+            None => proto::Response::err(Some(id), logs::refusal(&params.unit)),
+            Some(unit) => match logs::read(unit, params.lines, params.boot).await {
+                Ok(result) => proto::Response::ok(Some(id), &result),
+                // INTERNAL rather than INVALID_PARAMS: the request was well-formed and something
+                // on the board could not answer it. The one exception a caller will actually meet
+                // — a boot that is not in the journal — carries journalctl's own wording.
+                Err(e) => proto::Response::err(
+                    Some(id),
+                    proto::Error::new(proto::code::INTERNAL_ERROR, e),
+                ),
+            },
+        },
+
         proto::Call::SystemInfo => proto::Response::ok(
             Some(id),
             &proto::SystemInfoResult {
diff --git a/configd/src/pad.rs b/configd/src/pad.rs
index abb058fd..829df0f7 100644
--- a/configd/src/pad.rs
+++ b/configd/src/pad.rs
@@ -85,8 +85,9 @@ pub fn pair_timeout(requested: Option<u32>) -> Duration {
 ///  - **`class`** is the BR/EDR class-of-device: bits 8-12 are the major device class, and `0x05`
 ///    is Peripheral. Bits 6-7 of the minor field distinguish keyboard from pointing device from
 ///    gamepad — `0x01` in bits 2-5 with the keyboard/pointer bits clear is a joystick or gamepad.
-///    Present for a classic pad, absent for a BLE-only one — and every pad tried so far has been
-///    LE-only, so this arm is from the specification and has never fired on hardware.
+///    Present for a classic pad, absent for a BLE-only one. A no-name "Pro Controller" (a Switch
+///    Pro clone) presents `0x2508` — peripheral, gamepad — and this is the arm that names it when
+///    BlueZ has not yet derived the icon from it.
 ///  - **`appearance`** is the BLE equivalent: category 15 (`0x03C0..=0x03C4`) is HID, and `0x03C4`
 ///    is specifically Gamepad. Many pads never set it, which is why it cannot stand alone. Only the
 ///    gamepad value counts, so an LE pad advertising generic HID falls through to its name.
@@ -102,8 +103,29 @@ pub fn looks_like_a_gamepad(
     class: Option<u32>,
     appearance: Option<u16>,
 ) -> bool {
+    gamepad_evidence(name, icon, class, appearance).is_some()
+}
+
+/// How a device came to look like a gamepad — and how much that is worth.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Evidence {
+    /// The radio said so: BlueZ's icon, the class-of-device or the gamepad appearance. Settled.
+    Classified,
+    /// Only the name said so. Enough to pair when nothing better turns up, and not enough to stop
+    /// looking: the Pro Controller clone's LE face is `BLE Controller_280609` with nothing else
+    /// set, and stopping on it is what cost every pairing thirty seconds and a dead object.
+    NameOnly,
+}
+
+/// [`looks_like_a_gamepad`], with the strength of the answer. Same four signals, same order.
+pub fn gamepad_evidence(
+    name: &str,
+    icon: Option<&str>,
+    class: Option<u32>,
+    appearance: Option<u16>,
+) -> Option<Evidence> {
     if icon == Some("input-gaming") {
-        return true;
+        return Some(Evidence::Classified);
     }
 
     if let Some(class) = class {
@@ -113,7 +135,7 @@ pub fn looks_like_a_gamepad(
         // 0x03 remote control — the keyboard (0x10) and pointing-device (0x20) bits are the ones
         // this must not match, and they live above these values rather than overlapping them.
         if major == 0x05 && matches!(minor & 0x0f, 0x01 | 0x02) {
-            return true;
+            return Some(Evidence::Classified);
         }
     }
 
@@ -121,7 +143,7 @@ pub fn looks_like_a_gamepad(
         // 0x03C4 is Gamepad; the rest of category 15 is other HID. Only the gamepad value counts,
         // because a Bluetooth keyboard is category 15 too and must not be paired as a pad.
         if appearance == 0x03C4 {
-            return true;
+            return Some(Evidence::Classified);
         }
     }
 
@@ -137,6 +159,38 @@ pub fn looks_like_a_gamepad(
     ]
     .iter()
     .any(|needle| lower.contains(needle))
+    .then_some(Evidence::NameOnly)
+}
+
+/// Are these two Bluetooth addresses two faces of one pad?
+///
+/// Some pads are two devices at once. The no-name "Pro Controller" Switch clones advertise an LE
+/// personality (`BLE Controller_280609`, for phones) *and* the BR/EDR one that drives a robot, from
+/// two addresses that differ only in the vendor half: `98:B6:ED:28:06:09` and `98:B6:E9:28:06:09`.
+/// The lower three octets — the part a vendor assigns per unit — are identical, and the LE name
+/// even spells them out.
+///
+/// So two candidates that agree on those octets are one pad presenting twice, not two pads in
+/// pairing mode, and the choice between them is not ambiguous: the classic one is the one that
+/// carries HID to the kernel. Refusing would leave that pad unpairable without an address, and
+/// picking whichever appeared first is how the LE face got connected to for thirty seconds while
+/// the pad waited for a bond that never came.
+///
+/// Three octets, not two or four: two is too few to separate unrelated devices from one vendor,
+/// and four already reaches into the OUI, which is exactly the half that differs.
+pub fn same_pad(a: &str, b: &str) -> bool {
+    let tail = |mac: &str| -> Option<[u8; 3]> {
+        let mut parts = mac.rsplit(':');
+        let mut tail = [0u8; 3];
+        for slot in tail.iter_mut().rev() {
+            *slot = u8::from_str_radix(parts.next()?, 16).ok()?;
+        }
+        Some(tail)
+    };
+    match (tail(a), tail(b)) {
+        (Some(a), Some(b)) => a == b,
+        _ => false,
+    }
 }
 
 /// A set of pads that exists only in memory.
@@ -287,14 +341,16 @@ mod tests {
     }
 
     /// A classic pad, identified by class-of-device with no icon and no name — which is what
-    /// discovery reports before a device is queried. Synthetic in a way the others are not: no pad
-    /// bonded to this robot has ever presented a class, so this arm is only ever exercised here.
+    /// discovery reports before a device is queried.
     #[test]
     fn a_peripheral_joystick_class_is_a_gamepad() {
         // Major 0x05 (peripheral), minor 0x01 (joystick): 0x000504.
         assert!(looks_like_a_gamepad("", None, Some(0x000504), None));
         // Minor 0x02, gamepad: 0x000508.
         assert!(looks_like_a_gamepad("", None, Some(0x000508), None));
+        // The class a "Pro Controller" Switch clone actually presents on the board (2026-09-09):
+        // the same gamepad minor with the limited-discoverable service bit set.
+        assert!(looks_like_a_gamepad("", None, Some(0x002508), None));
     }
 
     /// The direction that matters more. A keyboard and a mouse are peripherals too, and pairing
@@ -337,6 +393,21 @@ mod tests {
         assert!(!looks_like_a_gamepad("Pierre's iPhone", None, None, None));
     }
 
+    /// A name is enough to pair on and not enough to stop looking on; anything the radio classified
+    /// is both. The clone's two faces, as BlueZ reports them, land on opposite sides.
+    #[test]
+    fn a_name_alone_is_weak_evidence() {
+        assert_eq!(
+            gamepad_evidence("BLE Controller_280609", None, None, None),
+            Some(Evidence::NameOnly)
+        );
+        assert_eq!(
+            gamepad_evidence("Pro Controller", Some("input-gaming"), Some(0x2508), None),
+            Some(Evidence::Classified)
+        );
+        assert_eq!(gamepad_evidence("Pierre's iPhone", None, None, None), None);
+    }
+
     /// The whole arc, over the fake: pair the pad that is in pairing mode, see it bonded and
     /// trusted, forget it.
     #[tokio::test]
@@ -441,6 +512,16 @@ mod tests {
         assert_eq!(pad.mac, "A4:AE:11:00:22:33");
     }
 
+    /// The Pro Controller clone's two faces share their unit octets and nothing else about the
+    /// address; an unrelated device from the same vendor shares the OUI and nothing else.
+    #[test]
+    fn two_faces_of_one_pad_share_their_unit_octets() {
+        assert!(same_pad("98:B6:ED:28:06:09", "98:B6:E9:28:06:09"));
+        assert!(same_pad("98:b6:ed:28:06:09", "98:B6:E9:28:06:09"));
+        assert!(!same_pad("98:B6:E9:28:06:09", "98:B6:E9:46:9F:EA"));
+        assert!(!same_pad("98:B6:E9:28:06:09", "not an address"));
+    }
+
     /// A caller cannot hold the adapter in discovery for as long as it likes, and zero means "look
     /// once" rather than "look forever" — a scripted retry needs to be able to ask.
     #[test]
diff --git a/configd/src/units.rs b/configd/src/units.rs
index 667a2891..18d3fffb 100644
--- a/configd/src/units.rs
+++ b/configd/src/units.rs
@@ -93,8 +93,9 @@ pub async fn describe(unit: &str) -> proto::ServiceUnit {
     }
 }
 
-/// `btd.service` names the service `btd`, which is what it publishes under.
-fn service_of(unit: &str) -> &str {
+/// `btd.service` names the service `btd`, which is what it publishes under — and, with a pid
+/// after it, what it logs under. [`crate::logs`] reads it for the second reason.
+pub fn service_of(unit: &str) -> &str {
     unit.strip_suffix(".service").unwrap_or(unit)
 }
 
diff --git a/configd/systemd/configd.service b/configd/systemd/configd.service
index 92683950..8ec1452a 100644
--- a/configd/systemd/configd.service
+++ b/configd/systemd/configd.service
@@ -71,6 +71,12 @@ RestartSec=2s
 #   - CAP_SYS_BOOT is NOT granted, because logind performs the reboot; configd only asks. A
 #     capability here would let it call reboot(2) directly, which is precisely the unclean
 #     shutdown this service exists to avoid.
+#
+# `system.logs` spawns `journalctl` (see `configd::logs`) and needs nothing added here, which is
+# worth stating so nobody loosens this file for it: /usr stays executable under
+# ProtectSystem=strict, and the journal files are 0640 root:systemd-journal — so uid 0 reads them
+# as their owner, with the capability bounding set still empty. If a future kernel or journald
+# changes that, the fix is a SupplementaryGroups=systemd-journal, not a capability.
 NoNewPrivileges=yes
 ProtectSystem=strict
 ProtectHome=yes
diff --git a/deploy/robotd.toml b/deploy/robotd.toml
index 160b6d75..9021a7be 100644
--- a/deploy/robotd.toml
+++ b/deploy/robotd.toml
@@ -1,7 +1,10 @@
 # robotd — per-robot parameters.
 #
-# Installed to /etc/robot/robotd.toml. Read once at startup, not watched: changing
-# anything here needs `systemctl restart robotd`. Live reload is deferred
+# Installed to /etc/robot/robotd.toml. Mostly read once at startup and not watched, so
+# mostly a change needs a restart — of the daemon that reads the section, which is not
+# always robotd: [media] and [duck_detector] are mediad's and [head_imu] is tofd's. The two
+# exceptions: padd re-reads [pad_imu_head_control] a second after the file changes, and robotd
+# re-reads [policy] when asked. `robotctl configure` knows which is which and offers it
 # (docs/design/robotd-design.md §4.2).
 #
 # It lives here, and not under /opt/robot/daemon/releases/<ver>/, on purpose: this is
@@ -112,8 +115,9 @@ mode = "walk"
 # "observation width is 51, expected 61".)
 #
 # Walk-mode defaults, spelled out, all under /opt/robot/policies/current/:
-# walk        = "alpha_walking.onnx"     the velstand gait
-# stand       = "alpha_stand.onnx"       standing + body pose
+# walk        = "velstand.onnx"          walks on a twist, stands still at zero command
+# stand       = "none"                   velstand stands on its own; "alpha_stand.onnx" is
+#                                        the old standing + body-pose network, still in the set
 # sitstand    = "alpha_sitstand.onnx"    sit <-> stand, posture flag
 # ground_pick = "alpha_ground_pick.onnx" A-button pick
 # kick_left   = "ball_kick_left.onnx"
@@ -166,8 +170,8 @@ mode = "walk"
 
 # Scale actions with battery voltage: effective scale = action_scale * (nominal / measured
 # EMA, clamped 6.0..9.5 V). The servos' effective kP tracks their supply, so this holds the
-# robot's response steady as the pack sags. Off by default, as in the prototype.
-# voltage_adapt = false
+# robot's response steady as the pack sags. On by default.
+# voltage_adapt = true
 # nominal_voltage = 7.4
 
 [safety]
@@ -207,11 +211,11 @@ mode = "walk"
 # selects the standing network, and that is the stand-up.
 #
 # The only thing the daemon does about a fall. With it off, a fall changes nothing: the
-# policy keeps driving and the humans stay in charge, which is the prototype's behaviour
-# and the default here. ON by default since it was validated on a robot: the whole point is
-# that the fleet lands soft, and a mode every board has to opt into individually is a mode
-# most boards do not have. Set it to false on a robot that needs the old behaviour.
-# limp_fall = true
+# policy keeps driving and the humans stay in charge, which is the prototype's behaviour.
+# OFF by default: the hand-back at the end is to the standing network, and the default
+# configuration (velstand as `walk`, `stand` unset) loads none. Set it to true on a robot
+# that runs a standing policy.
+# limp_fall = false
 
 # When a fall counts as started. This is the whole feature, and both ways of getting it
 # wrong are real: too early and the robot limps out of leans it would have walked off —
@@ -292,8 +296,16 @@ mode = "walk"
 # The ToF theremin: a hand's distance in front of the beak becomes a note, and the mouth
 # opens with the pitch. Picked up with `robotctl theremin` (or `robot.theremin`) — this
 # switch is only whether it *can* be, so a duck with a known-bad ToF can refuse outright.
+#
+# **Off by default.** It is a party trick, and a duck nobody asked to play one has no
+# business holding a subscription to the depth stream; `robotctl theremin` on a duck that has
+# not opted in says so and names this key. Turning it on does not start anything by itself.
+#
+# Nothing else changes with it: `tofd` runs and polls the sensor either way, so
+# `robotctl monitor`'s ToF grid works the same whichever way this is set.
+#
 # Needs [audio] on: a theremin with no voice is a mouth opening for no reason.
-# enabled = true
+# enabled = false
 
 # tofd's depth stream.
 # socket = "/run/tofd/tof.sock"
@@ -324,20 +336,26 @@ mode = "walk"
 # withdrew keeps sounding.
 # hold_ms = 250
 
-[detect]
+[duck_detector]
 # Finding other Microducks in the head camera. Read by `mediad`, not `robotd` — the frames are on
 # `mediad`'s pipeline and perception belongs next to the sensor — but the switch lives here because
 # this is the file `robotctl configure` edits and a robot has one place for its settings.
 #
-# **Off by default.** The model ships in the release (models/duck_detect.rknn for the NPU,
-# models/duck_detect.onnx for the CPU), and a robot nobody has asked to look for ducks should not
-# pay ~60 ms of work every half second for it.
+# **Off by default.** A robot nobody has asked to look for ducks should not pay ~60 ms of work
+# every half second for it.
 # enabled = true
 
 # Which model, and therefore which processor: a `.rknn` runs on the NPU, an `.onnx` on the CPU.
-# Unset tries the release's own, NPU first — and falls through to the CPU on a board whose NPU is
+# Unset means the installed set — /opt/robot/detector/current/duck_detect.rknn for the NPU,
+# duck_detect.onnx for the CPU — NPU first, falling through to the CPU on a board whose NPU is
 # switched off in its device tree, which is how Armbian ships the Radxa Zero 3. `sudo sh
 # /opt/robot/daemon/current/scripts/setup-npu.sh` turns it on, and needs a reboot.
+#
+# That set comes from the Hub (pollen-robotics/microduck-duck-detector, trained in
+# pollen-robotics/duck_detector), the way the official policy set does: the release's postinstall
+# hook seeds it once, `robotctl duck-detector check` asks whether a newer one exists, and
+# `sudo robotctl duck-detector update` installs it and restarts mediad onto it. A retrain is a tag
+# there, not a daemon release. This key is for a model of your own.
 # model = "/home/microduck/my_detector.rknn"
 
 # Looks per second. **2 is a thermal limit, not a preference**: flat out this reaches 95 °C on a
@@ -350,6 +368,24 @@ mode = "walk"
 # coordinates. So this is a yes/no threshold rather than a dial.
 # threshold = 0.35
 
+[head_imu]
+# The BMI088 on the head module, read by tofd and served as `head_imu.stream` — gyro,
+# acceleration and a Madgwick orientation, for the mapping work.
+#
+# **Off by default, and this is the whole section.** Reading it at 100 Hz costs ~3.5-4.5% of a
+# core on this SoC, and a bench that takes the loop apart says none of that is fixable: the
+# wakeups are 0.7 points of it, the fusion 0.3, and the rest is the two I²C transactions a
+# sample takes — which is what a gyro and an accelerometer sample *is*. Nothing subscribes to
+# the stream yet, so every duck was paying it from boot for nobody.
+#
+# Turn it on when something reads it. `tofd --imu-hz 50` is the other lever: the cost is linear
+# in the rate. Depth is unaffected either way — tofd ranges the ToF regardless, so
+# `robotctl monitor`'s grid does not depend on this.
+#
+# A subscriber to `head_imu.stream` while this is off gets the reason, naming this key, rather
+# than the silence a board with no sensor fitted gives.
+# enabled = false
+
 [chorale]
 # Several ducks singing one piece in four parts, found over Bluetooth with no shared clock: the
 # conducting duck's beat counter is the timebase, and the parts are worked out from each duck's own
@@ -372,10 +408,16 @@ mode = "walk"
 # only supported way to change one was a systemd drop-in, and nobody reaches for a drop-in to
 # answer "why is the video soft?".
 
-# Stream the head camera. Off streams a test pattern instead, which is what a board with no
-# camera wants — the pipeline still starts, so the WebRTC *control* channel still exists. It is
-# bundled with the video track, so a pipeline that will not start costs both.
-# camera = true
+# Where the video comes from: "camera" or "test".
+#
+# "test" streams a test pattern, which is what a board with no camera wants — the pipeline still
+# starts, so the WebRTC *control* channel still exists. It is bundled with the video track, so a
+# pipeline that will not start costs both. A name rather than a boolean because "camera = false"
+# does not mean "no video", it means "synthetic video", and nothing in the old key said so.
+#
+# The pattern ignores `quality` and runs at 256x144@5: it exists to make the session reachable,
+# and drawing a 720p30 one in software cost five times what the camera it stands in for does.
+# source = "camera"
 
 # Frame size and rate, as one name: 1080p30, 720p30, 720p15 or 360p30.
 #
@@ -414,3 +456,22 @@ mode = "walk"
 #
 # gcc is webrtcsink's own default, so this line changes nothing; it is here to be found.
 # congestion_control = "gcc"
+
+# ── Controller-IMU head control ─────────────────────────────────────────────────────────────
+#
+# Read by `padd`, not by `robotd`. Some pads carry an inertial unit — the "Pro Controller" Switch
+# clones do, an Xbox pad does not. With this on and such a pad connected, Y stops meaning "the
+# sticks pose the head" and means "the pad's tilt poses the head": the sticks keep driving, and
+# turning the pad in your hands turns the robot's head. Y again holds the head where it is, still
+# driving. A third press hands the head back to the pad from where the pad is *now* — its yaw is
+# a gyro's word alone and drifts, and re-centring on every re-entry is how you beat that without
+# a magnetometer. Off, or on a pad with no IMU, Y is what it always was.
+#
+# Not [head_imu], which is the IMU in the robot's head. This section was [imu_head] once; a file
+# still saying that loads, and `robotctl configure` renames it on its next save.
+# [pad_imu_head_control]
+# enabled = false
+
+# Head radians per pad radian. 1 follows the pad exactly; more turns a small wrist movement into
+# a large head movement. The head's own travel limit still applies.
+# gain = 1.0
diff --git a/docs/README.md b/docs/README.md
index 867f71de..7b654d14 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -3,6 +3,10 @@
 The [README](../README.md) is the front door — what a microduck is, and where to go. If you have
 one in front of you and want to drive it, start at the [cheat sheet](robot/cheatsheet.md).
 
+[`faq.md`](faq.md) is the other front door: task-shaped questions from somebody building
+*against* a duck rather than changing it — running a model too heavy for the board, getting the
+camera into their own program, why a Space cannot connect.
+
 It is also where a **publisher** starts: [`policy-manifest.md`](policy-manifest.md) is the
 contract for a `manifest.json` beside a microduck `.onnx`, and it owns every field. The design
 docs give the reasoning and point at it.
@@ -15,6 +19,7 @@ docs give the reasoning and point at it.
 | [`pair-a-gamepad.md`](robot/pair-a-gamepad.md) | Once per pad: pairing mode, `pad pair`, and what to do when it will not bond. |
 | [`cheatsheet-dev.md`](robot/cheatsheet-dev.md) | The commands that need a dev board: branch builds, candidates, dev pushes. |
 | [`dev-push.md`](robot/dev-push.md) | Build on your machine and install on the board over ssh, with no CI run. |
+| [`simulation.md`](robot/simulation.md) | The simulated duck: `scripts/duck-sim`, the real daemons against a MuJoCo body, one duck or several in containers. |
 | [`duckctl.md`](robot/duckctl.md) | Every `duckctl` command — the robot from a laptop, over Bluetooth. |
 | [`install-dev.md`](robot/install-dev.md) | Setting up a board for development, from nothing. |
 | [`install-by-hand.md`](robot/install-by-hand.md) | The same install as separate commands, for testing one step at a time. |
@@ -44,6 +49,7 @@ own the mechanism is the bug.
 | [`webrtc-console.md`](design/webrtc-console.md) | The WebRTC client: serving it from the robot, finding the robot, and what the page should be. |
 | [`remote-access-design.md`](design/remote-access-design.md) | Reaching a duck from outside the LAN: the Hugging Face account, the device flow, and the bridge to a rendezvous service. |
 | [`boot-recovery-net.md`](design/boot-recovery-net.md) | Falling back to golden when the release that booted cannot start its daemons. |
+| [`simulation.md`](design/simulation.md) | The twin: where the seam between daemon and body is, the body protocol, the fake radio, the containers, and what it is and is not a twin of. |
 
 ## `project/` — you are running the project
 
@@ -59,6 +65,7 @@ Dated records rather than reference. They describe a moment, and go stale on pur
 | [`media-bringup.md`](project/media-bringup.md) | What a Radxa Zero 3W does about video: the VPU, what MPP needs, and the two plugins that have to be built. |
 | [`pad-minimal-pairing.md`](project/pad-minimal-pairing.md) | The smallest board configuration a gamepad will bond under, found by taking one away at a time. |
 | [`idle-cpu.md`](project/idle-cpu.md) | What the daemons do when nobody is asking them to: four things that stopped, two that were measured and left alone, and what still wants a board. |
+| [`tof-on-demand.md`](project/tof-on-demand.md) | `tofd`'s idle 5% is nine parts head IMU to one part depth, and the IMU has no consumer. Why the laser and the unit were left alone and the IMU got a switch. |
 
 ## `ideas/` — not designed yet
 
diff --git a/docs/design/app-path-design.md b/docs/design/app-path-design.md
index 361b8df8..6fa304f0 100644
--- a/docs/design/app-path-design.md
+++ b/docs/design/app-path-design.md
@@ -386,6 +386,40 @@ the tidier model and needs `btd` to know when a call ended, which needs it to pa
 never does (§3), and that property is what keeps the routed subset a transport rather than a second
 implementation of the API.
 
+### 3.6 A reply bigger than one burst, and the MTU the notify side cannot ask  · **measured**
+
+`bluer`'s callback model — the one that works here, for the reason in `btd/src/bluez.rs`'s header —
+gives the notify side neither of the two things a sender needs. It cannot ask what the link
+negotiated, and `notify` returns as soon as a D-Bus signal is queued, so nothing tells the pump when
+the radio has caught up. Both gaps were papered over by sizing every reply for the 20-byte floor and
+firing chunks as fast as the loop would spin.
+
+Measured against the board from a Mac, asking `system.logs` for a journal tail:
+
+| reply | notifications at the floor | what happened |
+|---|---|---|
+| ~5 KiB (24 lines) | ≈265 | delivered, in 1.83 s |
+| ~7 KiB (32 lines) | ≈350 | the notification session was torn down 150 ms in |
+
+The second row is the one that cost a board session to find. `btd` logged one INFO line saying the
+central had unsubscribed — it had not; CoreBluetooth still had the link up — and the client sat
+waiting out a 60-second idle budget with half an answer in its reassembler and no error to report.
+The pump was reading `notify`'s single error as "the central left", when a full queue and a departed
+central are the same `Err` from `bluer` and only `is_stopped()` tells them apart.
+
+Three changes, none of them a real solution, because the model has no readiness signal to offer:
+
+- **The payload comes from the write side.** BlueZ reports the negotiated MTU on every inbound
+  write, one ATT MTU serves both directions, and a central always writes before there is a reply to
+  send — `system.authenticate` is the first write of every session. So a session opens at the floor
+  and is sized properly from its first answer onward, roughly a tenfold cut in notifications.
+- **The pump pauses every 16 chunks**, about a connection interval. A small reply never pauses.
+- **A refused chunk is retried** rather than read as a disconnect, and giving up now logs a warning
+  saying so.
+
+What would solve it properly is the IO model's `sendable()`, and that stays out of reach: it serves
+only the `Acquire*` fd paths, which a CoreBluetooth central does not drive.
+
 ## 5. Pairing: just-works, and a PIN the transport checks
 
 A six-digit PIN, stored by `configd`, checked by `btd` before it serves anything. **Not** by the
diff --git a/docs/design/architecture.md b/docs/design/architecture.md
index 1b2c1e1b..568590ef 100644
--- a/docs/design/architecture.md
+++ b/docs/design/architecture.md
@@ -84,7 +84,7 @@ counter ([`updater-design.md`](updater-design.md)).
 | `updaterd` | releases: verify, install, swap, health-gate, roll back | `/run/updaterd.sock` | GitHub releases, `systemctl`, `robotd` |
 | `btd` | nothing — BLE transport for a subset of the API | a BLE GATT service | `robotd`, `configd`, `updaterd` — not `padd` or `tofd`, whose streams a radio this narrow cannot carry |
 | `padd` | nothing — gamepad transport; serves a raw input tap | `/run/padd/pad.sock` (`pad.input` only) | `/run/robotd.sock` |
-| `mediad` | the camera and audio pipeline; nothing of the robot — WebRTC transport and the remote front door (§5.2) | TCP: the console on `:8080`, signalling on `:8443` — no unix socket of its own | `robotd`, `configd`, `updaterd` |
+| `mediad` | the camera and audio pipeline; nothing of the robot — WebRTC transport and the remote front door (§5.2) | TCP: the console and PNG `GET /frame` on `:8080`, signalling on `:8443`; and one unix socket of its own, `/run/mediad/media.sock`, serving `media.frame` to a local recorder or perception process. A raw frame is ~1.8 MiB, so it is deliberately not carried on the WebRTC control channel | `robotd`, `configd`, `updaterd` |
 | `tofd` | the head's ToF sensor: an 8×8 depth matrix it publishes and nobody else reads | `/run/tofd/tof.sock` (`tof.stream`) | the HAT's I²C bus |
 | `robotctl` | nothing — the CLI, and the tool that must work on a broken robot | — | every socket above |
 
diff --git a/docs/design/policy-channel-design.md b/docs/design/policy-channel-design.md
index 34f686c9..8f71fbb2 100644
--- a/docs/design/policy-channel-design.md
+++ b/docs/design/policy-channel-design.md
@@ -273,16 +273,24 @@ updater design).
 
 Fetching rather than copying is the point: it is the arrangement `setup-board.sh` already uses
 for ONNX Runtime and `setup-gstreamer.sh` for the plugins, which are the other two things a board
-needs and a release has no business carrying. The pin lives in `[workspace.metadata.policies]`
+needs and a release has no business carrying. The duck detector followed the same road out of the
+release — `scripts/seed-detector.sh`, `/opt/robot/detector/current`, `robotctl duck-detector
+check/update`, a pin in `[workspace.metadata.detector]` — with a fixed file list in place of the
+manifest, since its two files have fixed names (`docs/project/npu-bringup.md`). The pin lives in `[workspace.metadata.policies]`
 and as literals in the script, with a test asserting they agree — `setup-gstreamer.sh`'s trap,
 because a script that runs from inside a release cannot read the manifest.
 
-**The pin is a floor, not a ceiling**, and that distinction is load-bearing. It ships inside the
-daemon release, so bumping it *does* need a daemon release — an earlier draft of this section
-claimed otherwise and was simply wrong. What the pin decides is what a *freshly provisioned* board
-installs. Moving past it is `robotctl policy update` (§9.1), which is the thing that makes a
-retrained gait reach a robot without a daemon release, and therefore the thing that makes this
-whole channel worth having.
+**The pin is a minimum, not a ceiling**, and that distinction is load-bearing. It ships inside
+the daemon release, so bumping it *does* need a daemon release — an earlier draft of this section
+claimed otherwise and was simply wrong. The pin decides two things: what a *freshly provisioned*
+board installs, and the oldest official set this daemon runs with. A board whose set is from our
+repo and below the pin is moved up to it by the post-install hook — the daemon's slot defaults
+name files, and a default that names a file only a newer set carries (v5's `velstand.onnx`) would
+otherwise leave a board that updated the daemon alone unable to load its gait, unhealthy, and
+rolled back. A set past the pin, from another repo, or without a `.source` record is left alone.
+Moving past it is `robotctl policy update` (§9.1), which is the thing that makes a retrained gait
+reach a robot without a daemon release, and therefore the thing that makes this whole channel
+worth having.
 
 Three things it does not do. It does not re-download a set it already has, so an update whose pin
 is unchanged touches no network — which matters because the post-install hook runs under a
@@ -657,7 +665,8 @@ dereferencing the symlinks that repository uses to give stable names to particul
 
 | in the set | upstream | role |
 | --- | --- | --- |
-| `alpha_walking.onnx` | `BEST_alpha_walking_rough.onnx` | walking / velstand |
+| `alpha_walking.onnx` | `BEST_alpha_walking_rough.onnx` | walking / velstand (default `walk` until set v5) |
+| `velstand.onnx` | `pollen-robotics/microduck_rl` `velstand_best.onnx` (2026-09-14) | walking + standing at zero command; default `walk` from set v5, `stand` unset |
 | `alpha_stand.onnx` | `BEST_alpha_stand_body_control.onnx` | standing + body-pose |
 | `alpha_sitstand.onnx` | `BEST_alpha_sitstand.onnx` | sit ↔ stand (posture flag) |
 | `alpha_ground_pick.onnx` | `alpha_ground_pick.onnx` | ground pick (phase command) |
@@ -703,7 +712,7 @@ its meaning for the things that genuinely are models and not control policies, s
 | Seeding never overwrites a set it did not install | The handover needs no flag: the first real install ends it (§9) |
 | The set is downloaded, not shipped | Same as ONNX Runtime and the plugins; bumping the pin ships a gait (§9) |
 | A failed fetch keeps the set already installed | A half-published revision must not downgrade a working gait (§9) |
-| The pin is a floor; `policy update` moves past it | Otherwise a gait still needs a daemon release, which is the thing this channel is for (§9.1) |
+| The pin is a minimum; `policy update` moves past it | A default that names a newer set's file must not roll the daemon back on boards behind it; a gait still needs no daemon release (§9.1) |
 | A set records the repo it came from | One writer, one copy, nothing to configure twice or drift (§9.1) |
 | Reload is a third thing, not reset-all | They look identical from outside and conflating them discards every override (§9.1) |
 | One-shot skills are config, not code | Kicks and roulade were the same arm with different numbers; a community one is a fifth set (§10) |
diff --git a/docs/design/remote-access-design.md b/docs/design/remote-access-design.md
index d1008352..ab78dfed 100644
--- a/docs/design/remote-access-design.md
+++ b/docs/design/remote-access-design.md
@@ -51,6 +51,13 @@ service too was made the other way for this reason, and §3.1 is where it costs
 
 ## 2. The account is an OAuth device flow against Hugging Face
 
+**The flow lives in [`hf-robot-account`](https://github.com/pollen-robotics/hf-robot-account)**,
+its own repository, because nothing in it is about a duck: any robot with no browser signs in the
+same way. What stays in `updater/src/account.rs` is what is a fact about *this* robot — the token
+path, the `robot` group, the mapping onto `proto`, and which JSON-RPC code each refusal deserves.
+Everything below about the flow itself describes that crate; everything about where the credential
+lands and who may read it describes this repository.
+
 ### 2.1 Why the device grant, which is also where `reachy_mini` ended up
 
 `reachy_mini` has **both**. It started with authorization code + PKCE, pointing the redirect URI
@@ -190,8 +197,8 @@ drops its answer. That is also what makes `logout` able to promise what it says.
 `huggingface_hub` ships a **first-party public device-code client**, `DEVICE_CODE_OAUTH_CLIENT_ID`
 = `26be6b09-91c5-47da-9861-d2d2bb7a7e36`, which is what `hf auth login` uses. It is public — no
 secret, so nothing needs baking into a release beyond a public identifier — and it needs no OAuth
-app registered anywhere. `updater::account::CLIENT_ID` is that constant, and it is the whole of
-what this decision came to.
+app registered anywhere. `hf_robot_account::HUGGINGFACE_CLIENT_ID` is that constant, and it is the
+whole of what this decision came to.
 
 Two alternatives, recorded because the first one looks obvious and is blocked:
 
@@ -223,7 +230,7 @@ What the account actually needs is `openid profile`, plus `read-repos` for one r
 mechanism (`policy-channel-design.md` §7).
 
 **So the narrow version is a Pollen-owned public device-code client with
-`openid profile read-repos`** — one constant in `account.rs` and one click by somebody with HF org
+`openid profile read-repos`** — one `Config::client_id` and one click by somebody with HF org
 admin. It is not blocking: the flow works today and a scope change is a re-login. It is worth
 doing before a duck goes home with anybody, because the failure mode is asymmetric — a robot that
 has been able to write all along cannot be un-done, while a robot that needs a wider scope later
@@ -301,8 +308,11 @@ Three things make that acceptable rather than merely permitted:
 - **It is revocable** — `account.logout` from anywhere, and revoking the grant on Hugging Face,
   which no robot-side gate could offer.
 
-  Worth being exact about the first one, because it is weaker than it sounds: **`logout` deletes
-  the robot's copy and revokes nothing.** The robot stops being a producer, which is the effect
+  Exact about the first one, because it has two halves and only one of them is `updaterd`'s.
+  `logout` deletes the credential, and the relay notices within one heartbeat — ten seconds — and
+  drops its connection, which on this service evicts the producer at once. So a robot signed out
+  stops being listed and stops being reachable. What it does **not** do is revoke anything:
+  **`logout` deletes the robot's copy and tells Hugging Face nothing.** The robot stops being a producer, which is the effect
   somebody signing out is after — but the access token it held stays valid at Hugging Face until
   it expires, up to thirty days, for anything that already read the file. The credential is
   `0640 root:robot`, so "anything" means root or `mediad` on that board; a stolen board is the
@@ -339,7 +349,7 @@ A device-code token comes back as `expires_in: 2591999` — thirty days — with
 and refreshing **rotates** it: the answer carries a *new* refresh token and the old one is spent.
 So the store is two strings plus a clock, and there are three consequences worth naming.
 
-**A robot that is simply left on must renew itself.** `updater::account::maintain` wakes every six
+**A robot that is simply left on must renew itself.** `hf_robot_account::maintain` wakes every six
 hours and refreshes anything with under a week left — three-quarters of the way through the
 token's life, leaving a week of retries for a board whose network is marginal. It is spawned
 unconditionally, unlike the update scheduler, because a robot with update checks switched off
@@ -391,6 +401,16 @@ is not, in three ways:
 | auth | none (§4 of `remote-webrtc.md`) | `Authorization: Bearer <hf token>` |
 | ids | its own `peerId`, its own `sessionId` | different ones, per hop |
 | our role | `listener` | `producer` |
+| where a reply arrives | on the socket, always | **`sessionStarted` and `list` in the `POST` response body**; everything else on the stream |
+
+That last row cost an afternoon and belongs in a table rather than in somebody's memory. On a
+WebSocket every answer comes back on the socket, so a client naturally treats a send as
+fire-and-forget. Here `handle_start_session` *returns* `{"type":"sessionStarted","sessionId":…}` to
+the caller of `POST /send` — the producer is notified over SSE, the consumer is answered in the
+response — and a page that discarded that body got the robot's offer for a session whose id it had
+never been told, then failed on a null peer connection. `list` is answered the same way, and is
+*also* pushed over the stream after the welcome, which is why the listing half looked healthy while
+the session half was broken.
 
 So the bridge keeps a session table both ways and rewrites `sessionId` on every `peer` message. That
 is where `reachy_mini`'s relay has needed most of its scar tissue (§3.4), and it is the honest
@@ -416,6 +436,15 @@ into a cadence slower than our own eviction. `reachy_mini`'s ladder has a middle
 publishes no `lease_seconds`**, so that rung is unreachable here; it is not worth reproducing a
 negotiation step for a field nothing sends.
 
+**`POST /send` before `GET /events` is a 400, so the order is not a preference.** The peer does
+not exist until the stream does — identity comes from the bearer token, and the token is bound to
+a peer by the `/events` connection. §3.4 wanted registration before anything reported the robot
+reachable for a different reason; the service enforces the same order for its own.
+
+**The rate limit is 1200 requests per 60 s per peer**, sliding. A 10 s heartbeat and a 30 s poll
+are nine requests a minute, so it constrains nothing here — it is a ceiling to know about before
+somebody shortens an interval to "be safe".
+
 **The SSE side has its own keepalive to size against.** After 30 s with nothing to deliver the
 server emits an `event: ping`, whose only job is to stop the HTTP/2 proxy in front of the Space
 from killing an idle connection. A read timeout on our side therefore has to be comfortably more
@@ -439,6 +468,23 @@ Four, each cheap to build in now and expensive to rediscover:
   yet know the robot exists.
 - **Backoff with jitter, capped.** 5 s growing to 60 s, plus ~10%. A fleet reconnecting in lockstep
   after a service restart is a self-inflicted outage.
+- **A credential that changed under the connection.** The token is read once per connection, so
+  neither a `logout` nor a `login --force` onto another account reaches a running relay by itself
+  — it would go on refreshing the lease with a credential its owner deleted. Re-read on the
+  heartbeat tick, which makes the lag one cadence, and dropping the stream is the deregistration:
+  a clean disconnect evicts the peer immediately, and the sweep is only for sockets that never
+  report closing. There is also an explicit `roles: []` withdraw, which is for keeping the channel
+  open to re-register later and is not what this wants.
+- **A 401 is not a case for backoff.** No number of retries fixes a token the service refuses; a
+  login does. So that path waits on the token file at the same 30 s cadence as a robot nobody has
+  signed in, rather than posting a doomed request every five seconds into somebody else's Space.
+
+Two more from their source, about what the server does rather than what to do about it. **Only
+producers carrying `meta.hardware_id` are swept**, so one without it is never evicted — a crashed
+daemon would haunt its owner's robot list until the Space restarted. That turns §3.7's "should"
+into a "must". And **a second `/events` on the same token supersedes the connection without
+evicting the peer**, so a daemon restarting while its previous socket is half-open reconnects
+cleanly — which is what makes a 60 s read timeout safe rather than merely brave.
 
 What we do **not** copy is their `RobotAppLock`: it arbitrates a local *app* against a remote session,
 and a duck has no app. `remote-webrtc.md` §9 owns the equivalent question here (a pad and a peer both
@@ -480,19 +526,28 @@ fills it in arbitrarily gets subtly wrong behaviour rather than a clear failure:
   So a duck **must** put something stable there, and the obvious candidate already exists:
   `producer.rs` reads the SoC serial for the local `meta`, which is exactly "stable per physical
   robot across reinstalls and renames". Leaving the key out means a robot that reconnects with a
-  fresh token is listed twice; putting the *name* there means renaming a robot forks its identity.
+  fresh token is listed twice — and, since the sweep keys on this field, never evicted at all;
+  putting the *name* there means renaming a robot forks its identity.
+
+  Where there is no serial to read — a developer's laptop, a board whose device tree has none — it
+  falls back to `/etc/machine-id`, stable per *install* rather than per robot. Weaker and still
+  correct for the purpose: one machine is listed once, and the producer stays sweepable. `sounds`
+  already makes exactly this substitution for exactly this reason.
 - **`name`** is what the listing shows a person, and the consumer's `name` is what the server
   reports back as `activeApp` to the owner's other devices. `transport` (`"wifi"` / `"usb"`) is a
   mini-ism a duck can leave alone; a `kind` of `microduck` is what lets one client list both
   families without opening a session.
 
-**And a hazard that belongs in the provisioning path, not here: peers are keyed by token.**
-`get_or_create_peer` is a `token -> peer_id` map, and a second SSE connection on the same token
-supersedes the first. Two robots sharing one token therefore take turns being reachable, and
-neither is broken in a way that looks like a bug. Each duck runs its own device flow, so each gets
-its own token — *unless* an image is cloned with `/etc/robot/hf-token` in it, which is exactly what
-this project's flashing path does with everything else in `/etc/robot`. Whatever produces a golden
-image has to exclude that file, and this is the note that says why.
+**And one protocol fact with a consequence: peers are keyed by token.** `get_or_create_peer` is
+a `token -> peer_id` map, and a second connection on the same token supersedes the first. Two
+things sharing a token therefore take turns being reachable, and neither looks broken. Each duck
+runs its own device flow, so no two robots share one — images are built from scratch rather than
+cloned, so there is no path by which a credential is copied onto a second board.
+
+  Where it does bite is a **consumer**: a cloud backend that authenticates with the *robot's* token
+  supersedes the robot's own peer and takes it off the listing. A Space consuming a duck needs its
+  own token on the same account, or the visitor's. §5's client uses the visitor's, which is why it
+  never meets this.
 
 ## 4. The rendezvous is the one `reachy_mini` uses — **decided**
 
@@ -525,47 +580,381 @@ The one thing that does not transfer is its **lock model** — `RobotAppLock`, l
 remote session, which the mini's relay gates incoming sessions on. A duck has no app, so §3.4
 takes the reconnect behaviour and leaves that part.
 
-## 5. The client, and where it is served — **open**
-
-The console is `include_str!`'d into `mediad` and served by the robot (`webrtc-console.md` §1), which
-works because the client is on the LAN. **A remote client cannot fetch a page from a robot it cannot
-reach**, so remote needs the page hosted off-robot *and* a second signalling transport in it.
-
-Three ways:
-
-- **The same file, published by CI to GitHub Pages**, with the transport chosen by the URL it is given.
-  One page, two hosts, still no build step — the constraint `webrtc-console.md` §8 defends survives.
-  The service stays a rendezvous and nothing about the client lives in it.
-- **The service serves the page.** One host and one deploy, at the cost of putting the client inside a
-  service we may not own; a page in a private repo is a page nobody here can edit.
-- **No client yet.** Prove login and the relay with the service's own dashboard, `/api/robot-status`
-  and `duckctl` — which needs no page at all, and is the whole of slices 1 and 2 in §8.
-
-**Recommendation: the third, then the first.** The proof that the token path and the lease work needs
-no UI, and deferring the hosting decision by a slice costs nothing.
-
-One thing to know before that page is written, and it is settled rather than a preference:
-`EventSource` **cannot set headers**, so a browser speaking the SSE wire must either put the token
-in the query string or read the stream with `fetch` and split SSE by hand. `reachy-mini-js` does
-the former. **The server is removing it** — `_resolve_hf_token` accepts `?token=` only as a
-transitional fallback, logs a deprecation warning per client IP, and says in its own docstring that
-the query form goes once the known clients ship the header. A bearer token in a query string is
-also a bearer token in the Space's access log and in every proxy in between.
-
-So the page is `fetch` plus a few lines of line-splitting, not one browser API — and it should be
-written that way first rather than written twice.
-
-## 6. NAT: decide the STUN server, defer TURN
-
-`webrtcsink` defaults its `stun-server` to a public Google address. LAN sessions need none, so nothing
-has exercised it — and the moment remote works, **a duck's reachability quietly depends on a third
-party we do not run**. Set the property rather than inherit it, for the same reason
-`remote-webrtc.md` §0 sets `congestion-control` to the value that is already the default: the day
-upstream changes it should not be the day every robot's connectivity changes with it.
-
-TURN is what makes symmetric NAT and CGNAT work at all, and it relays the *whole* session's media at
-somebody's expense. Not in the first slice, and `remote-webrtc.md` §11 is right that the decision
-belongs with whoever runs the rendezvous rather than with the daemon.
+## 5. The client is a Space with a Hugging Face sign-in — **decided**
+
+The console is `include_str!`'d into `mediad` and served by the robot (`webrtc-console.md` §1),
+which works because the client is on the LAN. **A remote client cannot fetch a page from a robot it
+cannot reach**, so remote needs the page hosted off-robot *and* a second signalling transport in
+it.
+
+**Decided: a Space in the `pollen-robotics` org with `hf_oauth: true`** — `microduck-console` —
+serving the same page the robot serves, with the transport chosen by how it was opened. And the
+deciding argument is not hosting, it is the **token**.
+
+A remote consumer authenticates to the rendezvous exactly as the robot does — a bearer token the
+service resolves through `whoami-v2`, reading `name` out of the answer. It performs no token-type
+check and no scope check, so a browser's OAuth token is accepted on the same footing as the
+robot's device-flow one. Which makes the whole question "where does a page get an HF token", and a
+Space answers it: `hf_oauth: true` in the README creates the OAuth app and registers a redirect URI
+targeting the Space, and `@huggingface/hub`'s `oauthLoginUrl` / `oauthHandleRedirectIfPresent` do
+the rest of the flow **client-side**, PKCE, with no secret in the page.
+
+### 5.0 It is a Docker Space, and that cost an afternoon
+
+There are two documented ways for a Space to hand its page that client id, and the tidy one did
+not work. A **static** Space is supposed to inject `window.huggingface.variables.OAUTH_CLIENT_ID`
+— `huggingface.js` reads exactly that (`oauth-login-url.ts`), `reachy_mini_website` reads exactly
+that, and HF ships `huggingfacejs/client-side-oauth` as the example. On `microduck-console` it
+never appeared: not after a metadata change, not after the Space went public, not after a
+delete-and-recreate, and not after the page was given a real `<html><head>` for an injector to
+work on — a page that had been a bare doctype for its whole life until then. Hugging Face's own
+API reported our Space and a working one as indistinguishable: both `sdk: static`, both public,
+both `hf_oauth: true`, both `RUNNING`.
+
+So the console is a **Docker** Space: `hf_oauth: true` puts `OAUTH_CLIENT_ID` in the container's
+environment — the documented path for anything that is not static, and the one the `grabette-*`
+Spaces use — and eight lines of `sh` substitute it into the page as it is served. A page that
+needs no server has one, for that reason and no other. `OAUTH_CLIENT_SECRET` is in the same
+environment and never goes near the page.
+
+Two things that came out of chasing it are worth keeping. The page **logs its own build stamp**
+(revision plus a hash of the page), because a static host caches and a browser caches harder, and
+an hour went into a fix that was never being loaded. And every step of the sign-in **races a
+timeout**: a spent `?code=` left in the address bar leaves `oauthHandleRedirectIfPresent` pending
+forever, and everything a page would say about that is on the far side of the `await`.
+
+GitHub Pages, which an earlier draft of this section preferred, loses on the same point: the page
+would need an OAuth app registered by hand and its own redirect URI, maintained by us, to arrive
+where a line of README metadata arrives. It stays possible — the page takes a client id from
+`?client_id=` as well, which is how one is tried before it is written down — and this is the same
+reasoning §2.3 used for taking Hugging Face's own device-code client rather than registering one.
+
+**We ask for no scopes beyond the defaults.** `openid profile` is always included and is all this
+needs — the token's whole job is proving an identity to the rendezvous, which is the argument §2.4
+makes about the robot's own credential, and it would be a poor look to fix it on the robot while
+handing a browser `write-repos`.
+
+**Not a route in `reachy_mini_central`.** One host and one deploy, at the cost of putting duck UI
+inside the service the mini fleet depends on. §4's "we maintain it, so a duck-shaped need is a pull
+request" cuts both ways: the reverse of that is that our page becomes their operational risk.
+
+**The page's source lives in this repository**, next to the one the robot serves, because it has to
+track two things that live here — the signalling protocol and this project's own method names — and
+a copy in a Space repo would drift from both. It **is** the one the robot serves:
+`mediad/webclient/index.html`, one file, with the transport decided by whether its
+`{{SIGNALLING_PORT}}` token was substituted. `web.rs` substitutes it and a test asserts the served
+page has none left; the Space copy keeps it, which is how the page knows no robot served it.
+
+The Space is a deploy target — `pollen-robotics/microduck-console` — and
+`scripts/publish-console.sh` is what puts a page there, along with the `Dockerfile` and
+`entrypoint.sh` that serve it. It substitutes the API version from `duck-ipc-proto`, stamps the
+build, and refuses to publish a page that has lost either the port token (which would make the
+Space's copy try to open a WebSocket) or the client-id token (which would leave it unable to sign
+anybody in). By hand while there is one Space; by CI when that stops being true.
+
+One thing settled rather than preferred, and it survives from the earlier draft: `EventSource`
+**cannot set headers**, so a browser speaking the SSE wire must either put the token in the query
+string or read the stream with `fetch` and split SSE by hand. `reachy-mini-js` does the former and
+**the server is removing it** — `_resolve_hf_token` accepts `?token=` as a transitional fallback,
+logs a deprecation per client IP, and says in its own docstring that the query form goes once the
+known clients ship the header. A bearer token in a query string is a bearer token in the Space's
+access log and in every proxy between. So the page is `fetch` plus a few lines of line-splitting,
+written that way once.
+
+What the page is, then, is the mirror of `mediad::relay`: SSE in, `POST /send` out, gst signalling
+envelopes with per-hop ids, and an opaque SDP/ICE payload — the same translation in the other
+direction, which is why §3.2's table is worth reading before writing it.
+
+### 5.1 A duck in a mini's client, which is a conversation rather than a commit
+
+Putting ducks into a rendezvous whose other clients are `reachy_mini_mobile_app` and its desktop
+counterpart means a duck can appear in somebody's mini app — and be driven as a mini, with method
+names this project does not serve. Video would arrive; nothing else would, and the failure would
+read as a broken robot.
+
+`meta.kind` is there so a client can tell the families apart (§3.7), and this page filters on it.
+The mini's clients cannot be made to, from here: that is a conversation with whoever owns them, and
+it is the direction §4 did not consider — not "what does a duck need from the service" but "what
+does a duck arriving in the service do to its existing clients".
+
+**A non-browser consumer works today, and its one snag is the channel label.**
+`ReachyCentralConsumer` — their aiortc client — connects to a duck through the rendezvous and
+decodes frames with nothing added on either side: `pip install "reachy_mini[central-consumer]"`,
+`robot_name="olducky"`, and `latest_frame()` returns `(720, 1280, 3) uint8`. Verified. What it says
+on the way past is `ignoring unexpected data channel: 'control'`, because it looks for the label
+the mini's daemon opens and ours is `control` (`remote-webrtc.md` §5). Nothing for a perception
+consumer, which wants pixels — and the first thing to fix for one that wants to *drive* a duck,
+where the label is the smaller half of the problem and the method names are the larger. §5.2 is
+both halves, on this side.
+
+**Two of their clients select on `meta.name` and neither reads `kind`.** The host shell's picker
+lists whatever is online, and `ReachyCentralConsumer` matches `robot_name` against `meta.name` with
+a **fallback**: one visible producer for the token is used whatever it is called. So a cloud backend
+written for a mini, on an account whose only online robot is a duck, picks the duck and drives it
+with method names this project does not serve. That is worth telling them before somebody meets it,
+and it is a two-line change on their side — `kind` is already on the wire.
+
+### 5.2 A consumer that drives a duck, and the one line of theirs it has to get past
+
+`spaces/policy-shop` is the second consumer in this repository and the first that *sends*
+anything: sign in, list the account's ducks, and put a policy from the Hub onto one in a click —
+`policy.fetch`, `robot.setSkill`, `robot.policies`, `robot.do`, which is `robotctl policy add`'s
+own order over a datachannel instead of over a unix socket.
+
+The whole cost of "drive" over "watch" is a label. `ReachyCentralConsumer` handles
+`pc.on("datachannel")` with `if channel.label != "data": ignoring unexpected data channel`, and
+`mediad` opens `control` (`remote-webrtc.md` §5) — so a consumer that wants pixels needs nothing
+and a consumer that wants to send a call gets no channel at all. `RTCPeerConnection` is a pyee
+emitter, so `pc.on` *appends* rather than replaces: a subclass overriding `_build_pc` registers a
+second listener, theirs still runs and still warns about a label it does not know, and ours takes
+the channel it dropped. Nothing in their package is rewritten, which is what makes it survive the
+version that fixes their side — the day their handler takes `control`, ours stops being the first
+to claim it and the shim becomes a deletion.
+
+Their `send_command` is reused rather than reimplemented, and that is not laziness:
+`RTCDataChannel.send` is not thread-safe, they already marshal every send onto the loop that owns
+the peer connection, and a Gradio callback runs in whichever worker thread the request landed in.
+
+**Two refusals, and which side owns them is most of what writing this settled.** `policy.fetch`
+checks the claims that are about the robot — `obs_len`, `action_len`, `model_api`, `robot.model` —
+and it checks them *before* the download, so a client should not repeat them and should show what
+the robot said. `robot.setSkill` checks nothing about the command encoding: a phase policy
+installed as a one-shot is **accepted**, and the robot then feeds a constant to a network trained
+on a phase, which is plausible movement and wrong movement. That rule lives in `robotctl`, and
+`robotctl` is not in the path of a click — so `catalogue.refusal` is the same rule written a second
+time, and any client that grows this button needs it a third.
+
+**A `401` from the rendezvous is the token and nothing else, and proving that took reading their
+`app.py` after guessing wrong.** The first version of this page listed robots with `GET
+/api/robot-status`, got a `401`, and concluded the endpoint must require an established peer —
+plausible, because `POST /send` does (§3.1's note) and because the robot only ever polls it while
+holding a stream. It does not: the route is `Depends(_resolve_hf_token)` and then
+`validate_hf_token`, which is one `whoami-v2` call with no scope check, no token-type check and no
+peer requirement, filtered to `p.username == username`. Its own docstring says it exists for
+exactly this — "a passive status indicator without consuming a session slot".
+
+Which makes it the *better* call than the console's `list`, for a reason §3.7 already stated: peers
+are keyed by token, so the `/events` stream a browser opens to list would supersede the one a
+session is riding on. A page listing that way cannot refresh its list without dropping its own
+session. `/api/robot-status` opens nothing.
+
+The `401` was **Gradio's mocked sign-in**. Outside a Space — `SPACE_ID` unset —
+`gr.LoginButton` behaves, the profile is real, and `_get_mocked_oauth_info` sets `access_token` to
+the literal string `mock-oauth-token-for-local-dev`. A service that resolves tokens through
+`whoami-v2` refuses that, correctly, and the symptom is a page saying "sign in again" beside a
+console listing the same duck. So a local run has to prefer `HF_TOKEN` or what `hf auth login`
+stored, and the mock is recognised by value rather than by an `SPACE_ID` check — a real token that
+arrives outside a Space is still a real token.
+
+**And the general lesson, which is why the page now logs everything to two places at once.** Four
+layers meet in one button — a token, a rendezvous, a candidate pair, a robot's own refusal — and
+all four fail as "nothing happened". Every HTTP status, every signalling frame, every JSON-RPC
+line and every refusal is logged, with the token's *source* named and the token never written
+down; `DUCK_LOG=DEBUG` adds the streaming notifications and the per-candidate ICE lines. The panel
+is on the page as well as the terminal because a Space has logs nobody has open and a browser has
+no stderr. Each layer is also runnable alone — `uv run rendezvous.py`, `uv run catalogue.py`,
+`uv run lan.py` — which is what turns "it does not work" into a line number without a
+conversation.
+
+`IntentResult` is the other thing a client gets wrong once: `robot.setSkill`, `robot.do`,
+`robot.init` and `robot.relax` answer `accepted: false` with a reason rather than a JSON-RPC
+error, deliberately — safety refusing to run a policy on a fallen robot is not a broken call. A
+page that only catches errors reports every one of those as a success and leaves a motionless
+robot unexplained.
+
+**And the transport is what this leans on hardest from a Space.** The control channel is SCTP over
+the same candidate pair as the media, so a relay that is not there takes the click with it: from a
+data centre the session negotiates and may then carry nothing. §6's endpoint answers now, so the
+ordinary case is covered — but a metered dependency is still a dependency, which is why the status
+line names the stage it reached rather than saying "connecting…", and why the page has a second
+way in.
+
+**`lan.py` is that second way, and it is a transport rather than a second design.** The robot is
+already serving `webrtcsink`'s signalling server at `ws://<robot>:8443` — the one the console
+talks to — and it carries the same gst envelopes the rendezvous carries over SSE and `POST /send`.
+So one hop is swapped and nothing above it changes: the same `control` channel, the same JSON-RPC,
+the same buttons, and the page holds either consumer without asking which. §3.2's table is the
+whole of the difference, and swapping in the direction of the LAN removes rather than adds — no
+account, no lease, no rendezvous, no relay, host candidates on both sides.
+
+Which turns out to be worth more than a workaround for a dead DNS record, and it is the argument
+for keeping it after §6 is fixed: **it separates the transport from everything else.** A click
+that works on the LAN and not through the rendezvous has told you which layer to look at, and
+that answer was previously a guess.
+
+Its one cost is that it is hand-written where the rendezvous half was inherited: a dozen envelope
+shapes read off `net/webrtc/protocol` and the console page, and getting one wrong produces silence
+rather than an error. So `uv run lan.py` stands up a producer on loopback that speaks the same
+protocol and drives a real session against it — welcome, list, `startSession`, an offer answered,
+DTLS, SCTP, the channel, a call matched to its reply. Two aiortc peers on `127.0.0.1` are not a
+duck; they are the same protocol, which is the part that fails quietly.
+
+### 5.3 Frames out of the robot, which is what §6 was blocking
+
+The goal §5.2's Space was a step towards is a Space **processing this camera on Hugging Face
+hardware**, and that is the one thing the control lane cannot carry: pixels are what a media path
+is for. Pulling them means WebRTC, WebRTC across two NATs means a relay candidate, and §6 says
+there is not one. `vision-demo` had "signalling worked and media did not" as its documented
+expected outcome for exactly this reason.
+
+**So the robot dials the Space and pushes.** `media.stream {url}` — answered by `mediad` itself,
+like `media.video`, because the pipeline is `mediad`'s and no service owns it — tells the robot a
+`wss://` to connect to; it opens it outward and sends frames. An outbound WebSocket is the one
+thing that always works, and the robot is already proving it every second it is reachable at all.
+No relay, no ICE, and **the rendezvous carries an instruction rather than payload**, which is the
+property that makes this scale where relaying pixels through a service the mini fleet depends on
+would not.
+
+    Space ──media.stream {url}──► rendezvous ──► robot
+    robot ═══════ H.264, outbound wss, direct ═══════► Space
+
+**H.264 rather than JPEG, and it was JPEG first.** The board has a hardware encoder, so the encode
+costs the VPU rather than a core, and prediction is worth an order of magnitude of bytes — 0.5 KB
+an access unit against JPEG's 6.5 KB a frame on synthetic content, less on real footage and the
+same direction. Two things had to be built to make it safe, and both are the kind that fail
+invisibly:
+
+- **A receiver that joins mid-stream can decode nothing until a keyframe**, and a Space restarts on
+  every push, so reconnecting is the common case rather than the exception. `h264parse
+  config-interval=-1` repeats SPS and PPS in front of every keyframe, and opening the valve sends
+  an upstream `force-key-unit` so the first thing a receiver gets is decodable.
+- **Dropping the oldest and keeping the newest is right for JPEG and wrong here.** A predicted
+  frame whose reference was dropped decodes to garbage that looks like a broken camera rather than
+  a broken transport. So a gap abandons the stream to the next keyframe, in two places: the
+  branch's queue and the sender's channel.
+
+JPEG stays reachable on `media.stream {"encoding": "jpeg"}`, because every frame being independent
+is worth having for a receiver that reconnects constantly.
+
+**The branch is valved, not conditional.** `webrtcsink` owns the video track's encoder and is
+handed raw video on purpose — pre-encoded input puts the encoder out of reach of its congestion
+control, which this pipeline tried and reverted — so there is nothing to tap and this is a *second*
+encoder off the same raw tee. On a board where the encoder is the budget that has to cost nothing
+when nobody is streaming, so the branch is built once behind a `valve drop=true` and opened by a
+property write. Adding and removing elements on a live pipeline was the alternative, and
+`pipeline.rs`'s history with a `videoflip` is why nobody should reach for that here.
+
+What this does **not** do is give a browser a picture of a robot, carry audio, or close a teleop
+loop. Those want WebRTC and §6 is still what they need; the frame stream is for the case where the
+consumer is a program.
+
+## 6. NAT: STUN on both ends, and the robot offers the relay — **decided**
+
+`stun.l.google.com:19302`, which is `webrtcsink`'s own default and now also what the console asks
+for when it is remote. That second half was missing and mattered: a page offering only its
+`192.168.…` addresses to a robot on another network negotiates a session perfectly and carries
+nothing, because there is no candidate pair that can work.
+
+**TURN is not optional and it is not symmetric.** Between a robot behind a home router and a
+consumer behind whatever a cloud provider gives a container, srflx-to-srflx needs both NATs to
+allow a hole to be punched — often they do, and often enough they do not. A relay always works, at
+the cost of somebody's bandwidth, which is why ICE tries it last.
+
+**One relay candidate is enough, and it is not always the robot's.** A connection needs *one*, not
+two, and `aiortc`'s STUN client works where its TURN client does not — so a Python consumer cannot
+be the side that relays, and the robot has to be. `reachy_mini`'s #1182 established that
+arrangement and `mediad::turn` is the same one.
+
+**What that argument left out is whether the two ends can address each other at all**, and an
+iPhone on a mobile network is the case where they cannot. It has no IPv4 socket: it reaches a
+*hostname* through DNS64/NAT64, the STUN server reports an IPv4 reflexive address back, and the
+phone gathers a candidate saying so. But an ICE candidate is a bare literal, and the robot's relay
+candidate is a bare IPv4 literal on a board with no global IPv6 at all — which that phone cannot
+send a packet to. Measured on olducky: six sessions, `offering relay candidates relays=5` every
+time, `Ice connection state … failed` every time, about eight seconds apart.
+
+So **the console offers a relay of its own** (`refreshRelays` in `mediad/webclient/index.html`),
+and only its own allocation can bridge this: `turn.cloudflare.com` is a name, so it resolves over
+IPv6, and the relayed address Cloudflare hands back is IPv4, which the robot can reach. Confirmed
+from the phone before it was written — the same credentials in a Trickle ICE page gathered a
+`relay` candidate with an IPv4 address over 4G, where the robot's own candidates paired with
+nothing.
+
+The page mints them with **the visitor's** token, not the robot's, which is the right way round
+twice over: a robot's allowance should go on being watched rather than on watching, and a browser
+signed in with `hf_oauth` already holds a token of its own. A LAN session asks for none — there
+are host candidates on both sides and nothing would use a relay.
+
+The credentials are Cloudflare's, minted per account by a proxy Hugging Face hosts and
+authenticated with **the same token the relay signs in with** — so a robot that belongs to
+somebody can offer a relay and one that belongs to nobody cannot, which is the same line §2 draws
+everywhere else. They are short-lived: a task refreshes at half of a 600 s lifetime, and retries
+in thirty seconds after a *transient* failure only. A robot nobody
+has signed in has nothing to retry for, and a warning every thirty seconds for the life of the
+daemon is how a log stops being read.
+
+**Fetching them must never be in the way.** The only caller is GStreamer's `consumer-added`
+handler, where the SDP offer for that consumer is not generated until the handler returns, so an
+HTTP request there would delay every connection — including the LAN ones that will never use a
+relay — by however long the proxy takes to answer. `Relays::uris` therefore reads a cache, never
+blocks (a `try_read` that yields nothing rather than waiting) and never fails. An empty answer is
+the ordinary state for the first few seconds after boot and forever on a robot with no account,
+and it means host and srflx only, which is all anything on the same network needs.
+
+**The proxy is the Space, and the name in front of it was the dead part.** `turn.fastrtc.org` —
+what `fastrtc`'s own code points at and what `reachy_mini` #1182 copied into this arrangement — is
+a dangling delegation, not an outage: the `.org` registry names four Route53 nameservers for the
+zone, the registration is healthy and locked until 2027, and all four nameservers answer `REFUSED`
+for the zone they are authoritative for, which is what Route53 says when the hosted zone behind
+them is gone. `fastrtc/turn-service`, the Space that alias pointed at, never stopped answering.
+So `DEFAULT_TURN_ENDPOINT` addresses it directly, at
+`https://fastrtc-turn-service.hf.space/credentials`, and the vanity record is out of the path.
+
+**That also closes a token-exfiltration route, which is the half that mattered more than the
+outage.** A dangling Route53 delegation is a known takeover shape — create hosted zones until AWS
+assigns you one of the four delegated nameservers, and one is enough, because a resolver needs
+only one authoritative answer. Whoever landed it would serve records for the name, pass DNS
+validation for a certificate on it, and be handed the account token every signed-in robot sends
+as a bearer header every five minutes. That token is the robot's whole credential; §2.4 is about
+how broad its scopes are.
+
+**The endpoint is checked before the token can reach it.** `turn::parse_endpoint` is a `clap`
+`value_parser` on `--turn-url`: `https` unless the host is loopback, no userinfo, no query and no
+fragment. A wrong value stops the daemon at argument parsing rather than becoming a warning every
+thirty seconds. Redirects need no separate guard — `reqwest` strips `Authorization` when a
+redirect crosses scheme, host or port (`src/redirect.rs`, `remove_sensitive_headers`), so the
+token cannot be walked to a third-party origin.
+
+**The allowance is the robot owner's, and it is finite** — 10 GB a month on a free Hugging Face
+account. A relayed video session is roughly a gigabyte an hour, so a robot driven hard over a
+relay can spend it, after which the proxy answers with no relay servers and `turn.rs` logs "the
+TURN proxy offered no relay servers" at info level. That is indistinguishable from a robot that
+was never offered one, which is a legibility gap worth closing when somebody hits it. It is also
+the argument `stream.rs` makes for sending frames outbound rather than through a relay.
+
+**Something now notices when it dies, which is the reason this went unnoticed for three months.**
+The endpoint was already dead when #1182 shipped it, and the only symptom was a warning in a log
+and a candidate type nobody counted. `.github/workflows/turn-endpoint.yml` runs daily: one
+authenticated `GET` against `DEFAULT_TURN_ENDPOINT`, asserting 200 and at least one `turn:`/
+`turns:` entry. Every other check in the repository passes regardless, because every one of them
+pairs two peers on one network, which never looks at a relay.
+
+Three things about its shape are deliberate. It reads the URL **out of `turn.rs` with `sed`**
+rather than keeping a copy, because a check holding its own endpoint tests whatever it was last
+told and can drift from what the daemon compiles in — and a green check on a URL no robot uses is
+worse than no check, since it reads as proof. It is **not** on `pull_request`: the failure being
+guarded against is "nobody touched this for months", which a PR trigger cannot see, and a third
+party's outage must never block unrelated work. And a **missing `HF_TOKEN` secret fails** rather
+than skipping, because a check that quietly skips itself into permanent silence is the exact
+failure mode it exists to end.
+
+Two things this deliberately does not do:
+
+- **Our own proxy.** This endpoint is a small service holding a Cloudflare Calls key and minting
+  short-lived credentials for a caller with a valid HF token, and running one ourselves would end
+  the dependency on a dormant project's Space — `--turn-url` is already the seam it plugs into.
+  Worth doing, and not worth blocking relay coverage on: `*.hf.space` is `{owner}-{space}`, so it
+  breaks if `fastrtc` renames or removes the Space, and there is no CNAME layer left to repoint.
+  That is the residual risk, named rather than closed.
+- **A Cloudflare key on the robot**, using `TURN_KEY_ID` and `TURN_KEY_API_TOKEN` directly. Fastest
+  and worst: a long-lived API token on every board, which is the shape of mistake §2.4 exists to
+  stop making.
+
+Nothing about a relay is fatal. `add-turn-server` is checked for existence before it is emitted —
+a panic in a C closure aborts the process rather than unwinding, which `pipeline.rs` learned once
+already — a refused URI is a line in the journal, and a robot that cannot offer a relay is
+reachable from most places rather than none. **And a TURN URI carries a password**, so only the
+host half is ever logged.
 
 ## 7. Authorisation, restated now that there is an account
 
@@ -601,29 +990,51 @@ Five slices, and the first two are independently useful and need no client:
    three calls, three transports, two CLIs, and a token that renews itself. Verifiable on its own,
    which is what made it the first slice: it prints the Hugging Face username.
 2. **The relay, registering only** — producer registration, the negotiated heartbeat, reconnect and
-   backoff, the split-brain poll. `mediad`. Verifiable with no client at all: the service's dashboard
-   counts a producer and `/api/robot-status` lists the duck.
-3. **Session translation** — a remote consumer gets video and the `control` channel. The first slice
-   that needs something to connect *with*.
-4. **The client, hosted.** §5.
-5. **STUN decided; TURN if a real network needs it.** §6.
+   backoff, the split-brain poll. `mediad`. **Done**: `mediad::relay`, a task with no GStreamer in
+   it, inert until `/etc/robot/hf-token` exists and picking it up without a restart when it does.
+   Verifiable with no client at all: the service's dashboard counts a producer and
+   `/api/robot-status` lists the duck.
+3. **The client, hosted.** §5. Ahead of session translation rather than after it, which is a change
+   of order and the reason for it is verification: the service ships no front-end of its own — `GET
+   /` is a status page counting peers, producers and sessions — and its consumers are the mini's
+   mobile and desktop apps, which would drive a duck with a mini's method names. So there is
+   nothing to connect with that we do not write, and translating sessions first would mean
+   building the half that can only be tested against a fake.
+4. **Session translation** — a remote consumer gets video and the `control` channel. **Done**:
+   `relay::bridge` opens `ws://127.0.0.1:<--port>` as a consumer when a session is asked for,
+   rewrites `sessionId` per hop, reads no payload, refuses a second session by name, and tells the
+   service when a session ends however it ends — including the case where there is no producer to
+   bridge to, which is a robot whose pipeline never reached PLAYING.
+5. **STUN decided; TURN offered by the robot.** §6. **Done**: `stun.l.google.com:19302` on both
+   ends, and `mediad::turn` keeps Cloudflare credentials fresh so every consumer's offer carries a
+   `relay` candidate — from `fastrtc-turn-service.hf.space`, the Space itself, because the alias
+   in front of it is a dangling delegation. §6 has the argument; the three things to carry away
+   are that only the robot needs credentials, that reading them must never block the thread
+   building an offer, and that no check in this repo would notice if that endpoint died again.
 
 ## 9. What is open, and who can close it
 
 | | needs |
 |---|---|
 | §2.4 the scope breadth | one public device-code client in the `pollen-robotics` HF org with `openid profile read-repos`, created by somebody with org admin. Not blocking — a scope change is a re-login — and it should not ship without it |
-| §5 where the client is served | follows the shape of §3, and is the decision that actually couples us to a service |
+| a calibration for the camera | `media.video` publishes the module's design figures with `calibrated: false`, which is enough to map a room and not enough for metrology. Measuring one robot and writing `[media.intrinsics]` closes it for that robot; a per-unit calibration in provisioning closes it for the family. §11 of `remote-webrtc.md` |
+| everything on the wire should be timestamped at source | `remote-webrtc.md` §11: `abs-capture-time` on the media, checked against what `webrtcsink`, a browser and `aiortc` actually surface; and a monotonic-plus-epoch field on every control-channel notification that describes a moment. Wanted for any consumer that has to relate what the robot saw to what it felt — visual-inertial SLAM is the case that makes it concrete — and it wants its own version bump rather than riding along with a transport |
 | §2.6 `logout` revokes nothing | whether Hugging Face accepts a revocation for the first-party device-code client, checked rather than assumed. Not blocking — signing out stops the robot being reachable, and a stolen board is answered on hf.co — but it is the difference between "forgotten" and "revoked" |
+| §6 the relay check needs a token | `.github/workflows/turn-endpoint.yml` exists and runs daily, and fails until an `HF_TOKEN` secret is set on the repository — a Hugging Face token with no scope beyond sign-in, used only to mint TURN credentials. Failing loudly is deliberate; the alternative is a check that skips itself into silence |
+| §6 the relay is somebody else's Space | a credentials proxy of our own, holding the Cloudflare key in one place instead of trusting a dormant project's Space to keep its name. `--turn-url` is the seam. Not blocking — the Space answers — but `*.hf.space` is `{owner}-{space}` and there is no alias left to repoint if it moves |
 
 Closed since this page was written: the OAuth client (§2.3 — Hugging Face ships one), whether the
 token expires (§2.7 — thirty days, with a rotating refresh token), which rendezvous to use (§4 —
-the mini's), and whether we can read it (§4 — we maintain it; the "private repo" in an earlier
-draft was a wrong-name 401).
-
-One item this page created rather than closed: **a golden image must not carry
-`/etc/robot/hf-token`**, because peers are keyed by token and two robots sharing one take turns
-being reachable. §3.7. That belongs to whoever owns the flashing path.
+the mini's), whether we can read it (§4 — we maintain it; the "private repo" in an earlier draft
+was a wrong-name 401), where the client is served (§5 — a static Space with `hf_oauth`, because
+the question was never hosting but how a page gets a token), and which relay endpoint to use (§6 —
+the Space itself; the alias in front of it is a dangling delegation).
+
+One item this page created and closed: **peers are keyed by token**, so two things sharing one
+take turns being reachable. Not a provisioning problem — images are built from scratch, not cloned,
+so no second board ever receives a copy — but it *is* a constraint on consumers: a cloud backend
+must authenticate with its own token, not the robot's, or it takes the robot off the listing by
+connecting. §3.7.
 
 ## 10. Not doing
 
diff --git a/docs/design/remote-webrtc.md b/docs/design/remote-webrtc.md
index 60b6188b..d1b1b1f9 100644
--- a/docs/design/remote-webrtc.md
+++ b/docs/design/remote-webrtc.md
@@ -518,7 +518,58 @@ The alternative was building `mediad` on an arm64 runner like the plugins in
 two and leaves nobody able to build `mediad` on a laptop — which for the crate that will need the
 most iteration against real hardware is the wrong trade.
 
-## 11. Deferred, with reasons
+### `media.video` says what the picture is, geometrically
+
+Width, height, the mount rotation — and the camera's **intrinsics**, which is what a consumer needs
+to turn a pixel into a direction. Without them a monocular reconstruction is scale-free and its
+angles are wrong; SLAM, visual odometry and "how far away is that" all begin here.
+
+Four numbers and a flag: `fx`, `fy`, `cx`, `cy`, and `calibrated`. They describe the frame **as it
+is sent** — unrotated, because nothing on the robot rotates pixels — so a consumer that applies
+`rotate` has to rotate these with it, swapping `cx` with `cy`. The flag is not decoration: `false`
+means the IMX219 module's design figures (3.04 mm over a 1.12 µm pitch, principal point assumed
+central, no distortion model), which is good to a few percent and enough to map a room; `true`
+means a measurement: *this* robot's, written into `[media.intrinsics]`, or — the default, since the camera and lens are one part across the alpha family — the family's solve that `robotd-params` ships. A consumer that needs
+metrology can tell that it needs to ask.
+
+**And the key is absent when the geometry is unknown**, rather than present and wrong. That is a
+robot streaming a test pattern, or one where `media-ctl` would not set the sensor mode — in which
+case the sensor is in its 3280×2464 boot mode, whose field of view is the whole array rather than
+the 1920×1080 crop, and every intrinsic would be off by about 1.7×. `mediad::camera` has the
+arithmetic and the mode table, including the fact that reading 720p off the sensor would *narrow*
+the view to 27° rather than saving anything.
+
+## 11. Everything on the wire should carry the time it happened — **wanted**
+
+Nothing this transport carries is timestamped at source today. A frame arrives when it arrives, a
+`robot.state` notification arrives when it arrives, and a consumer that wants to know *when* the
+robot saw or felt something has only its own clock to go on — which, over a relay on another
+continent, is off by whatever the path cost that second.
+
+That is fine for driving a robot you are watching, and it is the wrong shape for everything a
+remote consumer is interesting for. **SLAM is the case that makes it concrete**: monocular SLAM on
+a stream with no capture times can be run, and the moment somebody wants visual-inertial — the IMU
+this robot already has, at 50 Hz, on the same control channel — the two series cannot be related
+except by guessing. Timestamps applied at the far end measure the network, not the robot.
+
+Two halves, and they are not the same problem:
+
+- **Media.** RTP timestamps are relative to a random offset, so they order frames and date none of
+  them. The mechanism for this is the `abs-capture-time` RTP header extension, which carries a
+  wall-clock capture time per packet and is what a receiver needs to line video up against
+  anything else. Whether `webrtcsink` will negotiate it, and what a browser and `aiortc` expose of
+  it, is the thing to check first — a header extension nothing on the receiving side surfaces buys
+  nothing.
+- **The control channel.** This one is ours and cheap: a monotonic reading, plus the boot epoch
+  that makes it comparable across processes, on every notification that describes a moment. The
+  cost is a field per message and an argument about which clock — and the answer has to be the
+  same one the media path ends up dating frames with, or the two series still cannot be joined.
+
+Not built, and deliberately not started as part of the remote path: it changes what every
+notification looks like, so it wants its own decision and its own version bump rather than riding
+along with a transport. `remote-access-design.md` §9 carries it as open.
+
+## 12. Deferred, with reasons
 
 - **A WebSocket surface for server-side programs** (`architecture.md` §5.3). Same JSON-RPC, no
   media stack, `get_frame` returning a JPEG. It is a few dozen lines once §5's routing exists, and
diff --git a/docs/design/robotd-design.md b/docs/design/robotd-design.md
index 3cf00dfb..5bfe7489 100644
--- a/docs/design/robotd-design.md
+++ b/docs/design/robotd-design.md
@@ -43,18 +43,18 @@ the hardware does: the v2 board sits on the Dynamixel bus and serves an on-chip
 quaternion out of the same register block the servos answer at. One board, one code path, no
 IMU abstraction. It is listed first in the id vector so it answers before the servo burst.
 
-**One owner at a time, and nothing hard-enforces it.** `serialport` sets `TIOCEXCL`, which
+**One owner at a time; tty exclusivity alone does not enforce it.** `serialport` sets `TIOCEXCL`, which
 turns a second *unprivileged* open into `EBUSY` — but `robotd.service` runs as root, because
-motor control needs the character devices, and root is not stopped by that flag. So the
-exclusion is arranged rather than enforced, and each other claimant is kept off the port
-deliberately:
+motor control needs the character devices, and root is not stopped by that flag. The daemon
+and standalone `init` therefore share an advisory lock, and other claimants are kept off the
+port separately:
 
 - **The control loop** owns it for as long as the daemon runs.
-- **`robotd init`** opens the port itself, and as root it will succeed *while the daemon is
-  running* — two writers interleaving packets on one bus, which reads as a hardware fault. So
-  it wants the daemon stopped, and that is exactly why `robot.init` and `robot.relax` exist as
-  IPC methods (§3.3): the daemon serves both from inside the loop, so nothing else has to open
-  the bus at all. `init` is the escape hatch for a robot whose daemon is not running.
+- **`robotd init`** opens the port itself, but must first take the daemon's endpoint lock.
+  It holds that lock through the entire ramp: a running daemon refuses `init`, and an `init`
+  already moving the robot refuses a daemon startup or another `init`. `robot.init` and
+  `robot.relax` remain the IPC methods (§3.3) for a running daemon; standalone `init` is the
+  escape hatch for a robot whose daemon is not running.
 - **`serial-getty@ttyS2`** — Armbian runs a login console on UART2 by default, and an `agetty`
   holding the port makes every servo invisible to everything else. `scripts/setup-board.sh`
   masks the unit; `fuser -v /dev/ttyS2` naming `agetty` is how that was found, and it is still
@@ -62,6 +62,23 @@ deliberately:
 - **The runtime**, at a coarser grain: it drives the same bus, so a board runs the runtime or
   `robotd` and never both, and the units say so with `Conflicts=` (§5.2).
 
+**Socket ownership.** Both entry points acquire `<socket>.lock` (normally
+`/run/robotd.sock.lock`) before publishing `/run/robotd/identity.json` or opening the bus.
+The daemon also binds its listener before starting the control thread, and keeps the lock
+through control-thread shutdown and socket cleanup. A refused duplicate must not overwrite
+the owner's PID and build: `robotctl health` and updater startup checks read that identity.
+For a listener left by an older daemon without a lock, the daemon's bind path removes only
+an actual socket that refuses a bounded connection probe; live listeners and ambiguous paths
+are preserved. Standalone `init` only locks and never binds or cleans up the socket.
+
+**Never unlink the lock file, even at shutdown.** The kernel releases the advisory lock when
+its file is closed or the process exits, including `SIGKILL`; the file itself stays in place.
+Deleting and recreating it could leave contenders locking two different inodes under the same
+name. File existence does not mean the lock is held. The lock is per `--socket`, so callers
+using the same physical bus must use the same socket setting; separate endpoints remain useful
+for independent fake daemons. Older binaries and other tools do not participate in this lock
+and must still be stopped before standalone `init` takes over the bus.
+
 ### 1.2 Who talks to `robotd`
 
 ```text
@@ -256,6 +273,15 @@ saying so:
   swapped in arrives at 250, so the check is what removes a whole class of "why is it slow on
   this robot". `shutdown = 52` is the error mask that latches on overload, overheating and
   input-voltage faults.
+- **A swapped-in servo is adopted, not configured by hand.** A new XL330 answers as ID 1 at
+  57 600 baud, and neither is used on this bus. So before the register check, `open_bus` pings
+  the fifteen expected IDs; if *exactly one* is silent, it looks for ID 1 — first at 1 Mbps,
+  then by reopening the port at 57 600 — writes it the missing ID and then the bus's baud rate,
+  reopens at 1 Mbps, runs the same register check on it, and reboots it. The reboot is what
+  clears the hardware-error alert the flash leaves set, which would otherwise hold torque off
+  until someone pulled the battery. A complete bus pays fifteen pings for this and nothing
+  else — the 57 600 probe never runs unless a servo is missing. Two missing servos are left
+  alone: there is no telling which one a fresh servo replaces, and the journal says so.
 - The position P gain is written with I and D at **zero**, the runtime's `--ki`/`--kd`
   defaults. These are RAM registers, so a power cycle restores the servo's factory values, and
   the factory D is not zero: left in place it damps the servo's internal PID and the robot runs
@@ -474,7 +500,8 @@ a robot lying on its side, and the wrong one for softening a landing: gravity pa
 `fall_gravity_z` held for 200 ms *is* the robot on the floor, and the window worth acting in
 has closed by then.
 
-So `limp_fall` (on by default since it was validated on a robot) runs a second, separate
+So `limp_fall` (off by default: the default velstand gait loads no standing network to hand
+back to) runs a second, separate
 detector — `duck_control::fall` — on the rate rather than the position. Projected gravity
 rotates with the trunk, so `ġ = −ω × g` is exact and comes straight from the gyro in the same
 12-byte IMU block; extrapolating it over ~0.3 s says where gravity is heading. It fires when
@@ -751,10 +778,20 @@ single last-writer slot would lose.
 
 ### 4.2 Params
 
-A TOML file read at startup, **not watched** — live reload comes later. It lives outside
+A TOML file read at startup and, for the most part, **not watched**. It lives outside
 `releases/<ver>/` so it survives update *and* rollback, next to the updater's own config at
 `/etc/robot/robotd.toml`.
 
+Two parts of it are watched, and both are exceptions earned by what a restart would cost rather
+than steps towards watching the whole file. `padd` stats the file once a second and re-reads
+`[pad]` and `[pad_imu_head_control]` when the mtime moves: a binding is changed from a phone, and restarting
+`padd` to apply it would drop the pad session and let `robotd`'s deadman zero a walking robot.
+`robotd` re-reads `[policy]` — all of it but `mode` and `enabled` — when asked to, which is how
+`robotctl policy add` lands a skill without taking motor control away from a standing robot.
+Re-reading `[safety]` or `[control]` under a running loop is a different and much larger promise,
+and it is still not made. `robotctl configure` knows which of the three answers a key wants, and
+a key that says nothing fails a test in `robotctl`.
+
 Belonging to the board rather than the release is what makes a hand-edited policy path stick: the
 defaults point inside `releases/<ver>/`, so an ordinary update keeps a policy alongside the
 binaries trained against it, and deleting the override goes back to that. The file may be absent
@@ -959,3 +996,24 @@ path map now does. §4.4.
    has to reach the board, so prefer pure-Rust crates on that path. *Unverified on macOS:* the
    cross-build needs an aarch64 sysroot, which a Mac cannot provide, so `cargo board --bins` fails
    locally there — build the shipped set with `-p updater -p robotd -p robotctl`, or build on Linux.
+
+## Mapping telemetry (API v24)
+
+A mapper on the far end of the video — a laptop today, a server later — needs three things from
+the robot that `robot.state` did not carry: a clock shared with `tof.frame`, the IMU beyond its
+projected gravity, and where the camera and the ToF sensor are. All three are additive.
+
+- **`t_ns`** on `robot.state` and `tof.frame` is `CLOCK_MONOTONIC` in nanoseconds (`proto::clock`).
+  `t` and `at_us` stay: they are each daemon's own elapsed time, and a reader that only has one
+  stream still wants a number that starts at zero. `mediad`'s `media.video` answer reads
+  `mono_ns` and `real_ns` at one instant, so RTP timestamps — which RTCP sender reports state in
+  wall-clock — can be put on the same axis.
+- **`imu: {gyro, quat}`** is `ImuData` as the loop read it: the trunk IMU, 50 Hz, nothing above
+  it (`docs/design/robotd-design.md` §IMU). The head IMU on the prototype HAT is not read by
+  anything yet; when it is, it streams beside `tof.frame`, not here.
+- **`frames: {camera, tof}`** are trunk-frame poses at this tick's *measured* head joints from
+  `kinematics::head::HeadFk` — the same FK `robot.look` solves against — and **`robot.model`**
+  answers the static geometry (trunk height, joint order, ToF beam directions, the poses at head
+  zero). The kinematics stay in one crate; a client asks rather than transcribes.
+
+Cost: three small structs per published tick, only while someone is subscribed; the FK is ~50 ns.
diff --git a/docs/design/simulation.md b/docs/design/simulation.md
new file mode 100644
index 00000000..ae8ecf39
--- /dev/null
+++ b/docs/design/simulation.md
@@ -0,0 +1,290 @@
+# Simulation: the same daemons, a body in MuJoCo
+
+**Status:** built and in use. `robotd --sim`, `tofd --sim` and `mediad --sim-camera` are here, with
+`microduck_rl`'s `duck-body` serving the other half; the containers (§8), the ether (§5) and the
+per-duck cameras all run from `scripts/duck-sim`. Measured: the daemon holds `50.0 of 50.0 Hz · 0
+missed` against a MuJoCo body, detects a seated boot from the simulator's own joint angles, and
+`robotctl robot init` runs the sitstand policy until the duck is upright and stays there; four ducks
+in containers sing a full chorale over the ether. How to use it is
+[`docs/robot/simulation.md`](../robot/simulation.md); this page is the design.
+
+The goal is a duck you develop against exactly as you develop against a robot: the same binaries,
+the same units, the same `robotctl`, the same `duckctl open` — with the body in MuJoCo instead of on
+the desk. Not a mock, and not a test harness. A twin, with a written-down boundary.
+
+## 1. What using it looks like
+
+One command to get a duck. After that it is a robot, and you already know the commands.
+
+**What works today** (`scripts/duck-sim`, one duck, no container):
+
+```
+scripts/duck-sim               # a window opens, the duck stands up, and it is yours
+scripts/duck-sim drive         # walk it forward, then stop
+scripts/duck-sim ctl health    # or anything else robotctl does
+scripts/duck-sim log
+scripts/duck-sim down
+```
+
+It builds what is missing, writes the params, finds the ONNX Runtime in the RL repo's venv, starts
+both halves and stands the duck up. Three things it exists to stop anyone typing, because none is
+guessable: policies live at `/opt/robot/daemon/current` on a robot and in this repo on a laptop;
+`ort` dlopens a libonnxruntime a laptop does not have; and a unix socket path is capped at ~108
+bytes, so the state directory has to be short.
+
+**Where it goes**, once the containers are in:
+
+```
+duck-sim up 4                  # four ducks, sharing one MuJoCo window
+duck-sim shell duck-a          # you are on duck-a
+```
+
+Inside, nothing is special:
+
+```
+duck-a # robotctl health
+duck-a # robotctl configure
+duck-a # robotctl chorale
+duck-a # journalctl -u robotd -f
+```
+
+And from your own shell, exactly as with a robot on the desk:
+
+```
+duckctl open duck-a
+scripts/dev-push.sh microduck@duck-a
+```
+
+Four rules the harness holds itself to, because a development tool that needs a runbook does not get
+used:
+
+**No setup step anybody has to remember.** `duck-sim up` on a machine that has never run it builds
+the rootfs, fetches what is missing and says so — once. Whatever it genuinely cannot do for you, it
+prints as the exact line to paste, in the style the rest of `scripts/` already uses.
+
+**Defaults are the common case.** No count means one duck. No scene means the apartment. No
+`--cameras` means no cameras, because most sessions do not need them and they are what costs.
+
+**Nothing you cannot stop.** Every duck runs as a systemd unit, so `duck-sim down` is a
+`systemctl stop` — not a key combination. That rule was bought with a container that had to be
+killed from a second terminal because `Ctrl-]` is `AltGr + )` on a French keyboard.
+
+**A duck is addressable by name.** `duck-a`, `duck-b`, and each gets its own machine-id — so
+`robotctl quack` sounds different on each one, since a duck's voice is generated from its serial.
+Four ducks in a chorale should not be four copies of one voice.
+
+## 2. Where the seam is
+
+`duck_control::io::RobotIo` — six methods, and the only place a simulator is allowed to exist:
+
+```rust
+fn read(&mut self) -> Result<Sensors>;          // joints and IMU, one transaction
+fn write(&mut self, targets: &JointTargets) -> Result<()>;
+fn set_gain(&mut self, kp: u16) -> Result<()>;
+fn set_torque(&mut self, on: bool) -> Result<()>;
+fn slow_sensors(&mut self) -> Result<SlowSensors>;   // volts, per-joint temperature
+```
+
+Above it, nothing changes: the 50 Hz loop, the ONNX policies, `Safety`, fall detection, odometry,
+kinematics, maploc, every IPC call, all of `robotctl` and `duckctl`. Below it there is one thing —
+`DynamixelIo` — and the IMU is not separate from it, because on this robot the IMU is a Dynamixel
+node read in the same `sync_read` as the fifteen servos.
+
+`FakeIo` was already a full implementation of this trait, which is why `cargo test` needs no
+hardware. `RemoteIo` is the third.
+
+**Where a sensor's daemon *is* its driver, replace neither.** `tofd --fake` already synthesises
+frames at the loop level, and `tof/src/sensor.rs` says in as many words that the off-board `Sensor`
+"is not a fake sensor and must never become one". Simulated depth feeds that existing loop. The same
+reasoning will apply to anything else whose driver cannot be separated from its hardware.
+
+## 3. The body protocol
+
+TCP, newline-delimited JSON, one request and one answer per call. `duck_control::sim` is the
+implementation and carries the reasoning; the short version:
+
+* **TCP** because a unix path is capped at `SUN_LEN` (~108 bytes), and because the simulator must be
+  reachable from outside whatever the daemons run in — a container on Linux, a Linux VM with MuJoCo
+  on the host on macOS.
+* **JSON** because a tick is ~1 KB, so 50 KB/s, against being able to read a frame with `nc` and
+  write the other end in twenty lines of Python. A packed struct shared across two repositories in
+  two languages is how this project has lost days before.
+* **`TCP_NODELAY`**, not as a micro-optimisation: Nagle delays a small write up to ~40 ms, twice the
+  tick, and it would present as a slow simulator.
+
+Requests are `{"op":"hello"|"read"|"write"|"gain"|"torque"|"slow", …}`. The handshake carries
+`protocol` (currently 1) and is checked in both directions, because the two halves live in two
+repositories and "your simulator is old" and "your daemon is old" are otherwise the same symptom.
+
+**The simulator reports in the robot's own units** — radians, rad/s, mA, and the IMU already
+resolved into the trunk frame. MuJoCo knows its own model's ordering, scaling and frames; a
+translation layer on this side would be a second place for that to live and drift.
+
+**A dead simulator is one bad tick.** MuJoCo compiles its model, so changing the number of ducks
+restarts it, and the ducks must live through that. A broken connection is an error returned to the
+caller and a reconnect on the next call — no backoff thread, because the control loop is the retry
+timer.
+
+## 4. Faking the radio costs nothing
+
+Presence is already an IPC contract on `robotd`'s own socket: `chorale.subscribe`,
+`chorale.beacon` (what to advertise) and `chorale.heard` (what was heard, with an *age* rather than
+a timestamp). And `btd` is a **client** of robotd, not a server — so a simulated ether impersonates
+nothing and steals no socket path. One process holds one connection per duck, collects what each
+wants to advertise, and delivers it to the others with an RSSI derived from the distance between
+their bodies.
+
+No change to `robotd`, no protocol work, and three things better than the radio for development:
+the age-based synchronisation path is exercised for real; RSSI from ground truth makes range cutoffs
+and asymmetric links a knob rather than a staging problem; and `from` is documented as an identity
+for de-duplication only, so rotating it on a timer turns the address-rotation bug that cost a day
+into a regression test.
+
+## 5. The radio has to be bad, or the bug hides
+
+A perfect ether hides the bugs a real one causes, and this is measured rather than argued. Four ducks
+in the twin converged on one piece every time — simultaneous starts, staggered starts, no difference
+— because every duck was visible to every other instantly and losslessly. The one property that
+causes the field bug was the one the simulator did not model.
+
+`duck-ether --discovery <s> --loss <f> --seed <n>` makes it a bad radio: a duck takes a while to be
+*noticed*, per pair and timed from when it goes on the air, and a fraction of deliveries is dropped.
+Per pair because it is the asymmetry that splits a flock — one delay shared by everybody cannot
+produce it. Seeded, because a flaky radio is only useful for debugging if its flakiness repeats.
+
+**The reproduction**, four ducks, `a` and `b` singing twelve seconds before `c` and `d` join:
+
+```
+duck-ether --discovery 90 --loss 0.3 --seed 3
+```
+
+On main's chorale:
+
+| duck | part | bar | roster |
+|---|---|---|---|
+| a | *not singing* | — | 1 in range |
+| b | bass | 4 | 3 voices |
+| c | alto | 4 | 2 voices |
+| d | bass | 2 | 2 voices |
+
+Which is the field report — "sometimes nothing happens, sometimes two different songs" — with
+disagreeing rosters and a duplicated part as well.
+
+**What it does not yet prove.** With `chorale-election` merged the same scenario still splits (bars
+5, 12 and 8: three timelines). But at `--discovery 20 --loss 0.4` *both* converge, so ninety seconds
+of discovery is harsher than that branch was written for, and this is not evidence the fix fails on a
+robot. The experiment worth running is a sweep — the discovery value at which each version stops
+converging — which is now a loop over a number rather than four robots and a room.
+
+## 6. Architecture follows the host
+
+Every artifact this project builds is aarch64. The attractive idea was to run the board's own
+binaries on an x86 laptop under `qemu-user` — same bytes, perfect provenance. It was measured, twice,
+and the two results point opposite ways.
+
+**The daemon alone is fine.** CI's real aarch64 artifact, emulated on an x86 laptop:
+
+| | |
+|---|---|
+| `robotctl health` | `50.0 of 50.0 Hz · 3804 ticks · 0 missed` |
+| host CPU | 4.7% of one core, nine ONNX sessions loaded, policy driving |
+| policy inference | 0.029 ms against a 20 ms tick (measured natively) |
+
+Throughput was never the risk — and the slow part of a real tick, the Dynamixel sync-read, is a
+local socket here.
+
+**Under systemd it is not.** Booted in `systemd-nspawn`, aarch64 systemd 257 comes up in 8.7 s and
+then cannot start anything:
+
+```
+robotd.service:            (code=exited, status=226/NAMESPACE)
+systemd-journald.service:  (code=exited, status=243/CREDENTIALS)
+systemd-logind, systemd-tmpfiles, console-getty: the same
+```
+
+qemu-user 8.2 does not translate the new mount API (`fsopen`, `move_mount`, `open_tree`) that
+systemd 257 uses for per-unit namespaces and credentials. Per-unit hardening is the entire reason to
+boot a container rather than run seven processes in a terminal, so losing it loses the point. Newer
+qemu may fix it; in Debian 13 and Ubuntu 25.04 the static packages are transitional and the real
+binaries are dynamically linked, so it is a build-from-source question rather than an apt line.
+
+So the twin runs **the host's architecture**:
+
+* **x86 host** — an amd64 container and a native build. Real units, real hardening, real journal;
+  everything except CI's exact bytes.
+* **arm64 host (Apple Silicon)** — an arm64 container running the robot's own signed artifact,
+  natively. Full provenance, no emulation, identical commands.
+
+The consequence for the update path is small and worth stating plainly: `robotctl update apply` runs
+end to end — preflight, signature, artifact hash, compatibility, health gate, auto-rollback — because
+that is how `dev-push.sh` installs. What an x86 twin cannot do is install a *published* release.
+`board-test.sh` already covers the real artifact on the real architecture in CI.
+
+## 7. What it is and is not a twin of
+
+Identical, because it is the same code on the same path: the control loop, policies, safety, fall
+detection, kinematics, odometry, maploc, the whole IPC surface and its clients, the chorale's
+election and beat, the systemd units with their real `User=`, groups, `RuntimeDirectory=` and
+hardening, and the updater.
+
+Modelled — the real code path, synthesised input: actuator response (BAM models fitted to the real
+XL330s), the IMU, ToF depth, RSSI, the camera image, and release provenance on an x86 host.
+
+Absent — not exercised at all: the Dynamixel bus driver, the BLE radio, the camera ISP and rkaiq's
+3A, the NPU, the hardware encoder and its RGA path, thermals and battery.
+
+**A useful check on that list:** run a week of real bugs past it. A `videoflip` that cost 22 fps by
+breaking the encoder's zero-copy path to the RGA; a 3A engine missing a stream-start event; an
+auto-exposure loop that converges once and stops; an INT8 head whose score channel collapses to two
+values; a servo bus dropping reads. The twin would have caught **none** of them. That is not a flaw
+in the design, it is the boundary of it — and hardware stays the only place the drivers are real.
+
+## 8. The harness
+
+One MuJoCo process, one window, N duck bodies in one scene, so ducks share physics and can bump into
+each other. `microduck_rl` owns that half: it already has the scenes, the BAM actuator models and
+mjlab, and serving a body to a daemon is the mirror of the sim2real it does today.
+
+Each duck is a `systemd-nspawn` container — no daemon, no image format, a container is a directory —
+booted from one Debian 13 Trixie rootfs (`mmdebstrap`, unprivileged, 238 MB, under three minutes)
+with an overlay per duck. Run each as a service (`systemd-run --unit=duck-a …`) so `duck-sim down` is
+a `systemctl stop`: a duck you cannot quit is not much of a duck.
+
+`machinectl shell duck-a` is the way in, `duckctl open duck-a` the way to watch, and
+`scripts/dev-push.sh microduck@duck-a` the way to install a build.
+
+Two limits that follow from the physics rather than the plumbing. **Ducks do not hot-join** — MuJoCo
+compiles its model, so changing the count restarts the simulator, which is why `RemoteIo` reconnects.
+And **camera rendering is the scaling wall**, not the bipeds: N offscreen renders at 30 fps cost far
+more than N fifteen-DoF bodies, so cameras should be opt-in per duck. The 45 Hz health gate makes
+both a hard edge rather than a soft one — too many ducks and they do not get slow, they go
+*unhealthy* and the updater starts rolling releases back.
+
+## 9. Three ways to pick the wrong model
+
+Each of these presents as "the duck is on its back", and each cost an hour.
+
+**`scene_walk.xml` has no collisions.** It includes the model the RL work trains against, whose
+actuator default classes carry `contype="0" conaffinity="0"`. The duck sinks through a floor the
+scene really does contain — trunk z from 0.120 to -0.105 in a second — and the daemon reports a robot
+lying down, correctly. `scene.xml` includes `robot_allcollisions.xml`, and is what a twin wants.
+
+**`qpos0` is not a pose.** Every joint at zero is a shape this robot is never in; the daemon measured
+0.41 rad from its home frame and quite reasonably tried to stand up a robot that was already folded.
+The scenes carry `INIT`, `STAND`, `SIT` and `FOLD`, and `STAND` matches
+`duck_control::DEFAULT_POSITION` — whose right leg is *mirrored*, not symmetric, which is worth
+reading rather than assuming.
+
+**Torque belongs on at startup.** `robotd` never enables torque when it starts, because a daemon
+restarted by an update must leave a standing robot standing — the servos are already holding. A
+simulator that starts limp has its duck on the floor before the first read.
+
+The boot the daemon is actually written for is `--keyframe SIT`: a duck found folded, which it
+recognises and stands up with the sitstand policy.
+
+## 10. Known material to reuse
+
+`~/MISC/microduck_maploc` (outdated in every other respect) has two things worth taking: a simulated
+VL53L5CX in `sim/tof_sensor.py` — 8×8 zones, 45° square FoV, 4 m range, noise that grows with
+distance, 15 Hz — and `sim/assets/apartment.xml`, an indoor scene of 83 geoms. A room is worth much
+more than a ground plane to maploc, to wander, and to anything that hides.
diff --git a/docs/faq.md b/docs/faq.md
new file mode 100644
index 00000000..ef026610
--- /dev/null
+++ b/docs/faq.md
@@ -0,0 +1,83 @@
+# FAQ
+
+Questions that come up when you want a duck to do something it does not do out of the box. The
+design docs say how the machinery works; this says which piece to reach for.
+
+## I want to run a model that is too heavy for the board
+
+Run it somewhere else and send it the camera. The board is a Radxa Zero 3 — the NPU takes a small
+detector and little more — so anything larger belongs off the robot, and a Hugging Face Space on
+paid hardware is the path with the least to build: it already has a GPU option, an account system
+the robot shares, and a URL.
+
+**Use WebRTC.** The robot publishes H.264 over a WebRTC session, your Space consumes it, and the
+rendezvous introduces the two so neither needs to know the other's address. `spaces/vision-demo/`
+is the worked example.
+
+```
+your Space ──sign in, list robots──►  rendezvous  ◄──registers──  the duck
+your Space ◄═══════════ H.264 over WebRTC, media and control ════════════►  the duck
+```
+
+Three things you get for free by staying on WebRTC, and they are the reason it is the default:
+the media is encrypted end to end by DTLS-SRTP, the control channel rides the same session so you
+can *drive* as well as watch, and there is a return path — audio, or a second video track — the
+day you want one.
+
+## Does it work from a data centre? My Space is behind a NAT I do not control
+
+Yes. A robot behind a home router and a container behind a data centre's NAT usually cannot
+hole-punch to each other, so the robot offers a **relay candidate** — short-lived Cloudflare
+credentials it mints with its own account token — and your consumer uses it without holding any
+credentials of its own. `remote-access-design.md` §6 is the mechanism.
+
+Two caveats worth knowing before you are surprised by them:
+
+- **A relay costs the robot owner's bandwidth**, metered per Hugging Face account at 10 GB a
+  month on the free tier. A continuous 720p stream is roughly a gigabyte an hour, so a Space that
+  watches all day will spend it. ICE only relays when it must — a direct pair is used whenever
+  one can be found — but "must" is common between a home and a data centre.
+- **A browser consumer needs relay credentials of its own** when it has no IPv4 of its own; a
+  Python one does not. §6 has the case.
+
+## My consumer is a program and the stream runs all day. Is there something cheaper?
+
+There is a fallback, and it is a fallback rather than a second design: **`media.stream`**, where
+the robot dials *your* WebSocket and pushes frames outbound.
+
+```
+your Space ──media.stream {url: "wss://…/frames"}──►  rendezvous  ──►  the duck
+the duck   ══════════ frames, outbound wss, direct ══════════════►  your Space
+```
+
+It costs nobody's relay, because an outbound connection from the robot needs no hole punched. Use
+it when all three are true: the consumer is a **program** and not a person, the stream is
+**long-running** enough for relay metering to matter, and you need **frames only**.
+
+What you give up by leaving WebRTC, which is why it is not the default:
+
+- **No return path at all.** Nothing reaches the robot on this transport — no audio, no second
+  track, no teleop loop.
+- **No control channel.** Driving the robot means a JSON-RPC call over the rendezvous
+  (`spaces/shared/wire.py`), separately.
+- **Encryption is your TLS, not DTLS-SRTP**, and it terminates at your server rather than at the
+  peer.
+
+The robot sends one text **hello** describing what is coming — `frames.encoding` is `h264` or
+`jpeg` — then one binary message per frame. Branch on the hello rather than sniffing the bytes;
+`spaces/vision-demo/receiver.py` is the reference receiver and `decoder_for` is the branch.
+
+## How does my Space find the robot, and what stops somebody else's reaching it?
+
+The account. The robot registers with the rendezvous holding its own Hugging Face token, your
+Space signs the visitor in with `hf_oauth`, and the service only ever shows an account the robots
+it owns. Nothing is configured on the robot and no robot-side gate is involved —
+`remote-access-design.md` §7 is the argument for why that is enough.
+
+`spaces/shared/rendezvous.py` is the listing call: `ducks(token)` gives you what that account can
+reach.
+
+## Can I test without a robot?
+
+`spaces/vision-demo/fake_duck.py` stands in for one, and `scripts/duck-sim` runs the real daemons
+against a MuJoCo body ([`robot/simulation.md`](robot/simulation.md)).
diff --git a/docs/policy-manifest.md b/docs/policy-manifest.md
index a3e77cb4..321265d0 100644
--- a/docs/policy-manifest.md
+++ b/docs/policy-manifest.md
@@ -3,7 +3,7 @@
 What a `manifest.json` beside a microduck `.onnx` says, and what the robot does with each field.
 One vocabulary for two shapes: a **single-policy repo** (`<user>/microduck-<name>` on the Hub,
 one `policy.onnx`, the fields at the top level) and the **official set**
-(`pollen-robotics/microduck-policies`, nine files, the same fields once per entry under
+(`pollen-robotics/microduck-policies`, ten files, the same fields once per entry under
 `policies`). One reader understands both, and asking a publisher for something is "add a field",
 never "adopt our format".
 
@@ -67,6 +67,10 @@ a policy only on a claim that is present and wrong.
 | `eval` | object | display | free-form: what was checked, in what sim, how it did |
 | `policies[]` | array | set | one entry per file, with `file` plus any per-policy field above |
 
+Recurrent LSTM exports require `model_api: 2`; existing feed-forward exports remain API 1.
+See [recurrent policies](recurrent-policies.md) for the tensor contract, memory lifecycle
+and offline rehearsal.
+
 ## A single-policy repo
 
 ```json
diff --git a/docs/project/idle-cpu.md b/docs/project/idle-cpu.md
index d6e36861..12375bc7 100644
--- a/docs/project/idle-cpu.md
+++ b/docs/project/idle-cpu.md
@@ -4,14 +4,15 @@ A duck sitting on a desk with no pad connected, no viewer, and nothing driving i
 five daemons. This is what they were each doing in that state, what was changed, and — for the
 two candidates that were not — the numbers that say why.
 
-Everything here is arithmetic on the code or a measurement on this machine. **Nothing in it has
-been measured on a board**, and the last section says what that would take.
+Everything here was arithmetic on the code or a measurement on this machine. **Only the test
+pattern has been measured on a board**; the last section says what the rest would take.
 
 ## What was costing something
 
 | | idle before | idle after |
 |---|---|---|
 | `mediad` raw branch | 1.84 MB copied 30×/s | copied when a reader asks — ~2×/s |
+| `mediad` test pattern | 720p30 drawn by the CPU — 29.4% of a core | 256x144@5 — 0.7% of the pixel rate |
 | `tofd` frame poll | ~100 I²C reads/s | ~45 |
 | `padd`, pad connected, sticks centred | 50–100 msg/s | 10 |
 | `pet-detect`, when enabled | ~400 FFTs/s + 4 forward passes/s | none until the room makes a sound |
@@ -19,7 +20,8 @@ been measured on a board**, and the last section says what that would take.
 ### `mediad` copied every frame
 
 The appsink callback copied every buffer off the tee into a slot readers took the latest of.
-At 720p30 — the shipped quality, and `media.camera` defaults on — a UYVY frame is 1 280 × 720 × 2
+At 720p30 — the shipped quality, and `media.source` defaults to the camera — a UYVY frame is
+1 280 × 720 × 2
 = 1.84 MB. The readers are auto-exposure at 2 Hz and the duck detector at 2 Hz when enabled, so
 twenty-eight of every thirty copies were made for nobody: 55 MB/s of memcpy and a 1.8 MB
 allocation thirty times a second, from boot.
@@ -28,6 +30,30 @@ A reader now asks and the callback answers the *next* frame. Answering with the
 would be cheaper again and would put the reader's own polling period into the measurement — an
 exposure loop steering on half-second-old luma hunts rather than settles.
 
+### The test pattern was drawn at the camera's resolution
+
+A board with `[media] source = "test"` streams `videotestsrc` instead, so that a robot with no
+camera still has a session — signalling, negotiation, the datachannel, the control API, all of
+which ride the video track. It ran at `[media] quality`, the same rung a camera streams at.
+
+The difference is where the pixels come from. A camera's frames arrive off the ISP in hardware and
+cost `v4l2src` almost nothing to hand on; a test pattern's are drawn by this process, one packed
+UYVY frame at a time. Two boards, same model, both idle with nothing connected:
+
+| source | idle `mediad` |
+|---|---|
+| `Camera`, rkisp | 6.1% |
+| `Test`, 720p30 | **29.4%** |
+
+Five times the cost of the thing it stands in for, to synthesise 1.84 MB thirty times a second for
+a tee whose readers had all said no — `camera.json` on that board read `"frames":23142` against
+`"consumers":0`.
+
+The pattern now runs at `TEST_PATTERN_GEOMETRY` — 256x144 at 5 fps, 16:9 and 8-aligned like every
+`Quality` rung, 73 KB a frame. That is 0.7% of the pixel rate, and it is not a compromise: nothing
+in what the pattern is *for* wants resolution. `media.video` reports the small geometry, because
+that is what the robot is producing.
+
 ### `tofd` polled a 15 Hz sensor 100 times a second
 
 `data_ready` every 10 ms across the whole 66 ms between frames: about seven I²C transactions to
@@ -35,8 +61,11 @@ find one frame, six of them answered no. The loop now sits out the stretch in wh
 cannot yet have one and polls through the rest. Frame age is unchanged — still bounded by the
 10 ms poll, which is the granularity a frame is noticed at either way.
 
-This runs on every duck with a ToF fitted whether or not anyone uses the theremin, because
-`robotd`'s depth reader subscribes at startup rather than when the instrument is picked up.
+This runs on every duck with a ToF fitted whether or not anyone uses the theremin: `tofd`
+ranges continuously and sends to whoever happens to be subscribed, so no subscriber is the
+normal state and none of this poll is conditional on one. `[theremin] enabled` is off by
+default and does not change the figure — what it saves is `robotd`'s parked read, which was
+never the cost here.
 
 ### `padd` re-sent the same three zeros fifty times a second
 
@@ -107,7 +136,12 @@ measurement on a developer's machine. The four changes want confirming where the
 is:
 
 - `mediad`, `tofd` and `padd` CPU before and after, from `dev-push.sh` and `top -H`. The camera
-  one should be the visible change.
+  one should be the visible change. What exists so far is `mediad` idle on 0.12.0 — 6.1% with a
+  camera, 29.4% with the 720p test pattern — which is an after-figure for the raw branch with no
+  before-figure beside it, and nothing at all for `tofd` or `padd`.
+- The test pattern at 256x144@5 on the board that measured 29.4% at 720p30. The arithmetic says
+  0.7% of the pixel rate; what it actually leaves is `videotestsrc`'s per-frame overhead, which
+  no longer scales with the picture.
 - SoC temperature at idle over ten minutes, which is the number the whole exercise is for. The
   `videoflip` episode took this board to 97 °C and throttled it to 408 MHz, so idle headroom is
   what decides whether a duck walks well while it is also looking at something.
@@ -116,3 +150,10 @@ is:
   doing it.
 - That petting still starts as promptly as it did, on a robot in an ordinary room rather than a
   silent one.
+
+## What came after
+
+The head sensors were the loose end here, and a `ps -L` on a board settled them: `tofd`'s idle ~5%
+is 4.5% head IMU and 0.5% depth, and the IMU has no consumer in the tree at all. So the poll this
+page made cheaper was never the cost, and the thing worth turning off is the sensor nobody asked
+for. See [`tof-on-demand.md`](tof-on-demand.md).
diff --git a/docs/project/npu-bringup.md b/docs/project/npu-bringup.md
index 326f4c8a..a1cb7607 100644
--- a/docs/project/npu-bringup.md
+++ b/docs/project/npu-bringup.md
@@ -8,6 +8,32 @@ here as a quantised `.rknn`. First model, for reference: `yolo11n` at 320×320,
 from three sessions, mAP50 0.976 on a held-out session — and 3.9 MB after INT8 quantisation, which
 kept 2 of 2 detections at 95% box overlap against the float model on the desk.
 
+## Where the model comes from
+
+**The Hub, the way the policies do.** `duck_detector` publishes every run to
+[`pollen-robotics/microduck-duck-detector`](https://huggingface.co/pollen-robotics/microduck-duck-detector)
+— `duck_detect.rknn` for the NPU and `duck_detect.onnx` for the CPU fallback, at the repo root under
+fixed names, one tag per run. Nothing in this repository carries the weights: `mediad` reads them
+from `/opt/robot/detector/current`, and what fills that is
+
+| | |
+|---|---|
+| `scripts/seed-detector.sh` | run by the release's postinstall hook; installs the pin in `[workspace.metadata.detector]` on a board that has nothing, and never touches a set it did not install |
+| `robotctl duck-detector check` | what is installed against what the repo offers |
+| `sudo robotctl duck-detector update [--version <tag>]` | installs a revision and restarts `mediad` onto it |
+
+It is `seed-policies.sh` and `robotctl policy check/update` with a different root and a fixed file
+list, served by the same `updaterd` calls (`detector.check`, `detector.install`), and
+`docs/design/policy-channel-design.md` §9 has the reasoning that carries over: the pin is a floor,
+nothing partial goes live, a retrain is a tag rather than a daemon release.
+
+Two things worth knowing. The model repo **shares its name with the dataset repo**; the robot only
+ever addresses the model (`…/resolve/<rev>/…`, `api/models/…`), and the dataset lives under
+`datasets/`, so nothing on the robot can land on a frame by accident. And `update`'s "newest" is
+decided by **version tags** (`v2` sorts above `v1`; a name like `experimental` never counts), so a
+run meant for robots wants a `vN` tag — the first run was tagged `duck-v1`, which is what the pin
+names and is fine to install by name, but is not a version `check` can rank.
+
 ## What is here
 
 | | |
@@ -99,12 +125,16 @@ that as the price of perception, the two should be measured apart.
 
 ## What is still missing
 
-**Nothing on the robot can get a frame.** `mediad` has a raw NV12 tee branch that exists precisely
-for this — `architecture.md` §5.3 — but no IPC exposes it, which is also why capturing a dataset has
-to stop `mediad` to take the camera. Two ways forward, and they are not exclusive:
+`mediad` has a raw tee branch that exists precisely for this — `architecture.md` §5.3. Two ways
+forward, and they are not exclusive:
 
-- **`media.frame`**: a call that answers with one frame. Useful for far more than perception (a
-  snapshot in the console, a still for a bug report), and it makes capture stop fighting the daemon.
+- **`media.frame`** — **done.** A call that answers with one frame, on `mediad`'s own unix socket
+  (`/run/mediad/media.sock`), group-readable like the other observation sockets. Useful for far
+  more than perception (a snapshot in the console, a still for a bug report), and it means capturing
+  a dataset no longer has to stop `mediad` to take the camera. It answers a JSON-RPC header naming
+  a byte count, then those bytes: a raw frame is ~1.8 MiB, which is not something to base64 into a
+  control reply. It asks the tee for the *next* frame rather than taking a cached one, so a reader
+  cannot be handed the frame a stopped camera stopped on.
 - **The detector inside `mediad`**: subscribe to the raw branch, run the model at a few Hz, and
   publish detections on the state stream. This is where it ends up — perception next to the sensor,
   deriving features rather than shipping pixels — and it is what a behaviour would consume.
@@ -112,3 +142,41 @@ to stop `mediad` to take the camera. Two ways forward, and they are not exclusiv
 Once detections exist as state, the behaviours in `docs/ideas/autonomous_behavior.md` that currently
 key on Bluetooth ("a duck is *nearby*") can key on sight ("a duck is *there*"): approaching,
 following, facing, and a chorale where the ducks look at each other while they sing.
+
+### Taking a snapshot
+
+On the robot, `robotctl frame --output frame.uyvy` saves one fresh packed UYVY frame and prints
+its JSON metadata to stderr: width, height, bytes, capture timestamp, and `rotate` — degrees
+clockwise the camera is mounted from upright, the same number `media.video` tells a WebRTC peer.
+Use those dimensions when converting it, and apply that turn, for example `ffmpeg -f rawvideo
+-pixel_format uyvy422 -video_size 1280x720 -i frame.uyvy -frames:v 1 -vf transpose=1 frame.png`
+for a 1280×720 capture off a 90° mount; do not assume either number after changing the camera
+mode or the mount. The file is written only after the full response arrives.
+
+**The pixels are the ones the sensor delivered, and `rotate` is reported rather than applied** —
+the pipeline stopped turning frames because `videoflip` cost the encoder its zero-copy path and
+the board 22 fps, so every consumer turns for itself. Omit the `-vf` above and the picture is
+sideways with nothing in it to say why, which is exactly what `rotate` exists to prevent. It is
+`0` when `--flip-in-pipeline` already turned them.
+
+From a browser on the robot's LAN, open `http://<robot>:8080/frame`, or save it with
+`curl --fail http://<robot>:8080/frame -o frame.png`. This returns an **upright** PNG, with
+`Cache-Control: no-store`. That route is the exception to the paragraph above, because a PNG has
+nowhere to carry an angle: a quarter-turn mount swaps its width and height against the capture
+geometry, and the cost is one rotation per request rather than one per frame. A stopped or unavailable camera returns HTTP 503, never the
+last good picture. PNG preserves the RGB conversion without JPEG compression; it is not a
+byte-for-byte replacement for the raw UYVY data. This has the same LAN access boundary as the
+existing console and camera stream; there is no additional authentication on this route.
+
+The local endpoint supports `hello`, then `media.frame` on the same connection. Its socket is
+configurable with `mediad --frame-socket <path>` and `robotctl --media-socket <path> frame`.
+Failure to claim the socket aborts startup; an existing file or live listener is left intact.
+There are at most 16 local connections, each limited to five seconds, and at most four HTTP
+snapshot jobs. HTTP capture has a three-second deadline and response metadata is capped at
+4 KiB. Invalid geometry and payloads larger than 16 MiB are refused by both clients.
+
+`media.frame` intentionally has no `Call`/service-lane route: its JSON header is followed by a
+binary tail. Neither the WebRTC control datachannel nor `duckctl`'s current BLE transport
+carries snapshots. Use the local socket or the console's HTTP route; remote video transport is
+separate. A future shared socket-group helper can replace the existing duplicated ownership
+code without coupling this feature to a multi-daemon refactor.
diff --git a/docs/project/tof-on-demand.md b/docs/project/tof-on-demand.md
new file mode 100644
index 00000000..806d5c81
--- /dev/null
+++ b/docs/project/tof-on-demand.md
@@ -0,0 +1,182 @@
+# The head sensors when nobody is looking
+
+`tofd` ranged a laser and read an IMU from boot to shutdown on every duck with the head module
+fitted, whether or not one process was subscribed to either stream. This started as "start the
+unit when it is needed and stop it after" and ended somewhere much smaller, by measuring at each
+step: **the depth stream is not what costs anything, the sensor that does has no consumer at all,
+and nothing inside its loop was worth optimising.** So the laser and the unit were left alone and
+the head IMU got a switch, off by default.
+
+It follows [`idle-cpu.md`](idle-cpu.md), which took `tofd`'s poll from ~100 I²C reads a second to
+~45 and left the question of *why it polls at all* open.
+
+## What it costs, measured
+
+On olducky (Radxa Zero 3, RK3566), an idle board with nothing subscribed to either stream:
+
+```text
+$ ps -L -o tid,comm,pcpu -p "$(pidof tofd)"
+    TID COMMAND         %CPU
+  12209 tofd             0.0
+  12212 tof-sensor       0.5
+  12213 head-imu         4.5
+```
+
+Percentages are of one core, so the ~5% `top` shows for `tofd` is 1.25% of this SoC — and it is
+**nine parts head IMU to one part depth**. The socket-serving runtime, which has nothing to serve,
+costs nothing.
+
+That split is the whole of this document. Two things follow from it.
+
+**The IMU number is the two reads a sample takes.** Not the wakeups, and not the fusion. The
+crate's `bench_imu` runs the loop five ways, 10 s each at 100 Hz, on this board with `tofd`
+stopped:
+
+```text
+  sleep only  (0 reads)   cpu  0.69 %
+  filter only (0 reads)   cpu  1.00 %
+  update      (2 reads)   cpu  3.35 %
+  update_all  (2 reads)   cpu  3.86 %
+  three-reads (3 reads)   cpu  4.20 %
+```
+
+Being woken a hundred times a second is 0.69 points; the Madgwick update adds 0.31; the two I²C
+transactions are the remaining ~2.4–2.9. A gyro sample and an accelerometer sample *are* twelve
+bytes at two addresses, so there is no version of a full sample that costs fewer than two
+transactions — which is why nothing in this loop is worth optimising.
+
+Two caveats on those numbers, since they are the basis for a decision. `update` and `update_all`
+do identical work (one delegates to the other) and came out 0.51 points apart, so the noise floor
+is around half a point — CPU frequency scaling on an A55, most likely. And an earlier run of the
+same three read modes, with `tofd` still holding the bus, compressed them to 4.44/4.46/4.53 and
+made the third read look free. Neither changes the shape: the reads dominate, the floor is small,
+the third read is worth somewhere between 0.3 and 0.9 points.
+
+**Nothing subscribes to it.** `head_imu.stream` has no consumer in this tree: `btd` declines to
+proxy it (`btd/src/route.rs:412`), the updater's degraded IPC declines it
+(`updater/src/ipc.rs:819`), and no daemon subscribes. It was added for the mapping work, which has
+not arrived. So the largest recurring cost in this daemon is a sensor read for nobody.
+
+Worth saying plainly what this is *not*: the walk policy's IMU is a different chip on a different
+bus — the `imu_to_dxl` v2 board on the Dynamixel bus, read in the same 50 Hz `sync_read` as the
+fifteen servos (`duck-control/src/bus.rs`, `duck-control/src/model.rs:76`). Nothing here touches
+it, and nothing here can cost the policy an IMU sample.
+
+## What was decided
+
+**`[head_imu] enabled`, default off.** Nothing in the loop paid off, so the switch is the answer:
+a stream nothing subscribes to should not cost ~4% of a core from boot. It lives in
+`robotd.toml`, where `mediad` already reads `[media]`, so `robotctl configure` writes it and
+offers the `tofd` restart; `tofd --imu` reads the chip for one session without touching the file,
+and a subscriber while it is off gets a reason naming the key rather than the silence an unfitted
+sensor gives. Turn it on when the mapping work reads the stream.
+
+**The redundant third read went anyway**, as bmi088-rs#1 and a `tofd` that takes the sample from
+one call. It is worth 0.3–0.9 points, which is inside the noise of the table above, so it landed
+for the other reasons: the published `accel` becomes the sample the quaternion was computed from
+rather than one read ~200 µs later, and a read can fail in one place instead of two.
+
+**The rate is the remaining lever, and it is linear** — `--imu-hz 50` halves the read cost. Left
+as a flag rather than a config key: the first real consumer decides what rate it needs, and
+guessing now would be a number nobody chose.
+
+**If a consumer ever needs 100 Hz cheaply, the answer is the FIFO.** Both chips have one, so ten
+samples could arrive in one transaction instead of twenty — the only change that attacks the term
+that actually dominates. It costs frame parsing, watermark configuration and up to 100 ms of
+latency, which is why it is not being built for a consumer that does not exist.
+
+## The gating that was designed instead, and is no longer needed
+
+Kept because the reasoning is what led to the switch, and because step 1 is a bug regardless.
+
+### 1. Make "somebody wants this" true — a bug either way
+
+`accept` subscribes a connection to **both** channels before it has read a byte of the request
+(`tof/src/main.rs:612`), so `receiver_count()` counts connections, not interest: a client that
+asked for `head_imu.stream` holds a depth receiver, and one that connects and says nothing holds
+both.
+
+Move the `subscribe()` calls inside the matched arms of `subscriber()`, so a receiver exists only
+where the method is known, and hand the function the two `Sender`s instead of two `Receiver`s. This
+is worth doing on its own — a connection that has asked for nothing should not read as wanting
+depth — and it is the prerequisite for anything below.
+
+### 2. The IMU thread could open on the first subscriber and close after the last
+
+There is nothing expensive to preserve: `open_imu` is a handful of register writes, no firmware and
+no probe. So the thread could wait on an IMU lease, open, read at `imu_hz` while somebody is
+listening, and close when they go — the same 4% saved, without an operator having to know about a
+switch.
+
+**Not built, because the switch got there first and is a tenth of the machinery.** This becomes
+the better answer the moment there *is* a consumer: an opted-in duck would otherwise pay the 4%
+whenever nothing happens to be reading. Two details would decide whether it is done right:
+
+Two details decide whether it is done right:
+
+- **The subscribe answer must not lie.** `ImuStatus` starts at `unavailable: "no reading yet"`,
+  and `head_imu.stream`'s answer is written before the first sample. Cold, that answer would read
+  as "no BMI088 fitted", which is the one thing it must not say on a board that has one. So the
+  handler would signal the thread and wait for the open to resolve — bounded, a couple of hundred
+  milliseconds — before answering `found` or `lost`. (The switch has the same problem and solves
+  it the same way: `ImuStatus::off` is its own sentence, naming the key.)
+- **A cold `quat` is a converging `quat`.** The Madgwick fusion settles over about a second
+  (`tof/src/imu.rs:43`), so a subscriber gets orientation that is still moving where today it gets
+  one converged since boot. `gyro` and `accel` are raw and unaffected. Document it on
+  `method::HEAD_IMU_STREAM`; the first real consumer can say whether it needs a warm filter, which
+  is easy to add then and pointless to guess at now.
+
+### 3. Do not gate the ranging, and do not touch the unit
+
+Both were the plan before the measurement, and both are now closed:
+
+- **Ranging on demand buys 0.5% of one core.** That is what the `tof-sensor` thread costs to hold a
+  laser open, poll it and publish fifteen frames a second, after the poll work in `idle-cpu.md`.
+  Stopping and starting ranging is cheap in itself — `start(hz)`/`stop()` are one transaction each
+  (`tof/src/sensor.rs:293`, `:181`) — but it means a state machine in the one process that owns a
+  shared I²C bus, a resume path that has to be right, and a hardware assumption nobody has tested
+  (that stop-then-start does not re-upload firmware). Half a percent does not buy that.
+- **`robotd`'s theremin can keep subscribing at startup.** Its depth reader connects once and holds
+  (`robotd/src/theremin.rs:237`), which under a ranging gate would have pinned the laser on for
+  exactly the ducks that play notes. With no ranging gate there is nothing to pin, and the reason it
+  connects early — so the first arming window waits only for frames — stands unchallenged.
+
+The one argument left for gating the laser is the VCSEL's own power, which is not CPU and does not
+show up in `ps`. If somebody wants that closed, the number is in the VL53L8CX datasheet; at
+milliamps it stays closed and this bullet can go.
+
+## Why not start and stop the unit
+
+Kept because it is the answer to the question that started this, and because the reason is a durable
+fact about the daemon rather than a measurement.
+
+**The bring-up is seconds, and it is per process.** `Sensor::open` probes the device ID and then
+uploads the ULD firmware — ~90 KB over I²C, "a few seconds at 400 kHz" (`tof/src/sensor.rs:226`) —
+once per process, before ranging. A `monitor` that started the unit on `t` would show an empty grid
+for seconds, and `robotctl theremin` could not begin arming until the upload finished.
+
+**Nothing owns the "off".** Two clients can want depth at once, so stopping on exit needs a
+reference count that survives a client being `SIGKILL`ed, and systemd has none for manually started
+units. A `monitor` killed with Ctrl-\\ would leave the sensor ranging forever.
+
+**It needs privilege no client has.** `monitor` runs as an operator in the `robot` group;
+`systemctl start` wants root or a polkit rule granting `manage-units` on that unit to that group — a
+new install-path artifact that a board provisioned before it would silently not have.
+
+**One unit, two sensors.** Stopping `tofd` stops the head IMU too, which is the sensor this document
+ends up caring about.
+
+Socket activation would fix the privilege and the leak for free — a `tofd.socket` unit owning
+`/run/tofd/tof.sock`, where connecting *is* the start signal and systemd owns the lifecycle. It does
+not fix the firmware, which it moves onto the first connection of every session and repeats on each
+idle exit. It is the right mechanism for the day the *process* is what we want gone; it is not the
+answer to a poll, and after the measurement there is no poll worth answering.
+
+## What is left for a board
+
+- `ps -L` on a duck running the switch, showing no `head-imu` thread at all.
+- The bench again with the CPU governor pinned and the modes interleaved, if anybody wants the
+  third read's worth to better than half a point. Nothing now rests on it.
+- SoC temperature at idle over ten minutes, before and after. ~4% of a core will not be visible in
+  it, and that is the honest expectation to write down rather than discover: this was about not
+  reading a sensor for nobody, not about heat.
diff --git a/docs/recurrent-policies.md b/docs/recurrent-policies.md
new file mode 100644
index 00000000..b162c3ba
--- /dev/null
+++ b/docs/recurrent-policies.md
@@ -0,0 +1,86 @@
+# Recurrent ONNX policies
+
+The runtime accepts feed-forward policies and the explicit-state LSTM export produced by
+mjlab/rsl_rl. Both consume the existing 61D observation and produce the same 14 raw joint
+actions at 50 Hz. Observation normalization must be baked into the exported model.
+The training critic is not deployed. This adds no sensors or action filtering.
+
+## Model contract
+
+All tensors are float32. Inputs and outputs are matched by name, independently of order.
+
+| Model | Inputs | Outputs |
+| --- | --- | --- |
+| Feed-forward | `obs [1, 61]` | One output `[1, 14]` (existing output names remain accepted) |
+| LSTM | `obs [1, 61]`, `h_in [layers, 1, hidden]`, `c_in [layers, 1, hidden]` | `actions [1, 14]`, `h_out [layers, 1, hidden]`, `c_out [layers, 1, hidden]` |
+
+Batch dimensions may be symbolic; inference always uses one robot. Layers and hidden
+width must be positive static dimensions, identical across the four state tensors.
+Each state is limited to 1,048,576 elements. Unsupported names, ranks, types, widths and
+extra tensors fail at load. Warm-up also rejects invalid or non-finite outputs.
+GRU and other recurrent export signatures are not implemented.
+
+Publish recurrent policies with **`model_api: 2`** so older daemons refuse them before
+installation. This daemon also accepts existing API 1 feed-forward models. The manifest
+schema, observation width and action width are unchanged.
+
+## Memory lifetime
+
+Each loaded policy owns preallocated hidden and cell tensors. Every successful inference
+copies both new states into those buffers. Failed inference clears memory; non-finite
+outputs are rejected before either state is committed. Warm-up state is discarded.
+
+Memory starts at zero on initial activation, on switching networks (including switching
+back), explicit disable, controller reset after a pause or fall recovery, and a chained
+skill restarting. Brief sensor dropouts follow the existing resume grace period.
+Command changes within an active network retain memory.
+
+Replacing an inactive slot preserves the active network's memory only when its ONNX file
+has the same SHA-256 digest. A changed active model starts fresh, even at the same file path.
+Use self-contained ONNX exports for this guarantee: externally referenced weight files
+are not part of the ONNX file digest. An explicit controller reset always clears all slots.
+
+Existing action scaling and optional runtime filters retain their configuration. For a
+policy trained without action filtering, disable those filters in its deployment tuning;
+adding recurrence does not make a mismatched filter configuration valid.
+
+## Offline rehearsal and board timing
+
+The example uses the production Rust inference path and never opens the motor bus:
+
+```sh
+export ORT_DYLIB_PATH=/path/to/libonnxruntime.so
+cargo run --release -p duck-control --example policy-rehearsal -- policy.onnx > rehearsal.json
+```
+
+It warms up the actor, clears state, then measures 1,000 inferences with nominal gravity,
+zero commands and previous-action feedback. JSON includes p50/p95/p99/max latency, the
+number exceeding 20 ms, and the actions. Run the built example **on the Radxa** to establish
+onboard timing; development-host timings do not establish the robot's timing budget.
+These timings exclude sensor reads, motor writes and scheduling delays.
+
+For deterministic multi-step comparison against PyTorch or Python ONNX Runtime, supply a
+JSON array of records as the second argument:
+
+```json
+[{"obs": ["replace with exactly 61 numbers"], "reset": true}]
+```
+
+Each record supplies the complete observation, including previous actions. Set `reset` at
+episode boundaries. Compare the returned action sequence to the reference with the same
+observations and resets. This checks inference and memory handling, not physical sim2real
+transfer. Export trained checkpoints through the training repository's normalized exporter.
+
+## Tests
+
+```sh
+cargo test -p duck-control
+# Requires ONNX Runtime >= 1.23:
+cargo test -p duck-control --test recurrent_policy -- --ignored
+cargo test -p robotd recurrent_memory_resets_with_controller_feedback -- --ignored
+```
+
+Tiny checked-in fixtures use an actual ONNX LSTM operator. They exercise memory continuity,
+resets, policy switches, fallback selection, warm-up, hot swaps, dynamic batch dimensions,
+invalid contracts and non-finite state. Regenerate with
+`python duck-control/tests/fixtures/generate.py` in an environment with `onnx` and `numpy`.
diff --git a/docs/robot/cheatsheet.md b/docs/robot/cheatsheet.md
index d6c3676d..e286380f 100644
--- a/docs/robot/cheatsheet.md
+++ b/docs/robot/cheatsheet.md
@@ -90,7 +90,11 @@ this is relative motion and it drifts; it answers "did it walk in a circle" and
 angles between degrees and radians; `t` opens the [ToF matrix](#the-tof-sensor-tofd); `d` toggles
 the robot view and `[` / `]` orbit it; `p` opens the pad's raw input stream — every evdev report
 from the gamepad, with the gaps between them, which is the only place a stalled radio is visible
-([pair a gamepad](pair-a-gamepad.md#when-it-drops-while-you-are-driving)). Angles are degrees on screen — joints, head and the yaw rate.
+([pair a gamepad](pair-a-gamepad.md#when-it-drops-while-you-are-driving)). A pad with an inertial
+unit — the Pro Controller clones have one, the Xbox does not — grows that block by a panel: a
+wireframe pad that tilts and turns with the one in your hands, its pitch, roll and drifting yaw,
+the raw acceleration and rates, and whether the gyro's rest bias has been learned yet (hold it
+still half a second). The yellow bar is the pad's front edge. Angles are degrees on screen — joints, head and the yaw rate.
 Redirected or piped it prints one line per tick instead, so `> run.log` and `| grep FALLEN`
 behave, and those numbers stay radians whatever the screen is set to. The joint vectors are in
 `--json`, which carries the whole state, one object per line:
@@ -118,7 +122,8 @@ about a robot behaving oddly, and until now answering it meant a full-screen edi
 An interactive editor over `/etc/robot/robotd.toml`: every key the daemons know, the feature
 switches first (policy on/off, walk/roller, limp-fall, audio, pet detection, battery
 shutdown, camera and video quality…), current value against default, one line of doc. SPACE toggles, ENTER types a
-value, `u` reverts a key to its default. Values in yellow (marked `•`) are the keys where
+value, `u` reverts a key to its default, `ctrl+f` opens a fuzzy search over everything on
+screen (the selection follows as you type; ENTER or ESC keeps it there). Values in yellow (marked `•`) are the keys where
 this robot diverges from the defaults; everything else is the built-in default, and `unset`
 optionals show what they resolve to `(auto)`.
 
@@ -134,8 +139,10 @@ Three properties worth trusting:
 - **It cannot write a file robotd refuses to start on.** Every save is validated through the
   daemon's own loader first, atomically (temp file + rename), and rejected with the reason.
 
-The daemons read the file once at startup, so saving offers a restart — of the ones that read
-what you changed: `[media]` is `mediad`, everything else is `robotd`. `sudo`, because the file
+Saving offers what the change actually needs, from the daemon that actually reads it: a restart
+for most keys (`[media]` and `[duck_detector]` are `mediad`'s, `[head_imu]` is `tofd`'s), a `robotd`
+*reload* for `[policy]` — the motors stay powered — and nothing at all for `[pad]` and
+`[pad_imu_head_control]`, which `padd` picks up within a second. `sudo`, because the file
 is root-owned — without it the editor opens read-only and says so on the first write.
 `--file` points it elsewhere for a bench copy. The shipped `deploy/robotd.toml` stays the
 reference for *why* each knob exists; this is for flipping them.
@@ -147,9 +154,12 @@ sudo robotctl configure
 ```
 
 Set `media.quality` — `1080p30`, `720p30`, `720p15` or `360p30` — and take the restart it
-offers. `media.camera` off streams a test pattern instead, which is what a board with no camera
+offers. `media.source` set to `test` streams a test pattern instead, which is what a board with
+no camera
 wants: the WebRTC *control* channel rides on the video track, so a pipeline that cannot start
-costs both. `media.bitrate` follows the quality unless you set it; the unit is bits per second.
+costs both. The pattern ignores `media.quality` and runs at 256x144@5 — it is there to make the
+session exist, and drawing a 720p one costs five times the CPU a real camera does.
+`media.bitrate` follows the quality unless you set it; the unit is bits per second.
 
 `media.congestion_control` is the other knob in that section, and it is the one that moves CPU:
 `disabled` drops the bandwidth estimator, which is the largest single consumer in `mediad` (7.6% of
@@ -212,6 +222,23 @@ name one — `--version v1` is how to go back. The robot returns to its home pos
 slot and drives again, and **a slot you loaded yourself is left alone**, because it points
 somewhere else entirely.
 
+#### A newer duck detector
+
+The model `mediad` finds other ducks with lives on the Hub the same way
+(`pollen-robotics/microduck-duck-detector`) and versions on its own line:
+
+```
+robotctl duck-detector check
+```
+
+```
+sudo robotctl duck-detector update
+```
+
+Same shape as the policy pair — `--version <tag>` names one, and `check` changes nothing. `update`
+restarts `mediad`, which drops the console's video for a moment; whether the detector then runs at
+all is `[duck_detector] enabled` in `robotctl configure`.
+
 #### Trying your own file
 
 No release, no file to edit, no restart:
@@ -411,6 +438,7 @@ sudo robotctl robot init
 
 ```
 sudo robotctl robot relax --yes
+sudo robotctl robot reboot-motors           # every servo; or `reboot-motors 3 11` for just those. Torque off, then init / Start
 ```
 
 `init` powers the joints and ramps to the home pose over about two seconds — **it moves every joint**,
@@ -429,6 +457,13 @@ corrupt each other's replies:
 sudo systemctl stop robotd && sudo /opt/robot/daemon/current/bin/robotd init && sudo systemctl start robotd
 ```
 
+**Replacing a motor** needs no configuration tool. Fit the new servo straight from the box (ID 1,
+57 600 baud), power the servos, and `robotd` — or `robotd init` — finds the one joint that no longer
+answers, flashes the new servo as that joint, sets its registers and reboots it. The journal says
+`factory-fresh servo on the bus; flashing it as the missing joint` and then `replacement servo
+adopted`. One at a time: with two joints missing it cannot tell which the new servo is for, waits,
+and says so.
+
 `init` works whether or not the robot has fallen — by default a fall is a *report* (visible in
 `robotctl monitor`), not a gate, matching the prototype. A board that sets `[safety] fall_limp`
 or `fall_recover` in `robotd.toml` arms the gate: there a fallen robot goes limp and refuses
@@ -467,8 +502,8 @@ mapping is the prototype's, so muscle memory carries over:
 | --- | --- |
 | left stick | drive: forward/back and strafe · head: head yaw and pitch · body pose: up and crouch |
 | right stick | drive: turn · head: neck pitch and head roll · body pose: pitch and roll |
-| **Start** | toggle the policy — nothing moves until it is on |
-| **Y** / triangle | head mode: sticks pose the head (body holds still) |
+| **Start** | first press: torque on and a 2 s ramp to the home pose, then hold. Second press: the policy drives. After that it toggles the policy |
+| **Y** / triangle | head mode: sticks pose the head (body holds still). With `[pad_imu_head_control] enabled` and a pad that has an IMU: the pad's tilt poses the head and the sticks keep driving — see below |
 | **B** / circle | body-pose mode: sticks lean and crouch the standing robot |
 | **A** / cross | ground pick |
 | **X** / square | roulade — one forward roll; hold to chain rolls |
@@ -476,7 +511,23 @@ mapping is the prototype's, so muscle memory carries over:
 | **DPad-Down** | sit ↔ stand |
 | **RT / LT** | mouth (either trigger) — RT also quacks; LT rides the "wheee" while held |
 | **DPad-Up**, held 3 s | switch drive mode, walk ⇄ roller |
-| **Select**, held 2 s | sit down, then power off |
+| **DPad-Right** | reboot every servo: the way back from a tripped overload without pulling the battery. Torque off, then Start |
+| **Select**, short press | torque off (`robot.relax`) **on release**: the emergency stop. The robot drops, so hold it. Then Start stands it up again |
+| **Select**, held 2 s | sit down, torque off, power off — the release afterwards does nothing more |
+
+**Drive the head with the pad itself.** A Pro Controller carries an IMU, and with
+
+```bash
+sudo robotctl configure      # Controller-IMU head control → enabled
+```
+
+Y changes meaning on such a pad: the first press hands the head to the pad — tilt it and the head
+tilts, turn it and the head turns — while the sticks go on driving the body. Press Y again and the
+head holds where it is, sticks still driving. Press it a third time and the pad drives the head again
+**from wherever the pad is now**: its yaw is a gyro's word alone and drifts, and re-centring on every
+re-entry is how you beat the drift without a magnetometer. `gain` in the same section is head
+radians per pad radian, 1 by default. On an Xbox pad, or with the switch off, Y is the stick head
+mode above. `padd` picks the change up within a second; no restart.
 
 There is no stop button: release the sticks and the robot stands, and `robotd`'s deadman stops it
 if `padd` dies. On a roller robot (`mode = "roller"` in `robotd.toml`) the sticks take the roller
@@ -656,6 +707,11 @@ closer is higher — and the mouth opens with the note, wide at the top of the r
 until Ctrl-C and puts the instrument down on the way out. `--off` puts down one a client left
 up.
 
+**Off by default** — `[theremin] enabled` in `robotd.toml`, per duck, like the chorale above.
+`robotctl configure` is the way to set it, and it offers the `robotd` restart that picks it up;
+until then `robotctl theremin` refuses and names the key. Nothing else turns off with it: `tofd`
+runs regardless, so the depth grid below works on a duck that has never played a note.
+
 An explicit mode with nothing clever inside it: while it is up, the nearest return inside the
 playable band is the hand. Point the duck at open space and it is silent; point it at a wall
 40 cm away and it plays a steady note. It plays sitting, standing or walking — the mouth is
@@ -725,6 +781,19 @@ provisions the bus itself; the ToF step only adds the stable `/dev/i2c-pihat`
 name. Both sensor generations are supported — a VL53L5CX and a VL53L8CX are
 interchangeable on the board, and the daemon picks the driver from an ID read.
 
+#### The head IMU (`head_imu.stream`)
+
+`tofd` also serves the head module's BMI088 — gyro, acceleration and a Madgwick
+orientation — and it is **off by default**: `[head_imu] enabled` in `robotd.toml`,
+set with `robotctl configure`, which offers the `tofd` restart. Reading it costs
+~4% of a core at 100 Hz and nothing subscribes yet, so a duck that is not mapping
+was paying that from boot. A subscriber while it is off gets a reason naming the
+key, not the silence an unfitted sensor gives. `tofd --imu` reads it for one
+session without touching the file, and `--imu-hz` trades rate for cost linearly.
+
+None of this touches depth: the ToF ranges either way, so the grid above works on
+a duck whose IMU has never been switched on.
+
 ### Wifi (`configd`)
 
 ```
diff --git a/docs/robot/dev-push.md b/docs/robot/dev-push.md
index f9d0b949..7f552b22 100644
--- a/docs/robot/dev-push.md
+++ b/docs/robot/dev-push.md
@@ -333,7 +333,7 @@ This should not have been necessary, so it is worth reading the journal for why
 | | |
 |---|---|
 | `DUCK_ROBOT` | The robot, by name. Its address is found over Bluetooth and cached. |
-| `DUCK_BOARD_USER` | The ssh user on the board, for the name path. Default `radxa`. |
+| `DUCK_BOARD_USER` | The ssh user on the board, for the name path. Default `radxa`. `duckctl ssh` and `duckctl scp` read it too. |
 | `DUCK_PIN` | The robot's pairing PIN, if it is not the factory `000000`. Read by `duckctl`. |
 | `DUCK_BOARD_CACHE` | Where resolved addresses are cached. Default `~/.cache/duck/boards`. |
 | `DUCK_BOARD` | The board, by address, instead of an argument. `radxa@192.168.1.42`. |
diff --git a/docs/robot/duckctl.md b/docs/robot/duckctl.md
index c3d02dbe..0e4cccc2 100644
--- a/docs/robot/duckctl.md
+++ b/docs/robot/duckctl.md
@@ -74,6 +74,46 @@ ssh radxa@$(duckctl ip)
 connects to nothing, needs no PIN, and takes about a second — and the answer is not stale: `btd`
 re-reads the address every five seconds and re-advertises when it moves.
 
+Or skip the substitution:
+
+```bash
+duckctl ssh
+```
+
+```bash
+duckctl ssh -- sudo robotctl pad pair
+```
+
+`ssh` finds the address the way `ip` does and then becomes `ssh`, so the prompts, the terminal and
+the exit status are ssh's own. The account is `--user`, else `DUCK_BOARD_USER` from the environment
+— the variable [`dev-push.sh`](dev-push.md) reads, so a laptop set up for pushing is set up for this
+— else `radxa`. Words after `--` run on the robot instead of opening a shell.
+
+Files go the same way:
+
+```bash
+duckctl scp report.md :/tmp/
+```
+
+```bash
+duckctl scp :/var/log/robotd.log .
+```
+
+A path starting with `:` is on the robot — `scp`'s own `host:path` with the host left out, since the
+host is the part this finds for you. Everything else reaches `scp` as typed, `-r` and the rest of
+its flags included, and the progress meter and the exit status are `scp`'s own. The account resolves
+the way `ssh`'s does.
+
+This tool's own flags come first, before the paths:
+
+```bash
+duckctl --name ducky scp -r logs/ :/tmp/
+```
+
+A copy with no `:` anywhere in it is refused before the scan, because it is a local-to-local copy
+that no robot is party to and nothing in `scp`'s output would say so. A local file that really is
+named `:foo` is `./:foo`.
+
 A robot bonded to this machine often stops advertising the service to it, and then `ip` connects and
 asks `net.status` instead. That is slower and needs the PIN, and it always answers. `--verbose` says
 which of the two happened.
@@ -248,6 +288,50 @@ duckctl --name <robot-name> version
 The API version, the release, and the git revision it was built from. A `revision` of `null` means
 the release was built on somebody's laptop rather than by CI.
 
+## Logs
+
+```bash
+duckctl --name <robot-name> logs robotd
+```
+
+The last 40 lines of that daemon's journal, this boot. For more, and for the boot before this one:
+
+```bash
+duckctl --name <robot-name> logs robotd -n 200
+```
+
+```bash
+duckctl --name <robot-name> logs btd --boot -1
+```
+
+Readable units: `updaterd`, `robotd`, `configd`, `btd`, `padd`, `mediad`, `tofd`, plus
+`bluetooth` and `NetworkManager`. The `.service` suffix is optional, and anything else comes back
+refused with that list.
+
+Lines go to stdout and everything else to stderr, so `logs robotd -n 200 | grep -i panic` works.
+A long tail is trimmed to what the radio can carry, oldest lines first, with a note saying so.
+
+A tail that spans a restart says where:
+
+```
+2026-09-09T12:27:20+00:00 systemd[1]: Starting robotd.service - Robot control daemon...
+-- new robotd process, pid 3227 --
+2026-09-09T12:27:21+00:00 robotd[3227]: control loop running joints=15 hz=50.0 driving=true
+```
+
+Which matters after an update, when forty lines carry two different builds' output. Anything in
+`-- … --` comes from the robot rather than the journal.
+
+There is no `-f`, no `--since` and no search. For those, ssh in:
+
+```bash
+ssh radxa@$(duckctl --name <robot-name> ip)
+```
+
+```bash
+journalctl -u robotd -f
+```
+
 ## Updates
 
 Same words as `robotctl update`, so a command learned on the robot works here. Every one of them
@@ -549,7 +633,8 @@ minutes with nothing arriving at all — which is why they are the way to run an
 ## What it prints
 
 Replies go to stdout as pretty JSON, and everything else — progress, diagnosis, what the radio
-saw — to stderr. So `duckctl ... info > reply.json` keeps the two apart, and a JSON-RPC error
+saw — to stderr. `logs` is the exception and prints its lines as lines, since a journal tail in
+escaped JSON is unreadable; a refusal from it still prints as JSON. So `duckctl ... info > reply.json` keeps the two apart, and a JSON-RPC error
 from the robot still exits non-zero. Progress lines start with `·` and are one line each, so
 `update apply > outcome.json` leaves them on screen and keeps the outcome in the file.
 
diff --git a/docs/robot/pair-a-gamepad.md b/docs/robot/pair-a-gamepad.md
index 072a4eb2..9639efd5 100644
--- a/docs/robot/pair-a-gamepad.md
+++ b/docs/robot/pair-a-gamepad.md
@@ -14,6 +14,12 @@ On an **Xbox** controller this is two presses, and the second is the one that go
 
 On a **DualSense**: hold Create and PS together until the light bar flashes.
 
+On a **Pro Controller** — the no-name Switch-style pads, which bluetoothctl lists as
+`Pro Controller` — hold the small **Sync** button on the top edge, next to the USB-C port, until the
+player lights sweep back and forth. It is a classic Bluetooth (BR/EDR) pad, the Xbox one is LE, and
+the robot pairs the two in opposite orders; `pad pair` picks the right one by itself, and
+[pairing one by hand](#pairing-a-pro-controller-by-hand) says what the order is if you have to.
+
 ## Pair it
 
 ```bash
@@ -57,6 +63,21 @@ padd    active — driving whatever pad connects
 Two lines, because they fail separately: a connected pad with a dead driver looks exactly like a
 working robot ignoring you.
 
+A Pro Controller also carries a six-axis IMU, which the kernel exposes as a second input device
+beside the one that drives. `robotctl monitor`, with `p` for the pad block, shows it as a panel
+that appears only when the pad has one: a wireframe pad posed like the real one, pitch and roll
+from gravity, yaw from the gyro alone (it drifts — nothing on a pad observes heading), and the
+gyro's rest bias, which the clone needs learned before the picture stops turning on its own. Set
+the pad down for half a second and the panel says `settled`. The stream costs nothing while the
+monitor is not open: `padd` reads the IMU node only while somebody is subscribed to the tap — or
+while it is steering the head from it, below.
+
+The same attitude can drive the robot's head. `sudo robotctl configure`, section *Controller-IMU
+head control*, `enabled`: Y then hands the head to the pad's tilt while the sticks keep driving,
+Y again holds the head, and a third Y re-centres on the pad's current attitude and follows again —
+the [cheat sheet](cheatsheet.md#gamepad-configd) has the full cycle. The picture in the monitor and
+the head use one filter, so where the drawn pad points is where the head goes.
+
 `paired but NOT trusted` is the state worth knowing. It works now and does not reconnect after a
 reboot, because approving a reconnection needs an agent and at boot there is none. Re-run `pad pair`
 to fix it.
@@ -129,6 +150,44 @@ to check and how to drop it.
 Both are workarounds for the aic8800 radio, not properties of the design. They go when the radio
 does.
 
+### A classic pad and bluetoothd's CPU
+
+A Pro Controller streams IMU samples in every packet, about 200 packets a second, whether or not
+anyone touches it. With BlueZ's default `UserspaceHID=true` each one is relayed by bluetoothd through
+uhid, and that cost 16% of a core on graphite with the pad idle. `scripts/setup-board.sh` sets
+`UserspaceHID=false` in `/etc/bluetooth/input.conf` on every board, which hands the channel to the
+kernel's `hidp` and takes bluetoothd out of the data path — measured 0.0% afterwards, same driver,
+same input nodes, same bond. It applies at the next boot. An LE pad such as the Xbox is untouched by
+the setting: HID over GATT never went through `input.conf`. A board provisioned before this exists
+gets it by re-running the script:
+
+```bash
+sudo sh scripts/setup-board.sh && sudo reboot
+```
+
+## Pairing a Pro Controller by hand
+
+Only if `pad pair` is not available. The order matters and is the **reverse** of the Xbox one:
+
+```bash
+bluetoothctl pair 98:B6:E9:28:06:09
+```
+
+```bash
+bluetoothctl connect 98:B6:E9:28:06:09
+```
+
+```bash
+bluetoothctl trust 98:B6:E9:28:06:09
+```
+
+`connect` first — which bonds as a side effect — ends in the state that is hardest to read: the pad's
+light goes solid, `pad status` says `connected`, `bluetoothctl info` says `Paired: yes` and
+`Connected: yes`, and **no input device exists**, so `padd` sits at "waiting for padd to open a pad"
+and nothing drives. Recover with `sudo robotctl pad forget <address>`, put the pad back into pairing
+mode and pair again. Running `pad pair` never produces this state: it knows the pad is classic from
+the class BlueZ reports and pairs before it connects.
+
 ## When pairing fails every time
 
 Check `/etc/bluetooth/main.conf` for the `Privacy` setting. It should read `Privacy = device`.
diff --git a/docs/robot/simulation.md b/docs/robot/simulation.md
new file mode 100644
index 00000000..e0cd43f5
--- /dev/null
+++ b/docs/robot/simulation.md
@@ -0,0 +1,175 @@
+# The simulated duck
+
+A duck in MuJoCo, driven by the real daemons. You develop against it exactly as you develop against
+a robot on the desk: the same `robotd`, the same policies, the same 50 Hz loop, the same `robotctl`,
+the same console. Only the body is different.
+
+This page is how to use it. [`design/simulation.md`](../design/simulation.md) is what it is and is
+not a twin of, and why it is built the way it is.
+
+## What it is
+
+`robotd --sim host:port` runs the daemon with `duck_control::sim::RemoteIo` in place of the servo
+bus: every tick, joint positions, velocities and the IMU come in over a TCP socket from a MuJoCo
+process, and the policy's targets go back out. Everything above that seam — the control loop, the
+policy, safety, fall detection, kinematics, odometry, the whole IPC surface — is the code a robot
+runs, unchanged and unable to tell. `tofd --sim` gets its 8×8 depth frames from the same simulator;
+`mediad --sim-camera` gets a rendered head-camera image, mounted a quarter turn off like the real one.
+
+The MuJoCo half lives in [`microduck_rl`](https://github.com/pollen-robotics/microduck_rl) as
+`duck-body`: one process, one window, N duck bodies in one scene, with the BAM actuator models the
+policies were trained against.
+
+**What it is good for:** anything in the daemons and their clients — IPC, `robotctl`, the console,
+the updater, the chorale, policies standing and walking, mapping. **What it cannot tell you:**
+anything in a driver. The Dynamixel bus, the BLE radio, the camera ISP, the NPU and the hardware
+encoder are absent, not modelled; a bug in one of those is only visible on a robot.
+
+## What you need
+
+- This repo, built for your machine (`cargo build` happens on its own).
+- A checkout of `microduck_rl` with its venv, at `~/Pollen/microduck_rl` or wherever `DUCK_SIM_RL`
+  points. It provides `duck-body`, the scenes, and the `libonnxruntime` a laptop otherwise lacks.
+- For the container form only: `sudo`, `systemd-nspawn` (package `systemd-container`) and
+  `mmdebstrap`. The script says which one is missing and prints the line to install it.
+
+## `up` or `boot`?
+
+Both drive the same MuJoCo body with the same `robotd`. They differ in what the daemons run *under*.
+
+| | `scripts/duck-sim` (`up`) | `scripts/duck-sim boot N` |
+|---|---|---|
+| The daemons run as | plain processes, your user, a pidfile each | systemd services inside a `systemd-nspawn` container per duck, from the real unit files |
+| Needs | nothing beyond the repo and `microduck_rl` | `sudo`, a one-time Debian rootfs build |
+| Starts in | seconds | a minute the first time, seconds after |
+| Identity | your laptop's; several ducks are one process tree | a machine-id, a voice and a socket per duck, and `duck-ether` between them |
+| Exercises | the control loop, policies, IPC, `robotctl`, the console | all of that, plus `User=`/groups/`RuntimeDirectory=`/hardening, the updater's apply, health gate, rollback and restart order, `journalctl` |
+
+Rule of thumb: **`up`** when you are working on the control loop, a policy, IPC or a client.
+**`boot`** when you are working on anything that touches systemd, the updater or provisioning, or on
+more than one duck talking to another. Two of the bugs this simulator has caught were a daemon whose
+user did not exist, so its unit never started — a class `up` cannot see at all.
+
+## One duck, no container
+
+```sh
+scripts/duck-sim                # a MuJoCo window opens, the duck stands up, and it is yours
+scripts/duck-sim status         # health, and whether it is standing
+scripts/duck-sim drive          # walk forward for 8 s (args: vx vyaw, default 0.15 0)
+scripts/duck-sim ctl health     # anything robotctl does, aimed at this duck
+scripts/duck-sim monitor        # robotctl monitor: joints, IMU, ToF, sticks
+scripts/duck-sim log            # robotd's log
+scripts/duck-sim simlog         # the MuJoCo side
+scripts/duck-sim realtime       # how fast the world is running (see below)
+scripts/duck-sim down
+```
+
+Without an argument the script builds the daemons from the branch you are on, writes a params file
+naming the policies in this repo, starts `duck-body`, `tofd --sim` and `robotd --sim` under
+`~/.cache/duck-sim`, and enables the standing policy. `ctl` is `robotctl` pointed at that duck's
+sockets, which is the only thing that is different from a robot: on a board the sockets are under
+`/run`, here they are under the state directory.
+
+To talk to it from your own tools, the sockets are `~/.cache/duck-sim/duck-a.sock` (robotd; `duck.sock`
+is a link to whichever duck `ctl` talks to) and `~/.cache/duck-sim/duck-a-tof.sock`, and the body is
+on TCP port 7801.
+
+## Several ducks, each a machine you log into
+
+```sh
+scripts/duck-sim boot 4         # four ducks in one world, each in its own container (sudo)
+scripts/duck-sim shell          # you are on duck-a
+scripts/duck-sim shell duck-c   # or any other
+duck-a # robotctl health
+duck-a # journalctl -u robotd -f
+scripts/duck-sim down
+```
+
+`boot` runs each duck's daemons under real systemd in a `systemd-nspawn` container, booted from one
+Debian 13 rootfs (built once, about three minutes, kept under the state directory) with an overlay
+per duck. That buys the part the plain form cannot fake: the real unit files with their `User=`,
+groups, `RuntimeDirectory=` and hardening, under a real init — so `robotctl update apply`, the
+health gate and the restart order behave as they do on a robot. Ducks are `duck-a`, `duck-b`, ... and
+each has its own machine-id and its own voice.
+
+With more than one duck the script also starts `duck-ether`, a fake radio that carries the chorale's
+BLE beacons between containers. It is deliberately a *bad* radio — dropped and delayed beacons —
+because a perfect one hides the bugs the real one shows.
+
+The first time, `boot` builds the rootfs and may ask you to install `mmdebstrap`. Every duck is a
+systemd unit, so `down` is a `systemctl stop`, never a key combination.
+
+## A room to look at, and eyes to look with
+
+```sh
+DUCK_SIM_SCENE=apartment DUCK_SIM_CAMERAS=a scripts/duck-sim boot 2
+```
+
+The default world is a bare floor. `apartment` is six rooms in 7×6 m with doorways off centre on
+purpose, so a pose is recognisable from the duck's 45° forward view; anything with a slash is a path
+to your own scene, and `microduck_rl`'s `scene_*.xml` files are the built-in ones.
+
+Cameras are opt-in per duck (`a`, `a,c`, or `all`) because a rendered frame costs 12 ms against
+0.3 ms to step four ducks' physics: one camera is a third of a core, four is most of one. Each duck
+with a camera gets its own `mediad`, and its console is served at `http://127.0.0.1:8080`, `8081`,
+... by index, exactly the page a robot serves.
+
+## Knobs
+
+Environment variables, all optional:
+
+| Variable | Default | What it does |
+|---|---|---|
+| `DUCK_SIM_RL` | `~/Pollen/microduck_rl` | Where `duck-body`, the scenes and the ONNX runtime are. |
+| `DUCK_SIM_STATE` | `~/.cache/duck-sim` | Sockets, logs, params, the rootfs and the ducks' overlays. Short on purpose: a unix socket path is capped at about 108 bytes. |
+| `DUCK_SIM_DUCKS` | `1` | How many ducks; `boot N` sets it too. |
+| `DUCK_SIM_SCENE` | bare floor | A scene name (`apartment`) or a path. |
+| `DUCK_SIM_CAMERAS` | none | Which ducks render a camera: `a`, `a,c`, `all`. |
+| `DUCK_SIM_DUCK` | `duck-a` | Which duck `ctl` and `monitor` talk to. |
+| `DUCK_SIM_KEYFRAME` | `SIT` | Where a duck starts: `SIT` folded on the floor (the standing policy rises from it), `HOME`, `STAND`, `FOLD`. |
+| `DUCK_SIM_VIEWER` | `1` | `0` runs MuJoCo headless. |
+| `DUCK_SIM_PORT` | `7801` | The first duck's body port; +1 per duck. |
+| `DUCK_SIM_FRAME_PORT` | `7901` | The first camera's frame port; +1 per camera. |
+
+## Things worth knowing
+
+**Real time matters.** The daemons' loops are wall-clock. A simulator running below 1.0× real time
+is not merely slow to watch: the policies are driving a robot that moves less than they expect, and
+they cannot balance it. `scripts/duck-sim realtime` reports the factor, and `boot` prints it. Too
+many ducks, or too many cameras, and the ducks do not get slow — they go *unhealthy* at the 45 Hz
+gate, and in the container form the updater starts rolling releases back. Fewer ducks, fewer
+cameras, or a headless viewer are the fixes, in that order.
+
+**Ducks do not hot-join.** MuJoCo compiles its model, so changing the number of ducks restarts the
+simulator. The daemons survive that: `RemoteIo` reconnects on the next tick, and a duck whose body
+is briefly gone reports unhealthy rather than dying, the same as a robot with no power on the bus.
+
+**`--sim` is not `--fake`.** `robotd --fake` is a robot made of nothing: no physics, positions echo
+back perfectly, nothing falls over. It is for unit tests and for laptop work that needs no body at
+all. `--sim` is the twin. The two flags are mutually exclusive.
+
+**A duck should not think it is a laptop.** A duck's voice and its chorale identity are derived from
+the hardware serial, which several ducks on one machine would share. The script sets
+`DUCK_IDENTITY` per duck so they differ; nothing on a robot sets it.
+
+## By hand, without the script
+
+Each half takes a `host:port` and can be run alone, which is useful when something is wrong:
+
+```sh
+# the body, from the RL repo's venv
+duck-body --ducks 1 --port 7801 --keyframe SIT
+# the daemons, from this repo
+target/debug/tofd --sim 127.0.0.1:7801 --socket /tmp/d/duck-a-tof.sock
+DUCK_RUNTIME_DIR=/tmp/d ORT_DYLIB_PATH=<libonnxruntime.so> \
+    target/debug/robotd --sim 127.0.0.1:7801 --params <params.toml> --socket /tmp/d/duck-a.sock
+# a camera, if duck-body was started with --cameras a
+printf '[media]\nquality = "360p30"\n' > /tmp/d/mediad.toml
+target/debug/mediad --sim-camera 127.0.0.1:7901 --config /tmp/d/mediad.toml \
+    --robot-socket /tmp/d/duck-a.sock --tof-socket /tmp/d/duck-a-tof.sock
+```
+
+The camera's geometry has to match on both sides — `mediad` streams the `[media] quality` rung
+(`360p30` is 640×360), and the body must render at the same size, because frames arrive raw with no
+handshake and `mediad` refuses one of the wrong size rather than showing a picture nobody can read.
+`scripts/duck-sim` is the record of the rest of the arguments; read it before improvising.
diff --git a/duck-control/Cargo.toml b/duck-control/Cargo.toml
index f0bb20c3..28d8452f 100644
--- a/duck-control/Cargo.toml
+++ b/duck-control/Cargo.toml
@@ -13,6 +13,9 @@ description = "Robot control core: model, bus, sensing"
 # both crates, so no binary gains a dependency from this edge.
 duck-ipc-proto = { path = "../duck-ipc-proto" }
 serde = { workspace = true }
+# The simulator link speaks newline-delimited JSON — see `sim` for why a packed struct shared
+# between two repositories in two languages is the worse trade.
+serde_json = { workspace = true }
 thiserror.workspace = true
 tracing.workspace = true
 # `load-dynamic` dlopens libonnxruntime at first use instead of linking it. Two
@@ -24,6 +27,8 @@ tracing.workspace = true
 # internally, so a successful probe means its own load will succeed too — see
 # `policy::ensure_runtime` for why that matters.
 libloading = "0.8"
+# Identify unchanged networks when a different slot is hot-swapped.
+sha2 = "0.11.0"
 ort = { version = "=2.0.0-rc.11", default-features = false, features = ["load-dynamic"] }
 
 # 1.6.0 is a floor, not a preference: it de-stuffs protocol 2.0 status packets whose payload
@@ -37,3 +42,6 @@ rustypot = "1.6.0"
 # not have, so leaving it on breaks the aarch64 build outright. rustypot disables it for the
 # same reason; this crate has to as well, or cargo's feature unification turns it back on.
 serialport = { version = "4.8", default-features = false }
+
+[dev-dependencies]
+serde_json.workspace = true
diff --git a/duck-control/examples/policy-rehearsal.rs b/duck-control/examples/policy-rehearsal.rs
new file mode 100644
index 00000000..877cc99d
--- /dev/null
+++ b/duck-control/examples/policy-rehearsal.rs
@@ -0,0 +1,77 @@
+//! Offline inference only: never opens a motor bus.
+//! cargo run --release -p duck-control --example policy-rehearsal -- policy.onnx [trace.json]
+//! Trace: [{"obs": [61 floats], "reset": false}, ...]. Outputs actions and latency JSON.
+use duck_control::{
+    obs::Observation,
+    policy::{Net, Policy, PolicyPaths},
+};
+use std::{error::Error, path::PathBuf, time::Instant};
+
+fn main() -> Result<(), Box<dyn Error>> {
+    let mut args = std::env::args_os().skip(1);
+    let path = PathBuf::from(
+        args.next()
+            .ok_or("usage: policy-rehearsal MODEL.onnx [TRACE.json]")?,
+    );
+    let trace: Vec<serde_json::Value> = if let Some(path) = args.next() {
+        serde_json::from_slice(&std::fs::read(path)?)?
+    } else {
+        // Benchmark with nominal gravity, zero commands and previous-action feedback.
+        vec![serde_json::Value::Null; 1000]
+    };
+    if trace.is_empty() || args.next().is_some() {
+        return Err("expected a non-empty trace and at most two arguments".into());
+    }
+    let mut policy = Policy::load(
+        &PolicyPaths {
+            walk: path,
+            ..Default::default()
+        },
+        0.05,
+    )?;
+    // Warm CPU/kernel caches, then discard all memory from these synthetic steps.
+    for _ in 0..50 {
+        policy.infer(&Observation::zeroed(), Net::Walk)?;
+    }
+    policy.reset();
+    let mut actions = Vec::with_capacity(trace.len());
+    let mut times = Vec::with_capacity(trace.len());
+    let mut previous = [0.0; 14];
+    for entry in trace {
+        let mut x = [0.0f32; 61];
+        if entry.is_null() {
+            x[5] = -1.0;
+            x[34..48].copy_from_slice(&previous);
+        } else {
+            let values: Vec<f32> =
+                serde_json::from_value(entry.get("obs").ok_or("trace entry missing obs")?.clone())?;
+            x = values
+                .try_into()
+                .map_err(|_| "trace observations must contain exactly 61 numbers")?;
+            if entry
+                .get("reset")
+                .and_then(|v| v.as_bool())
+                .unwrap_or(false)
+            {
+                policy.reset();
+            }
+        }
+        let observation = Observation::from(x);
+        let start = Instant::now();
+        previous = policy.infer(&observation, Net::Walk)?;
+        times.push(start.elapsed().as_secs_f64() * 1000.0);
+        actions.push(previous);
+    }
+    times.sort_by(f64::total_cmp);
+    let percentile = |p: f64| times[((times.len() as f64 * p).ceil() as usize).saturating_sub(1)];
+    println!(
+        "{}",
+        serde_json::json!({
+            "steps": times.len(), "latency_ms": {"p50": percentile(0.50), "p95": percentile(0.95),
+            "p99": percentile(0.99), "max": times[times.len()-1]},
+            "over_20_ms": times.iter().filter(|&&t| t > 20.0).count(), "actions": actions,
+            "scope": "actor inference only; excludes sensor and motor I/O"
+        })
+    );
+    Ok(())
+}
diff --git a/duck-control/src/bus.rs b/duck-control/src/bus.rs
index 00fbca9c..4b76f9c4 100644
--- a/duck-control/src/bus.rs
+++ b/duck-control/src/bus.rs
@@ -19,7 +19,10 @@ use rustypot::servo::dynamixel::xl330::Xl330Controller;
 
 use crate::imu::{IMU_BLOCK_LEN, SflpDecoder};
 use crate::io::{ImuStale, IoError, JointTargets, Result, RobotIo, Sensors, SlowSensors};
-use crate::model::{BAUD_RATE, EXPECTED_REGISTERS, IMU_DXL_ID, JOINT_IDS, NUM_JOINTS};
+use crate::model::{
+    BAUD_RATE, EXPECTED_REGISTERS, FACTORY_BAUD_RATE, FACTORY_ID, IMU_DXL_ID, JOINT_IDS,
+    JOINT_NAMES, NUM_JOINTS,
+};
 
 /// Start of the contiguous block read every tick: `present_pwm`, `present_current`,
 /// `present_velocity`, `present_position`. Twelve bytes covers all four, and happens to be
@@ -48,6 +51,16 @@ const VOLTS_PER_COUNT: f64 = 0.1;
 /// costs a bounded hiccup rather than stalling the loop on the serial driver's default.
 const READ_TIMEOUT: Duration = Duration::from_millis(30);
 
+/// How long a servo is off the bus after a REBOOT before it answers again — "a few hundred
+/// milliseconds" per [`RobotIo::reboot`], with margin. Pinging too early would read a servo
+/// that is merely still booting as one whose flash failed, and fail an adoption that worked.
+const REBOOT_SETTLE: Duration = Duration::from_millis(500);
+
+/// Pause after each EEPROM write. The servo acknowledges before the cell is necessarily
+/// committed, and the writes here happen once per motor swap, so waiting costs nothing and
+/// removes the one race the datasheet leaves open.
+const EEPROM_SETTLE: Duration = Duration::from_millis(20);
+
 /// Run of consecutive stale reads at which the journal says something.
 ///
 /// 25 reads is half a second at 50 Hz — the same span [`SflpDecoder::ready`] waits for before
@@ -88,6 +101,9 @@ impl StaleImuTracker {
 
 pub struct DynamixelIo {
     controller: Xl330Controller,
+    /// Kept so the port can be reopened at the factory baud rate: `rustypot` owns the serial
+    /// handle outright and offers no way to change its speed in place.
+    port: String,
     /// IMU first, then the servos in [`JOINT_IDS`] order — the order blocks come back in.
     ids: Vec<u8>,
     imu: SflpDecoder,
@@ -99,17 +115,7 @@ pub struct DynamixelIo {
 
 impl DynamixelIo {
     pub fn open(port: &str) -> Result<Self> {
-        let serial = serialport::new(port, BAUD_RATE)
-            .timeout(READ_TIMEOUT)
-            .open()
-            .map_err(|e| IoError::Port {
-                path: port.to_owned(),
-                source: std::io::Error::other(e),
-            })?;
-
-        let controller = Xl330Controller::new()
-            .with_protocol_v2()
-            .with_serial_port(serial);
+        let controller = open_controller(port, BAUD_RATE)?;
 
         let mut ids = Vec::with_capacity(NUM_JOINTS + 1);
         ids.push(IMU_DXL_ID);
@@ -117,6 +123,7 @@ impl DynamixelIo {
 
         Ok(Self {
             controller,
+            port: port.to_owned(),
             ids,
             imu: SflpDecoder::default(),
             stale_imu: StaleImuTracker::default(),
@@ -132,42 +139,190 @@ impl DynamixelIo {
     pub fn check_registers(&mut self) -> Result<usize> {
         let mut fixed = 0;
         for &id in &JOINT_IDS {
-            for &(name, want) in EXPECTED_REGISTERS {
-                // rustypot returns a Vec even for a single-id read. An empty one means the
-                // servo did not answer, which must not be read as "register is fine".
-                let raw = match name {
-                    "return_delay_time" => self.controller.read_return_delay_time(id),
-                    "baud_rate" => self.controller.read_baud_rate(id),
-                    "pwm_slope" => self.controller.read_pwm_slope(id),
-                    "shutdown" => self.controller.read_shutdown(id),
-                    other => unreachable!("unhandled register {other}"),
-                }
-                .map_err(|e| IoError::Bus(format!("read {name} on {id}: {e}")))?;
-
-                let got = *raw.first().ok_or(IoError::ShortRead {
-                    what: "register read",
-                    expected: 1,
-                    got: 0,
-                })?;
-
-                if got == want {
-                    continue;
-                }
-                tracing::warn!(id, register = name, got, want, "correcting motor register");
-                match name {
-                    "return_delay_time" => self.controller.write_return_delay_time(id, want),
-                    "baud_rate" => self.controller.write_baud_rate(id, want),
-                    "pwm_slope" => self.controller.write_pwm_slope(id, want),
-                    "shutdown" => self.controller.write_shutdown(id, want),
-                    other => unreachable!("unhandled register {other}"),
-                }
-                .map_err(|e| IoError::Bus(format!("write {name} on {id}: {e}")))?;
-                fixed += 1;
+            fixed += self.check_registers_of(id)?;
+        }
+        Ok(fixed)
+    }
+
+    /// [`Self::check_registers`] for one servo.
+    fn check_registers_of(&mut self, id: u8) -> Result<usize> {
+        let mut fixed = 0;
+        for &(name, want) in EXPECTED_REGISTERS {
+            // rustypot returns a Vec even for a single-id read. An empty one means the
+            // servo did not answer, which must not be read as "register is fine".
+            let raw = match name {
+                "return_delay_time" => self.controller.read_return_delay_time(id),
+                "baud_rate" => self.controller.read_baud_rate(id),
+                "pwm_slope" => self.controller.read_pwm_slope(id),
+                "shutdown" => self.controller.read_shutdown(id),
+                other => unreachable!("unhandled register {other}"),
+            }
+            .map_err(|e| IoError::Bus(format!("read {name} on {id}: {e}")))?;
+
+            let got = *raw.first().ok_or(IoError::ShortRead {
+                what: "register read",
+                expected: 1,
+                got: 0,
+            })?;
+
+            if got == want {
+                continue;
             }
+            tracing::warn!(id, register = name, got, want, "correcting motor register");
+            match name {
+                "return_delay_time" => self.controller.write_return_delay_time(id, want),
+                "baud_rate" => self.controller.write_baud_rate(id, want),
+                "pwm_slope" => self.controller.write_pwm_slope(id, want),
+                "shutdown" => self.controller.write_shutdown(id, want),
+                other => unreachable!("unhandled register {other}"),
+            }
+            .map_err(|e| IoError::Bus(format!("write {name} on {id}: {e}")))?;
+            std::thread::sleep(EEPROM_SETTLE);
+            fixed += 1;
         }
         Ok(fixed)
     }
 
+    /// The expected servo IDs that do not answer a ping, in [`JOINT_IDS`] order.
+    ///
+    /// Fifteen pings, each bounded by [`READ_TIMEOUT`], so about half a second when the servos
+    /// are unpowered and a few milliseconds when they are not. Run once at startup: this is
+    /// what decides whether [`Self::adopt_replacement`] has anything to do, and it is the only
+    /// bus traffic the replacement path costs a robot whose servos are all present.
+    pub fn missing_servos(&mut self) -> Result<Vec<u8>> {
+        let mut missing = Vec::new();
+        for &id in &JOINT_IDS {
+            let answered = self
+                .controller
+                .ping(id)
+                .map_err(|e| IoError::Bus(format!("ping {id}: {e}")))?;
+            if !answered {
+                missing.push(id);
+            }
+        }
+        Ok(missing)
+    }
+
+    /// Flash a factory-fresh servo so it takes the place of the one that is missing.
+    ///
+    /// A new XL330 answers as ID 1 at 57 600 baud. Neither is used on this bus, so when exactly
+    /// one expected servo is silent the new one can be found, given the missing ID, switched to
+    /// the bus's speed, and then handed the same EEPROM check every other servo gets. That is
+    /// the whole of a motor swap: nobody has to run a configuration tool first.
+    ///
+    /// The servo is rebooted at the end, deliberately. A servo flashed this way comes out of it
+    /// with its hardware-error alert set (the observation behind this whole path), and that
+    /// alert holds torque off until the servo is power-cycled or rebooted. Rebooting here means
+    /// the servo that comes out of this is indistinguishable from one that was always there.
+    ///
+    /// Returns `Ok(false)` when nothing answers at the factory defaults: the servo is simply
+    /// missing, or was replaced by one that is not fresh. The bus is back at [`BAUD_RATE`]
+    /// either way, so the caller can keep waiting on it.
+    pub fn adopt_replacement(&mut self, id: u8) -> Result<bool> {
+        let name = JOINT_IDS
+            .iter()
+            .position(|&j| j == id)
+            .map(|i| JOINT_NAMES[i])
+            .ok_or_else(|| IoError::Bus(format!("{id} is not a joint id")))?;
+
+        // A servo that was already re-flashed to 1 Mbps but kept its ID is the one case where
+        // reopening the port would lose it; look at this speed first.
+        let baud = if self.ping_fresh()? {
+            BAUD_RATE
+        } else {
+            self.reopen(FACTORY_BAUD_RATE)?;
+            if !self.ping_fresh()? {
+                self.reopen(BAUD_RATE)?;
+                return Ok(false);
+            }
+            FACTORY_BAUD_RATE
+        };
+        tracing::warn!(
+            id,
+            joint = name,
+            found_at_baud = baud,
+            "factory-fresh servo on the bus; flashing it as the missing joint"
+        );
+
+        // ID first, then the baud rate: the servo answers the second write at the old speed
+        // and switches only afterwards, so both are acknowledged. The other order would need
+        // a reopen between the two writes for nothing.
+        self.controller
+            .write_id(FACTORY_ID, id)
+            .map_err(|e| IoError::Bus(format!("write id {id} on {FACTORY_ID}: {e}")))?;
+        std::thread::sleep(EEPROM_SETTLE);
+        if baud != BAUD_RATE {
+            let want = EXPECTED_REGISTERS
+                .iter()
+                .find(|(n, _)| *n == "baud_rate")
+                .map(|&(_, v)| v)
+                .expect("baud_rate is an expected register");
+            self.controller
+                .write_baud_rate(id, want)
+                .map_err(|e| IoError::Bus(format!("write baud_rate on {id}: {e}")))?;
+            std::thread::sleep(EEPROM_SETTLE);
+            self.reopen(BAUD_RATE)?;
+        }
+
+        // Now an ordinary servo at the right address: the same check the others get pins
+        // return_delay_time and the rest.
+        let fixed = self.check_registers_of(id)?;
+
+        RobotIo::reboot(self, id)?;
+        std::thread::sleep(REBOOT_SETTLE);
+        let back = self
+            .controller
+            .ping(id)
+            .map_err(|e| IoError::Bus(format!("ping {id} after reboot: {e}")))?;
+        if !back {
+            return Err(IoError::Bus(format!(
+                "servo {id} ({name}) was flashed but did not come back from its reboot"
+            )));
+        }
+        // The reboot exists to clear this; say so if it did not, because a servo that keeps
+        // its alert will hold torque off and the symptom — one limp joint — points nowhere.
+        let hardware_error = self
+            .controller
+            .read_hardware_error_status(id)
+            .map_err(|e| IoError::Bus(format!("read hardware_error_status on {id}: {e}")))?
+            .first()
+            .copied()
+            .unwrap_or(0);
+        if hardware_error != 0 {
+            tracing::error!(
+                id,
+                joint = name,
+                hardware_error,
+                "replacement servo still reports a hardware error after its reboot"
+            );
+        }
+        tracing::warn!(
+            id,
+            joint = name,
+            registers_fixed = fixed,
+            "replacement servo adopted"
+        );
+        Ok(true)
+    }
+
+    /// Does anything answer at the factory ID, at whatever speed the port is open at?
+    fn ping_fresh(&mut self) -> Result<bool> {
+        self.controller
+            .ping(FACTORY_ID)
+            .map_err(|e| IoError::Bus(format!("ping factory id {FACTORY_ID}: {e}")))
+    }
+
+    /// Close the port and open it again at `baud`.
+    ///
+    /// The old handle has to be gone first: `serialport` opens ttys exclusively, so opening a
+    /// second handle while the first lives fails with `EBUSY`. Hence the placeholder controller
+    /// — one with no port, never used — standing in while the real one is dropped.
+    fn reopen(&mut self, baud: u32) -> Result<()> {
+        self.controller = Xl330Controller::new();
+        self.controller = open_controller(&self.port, baud)?;
+        Ok(())
+    }
+
     /// Present positions only — a lighter read than [`RobotIo::read`], used once at startup
     /// to adopt the pose the robot is already in.
     pub fn present_positions(&mut self) -> Result<[f64; NUM_JOINTS]> {
@@ -241,6 +396,32 @@ impl DynamixelIo {
     }
 }
 
+/// The serial port at `baud`, wrapped in a Protocol 2 controller.
+fn open_controller(port: &str, baud: u32) -> Result<Xl330Controller> {
+    let serial = serialport::new(port, baud)
+        .timeout(READ_TIMEOUT)
+        .open()
+        .map_err(|e| IoError::Port {
+            path: port.to_owned(),
+            source: std::io::Error::other(e),
+        })?;
+    Ok(Xl330Controller::new()
+        .with_protocol_v2()
+        .with_serial_port(serial))
+}
+
+/// Which servo a factory-fresh one should become, given the IDs that did not answer.
+///
+/// Only an unambiguous answer is one: with two servos silent there is no telling which of them
+/// the new one replaces, and guessing would flash a leg joint as a neck joint. With none silent
+/// there is nothing to adopt — a stray fresh servo on a complete bus is not this code's problem.
+pub fn replacement_target(missing: &[u8]) -> Option<u8> {
+    match missing {
+        [one] => Some(*one),
+        _ => None,
+    }
+}
+
 impl RobotIo for DynamixelIo {
     fn read(&mut self) -> Result<Sensors> {
         let blocks = self
@@ -313,6 +494,15 @@ impl RobotIo for DynamixelIo {
         DynamixelIo::set_torque(self, on)
     }
 
+    fn reboot(&mut self, id: u8) -> Result<()> {
+        // The status packet is a courtesy the servo may not manage before it resets, so only a
+        // failure to send is an error here.
+        self.controller
+            .reboot(id)
+            .map(|_| ())
+            .map_err(|e| IoError::Bus(format!("reboot {id}: {e}")))
+    }
+
     fn set_gain(&mut self, kp: u16) -> Result<()> {
         // I and D are written too, at zero — the prototype's `--ki`/`--kd` defaults, which
         // its startup writes to every motor. These are RAM registers, so every power-up
@@ -407,6 +597,17 @@ impl RobotIo for DynamixelIo {
 mod tests {
     use super::*;
 
+    /// One silent servo is the only case a swap can be inferred from. With two silent there is
+    /// no telling which the fresh servo replaces, and guessing would flash a leg joint as a neck
+    /// joint; with none silent a stray fresh servo is nobody's replacement.
+    #[test]
+    fn a_replacement_is_inferred_only_from_exactly_one_missing_servo() {
+        assert_eq!(replacement_target(&[]), None);
+        assert_eq!(replacement_target(&[23]), Some(23));
+        assert_eq!(replacement_target(&[23, 31]), None);
+        assert_eq!(replacement_target(&JOINT_IDS), None);
+    }
+
     /// The block parsed per servo must cover current, velocity and position without
     /// overrunning. If `READ_LEN` and the offsets below ever disagree, joints get each
     /// other's values — which reads as a wiring fault, not a code bug.
diff --git a/duck-control/src/io.rs b/duck-control/src/io.rs
index 379724ff..82304062 100644
--- a/duck-control/src/io.rs
+++ b/duck-control/src/io.rs
@@ -134,6 +134,14 @@ pub trait RobotIo {
     /// never because a process began.
     fn set_torque(&mut self, on: bool) -> Result<()>;
 
+    /// Reboot one servo: the Protocol 2 REBOOT instruction.
+    ///
+    /// The way out of a latched hardware error — overload, overheating, electrical shock, the
+    /// `shutdown` mask — which otherwise holds torque off until the battery is pulled. The servo is
+    /// off the bus for a few hundred milliseconds and comes back with torque off and its RAM
+    /// registers, the gains among them, at their EEPROM defaults; the caller owns putting them back.
+    fn reboot(&mut self, id: u8) -> Result<()>;
+
     /// Supply voltage and case temperatures, in one extra transaction.
     ///
     /// Not part of [`Sensors`], and not on the tick's critical path: these registers sit at
@@ -191,6 +199,8 @@ pub struct FakeIo {
     /// How many times torque was written, so a test can tell "brought up once" from "written every
     /// tick" — the latter being a bus transaction per joint per tick.
     pub torque_writes: usize,
+    /// Every servo id rebooted, in order.
+    pub reboots: Vec<u8>,
 }
 
 impl Default for FakeIo {
@@ -217,6 +227,7 @@ impl FakeIo {
             track_targets: true,
             torque: None,
             torque_writes: 0,
+            reboots: Vec::new(),
         }
     }
 
@@ -284,6 +295,11 @@ impl RobotIo for FakeIo {
         Ok(())
     }
 
+    fn reboot(&mut self, id: u8) -> Result<()> {
+        self.reboots.push(id);
+        Ok(())
+    }
+
     fn imu_ready(&self) -> bool {
         self.imu_ready
     }
diff --git a/duck-control/src/lib.rs b/duck-control/src/lib.rs
index 14f161b6..ca6f95df 100644
--- a/duck-control/src/lib.rs
+++ b/duck-control/src/lib.rs
@@ -15,6 +15,8 @@ pub mod model;
 pub mod obs;
 pub mod policy;
 pub mod safety;
+/// A robot in MuJoCo, over TCP — the backend `robotd-design.md` §9 deferred.
+pub mod sim;
 
 pub use imu::ImuData;
 pub use io::{FakeIo, IoError, JointTargets, RobotIo, Sensors, SlowSensors};
diff --git a/duck-control/src/model.rs b/duck-control/src/model.rs
index ef1f144e..9a5fe374 100644
--- a/duck-control/src/model.rs
+++ b/duck-control/src/model.rs
@@ -79,6 +79,12 @@ pub const IMU_DXL_ID: u8 = 200;
 
 pub const BAUD_RATE: u32 = 1_000_000;
 
+/// What a servo answers as out of the box: ID 1 at 57 600 baud. Both are deliberately unused
+/// on this bus — no joint is ID 1 and nothing runs at that speed — which is what lets a
+/// replacement be told apart from every servo already fitted ([`crate::bus`]).
+pub const FACTORY_ID: u8 = 1;
+pub const FACTORY_BAUD_RATE: u32 = 57_600;
+
 /// EEPROM registers asserted (and corrected) at startup.
 ///
 /// `return_delay_time` is the load-bearing one: the XL330 ships at 250, which is 500 µs of
@@ -158,6 +164,16 @@ mod tests {
         assert!(!JOINT_IDS.contains(&IMU_DXL_ID));
     }
 
+    /// The replacement path finds a new servo by the ID it ships with. If a joint ever took
+    /// ID 1, a fresh servo would be indistinguishable from it — and flashing "the missing
+    /// joint" onto ID 1 would re-address a servo that was never missing.
+    #[test]
+    fn factory_defaults_are_unused_on_the_bus() {
+        assert!(!JOINT_IDS.contains(&FACTORY_ID));
+        assert_ne!(IMU_DXL_ID, FACTORY_ID);
+        assert_ne!(FACTORY_BAUD_RATE, BAUD_RATE);
+    }
+
     /// `MOUTH_INDEX` is used to skip a slot when mapping 14 policy actions onto 15 joints.
     /// Pointing it at the wrong joint would shift every action after it by one.
     #[test]
diff --git a/duck-control/src/obs.rs b/duck-control/src/obs.rs
index de1fcb84..433416d8 100644
--- a/duck-control/src/obs.rs
+++ b/duck-control/src/obs.rs
@@ -144,6 +144,13 @@ pub struct Observation {
     data: [f32; OBS_LEN],
 }
 
+/// Replay an already assembled observation (for offline policy rehearsal).
+impl From<[f32; OBS_LEN]> for Observation {
+    fn from(data: [f32; OBS_LEN]) -> Self {
+        Self { data }
+    }
+}
+
 impl Observation {
     pub fn as_slice(&self) -> &[f32] {
         &self.data
diff --git a/duck-control/src/policy.rs b/duck-control/src/policy.rs
index 8d7cf84f..346d76b2 100644
--- a/duck-control/src/policy.rs
+++ b/duck-control/src/policy.rs
@@ -4,7 +4,8 @@
 //! `microduck_runtime` does; the skill networks — sit↔stand, ground pick, the two kicks —
 //! are selected explicitly by the scheduler in `robotd`, which owns the priority rules.
 //! Every network shares the one 61-D observation layout, so a skill is a session choice
-//! plus a command-block encoding, never a new contract.
+//! plus a command-block encoding. LSTM exports additionally pass hidden/cell state,
+//! owned by each network; sensor observations and joint actions are unchanged.
 //!
 //! **Everything is validated at load, not at inference.** A bundle with the wrong
 //! observation width, the wrong action count, or a missing ONNX Runtime must fail while the
@@ -17,7 +18,9 @@ use std::sync::OnceLock;
 
 use ort::session::Session;
 use ort::session::builder::GraphOptimizationLevel;
-use ort::value::{Value, ValueType};
+use ort::tensor::TensorElementType;
+use ort::value::{Tensor, Value, ValueType};
+use sha2::{Digest, Sha256};
 
 use crate::obs::{ACTION_LEN, OBS_LEN, Observation};
 
@@ -34,6 +37,12 @@ const INTRA_THREADS: usize = 1;
 
 #[derive(Debug, thiserror::Error)]
 pub enum PolicyError {
+    #[error("reading {path}: {source}")]
+    Read {
+        path: PathBuf,
+        #[source]
+        source: std::io::Error,
+    },
     #[error("loading {path}: {source}")]
     Load {
         path: PathBuf,
@@ -68,12 +77,14 @@ pub enum PolicyError {
 impl PolicyError {
     /// The file this error is about, when it is about one.
     ///
-    /// `Load` and `Shape` name a file; a missing runtime or an `ort` panic does not, and
+    /// `Read`, `Load` and `Shape` name a file; a missing runtime or an `ort` panic does not, and
     /// blaming whichever policy happened to be loading when the dylib turned out to be absent
     /// would send an operator to replace a file that is fine.
     pub fn path(&self) -> Option<&Path> {
         match self {
-            PolicyError::Load { path, .. } | PolicyError::Shape { path, .. } => Some(path),
+            PolicyError::Read { path, .. }
+            | PolicyError::Load { path, .. }
+            | PolicyError::Shape { path, .. } => Some(path),
             PolicyError::Inference(_)
             | PolicyError::RuntimeMissing { .. }
             | PolicyError::RuntimePanic { .. } => None,
@@ -227,12 +238,13 @@ pub struct PolicyPaths {
 /// release, so a missing or corrupt file is a broken bundle, and the right outcome is
 /// "unhealthy, roll it back", not a robot that silently lost its kick.
 pub struct Policy {
-    walk: Session,
-    stand: Option<Session>,
-    sitstand: Option<Session>,
-    ground_pick: Option<Session>,
-    skills: Vec<Session>,
+    walk: Network,
+    stand: Option<Network>,
+    sitstand: Option<Network>,
+    ground_pick: Option<Network>,
+    skills: Vec<Network>,
     standing_threshold: f64,
+    active: Option<Net>,
     /// Roller mode and fall-recovery mode reserve the standing network (roller has none;
     /// fall recovery keeps it for getting up), so command magnitude must never select it.
     standing_disabled: bool,
@@ -255,15 +267,16 @@ impl Policy {
             // It also proves ONNX Runtime is actually present and usable, which with
             // `load-dynamic` is not known until something is run.
             let zero = Observation::zeroed();
-            fn open_warm(path: &Path, zero: &Observation) -> Result<Session, PolicyError> {
-                let mut session = open(path)?;
-                run(&mut session, path, zero)?;
-                Ok(session)
+            fn open_warm(path: &Path, zero: &Observation) -> Result<Network, PolicyError> {
+                let mut network = open(path)?;
+                network.run(zero)?;
+                network.reset();
+                Ok(network)
             }
             fn open_opt(
                 path: &Option<PathBuf>,
                 zero: &Observation,
-            ) -> Result<Option<Session>, PolicyError> {
+            ) -> Result<Option<Network>, PolicyError> {
                 path.as_deref().map(|p| open_warm(p, zero)).transpose()
             }
 
@@ -278,6 +291,7 @@ impl Policy {
                     .map(|path| open_warm(path, &zero))
                     .collect::<Result<Vec<_>, _>>()?,
                 standing_threshold,
+                active: None,
                 standing_disabled: false,
             })
         })
@@ -324,18 +338,92 @@ impl Policy {
         observation: &Observation,
         net: Net,
     ) -> Result<[f32; ACTION_LEN], PolicyError> {
-        let session = match net {
-            Net::Walk => None,
+        // Resolve fallback before comparing: asking for an absent skill must not reset
+        // the walking network on every tick.
+        let net = match net {
+            Net::Stand if self.stand.is_none() => Net::Walk,
+            Net::SitStand if self.sitstand.is_none() => Net::Walk,
+            Net::GroundPick if self.ground_pick.is_none() => Net::Walk,
+            Net::Skill(i) if i >= self.skills.len() => Net::Walk,
+            net => net,
+        };
+        let changed = self.active != Some(net);
+        let network = match net {
+            Net::Walk => &mut self.walk,
+            Net::Stand => self.stand.as_mut().unwrap(),
+            Net::SitStand => self.sitstand.as_mut().unwrap(),
+            Net::GroundPick => self.ground_pick.as_mut().unwrap(),
+            Net::Skill(i) => &mut self.skills[i],
+        };
+        if changed {
+            network.reset();
+        }
+        let result = network.run(observation);
+        // Never carry a failed inference's state into another control tick.
+        if result.is_err() {
+            network.reset();
+            self.active = None;
+        } else {
+            self.active = Some(net);
+        }
+        result
+    }
+
+    /// Preserve the running network when only another slot changed. Compare model
+    /// bytes, not paths: a reload may replace a file in place, and a seated swap may
+    /// intentionally replace the active network. Those cases must start fresh.
+    pub fn carry_over(&mut self, from: &Self) {
+        self.reset();
+        let Some(net) = from.active else {
+            return;
+        };
+        let target = match net {
+            Net::Walk => Some(&mut self.walk),
             Net::Stand => self.stand.as_mut(),
             Net::SitStand => self.sitstand.as_mut(),
             Net::GroundPick => self.ground_pick.as_mut(),
-            Net::Skill(index) => self.skills.get_mut(index),
+            Net::Skill(i) => self.skills.get_mut(i),
         };
-        let session = match session {
-            Some(session) => session,
-            None => &mut self.walk,
+        let source = match net {
+            Net::Walk => Some(&from.walk),
+            Net::Stand => from.stand.as_ref(),
+            Net::SitStand => from.sitstand.as_ref(),
+            Net::GroundPick => from.ground_pick.as_ref(),
+            Net::Skill(i) => from.skills.get(i),
         };
-        run(session, Path::new("<loaded>"), observation)
+        if let (Some(target), Some(source)) = (target, source)
+            && target.digest == source.digest
+        {
+            if let (Some(dst), Some(src)) = (&mut target.state, &source.state) {
+                dst.h
+                    .try_extract_tensor_mut::<f32>()
+                    .unwrap()
+                    .1
+                    .copy_from_slice(src.h.try_extract_tensor::<f32>().unwrap().1);
+                dst.c
+                    .try_extract_tensor_mut::<f32>()
+                    .unwrap()
+                    .1
+                    .copy_from_slice(src.c.try_extract_tensor::<f32>().unwrap().1);
+            }
+            self.active = Some(net);
+        }
+    }
+
+    /// Start a new episode, including when resuming after disable or fall recovery.
+    /// A network also starts fresh whenever selection switches away and back to it.
+    pub fn reset(&mut self) {
+        self.active = None;
+        self.walk.reset();
+        for network in self
+            .stand
+            .iter_mut()
+            .chain(self.sitstand.iter_mut())
+            .chain(self.ground_pick.iter_mut())
+            .chain(self.skills.iter_mut())
+        {
+            network.reset();
+        }
     }
 }
 
@@ -364,85 +452,238 @@ pub fn validate(path: &Path) -> Result<(), PolicyError> {
     catching_ort_panics(|| open(path).map(drop))
 }
 
-fn open(path: &Path) -> Result<Session, PolicyError> {
-    let session = Session::builder()
-        .and_then(|b| b.with_optimization_level(GraphOptimizationLevel::Level3))
-        .and_then(|b| b.with_intra_threads(INTRA_THREADS))
-        .and_then(|b| b.commit_from_file(path))
-        .map_err(|source| PolicyError::Load {
-            path: path.to_owned(),
-            source,
-        })?;
+/// The mjlab/rsl_rl LSTM export passes state explicitly. Buffers belong to one
+/// session, are allocated at load, and are never shared between policy slots.
+struct Network {
+    session: Session,
+    state: Option<LstmState>,
+    action_name: String,
+    path: PathBuf,
+    digest: [u8; 32],
+}
 
-    check_width(path, "observation width", session.inputs(), OBS_LEN)?;
-    check_width(path, "action count", session.outputs(), ACTION_LEN)?;
-    Ok(session)
+struct LstmState {
+    h: Tensor<f32>,
+    c: Tensor<f32>,
 }
 
-/// Assert the trailing dimension of a graph's single tensor outlet.
-///
-/// The leading dimension is the batch and is usually dynamic (`-1`), so only the last one
-/// is checked. That is the one that encodes the contract.
-fn check_width(
-    path: &Path,
-    what: &'static str,
-    outlets: &[ort::value::Outlet],
-    expected: usize,
-) -> Result<(), PolicyError> {
-    let shape = match outlets.first().map(|o| o.dtype()) {
-        Some(ValueType::Tensor { shape, .. }) => shape,
-        _ => {
-            return Err(PolicyError::Shape {
-                path: path.to_owned(),
-                what,
-                expected: expected.to_string(),
-                got: "not a tensor".into(),
-            });
+impl Network {
+    fn reset(&mut self) {
+        if let Some(state) = &mut self.state {
+            state.h.try_extract_tensor_mut::<f32>().unwrap().1.fill(0.0);
+            state.c.try_extract_tensor_mut::<f32>().unwrap().1.fill(0.0);
         }
-    };
+    }
 
-    let got = shape.iter().last().copied().unwrap_or(-1);
-    if got != expected as i64 {
-        return Err(PolicyError::Shape {
-            path: path.to_owned(),
-            what,
-            expected: expected.to_string(),
-            got: got.to_string(),
-        });
+    fn run(&mut self, observation: &Observation) -> Result<[f32; ACTION_LEN], PolicyError> {
+        let fail = |e: String| PolicyError::Inference(format!("{}: {e}", self.path.display()));
+        if !observation.as_slice().iter().all(|v| v.is_finite()) {
+            return Err(fail("non-finite observation".into()));
+        }
+        let input = Value::from_array(([1usize, OBS_LEN], observation.as_slice().to_vec()))
+            .map_err(|e| fail(format!("building input: {e}")))?;
+        let outputs = match &self.state {
+            Some(state) => self.session.run(ort::inputs![
+                "obs" => &input, "h_in" => &state.h, "c_in" => &state.c
+            ]),
+            None => self.session.run(ort::inputs!["obs" => &input]),
+        }
+        .map_err(|e| fail(e.to_string()))?;
+        let (_, actions) = outputs[self.action_name.as_str()]
+            .try_extract_tensor::<f32>()
+            .map_err(|e| fail(e.to_string()))?;
+        if actions.len() != ACTION_LEN || !actions.iter().all(|v| v.is_finite()) {
+            return Err(fail("expected 14 finite actions".into()));
+        }
+        let mut result = [0.0; ACTION_LEN];
+        result.copy_from_slice(actions);
+        if let Some(state) = &mut self.state {
+            let (hs, h) = outputs["h_out"]
+                .try_extract_tensor::<f32>()
+                .map_err(|e| fail(e.to_string()))?;
+            let (cs, c) = outputs["c_out"]
+                .try_extract_tensor::<f32>()
+                .map_err(|e| fail(e.to_string()))?;
+            let (expected_h, h_in) = state
+                .h
+                .try_extract_tensor_mut::<f32>()
+                .map_err(|e| fail(e.to_string()))?;
+            let (expected_c, c_in) = state
+                .c
+                .try_extract_tensor_mut::<f32>()
+                .map_err(|e| fail(e.to_string()))?;
+            // Check both before updating either, including dynamic runtime output shapes.
+            if hs != expected_h || cs != expected_c || !h.iter().chain(c).all(|v| v.is_finite()) {
+                return Err(fail(
+                    "invalid LSTM output state shape or non-finite state".into(),
+                ));
+            }
+            h_in.copy_from_slice(h);
+            c_in.copy_from_slice(c);
+        }
+        Ok(result)
     }
-    Ok(())
 }
 
-fn run(
-    session: &mut Session,
+fn shape_error(path: &Path, what: &'static str, expected: &str, got: String) -> PolicyError {
+    PolicyError::Shape {
+        path: path.to_owned(),
+        what,
+        expected: expected.into(),
+        got,
+    }
+}
+
+/// Require an exact rank and float32 type. Batch may be symbolic, but this runtime
+/// always supplies batch one; state layers and hidden width must be known at load.
+fn tensor_shape(path: &Path, outlet: &ort::value::Outlet) -> Result<Vec<i64>, PolicyError> {
+    match outlet.dtype() {
+        ValueType::Tensor {
+            ty: TensorElementType::Float32,
+            shape,
+            ..
+        } => Ok(shape.to_vec()),
+        other => Err(shape_error(
+            path,
+            "tensor type",
+            "float32",
+            format!("{}: {other:?}", outlet.name()),
+        )),
+    }
+}
+
+fn outlet<'a>(
     path: &Path,
-    observation: &Observation,
-) -> Result<[f32; ACTION_LEN], PolicyError> {
-    let input = Value::from_array(([1usize, OBS_LEN], observation.as_slice().to_vec()))
-        .map_err(|e| PolicyError::Inference(format!("{}: building input: {e}", path.display())))?;
-
-    let outputs = session
-        .run(ort::inputs!["obs" => &input])
-        .map_err(|e| PolicyError::Inference(format!("{}: {e}", path.display())))?;
-
-    let value = outputs
-        .values()
-        .next()
-        .ok_or_else(|| PolicyError::Inference(format!("{}: no output", path.display())))?;
-    let (_, data) = value.try_extract_tensor::<f32>().map_err(|e| {
-        PolicyError::Inference(format!("{}: extracting output: {e}", path.display()))
-    })?;
+    outlets: &'a [ort::value::Outlet],
+    name: &str,
+) -> Result<&'a ort::value::Outlet, PolicyError> {
+    outlets.iter().find(|o| o.name() == name).ok_or_else(|| {
+        shape_error(
+            path,
+            "tensor names",
+            name,
+            format!("{:?}", outlets.iter().map(|o| o.name()).collect::<Vec<_>>()),
+        )
+    })
+}
 
-    if data.len() != ACTION_LEN {
-        return Err(PolicyError::Inference(format!(
-            "{}: {} actions, expected {ACTION_LEN}",
-            path.display(),
-            data.len()
-        )));
+fn check_matrix(path: &Path, outlet: &ort::value::Outlet, width: usize) -> Result<(), PolicyError> {
+    let shape = tensor_shape(path, outlet)?;
+    if shape.len() != 2 || (shape[0] != 1 && shape[0] != -1) || shape[1] != width as i64 {
+        return Err(shape_error(
+            path,
+            "tensor shape",
+            &format!("[1 or dynamic, {width}]"),
+            format!("{}: {shape:?}", outlet.name()),
+        ));
     }
-    let mut actions = [0.0f32; ACTION_LEN];
-    actions.copy_from_slice(data);
-    Ok(actions)
+    Ok(())
+}
+
+fn open(path: &Path) -> Result<Network, PolicyError> {
+    let bytes = std::fs::read(path).map_err(|source| PolicyError::Read {
+        path: path.to_owned(),
+        source,
+    })?;
+    let digest: [u8; 32] = Sha256::digest(&bytes).into();
+    let session = Session::builder()
+        .and_then(|b| b.with_optimization_level(GraphOptimizationLevel::Level3))
+        .and_then(|b| b.with_intra_threads(INTRA_THREADS))
+        .and_then(|b| b.commit_from_file(path))
+        .map_err(|source| PolicyError::Load {
+            path: path.to_owned(),
+            source,
+        })?;
+
+    let inputs = session.inputs();
+    let outputs = session.outputs();
+    check_matrix(path, outlet(path, inputs, "obs")?, OBS_LEN)?;
+    let recurrent = match (inputs.len(), outputs.len()) {
+        (1, 1) => false,
+        (3, 3) => true,
+        counts => {
+            return Err(shape_error(
+                path,
+                "input/output contract",
+                "obs -> actions, or obs/h_in/c_in -> actions/h_out/c_out",
+                format!("{counts:?} tensors"),
+            ));
+        }
+    };
+    // Preserve the existing feed-forward output naming contract (the sole output).
+    let action = if recurrent {
+        outlet(path, outputs, "actions")?
+    } else {
+        &outputs[0]
+    };
+    check_matrix(path, action, ACTION_LEN)?;
+    let action_name = action.name().to_owned();
+    let state = if recurrent {
+        let mut shapes = Vec::new();
+        for (outlets, name) in [
+            (inputs, "h_in"),
+            (inputs, "c_in"),
+            (outputs, "h_out"),
+            (outputs, "c_out"),
+        ] {
+            let shape = tensor_shape(path, outlet(path, outlets, name)?)?;
+            if shape.len() != 3
+                || shape[0] <= 0
+                || (shape[1] != 1 && shape[1] != -1)
+                || shape[2] <= 0
+            {
+                return Err(shape_error(
+                    path,
+                    "LSTM state shape",
+                    "[positive layers, 1 or dynamic batch, positive hidden size]",
+                    format!("{name}: {shape:?}"),
+                ));
+            }
+            shapes.push(vec![shape[0], 1, shape[2]]);
+        }
+        if shapes.iter().any(|shape| shape != &shapes[0]) {
+            return Err(shape_error(
+                path,
+                "LSTM state shapes",
+                "matching h/c input and output shapes",
+                format!("{shapes:?}"),
+            ));
+        }
+        let shape = &shapes[0];
+        let count = usize::try_from(shape[0])
+            .ok()
+            .and_then(|n| n.checked_mul(shape[2] as usize))
+            .filter(|&n| n <= 1_048_576)
+            .ok_or_else(|| {
+                shape_error(
+                    path,
+                    "LSTM state size",
+                    "at most 1048576 elements per state",
+                    format!("{shape:?}"),
+                )
+            })?;
+        let make = || {
+            Tensor::from_array((shape.clone(), vec![0.0f32; count])).map_err(|source| {
+                PolicyError::Load {
+                    path: path.to_owned(),
+                    source,
+                }
+            })
+        };
+        Some(LstmState {
+            h: make()?,
+            c: make()?,
+        })
+    } else {
+        None
+    };
+    Ok(Network {
+        session,
+        state,
+        action_name,
+        path: path.to_owned(),
+        digest,
+    })
 }
 
 #[cfg(test)]
diff --git a/duck-control/src/safety.rs b/duck-control/src/safety.rs
index 84247813..77db56d4 100644
--- a/duck-control/src/safety.rs
+++ b/duck-control/src/safety.rs
@@ -167,6 +167,18 @@ impl<T: RobotIo> Safety<T> {
         self.io.set_torque(on)
     }
 
+    /// Reboot these servos, and forget the gain cache: a rebooted servo comes back at its EEPROM
+    /// gains, and a cache that still says the running gain is written would leave it there. The
+    /// next [`Self::apply`] rewrites the gains on every servo.
+    pub fn reboot_motors(&mut self, ids: &[u8]) -> Result<(), IoError> {
+        for &id in ids {
+            tracing::warn!(id, "rebooting servo");
+            self.io.reboot(id)?;
+        }
+        self.gain = None;
+        Ok(())
+    }
+
     /// The gain last written to the servos, or `None` before the first write. This is what
     /// the robot is running at, which is not always what the caller asked for.
     pub fn gain(&self) -> Option<u16> {
@@ -288,6 +300,26 @@ impl<T: RobotIo> Safety<T> {
 
 #[cfg(test)]
 mod tests {
+    /// A reboot forgets the gain cache, so the rebooted servos get their gains back on the next
+    /// apply instead of running at whatever their EEPROM says.
+    #[test]
+    fn rebooting_motors_rewrites_the_gain_on_the_next_apply() {
+        use crate::io::FakeIo;
+        use crate::model::DEFAULT_POSITION;
+        let mut s = Safety::new(FakeIo::at(DEFAULT_POSITION), SafetyConfig::default());
+        s.apply(DEFAULT_POSITION, DEFAULT_POSITION, 200).unwrap();
+        assert_eq!(s.gain(), Some(200));
+        s.reboot_motors(&[3, 11]).unwrap();
+        assert_eq!(s.io().reboots, vec![3, 11]);
+        assert_eq!(
+            s.gain(),
+            None,
+            "the gain cache must be forgotten after a reboot"
+        );
+        s.apply(DEFAULT_POSITION, DEFAULT_POSITION, 200).unwrap();
+        assert_eq!(s.gain(), Some(200));
+    }
+
     use super::*;
     use crate::imu::ImuData;
     use crate::io::FakeIo;
diff --git a/duck-control/src/sim.rs b/duck-control/src/sim.rs
new file mode 100644
index 00000000..8715d343
--- /dev/null
+++ b/duck-control/src/sim.rs
@@ -0,0 +1,441 @@
+//! A [`RobotIo`] whose robot is in MuJoCo.
+//!
+//! **The third backend the design doc named.** `docs/design/robotd-design.md` §9 deferred "the
+//! MuJoCo backend and the `RemoteIo` protocol"; this is it. Everything above this trait — the
+//! control loop, the policy, `Safety`, fall detection, odometry, kinematics, every IPC call and
+//! `robotctl` — runs unchanged and cannot tell the difference. That is the whole point: the seam
+//! is the one place a simulator is allowed to exist.
+//!
+//! ## Why TCP and not a unix socket
+//!
+//! Two reasons, both learned rather than assumed. A unix path is capped at `SUN_LEN` — about 108
+//! bytes — which a scratch directory blows through immediately. And the simulator has to be
+//! reachable from *outside* whatever the daemons run in: a container on Linux, and on macOS a Linux
+//! VM with MuJoCo on the host beside it. A port crosses all of those; a socket path does not.
+//!
+//! ## Why JSON
+//!
+//! One tick is fifteen joints in and fifteen out — about a kilobyte, so 50 KB/s at the loop's 50 Hz,
+//! which is nothing next to being able to read a frame with `nc` and write the other half of it in
+//! twenty lines of Python. The alternative is a packed struct shared between two repositories in
+//! two languages, which is exactly the shape of thing this project has already lost days to when an
+//! offset was wrong and the failure was silent.
+//!
+//! ## What it does when the simulator goes away
+//!
+//! It goes away *often*: MuJoCo compiles its model, so changing the number of ducks means restarting
+//! it, and the ducks are expected to survive that. So a dead connection is an error returned to the
+//! caller and a reconnect on the next call — no backoff thread, because **the control loop is the
+//! retry timer**. `robotd` already treats a failed `read` as a tick to skip rather than a reason to
+//! exit; this is the same tolerance it has for a missing `tofd`.
+
+use std::io::{BufRead, BufReader, Write};
+use std::net::{TcpStream, ToSocketAddrs};
+use std::time::Duration;
+
+use serde::{Deserialize, Serialize};
+
+use crate::imu::ImuData;
+use crate::io::{IoError, JointTargets, Result, RobotIo, Sensors, SlowSensors};
+use crate::model::NUM_JOINTS;
+
+/// Bumped when the wire format changes in a way an older peer would misread.
+///
+/// Checked in the handshake and reported by *both* numbers when it fails, because the two halves
+/// live in two repositories and "the simulator is too old" and "the daemon is too old" are the same
+/// symptom otherwise.
+pub const PROTOCOL: u32 = 1;
+
+/// How long to wait for the simulator to answer one request.
+///
+/// Comfortably longer than a tick, because a simulator that has just been asked to step a
+/// contact-heavy scene can be late without being broken — and comfortably shorter than forever,
+/// because a wedged simulator must not wedge the control loop with it.
+const TIMEOUT: Duration = Duration::from_millis(200);
+
+/// One request. `op` is the tag, so a frame is readable in a log without a decoder.
+#[derive(Debug, Serialize)]
+#[serde(tag = "op")]
+enum Request<'a> {
+    #[serde(rename = "hello")]
+    Hello { protocol: u32, joints: usize },
+    #[serde(rename = "read")]
+    Read,
+    #[serde(rename = "write")]
+    Write { targets: &'a [f64; NUM_JOINTS] },
+    #[serde(rename = "gain")]
+    Gain { kp: u16 },
+    #[serde(rename = "torque")]
+    Torque { on: bool },
+    #[serde(rename = "slow")]
+    Slow,
+}
+
+#[derive(Debug, Deserialize)]
+struct Hello {
+    protocol: u32,
+}
+
+/// What the simulator reports, in exactly the units [`Sensors`] wants — radians, rad/s, mA, and the
+/// IMU already resolved into the trunk frame.
+///
+/// **The simulator does the conversion, not this.** MuJoCo knows its own model's joint order,
+/// scaling and frame; a translation layer here would be a second place for that knowledge to live
+/// and drift. What crosses the wire is the robot's own units.
+#[derive(Debug, Deserialize)]
+struct SensorFrame {
+    positions: [f64; NUM_JOINTS],
+    velocities: [f64; NUM_JOINTS],
+    #[serde(default)]
+    currents_ma: [f64; NUM_JOINTS],
+    imu: ImuFrame,
+}
+
+#[derive(Debug, Deserialize)]
+struct ImuFrame {
+    gyro: [f64; 3],
+    gravity: [f64; 3],
+    quat: [f64; 4],
+}
+
+#[derive(Debug, Deserialize)]
+struct SlowFrame {
+    volts: f64,
+    temps_c: [f64; NUM_JOINTS],
+}
+
+/// An acknowledgement, so a write that the simulator refused is not silently a write that worked.
+#[derive(Debug, Deserialize)]
+struct Ack {
+    #[serde(default)]
+    error: Option<String>,
+}
+
+/// A robot in MuJoCo, reached over TCP.
+pub struct RemoteIo {
+    addr: String,
+    link: Option<Link>,
+    /// Reported once rather than every tick a disconnected loop runs.
+    complained: bool,
+}
+
+struct Link {
+    write: TcpStream,
+    read: BufReader<TcpStream>,
+}
+
+impl RemoteIo {
+    /// Name the simulator. Nothing is connected until the first call — a daemon must start whether
+    /// or not the simulator is up yet, exactly as it starts without a robot on the bus.
+    pub fn at(addr: impl Into<String>) -> Self {
+        Self {
+            addr: addr.into(),
+            link: None,
+            complained: false,
+        }
+    }
+
+    fn connect(&mut self) -> Result<&mut Link> {
+        if self.link.is_none() {
+            let address = self
+                .addr
+                .to_socket_addrs()
+                .and_then(|mut a| {
+                    a.next()
+                        .ok_or_else(|| std::io::Error::other("resolved to no address"))
+                })
+                .map_err(|source| IoError::Port {
+                    path: self.addr.clone(),
+                    source,
+                })?;
+
+            // A connect timeout as well as a read one: a port nobody listens on refuses instantly,
+            // but a host that silently drops packets would otherwise hang the loop.
+            let stream =
+                TcpStream::connect_timeout(&address, TIMEOUT).map_err(|source| IoError::Port {
+                    path: self.addr.clone(),
+                    source,
+                })?;
+
+            // **Nagle would be catastrophic here and silent.** It delays a small write waiting for
+            // more to send, up to ~40 ms — twice the tick — turning every transaction into a
+            // missed deadline that looks like a slow simulator.
+            let _ = stream.set_nodelay(true);
+            let _ = stream.set_read_timeout(Some(TIMEOUT));
+            let _ = stream.set_write_timeout(Some(TIMEOUT));
+
+            let read = BufReader::new(stream.try_clone().map_err(|source| IoError::Port {
+                path: self.addr.clone(),
+                source,
+            })?);
+            let mut link = Link {
+                write: stream,
+                read,
+            };
+
+            let hello: Hello = exchange(
+                &mut link,
+                &Request::Hello {
+                    protocol: PROTOCOL,
+                    joints: NUM_JOINTS,
+                },
+            )?;
+            if hello.protocol != PROTOCOL {
+                return Err(IoError::Bus(format!(
+                    "the simulator speaks protocol {} and this daemon speaks {PROTOCOL} — one of \
+                     the two is out of date, and they are in different repositories",
+                    hello.protocol
+                )));
+            }
+
+            tracing::info!(addr = %self.addr, protocol = PROTOCOL, "simulated body");
+            self.complained = false;
+            self.link = Some(link);
+        }
+        Ok(self.link.as_mut().expect("just connected"))
+    }
+
+    /// One request and its answer, dropping the connection if anything about it fails.
+    ///
+    /// Dropping on *any* error, not only on a closed socket: a frame that will not parse means the
+    /// two ends disagree about where a message begins, and there is no way to resynchronise a
+    /// line protocol except by starting again.
+    fn call<T: for<'de> Deserialize<'de>>(&mut self, request: &Request<'_>) -> Result<T> {
+        let result = self.connect().and_then(|link| exchange(link, request));
+        if let Err(error) = &result {
+            self.link = None;
+            if !self.complained {
+                self.complained = true;
+                tracing::warn!(
+                    addr = %self.addr, %error,
+                    "no simulated body; retrying every tick until it answers"
+                );
+            }
+        }
+        result
+    }
+}
+
+fn exchange<T: for<'de> Deserialize<'de>>(link: &mut Link, request: &Request<'_>) -> Result<T> {
+    let mut line = serde_json::to_string(request).map_err(|e| IoError::Bus(e.to_string()))?;
+    line.push('\n');
+    link.write
+        .write_all(line.as_bytes())
+        .map_err(|e| IoError::Bus(format!("sending {}: {e}", tag(request))))?;
+
+    let mut answer = String::new();
+    let read = link
+        .read
+        .read_line(&mut answer)
+        .map_err(|e| IoError::Bus(format!("waiting for {}: {e}", tag(request))))?;
+    if read == 0 {
+        return Err(IoError::Bus(format!(
+            "the simulator closed the connection during {}",
+            tag(request)
+        )));
+    }
+    serde_json::from_str(&answer).map_err(|e| {
+        IoError::Bus(format!(
+            "{} answered with something this cannot read: {e}",
+            tag(request)
+        ))
+    })
+}
+
+fn tag(request: &Request<'_>) -> &'static str {
+    match request {
+        Request::Hello { .. } => "hello",
+        Request::Read => "read",
+        Request::Write { .. } => "write",
+        Request::Gain { .. } => "gain",
+        Request::Torque { .. } => "torque",
+        Request::Slow => "slow",
+    }
+}
+
+fn acked(ack: Ack, what: &str) -> Result<()> {
+    match ack.error {
+        None => Ok(()),
+        Some(why) => Err(IoError::Bus(format!("the simulator refused {what}: {why}"))),
+    }
+}
+
+impl RobotIo for RemoteIo {
+    fn read(&mut self) -> Result<Sensors> {
+        let frame: SensorFrame = self.call(&Request::Read)?;
+        Ok(Sensors {
+            positions: frame.positions,
+            velocities: frame.velocities,
+            currents_ma: frame.currents_ma,
+            imu: ImuData {
+                gyro: frame.imu.gyro,
+                gravity: frame.imu.gravity,
+                quat: frame.imu.quat,
+            },
+        })
+    }
+
+    fn write(&mut self, targets: &JointTargets) -> Result<()> {
+        let ack: Ack = self.call(&Request::Write {
+            targets: &targets.positions,
+        })?;
+        acked(ack, "the joint targets")
+    }
+
+    fn set_gain(&mut self, kp: u16) -> Result<()> {
+        let ack: Ack = self.call(&Request::Gain { kp })?;
+        acked(ack, "the position gain")
+    }
+
+    fn set_torque(&mut self, on: bool) -> Result<()> {
+        let ack: Ack = self.call(&Request::Torque { on })?;
+        acked(ack, if on { "torque on" } else { "torque off" })
+    }
+
+    /// A simulated servo has no latched hardware error to clear and no firmware to restart, so
+    /// there is nothing to send: the reboot succeeds at once and the caller restores the gains as
+    /// it would on a robot. Deliberately not an op on the wire — the simulator would only have to
+    /// answer it with an ack.
+    fn reboot(&mut self, id: u8) -> Result<()> {
+        tracing::debug!(id, "reboot of a simulated servo: nothing to do");
+        Ok(())
+    }
+
+    fn slow_sensors(&mut self) -> Result<SlowSensors> {
+        let frame: SlowFrame = self.call(&Request::Slow)?;
+        Ok(SlowSensors {
+            volts: frame.volts,
+            temps_c: frame.temps_c,
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::net::TcpListener;
+    use std::thread;
+
+    /// A simulator made of canned answers: one script per connection, one answer per request.
+    ///
+    /// A real socket rather than a trait behind the socket, because the things worth testing here
+    /// *are* the socket — a peer that hangs up, a frame that will not parse, a second connection
+    /// after the first died.
+    fn simulator(scripts: Vec<Vec<&'static str>>) -> (String, thread::JoinHandle<Vec<String>>) {
+        let listener = TcpListener::bind("127.0.0.1:0").expect("a loopback port");
+        let addr = listener.local_addr().expect("its address").to_string();
+        let handle = thread::spawn(move || {
+            let mut heard = Vec::new();
+            for script in scripts {
+                let (stream, _) = listener.accept().expect("a connection");
+                let mut out = stream.try_clone().expect("a writer");
+                let mut lines = BufReader::new(stream);
+                for reply in script {
+                    let mut line = String::new();
+                    if lines.read_line(&mut line).expect("a request") == 0 {
+                        break;
+                    }
+                    heard.push(line.trim().to_string());
+                    out.write_all(reply.as_bytes()).expect("a reply");
+                    out.write_all(b"\n").expect("a newline");
+                }
+            }
+            heard
+        });
+        (addr, handle)
+    }
+
+    const HELLO: &str = r#"{"protocol":1}"#;
+    // One line, because the protocol is one frame per line and a test fixture that wraps would be
+    // testing the fixture.
+    const SENSORS: &str = concat!(
+        r#"{"positions":[0.1,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"#,
+        r#""velocities":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0.5],"#,
+        r#""currents_ma":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"#,
+        r#""imu":{"gyro":[0,0,0],"gravity":[0,0,-1],"quat":[1,0,0,0]}}"#
+    );
+    const OK: &str = r#"{}"#;
+
+    #[test]
+    fn a_read_carries_the_sensors_the_loop_expects() {
+        let (addr, sim) = simulator(vec![vec![HELLO, SENSORS]]);
+        let mut io = RemoteIo::at(addr);
+        let sensors = io.read().expect("a sensor frame");
+        assert_eq!(sensors.positions[0], 0.1);
+        assert_eq!(sensors.velocities[NUM_JOINTS - 1], 0.5);
+        assert_eq!(sensors.imu.gravity, [0.0, 0.0, -1.0]);
+
+        let heard = sim.join().expect("the simulator thread");
+        assert!(heard[0].contains(r#""op":"hello""#), "{heard:?}");
+        assert!(heard[1].contains(r#""op":"read""#), "{heard:?}");
+    }
+
+    #[test]
+    fn the_targets_cross_in_joint_order() {
+        let (addr, sim) = simulator(vec![vec![HELLO, OK]]);
+        let mut io = RemoteIo::at(addr);
+        let mut positions = [0.0; NUM_JOINTS];
+        positions[2] = -0.4579;
+        io.write(&JointTargets::new(positions)).expect("a write");
+
+        let heard = sim.join().expect("the simulator thread");
+        // Positional, exactly as the wire everywhere else in this project is: the third number is
+        // the third joint, and nothing names it.
+        assert!(heard[1].contains("[0.0,0.0,-0.4579,"), "{heard:?}");
+    }
+
+    #[test]
+    fn a_protocol_mismatch_names_both_versions() {
+        let (addr, _sim) = simulator(vec![vec![r#"{"protocol":99}"#]]);
+        let mut io = RemoteIo::at(addr);
+        let error = io
+            .read()
+            .expect_err("a mismatch is fatal to the connection");
+        let said = error.to_string();
+        assert!(said.contains("99") && said.contains("1"), "{said}");
+        assert!(said.contains("different repositories"), "{said}");
+    }
+
+    #[test]
+    fn a_refusal_is_an_error_rather_than_a_silent_success() {
+        let (addr, _sim) = simulator(vec![vec![HELLO, r#"{"error":"torque is disabled"}"#]]);
+        let mut io = RemoteIo::at(addr);
+        let error = io
+            .set_torque(true)
+            .expect_err("a refusal must not read as done");
+        assert!(error.to_string().contains("torque is disabled"), "{error}");
+    }
+
+    #[test]
+    fn a_simulator_that_restarts_is_reconnected_to_on_the_next_tick() {
+        // The case this exists for: MuJoCo compiles its model, so changing the number of ducks
+        // restarts it — and the ducks are expected to survive that. The first connection dies
+        // mid-read; the second is expected to be made without anyone asking.
+        let (addr, sim) = simulator(vec![vec![HELLO], vec![HELLO, SENSORS]]);
+        let mut io = RemoteIo::at(addr);
+
+        io.read().expect_err("the simulator hung up");
+        let sensors = io.read().expect("reconnected on the next call");
+        assert_eq!(sensors.positions[0], 0.1);
+
+        let heard = sim.join().expect("the simulator thread");
+        let hellos = heard.iter().filter(|l| l.contains("hello")).count();
+        assert_eq!(
+            hellos, 2,
+            "the second connection must handshake again: {heard:?}"
+        );
+    }
+
+    #[test]
+    fn a_frame_that_will_not_parse_drops_the_connection() {
+        // Not merely an error: a half-read line means the two ends disagree about where a message
+        // starts, and a line protocol cannot resynchronise except by starting again.
+        let (addr, sim) = simulator(vec![vec![HELLO, "not json"], vec![HELLO, SENSORS]]);
+        let mut io = RemoteIo::at(addr);
+        io.read().expect_err("garbage is an error");
+        io.read().expect("a fresh connection, not a wedged one");
+
+        let heard = sim.join().expect("the simulator thread");
+        assert_eq!(heard.iter().filter(|l| l.contains("hello")).count(), 2);
+    }
+}
diff --git a/duck-control/tests/fixtures/bad_action_count.onnx b/duck-control/tests/fixtures/bad_action_count.onnx
new file mode 100644
index 00000000..2040531d
Binary files /dev/null and b/duck-control/tests/fixtures/bad_action_count.onnx differ
diff --git a/duck-control/tests/fixtures/bad_batch.onnx b/duck-control/tests/fixtures/bad_batch.onnx
new file mode 100644
index 00000000..4cb3d50e
Binary files /dev/null and b/duck-control/tests/fixtures/bad_batch.onnx differ
diff --git a/duck-control/tests/fixtures/bad_rank.onnx b/duck-control/tests/fixtures/bad_rank.onnx
new file mode 100644
index 00000000..f0399159
Binary files /dev/null and b/duck-control/tests/fixtures/bad_rank.onnx differ
diff --git a/duck-control/tests/fixtures/bad_state_shape.onnx b/duck-control/tests/fixtures/bad_state_shape.onnx
new file mode 100644
index 00000000..245643bc
Binary files /dev/null and b/duck-control/tests/fixtures/bad_state_shape.onnx differ
diff --git a/duck-control/tests/fixtures/bad_width.onnx b/duck-control/tests/fixtures/bad_width.onnx
new file mode 100644
index 00000000..2b24d32f
Binary files /dev/null and b/duck-control/tests/fixtures/bad_width.onnx differ
diff --git a/duck-control/tests/fixtures/dynamic_batch.onnx b/duck-control/tests/fixtures/dynamic_batch.onnx
new file mode 100644
index 00000000..923abe99
Binary files /dev/null and b/duck-control/tests/fixtures/dynamic_batch.onnx differ
diff --git a/duck-control/tests/fixtures/dynamic_hidden.onnx b/duck-control/tests/fixtures/dynamic_hidden.onnx
new file mode 100644
index 00000000..264daa3d
Binary files /dev/null and b/duck-control/tests/fixtures/dynamic_hidden.onnx differ
diff --git a/duck-control/tests/fixtures/extra_input.onnx b/duck-control/tests/fixtures/extra_input.onnx
new file mode 100644
index 00000000..3b98c2f1
Binary files /dev/null and b/duck-control/tests/fixtures/extra_input.onnx differ
diff --git a/duck-control/tests/fixtures/feedforward.onnx b/duck-control/tests/fixtures/feedforward.onnx
new file mode 100644
index 00000000..2c97e5ea
Binary files /dev/null and b/duck-control/tests/fixtures/feedforward.onnx differ
diff --git a/duck-control/tests/fixtures/generate.py b/duck-control/tests/fixtures/generate.py
new file mode 100644
index 00000000..1f74e0e9
--- /dev/null
+++ b/duck-control/tests/fixtures/generate.py
@@ -0,0 +1,79 @@
+"""Regenerate tiny contract fixtures: python with onnx + numpy installed.
+
+The recurrent fixture uses the real ONNX LSTM operator, with deterministic weights.
+No trained model or hardware is needed. Output order deliberately differs from mjlab.
+"""
+from pathlib import Path
+import copy
+import numpy as np
+import onnx
+from onnx import TensorProto as T, helper as h, numpy_helper as nh
+
+ROOT = Path(__file__).parent
+
+def info(name, shape, dtype=T.FLOAT):
+    return h.make_tensor_value_info(name, dtype, shape)
+
+def save(name, nodes, inputs, outputs, initializers):
+    model = h.make_model(h.make_graph(nodes, name, inputs, outputs, initializers),
+                        opset_imports=[h.make_opsetid('', 17)], ir_version=8)
+    onnx.checker.check_model(model)
+    onnx.save(model, ROOT / (name + '.onnx'))
+    return model
+
+ff = save('feedforward', [h.make_node('Gather', ['obs', 'indices'], ['output'], axis=1)],
+          [info('obs', [1, 61])], [info('output', [1, 14])],
+          [nh.from_array(np.arange(14, dtype=np.int64), 'indices')])
+rng = np.random.default_rng(42)
+weights = [nh.from_array(rng.normal(0, .15, shape).astype('float32'), name)
+           for name, shape in [('W', (1, 8, 61)), ('R', (1, 8, 2)), ('B', (1, 16))]]
+model = save('lstm', [
+    h.make_node('Unsqueeze', ['obs', 'axis'], ['x']),
+    h.make_node('LSTM', ['x', 'W', 'R', 'B', '', 'h_in', 'c_in'],
+                ['y', 'h_out', 'c_out'], hidden_size=2),
+    h.make_node('Squeeze', ['h_out', 'axis'], ['flat']),
+    h.make_node('Tile', ['flat', 'repeats'], ['actions']),
+], [info('c_in', [1, 1, 2]), info('obs', [1, 61]), info('h_in', [1, 1, 2])],
+   [info('c_out', [1, 1, 2]), info('actions', [1, 14]), info('h_out', [1, 1, 2])],
+   weights + [nh.from_array(np.array([0], dtype=np.int64), 'axis'),
+              nh.from_array(np.array([1, 7], dtype=np.int64), 'repeats')])
+
+def variant(name, mutate, source=model):
+    m = copy.deepcopy(source)
+    mutate(m)
+    # Some invalid contracts also violate graph shape inference: they must be
+    # rejected, whether by ORT itself or by our load-time contract validation.
+    onnx.save(m, ROOT / (name + '.onnx'))
+
+def dimension(m, io, name, index, value):
+    entry = next(x for x in getattr(m.graph, io) if x.name == name)
+    d = entry.type.tensor_type.shape.dim[index]
+    d.ClearField('dim_param')
+    if isinstance(value, str):
+        d.ClearField('dim_value')
+        d.dim_param = value
+    else:
+        d.dim_value = value
+
+variant('bad_width', lambda m: dimension(m, 'input', 'obs', 1, 60))
+variant('bad_batch', lambda m: dimension(m, 'input', 'obs', 0, 2))
+variant('bad_state_shape', lambda m: dimension(m, 'input', 'c_in', 2, 3))
+variant('dynamic_hidden', lambda m: dimension(m, 'input', 'h_in', 2, 'hidden'))
+variant('missing_state', lambda m: m.graph.input.remove(m.graph.input[0]))
+variant('extra_input', lambda m: m.graph.input.append(info('unexpected', [1])))
+variant('wrong_type', lambda m: setattr(m.graph.input[0].type.tensor_type, 'elem_type', T.DOUBLE))
+variant('dynamic_batch', lambda m: [dimension(m, io, x.name, 0 if x.name in ('obs', 'actions') else 1, 'batch')
+                                   for io in ('input', 'output') for x in getattr(m.graph, io)])
+variant('bad_rank', lambda m: m.graph.input[0].type.tensor_type.shape.dim.insert(0, h.make_tensor_type_proto(T.FLOAT, [1]).tensor_type.shape.dim[0]), ff)
+variant('bad_action_count', lambda m: m.graph.initializer[0].CopyFrom(nh.from_array(np.arange(13, dtype=np.int64), 'indices')), ff)
+# Non-finite state should fail during warm-up even when its action output is finite.
+nan = copy.deepcopy(model)
+for node in nan.graph.node:
+    for i, name in enumerate(node.output):
+        if name == 'c_out': node.output[i] = 'cell'
+nan.graph.node.append(h.make_node('Add', ['cell', 'nan'], ['c_out']))
+nan.graph.initializer.append(nh.from_array(np.array(np.nan, dtype=np.float32), 'nan'))
+onnx.save(nan, ROOT / 'nan_state.onnx')
+
+variant('lstm_changed', lambda m: next(x for x in m.graph.initializer if x.name == 'B').CopyFrom(
+    nh.from_array(np.full((1, 16), .3, dtype=np.float32), 'B')))
diff --git a/duck-control/tests/fixtures/lstm.onnx b/duck-control/tests/fixtures/lstm.onnx
new file mode 100644
index 00000000..befdef32
Binary files /dev/null and b/duck-control/tests/fixtures/lstm.onnx differ
diff --git a/duck-control/tests/fixtures/lstm_changed.onnx b/duck-control/tests/fixtures/lstm_changed.onnx
new file mode 100644
index 00000000..120e03e0
Binary files /dev/null and b/duck-control/tests/fixtures/lstm_changed.onnx differ
diff --git a/duck-control/tests/fixtures/missing_state.onnx b/duck-control/tests/fixtures/missing_state.onnx
new file mode 100644
index 00000000..4ddcdcd9
Binary files /dev/null and b/duck-control/tests/fixtures/missing_state.onnx differ
diff --git a/duck-control/tests/fixtures/nan_state.onnx b/duck-control/tests/fixtures/nan_state.onnx
new file mode 100644
index 00000000..85f3fb90
Binary files /dev/null and b/duck-control/tests/fixtures/nan_state.onnx differ
diff --git a/duck-control/tests/fixtures/wrong_type.onnx b/duck-control/tests/fixtures/wrong_type.onnx
new file mode 100644
index 00000000..fa008079
Binary files /dev/null and b/duck-control/tests/fixtures/wrong_type.onnx differ
diff --git a/duck-control/tests/recurrent_policy.rs b/duck-control/tests/recurrent_policy.rs
new file mode 100644
index 00000000..1e6142d9
--- /dev/null
+++ b/duck-control/tests/recurrent_policy.rs
@@ -0,0 +1,164 @@
+//! Requires ONNX Runtime >= 1.23: cargo test -p duck-control --test recurrent_policy -- --ignored
+//! Kept explicit so hosts without the dynamically loaded runtime still run the normal suite.
+use duck_control::obs::Observation;
+use duck_control::policy::{Net, Policy, PolicyPaths, validate};
+use std::path::PathBuf;
+
+fn fixture(name: &str) -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("tests/fixtures")
+        .join(format!("{name}.onnx"))
+}
+fn load(walk: &str, stand: Option<&str>) -> Policy {
+    Policy::load(
+        &PolicyPaths {
+            walk: fixture(walk),
+            stand: stand.map(fixture),
+            ..Default::default()
+        },
+        0.05,
+    )
+    .unwrap()
+}
+fn obs() -> Observation {
+    Observation::from([0.2; 61])
+}
+
+#[test]
+#[ignore = "requires ONNX Runtime >= 1.23"]
+fn feedforward_outputs_are_unchanged_by_selection_and_reset() {
+    let mut p = load("feedforward", None);
+    for net in [Net::Walk, Net::Stand, Net::Skill(999), Net::Walk] {
+        assert_eq!(p.infer(&obs(), net).unwrap(), [0.2; 14]);
+        p.reset();
+    }
+}
+
+#[test]
+#[ignore = "requires ONNX Runtime >= 1.23"]
+fn lstm_carries_state_and_reset_reproduces_first_action() {
+    let mut p = load("lstm", None);
+    let first = p.infer(&obs(), Net::Walk).unwrap();
+    let second = p.infer(&obs(), Net::Walk).unwrap();
+    assert_ne!(first, second, "memory must affect the next step");
+    p.reset();
+    assert_eq!(first, p.infer(&obs(), Net::Walk).unwrap());
+    assert_eq!(second, p.infer(&obs(), Net::Walk).unwrap());
+    // Missing slots resolve to the currently active walking network, without resetting it.
+    let third = p.infer(&obs(), Net::Walk).unwrap();
+    p.reset();
+    p.infer(&obs(), Net::Walk).unwrap();
+    p.infer(&obs(), Net::Stand).unwrap();
+    assert_eq!(third, p.infer(&obs(), Net::Skill(5)).unwrap());
+}
+
+#[test]
+#[ignore = "requires ONNX Runtime >= 1.23"]
+fn switching_networks_does_not_leak_or_resume_old_state() {
+    let mut p = load("lstm", Some("lstm"));
+    let first = p.infer(&obs(), Net::Walk).unwrap();
+    assert_ne!(first, p.infer(&obs(), Net::Walk).unwrap());
+    assert_eq!(first, p.infer(&obs(), Net::Stand).unwrap());
+    assert_ne!(first, p.infer(&obs(), Net::Stand).unwrap());
+    assert_eq!(first, p.infer(&obs(), Net::Walk).unwrap());
+    let mut mixed = load("lstm", Some("feedforward"));
+    assert_eq!(first, mixed.infer(&obs(), Net::Walk).unwrap());
+    assert_eq!([0.2; 14], mixed.infer(&obs(), Net::Stand).unwrap());
+    assert_eq!(first, mixed.infer(&obs(), Net::Walk).unwrap());
+}
+
+#[test]
+#[ignore = "requires ONNX Runtime >= 1.23"]
+fn warmup_does_not_become_episode_history_and_dynamic_batch_works() {
+    let mut p = load("lstm", None);
+    let first = p.infer(&obs(), Net::Walk).unwrap();
+    p.reset();
+    assert_eq!(first, p.infer(&obs(), Net::Walk).unwrap());
+    let mut dynamic = load("dynamic_batch", None);
+    assert_eq!(first, dynamic.infer(&obs(), Net::Walk).unwrap());
+}
+
+#[test]
+#[ignore = "requires ONNX Runtime >= 1.23"]
+fn unsupported_contracts_fail_before_the_control_loop() {
+    for name in [
+        "bad_width",
+        "bad_batch",
+        "bad_state_shape",
+        "dynamic_hidden",
+        "missing_state",
+        "extra_input",
+        "wrong_type",
+        "bad_rank",
+        "bad_action_count",
+    ] {
+        assert!(validate(&fixture(name)).is_err(), "accepted {name}");
+    }
+    assert!(
+        Policy::load(
+            &PolicyPaths {
+                walk: fixture("nan_state"),
+                ..Default::default()
+            },
+            0.05
+        )
+        .is_err()
+    );
+}
+
+#[test]
+#[ignore = "requires ONNX Runtime >= 1.23"]
+fn bad_inference_does_not_poison_the_next_episode() {
+    let mut p = load("lstm", None);
+    let first = p.infer(&obs(), Net::Walk).unwrap();
+    assert!(
+        p.infer(&Observation::from([f32::NAN; 61]), Net::Walk)
+            .is_err()
+    );
+    assert_eq!(first, p.infer(&obs(), Net::Walk).unwrap());
+}
+
+#[test]
+#[ignore = "requires ONNX Runtime >= 1.23"]
+fn replacing_another_slot_preserves_only_the_unchanged_active_network() {
+    let mut old = load("lstm", Some("feedforward"));
+    old.infer(&obs(), Net::Walk).unwrap();
+    let mut replacement = load("lstm", Some("lstm"));
+    replacement.carry_over(&old);
+    assert_eq!(
+        old.infer(&obs(), Net::Walk).unwrap(),
+        replacement.infer(&obs(), Net::Walk).unwrap()
+    );
+    let mut changed = load("feedforward", None);
+    changed.carry_over(&old);
+    assert_eq!([0.2; 14], changed.infer(&obs(), Net::Walk).unwrap());
+    // The inactive standing slot must still start a new episode.
+    let mut fresh = load("lstm", None);
+    assert_eq!(
+        fresh.infer(&obs(), Net::Walk).unwrap(),
+        replacement.infer(&obs(), Net::Stand).unwrap()
+    );
+}
+
+#[test]
+#[ignore = "requires ONNX Runtime >= 1.23"]
+fn changed_weights_at_the_same_path_start_with_fresh_memory() {
+    let path =
+        std::env::temp_dir().join(format!("microduck-recurrent-{}.onnx", std::process::id()));
+    std::fs::copy(fixture("lstm"), &path).unwrap();
+    let paths = PolicyPaths {
+        walk: path.clone(),
+        ..Default::default()
+    };
+    let mut old = Policy::load(&paths, 0.05).unwrap();
+    old.infer(&obs(), Net::Walk).unwrap();
+    std::fs::copy(fixture("lstm_changed"), &path).unwrap();
+    let mut replacement = Policy::load(&paths, 0.05).unwrap();
+    replacement.carry_over(&old);
+    let mut fresh = load("lstm_changed", None);
+    assert_eq!(
+        fresh.infer(&obs(), Net::Walk).unwrap(),
+        replacement.infer(&obs(), Net::Walk).unwrap()
+    );
+    std::fs::remove_file(path).unwrap();
+}
diff --git a/duck-detect/models/duck_detect.onnx b/duck-detect/models/duck_detect.onnx
deleted file mode 100644
index 42d1e6fc..00000000
Binary files a/duck-detect/models/duck_detect.onnx and /dev/null differ
diff --git a/duck-detect/models/duck_detect.rknn b/duck-detect/models/duck_detect.rknn
deleted file mode 100644
index 49fce2e2..00000000
Binary files a/duck-detect/models/duck_detect.rknn and /dev/null differ
diff --git a/duck-detect/src/lib.rs b/duck-detect/src/lib.rs
index 3407f7e5..9a9b2659 100644
--- a/duck-detect/src/lib.rs
+++ b/duck-detect/src/lib.rs
@@ -228,6 +228,72 @@ pub fn letterbox_from_uyvy(
     }
 }
 
+/// The frame as an upright RGB picture, scaled to fit a box, with no padding.
+///
+/// [`letterbox_from_uyvy`] above is for the model: a square, padded, at whatever size the network
+/// wants. This is for a *person or a program looking at the picture* — a JPEG on its way to a
+/// Space that runs a model of its own — so it keeps the aspect ratio and pads nothing.
+///
+/// **The turn is applied here rather than reported.** `mediad`'s pipeline deliberately does not
+/// rotate: a `videoflip` cost the encoder its zero-copy path and the board 22 fps, so a WebRTC
+/// consumer is told the mount angle and turns the picture itself (`media.video`). That reasoning
+/// does not carry over to this path, because the conversion is a per-pixel loop either way and the
+/// turn is a change of which source pixel is fetched — free, inside a loop that is already
+/// running. And what receives these frames is a model, which wants them the way up it was trained
+/// on rather than a rotation flag to honour.
+///
+/// Returns the size written, which is not `(long, short)` in any predictable order: a quarter turn
+/// swaps the axes, so the caller is told rather than left to work it out.
+pub fn rgb_from_uyvy(
+    uyvy: &[u8],
+    width: usize,
+    height: usize,
+    longest: usize,
+    turn: Turn,
+    out: &mut Vec<u8>,
+) -> (usize, usize) {
+    let (upright_w, upright_h) = turn.upright(width, height);
+    // Downscale only. Asking for a box bigger than the sensor would interpolate detail that was
+    // never captured and cost the bandwidth of pretending.
+    let scale = (longest as f32 / upright_w.max(upright_h) as f32).min(1.0);
+    let out_w = ((upright_w as f32 * scale).round() as usize).max(1);
+    let out_h = ((upright_h as f32 * scale).round() as usize).max(1);
+    let stride = width * 2;
+
+    out.clear();
+    out.resize(out_w * out_h * 3, 0);
+    for y in 0..out_h {
+        let uy = (y * upright_h) / out_h;
+        for x in 0..out_w {
+            let ux = (x * upright_w) / out_w;
+            let (source_x, source_y) = turn.source(ux, uy, width, height);
+            let row = source_y * stride;
+            if row + stride > uyvy.len() {
+                // A frame that arrives mid-teardown is short. What is missing stays black rather
+                // than taking the daemon down over a picture — the same call `letterbox_from_uyvy`
+                // makes.
+                continue;
+            }
+            let pair = row + (source_x / 2) * 4;
+            // U Y0 V Y1: the luma is the odd byte of the half this pixel falls in.
+            let luma = uyvy[pair + 1 + 2 * (source_x & 1)] as i32 - 16;
+            let u = uyvy[pair] as i32 - 128;
+            let v = uyvy[pair + 2] as i32 - 128;
+
+            // BT.601 limited range in fixed point, as above: the ISP's convention.
+            let r = (298 * luma + 409 * v + 128) >> 8;
+            let g = (298 * luma - 100 * u - 208 * v + 128) >> 8;
+            let b = (298 * luma + 516 * u + 128) >> 8;
+
+            let target = (y * out_w + x) * 3;
+            out[target] = r.clamp(0, 255) as u8;
+            out[target + 1] = g.clamp(0, 255) as u8;
+            out[target + 2] = b.clamp(0, 255) as u8;
+        }
+    }
+    (out_w, out_h)
+}
+
 /// Candidates over `threshold`, suppressed, and mapped back to the original frame.
 ///
 /// **The head does not suppress anything.** 2100 candidates means one duck comes back as twenty
@@ -289,6 +355,42 @@ fn iou(a: &[f32; 4], b: &[f32; 4]) -> f32 {
 
 #[cfg(test)]
 mod tests {
+    /// A quarter turn swaps the axes and moves a known corner, which is the whole of what a
+    /// rotation can get wrong: an upside-down picture and an unrotated one have the same shape.
+    #[test]
+    fn the_rgb_scaler_turns_the_picture_and_keeps_its_shape() {
+        // 8x4 UYVY, all grey except the top-left pixel, which is bright.
+        let (width, height) = (8usize, 4usize);
+        let mut uyvy = [128u8, 16, 128, 16].repeat(width * height / 2);
+        uyvy[1] = 235; // Y0 of the first pair: the top-left pixel, white.
+
+        let mut out = Vec::new();
+        let (w, h) = rgb_from_uyvy(&uyvy, width, height, 8, Turn::None, &mut out);
+        assert_eq!((w, h), (8, 4), "unturned, the shape is the frame's");
+        assert!(out[0] > 200, "and the bright pixel is top-left: {}", out[0]);
+
+        let (w, h) = rgb_from_uyvy(&uyvy, width, height, 8, Turn::Right, &mut out);
+        assert_eq!((w, h), (4, 8), "a quarter turn swaps the axes");
+        // Turned clockwise, the frame's top-left corner is the picture's top-right — row zero,
+        // last column.
+        let top_right = (w - 1) * 3;
+        assert!(
+            out[top_right] > 200,
+            "the bright pixel moved to the top-right: {:?}",
+            &out[top_right..top_right + 3]
+        );
+        assert!(out[0] < 200, "and is no longer top-left: {}", out[0]);
+    }
+
+    /// Never upscales: a box larger than the sensor would interpolate detail nobody captured.
+    #[test]
+    fn the_rgb_scaler_only_ever_shrinks() {
+        let uyvy = [128u8, 16, 128, 16].repeat(8 * 4 / 2);
+        let mut out = Vec::new();
+        assert_eq!(rgb_from_uyvy(&uyvy, 8, 4, 64, Turn::None, &mut out), (8, 4));
+        assert_eq!(rgb_from_uyvy(&uyvy, 8, 4, 4, Turn::None, &mut out), (4, 2));
+    }
+
     use super::*;
 
     /// A tall frame fits inside the square with grey above and below, and nothing stretches.
diff --git a/duck-ether/Cargo.toml b/duck-ether/Cargo.toml
new file mode 100644
index 00000000..b489e1ff
--- /dev/null
+++ b/duck-ether/Cargo.toml
@@ -0,0 +1,15 @@
+[package]
+name = "duck-ether"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+description = "A radio for simulated ducks: what one advertises, the ones near it hear"
+
+[dependencies]
+duck-ipc-proto = { path = "../duck-ipc-proto" }
+thiserror.workspace = true
+clap = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
+tokio = { workspace = true, features = ["rt-multi-thread", "macros", "net", "io-util", "time", "sync"] }
+tracing.workspace = true
+tracing-subscriber = { workspace = true, features = ["env-filter"] }
diff --git a/duck-ether/src/main.rs b/duck-ether/src/main.rs
new file mode 100644
index 00000000..8c78dd69
--- /dev/null
+++ b/duck-ether/src/main.rs
@@ -0,0 +1,466 @@
+//! A radio for simulated ducks: what one advertises, the ones near it hear.
+//!
+//! ```text
+//! duck-ether --duck duck-a=/run/duck-a/robotd.sock@7801 \
+//!            --duck duck-b=/run/duck-b/robotd.sock@7802
+//! ```
+//!
+//! **This replaces `btd`'s radio and nothing above it.** Presence is already an IPC contract on
+//! `robotd`'s own socket — `chorale.subscribe` to be told what to put on the air, `chorale.beacon`
+//! carrying it, `chorale.heard` carrying what came back — and `btd` is a *client* of `robotd`
+//! rather than a server. So this impersonates nothing and steals no socket path: it holds one
+//! connection per duck, exactly as `btd` does, and every duck's election, roster, beat and
+//! conductor deference runs unmodified and cannot tell.
+//!
+//! ## What decides who hears whom
+//!
+//! Distance, because [`ChoraleHeard`] has no signal strength in it — a real scanner either sees an
+//! advertisement or does not, and a beacon out of range simply never arrives. So the ether asks each
+//! simulator where its duck is standing and delivers a beacon only to ducks within [`RANGE`] of it.
+//! That is a cruder radio than a real one and a far more controllable one: a range that is a number
+//! makes "these two can hear each other and those two cannot" a thing you can set up in a second,
+//! which on real hardware means carrying robots into other rooms.
+//!
+//! ## Two things it gets right that are easy to get wrong
+//!
+//! **`age_us` is an age, not a timestamp.** The field exists because two daemons share a machine and
+//! not an epoch, and `robotd` subtracts it from its own clock on arrival — so filling it with a real
+//! elapsed time is what keeps the beat synchronisation being exercised rather than short-circuited.
+//!
+//! **The address rotates.** `from` is documented as an identity for de-duplication only, and a real
+//! duck's BLE address changes underneath it — a fact that cost this project a day when something
+//! keyed on it. `--rotate` makes that happen on a timer, which turns the bug into a test.
+//!
+//! ## Being a bad radio on purpose
+//!
+//! **A perfect ether hides the bugs a real one causes**, and that is not a hypothetical. Four ducks
+//! in the twin converge on one piece every time, staggered starts included — because every duck is
+//! visible to every other from the moment it boots, instantly and losslessly. On hardware, BLE
+//! discovery is slow and lossy, so two ducks can be singing before the other two have seen them,
+//! which is exactly the split-brain the chorale's election has to survive.
+//!
+//! So `--discovery` makes a duck take a while to be *noticed*, per pair rather than globally,
+//! because it is the asymmetry that splits a flock: A and B finding each other quickly while C and D
+//! are still deaf is the scenario, and one global delay cannot produce it. `--loss` drops a fraction
+//! of deliveries. Both are driven by a seeded PRNG, so a split that happens once can be made to
+//! happen again — a flaky radio is only useful for debugging if its flakiness repeats.
+
+use std::collections::HashMap;
+use std::path::PathBuf;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+use clap::Parser;
+use duck_ipc_proto as proto;
+use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
+use tokio::net::{TcpStream, UnixStream};
+use tokio::sync::Mutex;
+
+/// How far a beacon carries, in metres.
+///
+/// Generous on purpose: a real advertisement crosses a room and then some, and the interesting
+/// failures are about who is *out* of range, which is what `--range` is for.
+const RANGE: f64 = 8.0;
+
+/// How often each duck's beacon is delivered to the ducks near it.
+///
+/// A real scanner sees an advertisement repeatedly, not once — `robotd` ages every sighting and
+/// drops a peer that stops arriving, so a beacon sent once would be a duck that vanishes.
+const DELIVERY: Duration = Duration::from_millis(200);
+
+#[derive(Parser, Debug)]
+#[command(about = "A radio for simulated ducks", version)]
+struct Args {
+    /// A duck, as `name=/path/to/robotd.sock@body-port`. Repeat for each.
+    #[arg(long = "duck", value_name = "NAME=SOCKET@PORT", required = true)]
+    ducks: Vec<String>,
+
+    /// How far a beacon carries, in metres.
+    #[arg(long, default_value_t = RANGE)]
+    range: f64,
+
+    /// Rotate each duck's address every N seconds, as a real one does. 0 leaves it alone.
+    #[arg(long, default_value_t = 0)]
+    rotate: u64,
+
+    /// Take up to this many seconds to notice each duck, per pair. 0 is an instant, perfect radio.
+    #[arg(long, default_value_t = 0)]
+    discovery: u64,
+
+    /// Drop this fraction of deliveries, 0.0 to 1.0. A real advertisement is missed often.
+    #[arg(long, default_value_t = 0.0)]
+    loss: f64,
+
+    /// Seed for the discovery delays and the losses, so a split can be reproduced.
+    #[arg(long, default_value_t = 1)]
+    seed: u64,
+}
+
+/// A radio's imperfections, as numbers.
+#[derive(Debug, Clone, Copy)]
+struct Weather {
+    discovery: Duration,
+    loss: f64,
+    seed: u64,
+}
+
+/// Deterministic noise from a name and a counter — a splitmix step, which is short, well distributed
+/// and needs no dependency. Deterministic is the point: a radio that is flaky differently every run
+/// cannot be used to chase a bug.
+fn noise(seed: u64, key: &str, salt: u64) -> u64 {
+    let mut x = seed ^ salt;
+    for byte in key.as_bytes() {
+        x = x.wrapping_mul(0x100_0000_01b3) ^ u64::from(*byte);
+    }
+    x = (x ^ (x >> 30)).wrapping_mul(0xbf58_476d_1ce4_e5b9);
+    x = (x ^ (x >> 27)).wrapping_mul(0x94d0_49bb_1331_11eb);
+    x ^ (x >> 31)
+}
+
+#[derive(Debug, Clone)]
+struct Duck {
+    name: String,
+    socket: PathBuf,
+    body: u16,
+}
+
+fn parse_duck(text: &str) -> Result<Duck, String> {
+    let (name, rest) = text
+        .split_once('=')
+        .ok_or_else(|| format!("{text:?} is not name=socket@port"))?;
+    let (socket, port) = rest
+        .rsplit_once('@')
+        .ok_or_else(|| format!("{text:?} has no @body-port"))?;
+    Ok(Duck {
+        name: name.to_owned(),
+        socket: PathBuf::from(socket),
+        body: port
+            .parse()
+            .map_err(|_| format!("{port:?} is not a port number"))?,
+    })
+}
+
+/// What one duck is putting on the air, and whether it is listening.
+#[derive(Default)]
+struct OnAir {
+    beacon: Option<proto::ChoraleBeacon>,
+    listening: bool,
+    /// Where this duck is standing, from its simulator.
+    at: [f64; 3],
+    /// When this duck first had something to advertise — discovery is timed from there, because a
+    /// scanner cannot notice a duck that is not yet on the air.
+    since: Option<Instant>,
+    /// What its radio calls itself today.
+    address: String,
+}
+
+type Air = Arc<Mutex<HashMap<String, OnAir>>>;
+
+#[tokio::main(flavor = "current_thread")]
+async fn main() -> std::process::ExitCode {
+    let args = Args::parse();
+    tracing_subscriber::fmt()
+        .with_env_filter(
+            tracing_subscriber::EnvFilter::try_from_default_env()
+                .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info")),
+        )
+        .init();
+
+    let ducks: Vec<Duck> = match args.ducks.iter().map(|d| parse_duck(d)).collect() {
+        Ok(ducks) => ducks,
+        Err(why) => {
+            tracing::error!("{why}");
+            return std::process::ExitCode::FAILURE;
+        }
+    };
+
+    let air: Air = Arc::new(Mutex::new(HashMap::new()));
+    {
+        let mut on_air = air.lock().await;
+        for (index, duck) in ducks.iter().enumerate() {
+            on_air.insert(
+                duck.name.clone(),
+                OnAir {
+                    address: address_for(index, 0),
+                    ..Default::default()
+                },
+            );
+        }
+    }
+
+    let weather = Weather {
+        discovery: Duration::from_secs(args.discovery),
+        loss: args.loss.clamp(0.0, 1.0),
+        seed: args.seed,
+    };
+    tracing::info!(
+        ducks = ducks.len(),
+        range = args.range,
+        discovery_s = args.discovery,
+        loss = weather.loss,
+        seed = args.seed,
+        "the ether is open"
+    );
+
+    let mut tasks = Vec::new();
+    for duck in &ducks {
+        let (duck, air, range, weather) = (duck.clone(), air.clone(), args.range, weather);
+        tasks.push(tokio::spawn(async move {
+            loop {
+                if let Err(e) = serve(&duck, &air, range, weather).await {
+                    tracing::warn!(duck = %duck.name, error = %e, "lost the duck; retrying");
+                }
+                tokio::time::sleep(Duration::from_secs(1)).await;
+            }
+        }));
+    }
+
+    tasks.push(tokio::spawn(positions(ducks.clone(), air.clone())));
+    if args.rotate > 0 {
+        tasks.push(tokio::spawn(rotate(
+            ducks.clone(),
+            air.clone(),
+            args.rotate,
+        )));
+    }
+
+    for task in tasks {
+        let _ = task.await;
+    }
+    std::process::ExitCode::SUCCESS
+}
+
+/// A believable BLE address, and a different one after every rotation.
+fn address_for(index: usize, generation: u64) -> String {
+    let n = (index as u64 + 1) * 0x1_0000 + generation;
+    format!(
+        "E{:1X}:{:02X}:{:02X}:{:02X}:{:02X}:{:02X}",
+        index & 0xF,
+        (n >> 32) & 0xFF,
+        (n >> 24) & 0xFF,
+        (n >> 16) & 0xFF,
+        (n >> 8) & 0xFF,
+        n & 0xFF
+    )
+}
+
+/// One duck's connection: `btd`'s half of the conversation, without a radio underneath it.
+async fn serve(duck: &Duck, air: &Air, range: f64, weather: Weather) -> std::io::Result<()> {
+    let stream = UnixStream::connect(&duck.socket).await?;
+    let (read_half, mut write_half) = stream.into_split();
+    let mut lines = BufReader::new(read_half).lines();
+
+    let request = proto::Request::call(proto::Id::Number(1), &proto::Call::ChoraleSubscribe);
+    let mut line = serde_json::to_string(&request).map_err(std::io::Error::other)?;
+    line.push('\n');
+    write_half.write_all(line.as_bytes()).await?;
+    tracing::info!(duck = %duck.name, "on the air");
+
+    let mut deliveries = tokio::time::interval(DELIVERY);
+    let mut delivered = usize::MAX;
+    let mut tick = 0u64;
+    loop {
+        tokio::select! {
+            line = lines.next_line() => {
+                let Some(line) = line? else { return Ok(()) };
+                let Ok(request) = serde_json::from_str::<proto::Request>(&line) else { continue };
+                let Ok(proto::Call::ChoraleBeaconSet(want)) = request.as_call() else { continue };
+                let mut on_air = air.lock().await;
+                if let Some(entry) = on_air.get_mut(&duck.name) {
+                    let changed = entry.listening != want.listening
+                        || entry.beacon.is_some() != want.beacon.is_some();
+                    if entry.beacon.is_none() && want.beacon.is_some() {
+                        entry.since = Some(Instant::now());
+                    }
+                    if want.beacon.is_none() {
+                        entry.since = None;
+                    }
+                    entry.beacon = want.beacon.clone();
+                    entry.listening = want.listening;
+                    if changed {
+                        tracing::info!(
+                            duck = %duck.name,
+                            advertising = entry.beacon.is_some(),
+                            listening = entry.listening,
+                            "on the air"
+                        );
+                    }
+                }
+            }
+            _ = deliveries.tick() => {
+                tick += 1;
+                let heard = nearby(duck, air, range, weather, tick).await;
+                if heard.len() != delivered {
+                    delivered = heard.len();
+                    tracing::info!(duck = %duck.name, hears = delivered, "who is in range");
+                }
+                for heard in heard {
+                    let notify = proto::Request::notify(&proto::Call::ChoraleHeard(heard));
+                    let mut line = serde_json::to_string(&notify).map_err(std::io::Error::other)?;
+                    line.push('\n');
+                    if write_half.write_all(line.as_bytes()).await.is_err() {
+                        return Ok(());
+                    }
+                }
+            }
+        }
+    }
+}
+
+/// Every beacon this duck is close enough to hear.
+async fn nearby(
+    duck: &Duck,
+    air: &Air,
+    range: f64,
+    weather: Weather,
+    tick: u64,
+) -> Vec<proto::ChoraleHeard> {
+    let on_air = air.lock().await;
+    let Some(me) = on_air.get(&duck.name) else {
+        return Vec::new();
+    };
+    if !me.listening {
+        return Vec::new();
+    }
+    let here = me.at;
+
+    let mut heard = Vec::new();
+    for (name, other) in on_air.iter() {
+        if name == &duck.name {
+            continue;
+        }
+        let Some(beacon) = &other.beacon else {
+            continue;
+        };
+        let distance = ((other.at[0] - here[0]).powi(2) + (other.at[1] - here[1]).powi(2)).sqrt();
+        if distance > range {
+            continue;
+        }
+
+        // Not noticed yet. Per pair, and timed from when the other duck went on the air: it is the
+        // asymmetry that splits a flock, so one delay shared by everybody would not produce it.
+        if !weather.discovery.is_zero() {
+            let pair = format!("{}<-{}", duck.name, name);
+            let wait = Duration::from_millis(
+                noise(weather.seed, &pair, 0) % (weather.discovery.as_millis() as u64).max(1),
+            );
+            match other.since {
+                Some(since) if since.elapsed() >= wait => {}
+                _ => continue,
+            }
+        }
+
+        // And an advertisement is missed often. Seeded by the pair and the tick, so the same run
+        // drops the same frames.
+        if weather.loss > 0.0 {
+            let pair = format!("{}<-{}", duck.name, name);
+            let roll = (noise(weather.seed, &pair, tick) % 10_000) as f64 / 10_000.0;
+            if roll < weather.loss {
+                continue;
+            }
+        }
+        heard.push(proto::ChoraleHeard {
+            beacon: beacon.clone(),
+            from: other.address.clone(),
+            // An age rather than a timestamp — see the module comment. Zero would claim the
+            // advertisement arrived at the instant it is being handed over, which is the one
+            // reading a real scanner never produces.
+            age_us: 1_000,
+        });
+    }
+    heard
+}
+
+/// Where every duck is standing, asked of its simulator.
+async fn positions(ducks: Vec<Duck>, air: Air) {
+    let mut ticker = tokio::time::interval(Duration::from_millis(250));
+    loop {
+        ticker.tick().await;
+        for duck in &ducks {
+            if let Some(at) = ask_where(duck.body).await
+                && let Some(entry) = air.lock().await.get_mut(&duck.name)
+            {
+                entry.at = at;
+            }
+        }
+    }
+}
+
+async fn ask_where(port: u16) -> Option<[f64; 3]> {
+    let stream = TcpStream::connect(("127.0.0.1", port)).await.ok()?;
+    let (read_half, mut write_half) = stream.into_split();
+    let mut lines = BufReader::new(read_half).lines();
+    write_half
+        .write_all(b"{\"op\":\"hello\",\"protocol\":1,\"joints\":15}\n")
+        .await
+        .ok()?;
+    lines.next_line().await.ok()??;
+    write_half.write_all(b"{\"op\":\"read\"}\n").await.ok()?;
+    let answer = lines.next_line().await.ok()??;
+    let value: serde_json::Value = serde_json::from_str(&answer).ok()?;
+    let trunk = value.get("trunk")?.as_array()?;
+    Some([
+        trunk.first()?.as_f64()?,
+        trunk.get(1)?.as_f64()?,
+        trunk.get(2)?.as_f64()?,
+    ])
+}
+
+/// Give every duck a new address, as a real radio does, so that nothing may key on the old one.
+async fn rotate(ducks: Vec<Duck>, air: Air, seconds: u64) {
+    let mut ticker = tokio::time::interval(Duration::from_secs(seconds));
+    let started = Instant::now();
+    ticker.tick().await;
+    loop {
+        ticker.tick().await;
+        let generation = started.elapsed().as_secs() / seconds.max(1);
+        let mut on_air = air.lock().await;
+        for (index, duck) in ducks.iter().enumerate() {
+            if let Some(entry) = on_air.get_mut(&duck.name) {
+                entry.address = address_for(index, generation);
+            }
+        }
+        tracing::info!(generation, "every duck has a new address");
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_duck_is_a_name_a_socket_and_a_body() {
+        let duck = parse_duck("duck-a=/run/duck-a/robotd.sock@7801").expect("parses");
+        assert_eq!(duck.name, "duck-a");
+        assert_eq!(duck.socket, PathBuf::from("/run/duck-a/robotd.sock"));
+        assert_eq!(duck.body, 7801);
+    }
+
+    #[test]
+    fn a_socket_path_may_contain_an_at_sign() {
+        // Split from the right: the port is the last `@`, and a path is allowed to be strange.
+        let duck = parse_duck("d=/tmp/o@d/robotd.sock@7999").expect("parses");
+        assert_eq!(duck.socket, PathBuf::from("/tmp/o@d/robotd.sock"));
+        assert_eq!(duck.body, 7999);
+    }
+
+    #[test]
+    fn what_is_not_a_duck_says_so() {
+        assert!(parse_duck("duck-a").is_err());
+        assert!(parse_duck("duck-a=/path/without/a/port").is_err());
+        assert!(parse_duck("duck-a=/path@not-a-number").is_err());
+    }
+
+    #[test]
+    fn every_duck_has_its_own_address_and_a_new_one_each_generation() {
+        let first: Vec<String> = (0..4).map(|i| address_for(i, 0)).collect();
+        let later: Vec<String> = (0..4).map(|i| address_for(i, 7)).collect();
+        for window in first.windows(2) {
+            assert_ne!(window[0], window[1], "two ducks shared an address");
+        }
+        for (a, b) in first.iter().zip(&later) {
+            assert_ne!(a, b, "an address survived a rotation: {a}");
+        }
+        assert_eq!(first[0].len(), "E0:00:01:00:00:00".len());
+    }
+}
diff --git a/duck-ipc-proto/Cargo.toml b/duck-ipc-proto/Cargo.toml
index 141cc4d5..8ebe0c73 100644
--- a/duck-ipc-proto/Cargo.toml
+++ b/duck-ipc-proto/Cargo.toml
@@ -13,6 +13,8 @@ description = "IPC contracts between the robot's services and their clients"
 # it belongs in the crate that owns the behaviour, not here.
 [dependencies]
 serde.workspace = true
+# `clock`: CLOCK_MONOTONIC / CLOCK_REALTIME, which std does not expose as raw nanoseconds.
+libc = "0.2"
 serde_json.workspace = true
 semver.workspace = true
 
diff --git a/duck-ipc-proto/src/lib.rs b/duck-ipc-proto/src/lib.rs
index 69877586..dbf68a94 100644
--- a/duck-ipc-proto/src/lib.rs
+++ b/duck-ipc-proto/src/lib.rs
@@ -273,7 +273,71 @@ pub const JSONRPC_VERSION: &str = "2.0";
 /// older `robotctl` against this `configd` prints no `units` block at all rather than a wrong one.
 /// Both come out of the same release and an apply restarts both, so the skew lasts as long as the
 /// update does; a board left mid-update sees a missing block, not a lie.
-pub const API_VERSION: u32 = 23;
+///
+/// # v24 — a clock every stream shares, and what a map needs from the robot
+///
+/// Three additive fields and one read, for a mapper that pairs a camera frame with the joint
+/// angles and depth cells of the same instant (`docs/design/robotd-design.md` §mapping):
+///
+/// - [`RobotState::t_ns`] and [`TofFrame::t_ns`] are the same `CLOCK_MONOTONIC`, nanoseconds,
+///   so a sample from `robotd` and a frame from `tofd` can be put on one axis without guessing
+///   the offset between two daemons' start times. `t` and `at_us` stay as they were.
+/// - [`RobotState::imu`] is the trunk IMU as the loop sees it: gyro and orientation, not only
+///   the projected gravity [`SafetyState`] already carried. [`RobotState::frames`] is the
+///   camera and ToF sensor pose in the trunk frame, from the same head FK `robot.look` uses —
+///   published so no client has to carry a copy of the kinematics.
+/// - `robot.model` ([`ModelResult`]) answers the static geometry those poses are stated in.
+///
+/// `mediad`'s `media.video` answer gains `mono_ns` and `real_ns`, the two clocks read at the
+/// same instant, so a peer can put RTP timestamps (whose RTCP sender reports are wall-clock)
+/// onto the same monotonic axis. Additive everywhere: an older client ignores fields it does
+/// not know, and an older daemon leaves them at their defaults (zero, or absent).
+///
+/// # v25 — the whole skeleton's pose, for a viewer
+///
+/// [`RobotState::skeleton`] carries every body's pose in the trunk frame this tick, and
+/// [`ModelResult::skeleton`] the matching static tree (each link's name and parent). Together they
+/// let a viewer draw the robot moving for real — the full kinematics, of which
+/// [`RobotState::frames`] (camera, ToF, head IMU) is a few leaves — without carrying a copy of the
+/// kinematics, the same reason `frames` and `tof_beams` come from the robot. Both from the same FK
+/// `robot.look` uses. Additive: the `Vec`s are empty from a daemon predating it.
+///
+/// # v26 — `system.logs`
+///
+/// The tail of one daemon's journal, over the wire. Until now the answer to "what did it say
+/// before it stopped" was `journalctl` over ssh, which needs a network the robot may not have and
+/// an address a phone has no way to reach — so the one question support asks first was the one
+/// question the wire could not answer.
+///
+/// Additive as a method, and narrow on purpose: a unit from a fixed list, a line count, and which
+/// boot. Not a `journalctl` command line — see [`LogsParams`] for why that boundary is where it is.
+///
+/// An older `configd` answers [`code::METHOD_NOT_FOUND`] naming the method, which is the designed
+/// skew and not a handshake refusal: a new `duckctl` against a robot on an older release reports
+/// that the robot is too old rather than failing obscurely.
+///
+/// # v28 — `detector.*`
+///
+/// The duck detector leaves the release the way the policies did at v19: `mediad` reads it from
+/// `/opt/robot/detector/current`, the release's postinstall hook seeds that from a pinned Hub
+/// revision, and `detector.check` / `detector.install` are how a board asks what exists and
+/// moves to it — `policy.check` / `policy.install` with a different root, answered by the same
+/// daemon for the same reason (it has the network stack). An install restarts `mediad`, which is
+/// where the model is loaded, and says whether that took.
+///
+/// Additive as methods; the parameters and answers are the policy set's own types.
+///
+/// # v27 — the pad's IMU, on the pad tap
+///
+/// Three more [`PadReport`] variants: a pad's inertial unit as a second evdev node beside the one
+/// that drives, its samples, and its going away. The "Pro Controller" Switch clones ship a
+/// six-axis IMU and the kernel's `hid-nintendo` exposes it as a separate accelerometer device
+/// under the same HID parent; an Xbox pad has none and a subscriber never sees the variants.
+///
+/// A new variant on a tagged enum is what a robotctl built before it cannot decode, which is the
+/// one reason this is a bump rather than a note: the tap is still `padd`'s own socket, and every
+/// other client is untouched.
+pub const API_VERSION: u32 = 28;
 
 /// The observation width every policy this robot family runs is built against.
 ///
@@ -331,6 +395,10 @@ pub mod socket {
     /// Under `/run/tofd/` for the same reason as the pad's: it is that unit's
     /// `RuntimeDirectory=`, so systemd removes the socket when the daemon stops.
     pub const TOF: &str = "/run/tofd/tof.sock";
+
+    /// `mediad`'s on-demand raw-frame endpoint. It is local-only: a raw camera frame is for a
+    /// recorder or perception process on the robot, not a multi-megabyte WebRTC control reply.
+    pub const MEDIA: &str = "/run/mediad/media.sock";
 }
 
 /// Where each daemon publishes what it is running: `/run/<service>/identity.json`.
@@ -388,6 +456,12 @@ pub const JOINT_NAMES: [&str; 15] = [
 pub mod method {
     pub const HELLO: &str = "hello";
 
+    /// One raw camera frame. `mediad` answers the JSON-RPC header, followed immediately by the
+    /// bytes named in that header, on its local Unix socket.
+    /// Deliberately not a `Call`: its binary tail must never enter Service/Lane routing
+    /// or the WebRTC control datachannel. Local clients dial `socket::MEDIA` explicitly.
+    pub const MEDIA_FRAME: &str = "media.frame";
+
     pub const CHECK: &str = "update.check";
     pub const APPLY: &str = "update.apply";
     pub const ROLLBACK: &str = "update.rollback";
@@ -469,6 +543,12 @@ pub mod method {
     /// yield a fallen robot is commanded at, which keeps torque on. This is the register.
     pub const ROBOT_RELAX: &str = "robot.relax";
 
+    /// Reboot servos: the REBOOT instruction, which clears a latched hardware error (overload,
+    /// overheating, electrical shock) that otherwise holds torque off until the battery is pulled.
+    /// Torque is cut on every joint first and the robot is back at limp afterwards, so `robot.init`
+    /// or `robot.enable` brings it up from a known state. Discrete; send as a request.
+    pub const ROBOT_REBOOT_MOTORS: &str = "robot.rebootMotors";
+
     // ── skills ───────────────────────────────────────────────────────────────
     //
     // One-shot scripted moves, ported from `microduck_runtime`. Each swaps a dedicated
@@ -547,6 +627,10 @@ pub mod method {
     /// is in them — and, when a load failed, what is in them instead of what was asked for.
     pub const ROBOT_POLICIES: &str = "robot.policies";
 
+    /// The static geometry [`RobotState::frames`] and [`TofFrame`] are stated in — see
+    /// [`ModelResult`]. A read; asked once per session.
+    pub const ROBOT_MODEL: &str = "robot.model";
+
     /// Put a different `.onnx` in one slot, or drop an override and go back to the default.
     ///
     /// Answered like [`ROBOT_SET_MODE`] and for the same reason: the swap happens at the home
@@ -579,6 +663,16 @@ pub mod method {
     /// Search the Hub for policies.
     pub const POLICY_SEARCH: &str = "policy.search";
 
+    // ── detector.* ───────────────────────────────────────────────────────────
+    //
+    // The duck detector's set, served by `updaterd` for `policy.*`'s reason. The answers are
+    // `policy.*`'s types: a set is a set, whatever is in it.
+
+    /// Is there a newer duck detector than the one installed?
+    pub const DETECTOR_CHECK: &str = "detector.check";
+    /// Install a duck detector from the Hub, and restart `mediad` onto it.
+    pub const DETECTOR_INSTALL: &str = "detector.install";
+
     // ── account.* ────────────────────────────────────────────────────────────
     //
     // Which Hugging Face account this robot belongs to. Served by `updaterd` for `policy.*`'s
@@ -630,6 +724,8 @@ pub mod method {
     pub const SYSTEM_INFO: &str = "system.info";
     /// What systemd says about each daemon, and which release each is running from.
     pub const SYSTEM_SERVICES: &str = "system.services";
+    /// The tail of one unit's journal, for a client with no shell on the robot.
+    pub const SYSTEM_LOGS: &str = "system.logs";
     /// Rename the robot. This is the name a phone sees.
     pub const SYSTEM_SET_NAME: &str = "system.setName";
     /// Reboot, cleanly, through systemd.
@@ -710,6 +806,13 @@ pub mod method {
 
     /// One 8×8 depth frame, pushed after [`TOF_STREAM`].
     pub const TOF_FRAME: &str = "tof.frame";
+
+    /// Subscribe to the head IMU (BMI088 on the HAT, same I²C bus as the ToF). The answer
+    /// describes the sensor, then [`HEAD_IMU_FRAME`] notifications arrive until the connection closes.
+    pub const HEAD_IMU_STREAM: &str = "head_imu.stream";
+
+    /// One head-IMU sample, pushed after [`HEAD_IMU_STREAM`].
+    pub const HEAD_IMU_FRAME: &str = "head_imu.frame";
 }
 
 /// JSON-RPC error codes.
@@ -809,6 +912,8 @@ pub enum Call {
     RobotInit,
     /// Cut power to the joints. The robot collapses if nothing holds it.
     RobotRelax,
+    /// Reboot servos (all of them, or the ids named), then limp. See [`method::ROBOT_REBOOT_MOTORS`].
+    RobotRebootMotors(RebootMotorsParams),
     /// Run a one-shot skill, or toggle sit↔stand.
     RobotDo(DoParams),
     /// Standing body pose. Continuous. Send as a notification.
@@ -837,6 +942,8 @@ pub enum Call {
     RobotSetMode(SetModeParams),
     /// What each policy slot runs; see [`method::ROBOT_POLICIES`].
     RobotPolicies,
+    /// Static robot geometry for a mapper; see [`method::ROBOT_MODEL`].
+    RobotModel,
     /// Load one slot, or reset it; see [`method::ROBOT_LOAD_POLICY`].
     RobotLoadPolicy(LoadPolicyParams),
     /// Re-read every slot from disk; see [`method::ROBOT_RELOAD_POLICIES`].
@@ -852,6 +959,12 @@ pub enum Call {
     /// Search the Hub; see [`method::POLICY_SEARCH`].
     PolicySearch(PolicySearchParams),
 
+    // ── detector.* ───────────────────────────────────────────────────────────
+    /// What detector is installed and what the Hub offers; see [`method::DETECTOR_CHECK`].
+    DetectorCheck,
+    /// Install a detector and restart `mediad` onto it; see [`method::DETECTOR_INSTALL`].
+    DetectorInstall(PolicyInstallParams),
+
     // ── account.* ────────────────────────────────────────────────────────────
     /// Start a device-code login; see [`method::ACCOUNT_LOGIN`].
     AccountLogin(AccountLoginParams),
@@ -869,6 +982,8 @@ pub enum Call {
     // ── system.* ─────────────────────────────────────────────────────────────
     SystemInfo,
     SystemServices,
+    /// The tail of one unit's journal; see [`method::SYSTEM_LOGS`].
+    SystemLogs(LogsParams),
     SystemSetName(SetNameParams),
     SystemReboot,
     /// Read the pairing PIN.
@@ -900,6 +1015,8 @@ pub enum Call {
     PadInput,
     /// Subscribe to the ToF depth stream. Answered by `tofd`.
     TofStream,
+    /// Subscribe to the head IMU (BMI088 on the HAT); see [`method::HEAD_IMU_STREAM`].
+    HeadImuStream,
 }
 
 /// The service that owns the answer to a call.
@@ -978,6 +1095,7 @@ impl Call {
             Call::RobotEnable(_) => method::ROBOT_ENABLE,
             Call::RobotInit => method::ROBOT_INIT,
             Call::RobotRelax => method::ROBOT_RELAX,
+            Call::RobotRebootMotors(_) => method::ROBOT_REBOOT_MOTORS,
             Call::RobotDo(_) => method::ROBOT_DO,
             Call::RobotPose(_) => method::ROBOT_POSE,
             Call::RobotMouth(_) => method::ROBOT_MOUTH,
@@ -991,12 +1109,15 @@ impl Call {
             Call::RobotMode => method::ROBOT_MODE,
             Call::RobotSetMode(_) => method::ROBOT_SET_MODE,
             Call::RobotPolicies => method::ROBOT_POLICIES,
+            Call::RobotModel => method::ROBOT_MODEL,
             Call::RobotLoadPolicy(_) => method::ROBOT_LOAD_POLICY,
             Call::RobotReloadPolicies => method::ROBOT_RELOAD_POLICIES,
             Call::PolicyCheck => method::POLICY_CHECK,
             Call::PolicyInstall(_) => method::POLICY_INSTALL,
             Call::PolicyFetch(_) => method::POLICY_FETCH,
             Call::PolicySearch(_) => method::POLICY_SEARCH,
+            Call::DetectorCheck => method::DETECTOR_CHECK,
+            Call::DetectorInstall(_) => method::DETECTOR_INSTALL,
             Call::AccountLogin(_) => method::ACCOUNT_LOGIN,
             Call::AccountStatus => method::ACCOUNT_STATUS,
             Call::AccountLogout => method::ACCOUNT_LOGOUT,
@@ -1007,6 +1128,7 @@ impl Call {
             Call::NetForget(_) => method::NET_FORGET,
             Call::SystemInfo => method::SYSTEM_INFO,
             Call::SystemServices => method::SYSTEM_SERVICES,
+            Call::SystemLogs(_) => method::SYSTEM_LOGS,
             Call::SystemSetName(_) => method::SYSTEM_SET_NAME,
             Call::SystemReboot => method::SYSTEM_REBOOT,
             Call::SystemPairingPin => method::SYSTEM_PAIRING_PIN,
@@ -1022,6 +1144,7 @@ impl Call {
             Call::RobotRemoveSkill(_) => method::ROBOT_REMOVE_SKILL,
             Call::PadInput => method::PAD_INPUT,
             Call::TofStream => method::TOF_STREAM,
+            Call::HeadImuStream => method::HEAD_IMU_STREAM,
         }
     }
 
@@ -1059,6 +1182,9 @@ impl Call {
                 // replacing the official set. `policy.search` and `policy.fetch`'s read-only
                 // cousins stay ungated — asking what exists changes nothing.
                 | Call::PolicyFetch(_)
+                // Replacing the detector writes to the eMMC and restarts `mediad`, which drops
+                // every video session. `detector.check` is a read and stays ungated.
+                | Call::DetectorInstall(_)
                 // Signing the robot in binds it to a Hugging Face account, and signing it out
                 // takes it away again. That is the most consequential pair here by one measure
                 // nothing else in this list shares: it decides who can reach the robot *from
@@ -1116,6 +1242,9 @@ impl Call {
             // `robotd` to reload, which is the same order of magnitude as a small update — long,
             // but bounded and not a stream.
             Call::PolicyCheck | Call::PolicyInstall(_) => (Updater, Prompt),
+            // The same two, for the detector: one round trip, or a fourteen-megabyte download
+            // and a `mediad` restart.
+            Call::DetectorCheck | Call::DetectorInstall(_) => (Updater, Prompt),
             // `fetch` downloads one file and `search` is a single query; both are bounded and
             // neither streams.
             Call::PolicyFetch(_) | Call::PolicySearch(_) => (Updater, Prompt),
@@ -1138,6 +1267,7 @@ impl Call {
             | Call::RobotModelApi
             | Call::RobotRemoteSessionActive
             | Call::RobotPolicies
+            | Call::RobotModel
             | Call::RobotMode => (Robot, Prompt),
             // Intents and one-shot skills. All fast: they store a value the control loop reads on
             // its next tick, and none of them waits for the robot to finish anything.
@@ -1148,6 +1278,7 @@ impl Call {
             | Call::RobotEnable(_)
             | Call::RobotInit
             | Call::RobotRelax
+            | Call::RobotRebootMotors(_)
             | Call::RobotDo(_)
             | Call::RobotPose(_)
             | Call::RobotMouth(_)
@@ -1168,6 +1299,7 @@ impl Call {
             | Call::NetForget(_)
             | Call::SystemInfo
             | Call::SystemServices
+            | Call::SystemLogs(_)
             | Call::SystemSetName(_)
             | Call::SystemReboot
             | Call::SystemPairingPin
@@ -1204,6 +1336,7 @@ impl Call {
             // exists today reaches neither: what a call *is* does not depend on who may ask it.
             Call::PadInput => (Pad, Stream),
             Call::TofStream => (Tof, Stream),
+            Call::HeadImuStream => (Tof, Stream),
 
             // ── answered by no service ──────────────────────────────────────
             //
@@ -1255,11 +1388,13 @@ impl Call {
             Call::RobotLook(p) => encode(p),
             Call::RobotEnable(p) => encode(p),
             Call::RobotDo(p) => encode(p),
+            Call::RobotRebootMotors(p) => encode(p),
             Call::RobotPose(p) => encode(p),
             Call::RobotMouth(p) => encode(p),
             Call::RobotSetMode(p) => encode(p),
             Call::RobotLoadPolicy(p) => encode(p),
             Call::PolicyInstall(p) => encode(p),
+            Call::DetectorInstall(p) => encode(p),
             Call::PolicyFetch(p) => encode(p),
             Call::PolicySearch(p) => encode(p),
             Call::AccountLogin(p) => encode(p),
@@ -1271,6 +1406,7 @@ impl Call {
             Call::RobotSubscribe(p) => encode(p),
             Call::NetConnect(p) => encode(p),
             Call::NetForget(p) => encode(p),
+            Call::SystemLogs(p) => encode(p),
             Call::SystemSetName(p) => encode(p),
             Call::SystemSetPairingPin(p) => encode(p),
             Call::SystemAuthenticate(p) => encode(p),
@@ -1290,8 +1426,10 @@ impl Call {
             | Call::RobotRelax
             | Call::RobotShutdown
             | Call::RobotPolicies
+            | Call::RobotModel
             | Call::RobotReloadPolicies
             | Call::PolicyCheck
+            | Call::DetectorCheck
             | Call::AccountStatus
             | Call::AccountLogout
             | Call::RobotMode => Value::Object(serde_json::Map::new()),
@@ -1306,6 +1444,7 @@ impl Call {
             | Call::RobotSkills
             | Call::PadInput
             | Call::TofStream
+            | Call::HeadImuStream
             | Call::ChoraleSubscribe => Value::Object(serde_json::Map::new()),
         }
     }
@@ -1345,6 +1484,7 @@ impl Call {
             method::ROBOT_ENABLE => Call::RobotEnable(decode(params)?),
             method::ROBOT_INIT => Call::RobotInit,
             method::ROBOT_RELAX => Call::RobotRelax,
+            method::ROBOT_REBOOT_MOTORS => Call::RobotRebootMotors(decode(params)?),
             method::ROBOT_DO => Call::RobotDo(decode(params)?),
             method::ROBOT_POSE => Call::RobotPose(decode(params)?),
             method::ROBOT_MOUTH => Call::RobotMouth(decode(params)?),
@@ -1358,12 +1498,15 @@ impl Call {
             method::ROBOT_MODE => Call::RobotMode,
             method::ROBOT_SET_MODE => Call::RobotSetMode(decode(params)?),
             method::ROBOT_POLICIES => Call::RobotPolicies,
+            method::ROBOT_MODEL => Call::RobotModel,
             method::ROBOT_LOAD_POLICY => Call::RobotLoadPolicy(decode(params)?),
             method::ROBOT_RELOAD_POLICIES => Call::RobotReloadPolicies,
             method::POLICY_CHECK => Call::PolicyCheck,
             method::POLICY_INSTALL => Call::PolicyInstall(decode(params)?),
             method::POLICY_FETCH => Call::PolicyFetch(decode(params)?),
             method::POLICY_SEARCH => Call::PolicySearch(decode(params)?),
+            method::DETECTOR_CHECK => Call::DetectorCheck,
+            method::DETECTOR_INSTALL => Call::DetectorInstall(decode(params)?),
             method::ACCOUNT_LOGIN => Call::AccountLogin(decode(params)?),
             method::ACCOUNT_STATUS => Call::AccountStatus,
             method::ACCOUNT_LOGOUT => Call::AccountLogout,
@@ -1374,6 +1517,7 @@ impl Call {
             method::NET_FORGET => Call::NetForget(decode(params)?),
             method::SYSTEM_INFO => Call::SystemInfo,
             method::SYSTEM_SERVICES => Call::SystemServices,
+            method::SYSTEM_LOGS => Call::SystemLogs(decode(params)?),
             method::SYSTEM_SET_NAME => Call::SystemSetName(decode(params)?),
             method::SYSTEM_REBOOT => Call::SystemReboot,
             method::SYSTEM_PAIRING_PIN => Call::SystemPairingPin,
@@ -1397,6 +1541,7 @@ impl Call {
             method::ROBOT_REMOVE_SKILL => Call::RobotRemoveSkill(decode(params)?),
             method::PAD_INPUT => Call::PadInput,
             method::TOF_STREAM => Call::TofStream,
+            method::HEAD_IMU_STREAM => Call::HeadImuStream,
             other => {
                 return Err(Error::new(
                     code::METHOD_NOT_FOUND,
@@ -1492,6 +1637,7 @@ pub mod test_support {
             }),
             Call::RobotInit,
             Call::RobotRelax,
+            Call::RobotRebootMotors(RebootMotorsParams { ids: vec![3, 11] }),
             Call::RobotDo(DoParams {
                 skill: "ground_pick".into(),
             }),
@@ -1509,6 +1655,7 @@ pub mod test_support {
             Call::RobotShutdown,
             Call::RobotMode,
             Call::RobotPolicies,
+            Call::RobotModel,
             Call::RobotReloadPolicies,
             Call::PolicyCheck,
             Call::PolicyInstall(PolicyInstallParams {
@@ -1522,6 +1669,10 @@ pub mod test_support {
             Call::PolicySearch(PolicySearchParams {
                 query: "microduck".into(),
             }),
+            Call::DetectorCheck,
+            Call::DetectorInstall(PolicyInstallParams {
+                version: Some("v2".into()),
+            }),
             Call::AccountLogin(AccountLoginParams { force: false }),
             Call::AccountStatus,
             Call::AccountLogout,
@@ -1541,6 +1692,11 @@ pub mod test_support {
             }),
             Call::SystemInfo,
             Call::SystemServices,
+            Call::SystemLogs(LogsParams {
+                unit: "robotd".into(),
+                lines: 40,
+                boot: -1,
+            }),
             Call::SystemSetName(SetNameParams {
                 name: "duck-01".into(),
             }),
@@ -1572,6 +1728,7 @@ pub mod test_support {
             }),
             Call::PadInput,
             Call::TofStream,
+            Call::HeadImuStream,
         ]
     }
 }
@@ -1674,6 +1831,24 @@ impl Request {
         serde_json::from_value(self.params.clone()?).ok()
     }
 
+    /// A head-IMU sample notification: no `id`.
+    pub fn notify_head_imu_frame(frame: &HeadImuFrame) -> Self {
+        Self {
+            jsonrpc: JSONRPC_VERSION.to_owned(),
+            id: None,
+            method: method::HEAD_IMU_FRAME.to_owned(),
+            params: Some(serde_json::to_value(frame).unwrap_or(Value::Null)),
+        }
+    }
+
+    /// Read a head-IMU notification back.
+    pub fn as_head_imu_frame(&self) -> Option<HeadImuFrame> {
+        if self.method != method::HEAD_IMU_FRAME {
+            return None;
+        }
+        serde_json::from_value(self.params.clone()?).ok()
+    }
+
     /// A progress notification: no `id`, so no response is expected.
     pub fn notify_progress(progress: &Progress) -> Self {
         Self {
@@ -2030,6 +2205,13 @@ pub struct ThereminState {
 /// the list it does know, which is the same shape as a bad policy slot.
 pub type Skill = String;
 
+/// Which servos [`method::ROBOT_REBOOT_MOTORS`] reboots. Empty means every servo.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct RebootMotorsParams {
+    pub ids: Vec<u8>,
+}
+
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct DoParams {
@@ -2177,7 +2359,7 @@ pub struct PolicySlot {
     pub error: Option<String>,
 }
 
-/// Which set to install, for [`Call::PolicyInstall`].
+/// Which set to install, for [`Call::PolicyInstall`] and [`Call::DetectorInstall`].
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 pub struct PolicyInstallParams {
@@ -2715,6 +2897,40 @@ pub struct HelloResult {
     pub revision: Option<String>,
 }
 
+/// Metadata preceding the binary tail of a local `media.frame` response.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct MediaFrameHeader {
+    pub width: u32,
+    pub height: u32,
+    pub format: String,
+    pub bytes: usize,
+    pub captured_at_unix_us: u128,
+    /// Degrees clockwise the camera is mounted from upright — the same number `media.video`
+    /// tells a WebRTC peer, and zero when `--flip-in-pipeline` already turned these pixels.
+    ///
+    /// **Carried rather than written down.** The geometry above describes the bytes exactly as
+    /// they are, and a consumer cannot recover the mount from them: a 180° mount is
+    /// indistinguishable from an upright one, and a quarter turn is only a guess from the aspect
+    /// ratio. A recorder building a dataset needs the angle programmatically, and a human
+    /// converting a frame should not have to find a document to learn their picture is sideways.
+    pub rotate: u32,
+}
+impl MediaFrameHeader {
+    /// Bound allocation and reject malformed geometry before decoding pixels.
+    pub fn valid_uyvy(&self) -> bool {
+        self.width > 0
+            && self.height > 0
+            && self.width.is_multiple_of(2)
+            && self.format == "UYVY"
+            && matches!(self.rotate, 0 | 90 | 180 | 270)
+            && self.bytes <= 16 * 1024 * 1024
+            && (self.width as usize)
+                .checked_mul(self.height as usize)
+                .and_then(|n| n.checked_mul(2))
+                == Some(self.bytes)
+    }
+}
+
 /// Where an in-flight update has got to. Mirrors the state machine in
 /// `docs/design/updater-design.md` §7.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
@@ -3252,6 +3468,103 @@ pub struct RobotState {
     /// state of a duck — see [`ChoraleState`].
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub chorale: Option<ChoraleState>,
+    /// `CLOCK_MONOTONIC` at this tick, nanoseconds — the same clock as [`TofFrame::t_ns`], so a
+    /// mapper can put a state sample and a depth frame on one axis. Zero from a daemon predating
+    /// it; `t` is still the loop's own elapsed time. (v24)
+    #[serde(default)]
+    pub t_ns: u64,
+    /// The trunk IMU as the loop read it this tick. Absent from a daemon predating it, or while
+    /// no sensors have been read. (v24)
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub imu: Option<ImuState>,
+    /// Where the camera and the ToF sensor are in the trunk frame at this tick's measured head
+    /// joints, from the same head FK `robot.look` uses. Published so a client that pairs a picture
+    /// with a pose never carries its own copy of the kinematics. (v24)
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub frames: Option<FramesState>,
+    /// Every body's pose in the trunk frame this tick, in [`ModelResult::skeleton`] order, from the
+    /// same head FK `robot.look` uses — the whole skeleton, so a viewer can draw the robot moving
+    /// for real. `frames` is a few leaves of this. Empty from a daemon predating it. (v25)
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub skeleton: Vec<PoseState>,
+}
+
+/// The trunk IMU, in [`RobotState::imu`]. Trunk frame: x forward, y left, z up.
+#[derive(Debug, Default, Clone, Copy, PartialEq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct ImuState {
+    /// Angular velocity, rad/s.
+    pub gyro: [f64; 3],
+    /// Orientation trunk → world, scalar-first `[w, x, y, z]`. The world is the IMU's own
+    /// gravity-aligned frame with an arbitrary yaw at boot — the same frame `odom` lives in.
+    pub quat: [f64; 4],
+}
+
+/// A pose in the trunk frame: position in metres, orientation scalar-first `[w, x, y, z]`.
+#[derive(Debug, Default, Clone, Copy, PartialEq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct PoseState {
+    pub pos: [f64; 3],
+    pub quat: [f64; 4],
+}
+
+/// Sensor poses in the trunk frame, in [`RobotState::frames`].
+///
+/// Conventions, stated once: `camera` is the OpenCV camera frame (+x right, +y down, +z along
+/// the optical axis) — the frame intrinsics and a pixel's ray are expressed in. `tof` is the
+/// VL53L5CX/L8CX integration frame (+x along the optical axis, +y left, +z up), the frame
+/// [`ModelResult::tof_beams`] is stated in. Both come from `kinematics::head::HeadFk`.
+#[derive(Debug, Default, Clone, Copy, PartialEq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct FramesState {
+    pub camera: PoseState,
+    pub tof: PoseState,
+    /// The head IMU (BMI088) in the trunk frame. The `head_imu.stream` samples are in the IMU's
+    /// own tilted axes; this pose (sensor→trunk, from the same head FK) is how a consumer rotates
+    /// them into the trunk/camera frame. Absent from a daemon predating it. (v24)
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub head_imu: Option<PoseState>,
+}
+
+/// Answer to [`Call::RobotModel`]: the geometry that does not change while the robot runs.
+///
+/// Everything a mapper needs beyond the per-tick poses in [`RobotState::frames`], so that the
+/// kinematics stay in one place — the `kinematics` crate — and a laptop or a server asks rather
+/// than transcribes. Angles and distances in radians and metres.
+#[derive(Debug, Default, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct ModelResult {
+    /// Which MJCF asset the numbers come from, e.g. `alpha`.
+    pub asset: String,
+    /// Height of the trunk origin above the floor when standing at rest.
+    pub trunk_height_m: f64,
+    /// Every joint, in [`RobotState::joints`] order.
+    pub joint_names: Vec<String>,
+    /// The four head joints in the order [`RobotState::head`] uses.
+    pub head_joints: Vec<String>,
+    /// Unit direction of each ToF zone in the sensor frame, row-major like
+    /// [`TofFrame::distance_mm`]: row 0 is the top of the grid, column 0 the sensor's left.
+    pub tof_beams: Vec<[f64; 3]>,
+    /// The sensor's field of view per axis, degrees.
+    pub tof_fov_deg: f64,
+    /// Sensor poses at every head joint zero — a fixed reference; the live ones are in
+    /// [`RobotState::frames`].
+    pub frames_at_zero: FramesState,
+    /// The body tree the per-tick [`RobotState::skeleton`] poses are stated in: each link's name
+    /// and parent, in the same order. Empty from a daemon predating it. (v25)
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub skeleton: Vec<SkeletonLink>,
+}
+
+/// One link in the body tree — a name and its parent — so a viewer can match a
+/// [`RobotState::skeleton`] pose to a link and draw the edge to its parent. (v25)
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct SkeletonLink {
+    /// The MJCF body name, e.g. `trunk_base`, `upper_leg_left`.
+    pub name: String,
+    /// Index of this link's parent in [`ModelResult::skeleton`], or `None` for the root.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub parent: Option<usize>,
 }
 
 /// What the duck chorale is doing, in [`RobotState`].
@@ -3589,6 +3902,63 @@ pub struct ServiceUnit {
     pub identity: Option<Identity>,
 }
 
+/// Which unit's journal to read, and how much of it. Parameters of [`Call::SystemLogs`].
+///
+/// **A unit name, not a filter expression.** The service picks from a fixed list and refuses
+/// anything else, because this call is reachable from a phone in radio range and `journalctl`
+/// arguments are not a language to hand such a peer. What that costs is `-g`, `--since` and
+/// several other things a person with a shell would reach for; what it buys is that the worst a
+/// client can ask for is the tail of a daemon this project ships.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct LogsParams {
+    /// `robotd` or `robotd.service` — the service resolves either. See `configd::logs` for the
+    /// units it will read.
+    pub unit: String,
+    /// How many lines from the end. Clamped to [`MAX_LOG_LINES`], and the byte budget below
+    /// usually binds first.
+    pub lines: usize,
+    /// Which boot: `0` is the current one, `-1` the one before it, and so on backwards.
+    ///
+    /// Negative rather than an index because that is the question — "what did it say before it
+    /// restarted" — and because it is `journalctl -b`'s own convention, so the answer to "which
+    /// boot did I just read" is the same number in both places.
+    pub boot: i32,
+}
+
+/// Ceiling on [`LogsParams::lines`], applied by the service rather than trusted from the caller.
+pub const MAX_LOG_LINES: usize = 500;
+
+/// Ceiling on the serialised `lines` array, in bytes.
+///
+/// **This exists because of the transport, and it is the binding limit in practice.** BLE
+/// reassembles a reply into one line, and the client's buffer for that is bounded — a peer that
+/// never sends a newline must not be able to grow it without limit. 48 KiB leaves the rest of a
+/// JSON-RPC envelope room inside a 64 KiB client buffer, and at a typical ATT MTU it is already
+/// several seconds on the air, which is the other reason not to raise it.
+///
+/// The service drops the *oldest* lines to fit and says it did, because the newest are the ones
+/// somebody asked for.
+pub const MAX_LOG_BYTES: usize = 48 * 1024;
+
+/// Answer to [`Call::SystemLogs`].
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct LogsResult {
+    /// The unit as systemd names it, so a caller that typed `robotd` sees what it actually read.
+    pub unit: String,
+    /// Oldest first, the way a journal reads. No trailing newlines.
+    ///
+    /// **A line in `-- … --` is the robot's, not the journal's.** `journalctl` uses that shape
+    /// for what it inserts rather than recorded (`-- Reboot --`, `-- No entries --`) and this
+    /// borrows it for the one thing a tail cannot otherwise show: `-- new robotd process, pid
+    /// 3227 --`, where the daemon restarted. A tail spanning an update carries two different
+    /// builds' output, and nothing in the lines themselves says where one ends.
+    pub lines: Vec<String>,
+    /// Lines were dropped from the front to fit [`MAX_LOG_BYTES`]. Not an error — it is what
+    /// asking for more than the radio can carry looks like, and a caller can say so.
+    pub truncated: bool,
+}
+
 /// Answer to [`Call::PadStatus`].
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct PadStatusResult {
@@ -3862,6 +4232,81 @@ pub enum PadReport {
         /// usually an errno the operator wants verbatim.
         why: String,
     },
+    /// The pad has an inertial unit and its node is open. Sent on subscribing if one is already
+    /// being read, and again each time one appears — the same one code path as `Attached`.
+    ///
+    /// Independent of `Attached`: the IMU is a second evdev device with a life of its own, and a
+    /// pad without one simply never sends this. Everything in a [`PadImuSample`] is read against
+    /// the device here.
+    ImuAttached { device: Box<PadImuDevice> },
+    /// Inertial samples, as many as the kernel handed over in one read — see [`PadImuBatch`].
+    Imu(PadImuBatch),
+    /// The IMU node closed.
+    ImuDetached { why: String },
+}
+
+/// A pad's inertial unit, as the kernel describes it.
+///
+/// One device rather than six axes in [`PadInputDevice::axes`], because the kernel keeps them
+/// apart: an accelerometer node carries `INPUT_PROP_ACCELEROMETER` and its `ABS_X..Z` are metres
+/// per second squared, not a stick. Reading them as a stick is what gilrs would do, which is why
+/// `padd` drives from the other node and this one is only ever tapped.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct PadImuDevice {
+    /// As the kernel names it: "Nintendo Switch Pro Controller IMU".
+    pub name: String,
+    /// The event node being read.
+    pub node: String,
+    /// Raw units per **g** on the accelerometer axes, from the driver's `resolution`. 4096 on
+    /// `hid-nintendo`. Zero when the driver did not say, in which case the raw numbers are all a
+    /// reader has.
+    pub accel_per_g: i32,
+    /// Raw units per **degree per second** on the gyro axes. 14247 on `hid-nintendo`.
+    pub gyro_per_dps: i32,
+    /// The accelerometer's full scale, raw units, so a reader can tell a clipped sample.
+    pub accel_max: i32,
+    /// The gyro's full scale, raw units.
+    pub gyro_max: i32,
+}
+
+/// The inertial samples one read of the IMU node produced.
+///
+/// A batch rather than one sample per report, because of what a sample costs to send: at six
+/// hundred a second, one JSON line and one socket write each was measured at 6.6% of a core on the
+/// board (2026-09-09, `padd` with a subscriber, above its 1.6% idle). The kernel already groups
+/// them — the clone packs three samples into every HID packet — so the tap sends what one `read`
+/// returned, and the viewer takes them in order: measured at exactly three per batch, two hundred
+/// batches a second, and 4.4% of a core. Nothing is summarised: every sample is here.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct PadImuBatch {
+    /// In the order the kernel delivered them, oldest first. Never empty on the wire.
+    pub samples: Vec<PadImuSample>,
+    /// Batches this subscriber missed because its own socket was behind, since the last one it did
+    /// receive. Counted apart from [`PadFrame::socket_dropped`]: a dropped IMU batch says nothing
+    /// about the stick reports.
+    #[serde(default, skip_serializing_if = "is_zero")]
+    pub socket_dropped: u64,
+}
+
+/// One inertial sample: everything the IMU node delivered between two `SYN_REPORT`s.
+///
+/// Raw kernel units, deliberately — the tap hands out what the device said and the resolution to
+/// read it with, and the conversion happens once, in the viewer. Six integers rather than a
+/// `PadFrame`'s event list because this arrives at several hundred a second and every byte is
+/// paid for on the board's CPU.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct PadImuSample {
+    /// Samples since this IMU attached, counted by `padd`. A hole is a batch this subscriber
+    /// missed — [`PadImuBatch::socket_dropped`].
+    pub seq: u64,
+    /// The kernel's timestamp, microseconds since the epoch — the same clock and the same
+    /// caveats as [`PadFrame::at_us`].
+    pub at_us: u64,
+    /// `ABS_X`, `ABS_Y`, `ABS_Z`: acceleration, including gravity. At rest on a table the axis
+    /// pointing up reads about `+accel_per_g`.
+    pub accel: [i32; 3],
+    /// `ABS_RX`, `ABS_RY`, `ABS_RZ`: angular rate about the same three axes.
+    pub gyro: [i32; 3],
 }
 
 /// One report from the pad: everything the kernel delivered between two `SYN_REPORT`s.
@@ -4008,12 +4453,61 @@ pub struct TofFrame {
     /// Microseconds since `tofd` started — the sender's monotonic clock, like
     /// [`PadFrame::at_us`].
     pub at_us: u64,
+    /// `CLOCK_MONOTONIC` when the frame was read, nanoseconds — the clock
+    /// [`RobotState::t_ns`] shares. Zero from a `tofd` predating it. (v24)
+    #[serde(default)]
+    pub t_ns: u64,
     pub rows: u8,
     pub cols: u8,
     pub distance_mm: Vec<i16>,
     pub status: Vec<u8>,
 }
 
+/// Answer to [`Call::HeadImuStream`]. Describes the head IMU rather than merely accepting, like
+/// [`TofStreamResult`]: a duck without the sensor still gets `accepted` with `sensor: None`.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct HeadImuStreamResult {
+    pub accepted: bool,
+    /// The IMU that answered, e.g. `BMI088`. `None` when there is none — see `unavailable`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub sensor: Option<String>,
+    /// Why there is no IMU: not fitted, bus unreadable, chip-id mismatch.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub unavailable: Option<String>,
+    /// Sample rate the reader runs at, Hz.
+    pub hz: u8,
+}
+
+/// One head-IMU sample — a [`method::HEAD_IMU_FRAME`] notification.
+///
+/// The BMI088 on the HAT, read by `tofd` (it owns that I²C bus). All values are in the IMU's own
+/// axes, which are tilted relative to the head/camera — the mount is not axis-aligned. To place a
+/// sample in the trunk/camera frame, rotate it by [`FramesState::head_imu`] (the sensor→trunk
+/// pose the kinematics compute for this tick). This is the head IMU, distinct from the body IMU
+/// that [`RobotState::imu`] carries on the motor bus. Units: rad/s, m/s², unitless quaternion.
+#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct HeadImuFrame {
+    /// Samples since this `tofd` started — a consumer can see a gap it did not cause.
+    pub seq: u64,
+    /// Microseconds since `tofd` started (sender's monotonic clock, like [`TofFrame::at_us`]).
+    pub at_us: u64,
+    /// `CLOCK_MONOTONIC` when the sample was read, ns — the clock [`RobotState::t_ns`] shares.
+    pub t_ns: u64,
+    /// Angular velocity, rad/s, in the BMI088's own (tilted) sensor axes — NOT the head or
+    /// camera frame. Combine with [`FramesState::head_imu`] (the sensor→trunk pose from the
+    /// kinematics) to place it. See that field.
+    pub gyro: [f32; 3],
+    /// Specific force, m/s², BMI088 sensor axes.
+    pub accel: [f32; 3],
+    /// Madgwick orientation, scalar-first `[w, x, y, z]`, sensor→world (gravity down, yaw
+    /// arbitrary). The world here is the IMU's own; relate it to the trunk via the mount pose.
+    pub quat: [f32; 4],
+    /// Chip temperature, °C.
+    pub temp_c: f32,
+}
+
 /// See [`method::ROBOT_CHORALE`].
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
@@ -4502,6 +4996,46 @@ macro_rules! log_startup_identity {
     }};
 }
 
+/// The clocks every daemon stamps with, so no two of them disagree about which clock
+/// "monotonic" means. Nanoseconds. `monotonic` is `CLOCK_MONOTONIC` — what
+/// [`RobotState::t_ns`] and [`TofFrame::t_ns`] carry; `realtime` is `CLOCK_REALTIME`, the
+/// clock RTCP sender reports are stated in, read together in `media.video` so a peer can
+/// relate the two.
+pub mod clock {
+    fn read(clock: libc::clockid_t) -> u64 {
+        let mut ts = libc::timespec {
+            tv_sec: 0,
+            tv_nsec: 0,
+        };
+        // SAFETY: `ts` is a valid, writable timespec and the clock ids are the constants libc
+        // exports for this platform.
+        let rc = unsafe { libc::clock_gettime(clock, &mut ts) };
+        debug_assert_eq!(rc, 0, "clock_gettime failed");
+        (ts.tv_sec as u64) * 1_000_000_000 + ts.tv_nsec as u64
+    }
+
+    /// `CLOCK_MONOTONIC`, nanoseconds.
+    pub fn monotonic_ns() -> u64 {
+        read(libc::CLOCK_MONOTONIC)
+    }
+
+    /// `CLOCK_REALTIME`, nanoseconds since the Unix epoch.
+    pub fn realtime_ns() -> u64 {
+        read(libc::CLOCK_REALTIME)
+    }
+
+    #[cfg(test)]
+    mod tests {
+        #[test]
+        fn monotonic_advances_and_realtime_is_this_century() {
+            let a = super::monotonic_ns();
+            let b = super::monotonic_ns();
+            assert!(b >= a);
+            assert!(super::realtime_ns() > 1_600_000_000_000_000_000);
+        }
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::test_support::every_call;
@@ -4624,6 +5158,7 @@ mod tests {
                             | Call::RobotSubscribe(_)
                             | Call::PadInput
                             | Call::TofStream
+                            | Call::HeadImuStream
                     ),
                     "{} is on the Stream lane but is not a subscription",
                     call.method()
@@ -4636,7 +5171,7 @@ mod tests {
     fn every_call_covers_every_variant() {
         assert_eq!(
             every_call().len(),
-            61,
+            67,
             "a Call variant was added or removed — update every_call() and this count"
         );
     }
@@ -4850,6 +5385,9 @@ mod tests {
                 // list: asking what exists is inspection, and support has to be able to ask it
                 // on a robot it may not change.
                 method::POLICY_FETCH,
+                // Replacing the detector writes fourteen megabytes to the eMMC and restarts
+                // `mediad`. `detector.check` stays off this list, like `policy.check`.
+                method::DETECTOR_INSTALL,
                 // Binding the robot to an account, and unbinding it. On this list for a reason
                 // none of the others share: it decides who can reach the robot from outside the
                 // building, and it survives every reboot. `account.status` must stay off it —
@@ -5216,6 +5754,10 @@ mod tests {
     fn the_theremin_block_is_absent_until_there_is_a_theremin() {
         let mut state = RobotState {
             t: 1.5,
+            t_ns: 0,
+            imu: None,
+            frames: None,
+            skeleton: Vec::new(),
             movement: MoveState {
                 requested: [0.0; 3],
                 applied: [0.0; 3],
@@ -5273,6 +5815,10 @@ mod tests {
     fn robot_state_uses_the_documented_field_names() {
         let state = RobotState {
             t: 1.5,
+            t_ns: 0,
+            imu: None,
+            frames: None,
+            skeleton: Vec::new(),
             movement: MoveState {
                 requested: [0.4, 0.0, 0.0],
                 applied: [0.15, 0.0, 0.0],
diff --git a/duckctl/src/main.rs b/duckctl/src/main.rs
index b029d6d5..c5cfd98e 100644
--- a/duckctl/src/main.rs
+++ b/duckctl/src/main.rs
@@ -20,6 +20,11 @@
 //! module the robot uses, so if the framing were asymmetric this would not work — which makes
 //! it a real test of the protocol rather than a reimplementation that could agree with itself.
 //!
+//! The one thing that *is* asymmetric is how long a line may be, and it has to be: the robot's cap
+//! bounds what an unpaired peer in radio range can make it buffer, and this end has no such peer.
+//! Sharing the tight one made every reply over 8 KiB unreadable here while `btd` served it
+//! correctly — see `framing::MAX_REPLY_LINE`.
+//!
 //! ```text
 //! cargo run -p duckctl -- scan          # robots in range, and their addresses
 //! cargo run -p duckctl -- status
@@ -27,6 +32,7 @@
 //! cargo run -p duckctl -- wifi connect "Pollen" --psk secret
 //! cargo run -p duckctl -- name "Ducky"
 //! cargo run -p duckctl -- call robot.health
+//! cargo run -p duckctl -- logs robotd -n 100
 //! ```
 //!
 //! `DUCK_ROBOT` and `DUCK_PIN` in the environment are the defaults for `--name` and `--pin`, for
@@ -422,6 +428,14 @@ fn deliver(command: &Command, address: &str) -> Result<(), Box<dyn std::error::E
             println!("{address}");
             Ok(())
         }
+        Command::Ssh { user, command } => {
+            let user = ssh_user(user.as_deref(), std::env::var("DUCK_BOARD_USER").ok());
+            become_program("ssh", &ssh_argv(&user, address, command))
+        }
+        Command::Scp { user, paths } => {
+            let user = ssh_user(user.as_deref(), std::env::var("DUCK_BOARD_USER").ok());
+            become_program("scp", &scp_argv(&user, address, paths))
+        }
         Command::Open { print, port } => {
             let url = console_url(address, *port);
             if *print {
@@ -437,11 +451,104 @@ fn deliver(command: &Command, address: &str) -> Result<(), Box<dyn std::error::E
                 .into()
             })
         }
-        // `run` only calls this for the two above; every other command's answer is its JSON.
+        // `run` only calls this for the four above; every other command's answer is its JSON.
         _ => Err("this command does not resolve an address".into()),
     }
 }
 
+/// Which account `ssh` and `scp` log into: the flag, else a non-empty `DUCK_BOARD_USER`, else
+/// `radxa`.
+///
+/// Empty is unset — `DUCK_BOARD_USER= duckctl ssh` reads as "not set", the same rule `DUCK_ROBOT`
+/// follows, because a variable emptied to switch it off must not become an ssh login of `@host`.
+/// `radxa` is the image's account and `dev-push.sh`'s default for the same variable.
+fn ssh_user(flag: Option<&str>, env: Option<String>) -> String {
+    flag.map(str::to_owned)
+        .or_else(|| env.filter(|user| !user.trim().is_empty()))
+        .unwrap_or_else(|| "radxa".to_owned())
+}
+
+/// `ssh`'s arguments: `user@address`, then whatever is to run there.
+///
+/// The command's words are passed through as separate arguments and ssh joins them with spaces
+/// on the far side, which is what `ssh host sudo robotctl pad pair` does at a prompt. Quoting for
+/// the remote shell is the caller's, exactly as it would be there.
+fn ssh_argv(user: &str, address: &str, command: &[String]) -> Vec<String> {
+    let mut argv = vec![format!("{user}@{address}")];
+    argv.extend(command.iter().cloned());
+    argv
+}
+
+/// What `scp` is refused for, checked **before** the radio is turned on.
+///
+/// Two of them, and neither could be left to `scp`: its usage error cannot mention the rule that
+/// is actually being broken. A copy with no `:` anywhere in it is the one worth catching — it is a
+/// local-to-local copy, `scp` performs it happily, and nothing in the output says the robot was
+/// never involved. Here rather than in `scp_argv` because the alternative is charging eight
+/// seconds of scanning for a robot the command was never going to touch.
+fn scp_refusal(paths: &[String]) -> Result<(), String> {
+    if !paths.iter().any(|path| path.starts_with(':')) {
+        return Err(format!(
+            "no path on the robot in `{}`\nA leading `:` is the robot: `duckctl scp report.md \
+             :/tmp/` sends a file up, `duckctl scp :/var/log/robotd.log .` brings one down. \
+             Without one this is a local-to-local copy that has nothing to do with a robot.",
+            paths.join(" "),
+        ));
+    }
+    if paths.len() < 2 {
+        return Err(format!(
+            "`{}` is a source with no destination. `scp` takes both: `duckctl scp \
+             :/var/log/robotd.log .`",
+            paths[0],
+        ));
+    }
+    Ok(())
+}
+
+/// `scp`'s arguments: every `:path` pointed at the robot, everything else as typed.
+///
+/// The rewrite is textual and deliberately narrow — a leading `:` becomes `user@address:` and
+/// nothing else is touched — so `-r`, `-P`, a local path, and a path with a colon in the middle of
+/// it all reach `scp` exactly as they were typed. `scp` itself decides what they mean.
+fn scp_argv(user: &str, address: &str, paths: &[String]) -> Vec<String> {
+    paths
+        .iter()
+        .map(|path| match path.strip_prefix(':') {
+            Some(remote) => format!("{user}@{address}:{remote}"),
+            None => path.clone(),
+        })
+        .collect()
+}
+
+/// Hand the terminal to `ssh` or `scp` and never come back.
+///
+/// Become the program rather than run it: the terminal is then its from here on — its prompts,
+/// its progress meter, its exit status, its handling of a dropped link — and nothing of this
+/// process is left behind to be `Ctrl-C`d separately. The radio was released before this was
+/// called, so there is nothing to clean up.
+///
+/// The command line is echoed first, on stderr, because a tool that resolved the address for you
+/// still owes you the address it resolved — and it is the line to paste when the next copy needs
+/// a flag this does not pass.
+fn become_program(program: &str, argv: &[String]) -> Result<(), Box<dyn std::error::Error>> {
+    eprintln!("{program} {}", argv.join(" "));
+    let mut child = std::process::Command::new(program);
+    child.args(argv);
+    #[cfg(unix)]
+    {
+        use std::os::unix::process::CommandExt;
+        let e = child.exec();
+        Err(format!("could not run {program}: {e}").into())
+    }
+    #[cfg(not(unix))]
+    {
+        let status = child
+            .status()
+            .map_err(|e| format!("could not run {program}: {e}"))?;
+        std::process::exit(status.code().unwrap_or(1));
+    }
+}
+
 /// Where the console is, given where the robot is.
 ///
 /// Plain `http`, because a robot on a LAN has no certificate to offer and `ws://` from an `https`
@@ -795,6 +902,55 @@ enum Command {
     /// stopped advertising the service to it is asked over BLE instead, which is slower and always
     /// answers.
     Ip,
+    /// ssh into the robot.
+    ///
+    /// `duckctl ssh` is `ssh <user>@$(duckctl ip)` as one step: the address comes from the
+    /// advertisement the way `ip` finds it, and then this process *becomes* `ssh`, so the terminal,
+    /// the exit status and the key prompts are ssh's own. Anything after `--` is run on the robot
+    /// instead of opening a shell: `duckctl ssh -- sudo robotctl pad pair`.
+    ///
+    /// The user is `--user`, else `DUCK_BOARD_USER` from the environment — the same variable
+    /// `scripts/dev-push.sh` reads, so a laptop set up for pushing is set up for this — else
+    /// `radxa`, the image's default account.
+    Ssh {
+        /// The account on the robot. Without it, `DUCK_BOARD_USER`; without that, `radxa`.
+        #[arg(long, value_name = "USER")]
+        user: Option<String>,
+        /// A command to run on the robot instead of opening a shell. Put it after `--`.
+        #[arg(
+            trailing_var_arg = true,
+            allow_hyphen_values = true,
+            value_name = "COMMAND"
+        )]
+        command: Vec<String>,
+    },
+    /// Copy files to or from the robot with `scp`.
+    ///
+    /// A path that starts with `:` is on the robot: `duckctl scp report.md :/tmp/` sends one up,
+    /// `duckctl scp :/var/log/robotd.log .` brings one down. That is `scp`'s own `host:path` with
+    /// the host left out, because the host is the thing this tool exists to find. Everything else
+    /// — local paths, `-r`, any other `scp` flag — is passed through as typed, and then this
+    /// process *becomes* `scp`, so the progress meter, the key prompts and the exit status are
+    /// `scp`'s own.
+    ///
+    /// `duckctl`'s own flags come before the paths — `duckctl --name ducky scp -r logs/ :/tmp/` —
+    /// and `--` ends them for anything after that this tool would otherwise read as its own. A
+    /// local file that really is named `:foo` is `./:foo`.
+    ///
+    /// The user resolves the way `ssh`'s does: `--user`, else `DUCK_BOARD_USER`, else `radxa`.
+    Scp {
+        /// The account on the robot. Without it, `DUCK_BOARD_USER`; without that, `radxa`.
+        #[arg(long, value_name = "USER")]
+        user: Option<String>,
+        /// What to copy, `scp`-style, with a leading `:` for a path on the robot.
+        #[arg(
+            trailing_var_arg = true,
+            allow_hyphen_values = true,
+            required = true,
+            value_name = "PATH"
+        )]
+        paths: Vec<String>,
+    },
     /// Open the robot's console in a browser.
     ///
     /// The page `mediad` serves: the camera, and the controls a WebRTC peer is allowed to drive.
@@ -811,6 +967,38 @@ enum Command {
         #[arg(long, default_value_t = 8080)]
         port: u16,
     },
+    /// The tail of one daemon's journal.
+    ///
+    /// `duckctl logs robotd` after a robot has misbehaved, which is the question `journalctl`
+    /// answers on the robot and nothing answered from here. Reachable with no network at all, so
+    /// it works on the robot whose wifi never came up — the one whose logs are hardest to get.
+    ///
+    /// `duckctl call system.services` names the units, and an unknown name is refused with the
+    /// real list. `bluetooth` and `NetworkManager` are readable too: they are what is broken when
+    /// the robot cannot be reached at all.
+    ///
+    /// Not a `journalctl` command line, and it never will be: this is served over a radio anyone
+    /// in range can talk to, so the robot picks the unit from a fixed list. For searching, take
+    /// the `ip` and use ssh.
+    Logs {
+        /// `robotd`, `btd`, `configd`, `updaterd`, `padd`, `mediad`, `tofd`, `bluetooth` or
+        /// `NetworkManager`. The `.service` suffix is optional.
+        #[arg(value_name = "SERVICE")]
+        service: String,
+        /// How many lines from the end.
+        ///
+        /// The default is what a BLE link carries in a couple of seconds. More is allowed and
+        /// costs proportionally — the robot trims the oldest lines to fit what the radio can
+        /// carry, and says so when it did.
+        #[arg(long, short = 'n', default_value_t = 40)]
+        lines: usize,
+        /// Which boot: `0` is this one, `-1` the one before it.
+        ///
+        /// `--boot -1` is "what did it say before it restarted", which is the reason the journal
+        /// is configured to survive a reboot at all (`deploy/journald.conf.d`).
+        #[arg(long, short = 'b', default_value_t = 0, allow_hyphen_values = true)]
+        boot: i32,
+    },
     /// Version handshake plus update status.
     Status,
     /// What the robot is running: the API version, the release, and the revision it was built from.
@@ -1155,16 +1343,26 @@ async fn run() -> Result<(), Box<dyn std::error::Error>> {
     let target = Target::new(cli.name.clone(), std::env::var("DUCK_ROBOT").ok());
     let pin = resolve_pin(cli.pin.clone(), std::env::var("DUCK_PIN").ok());
 
+    // Before the scan rather than after it: a copy that names no path on the robot is wrong on its
+    // own terms, and finding the robot first would charge eight seconds for the privilege.
+    if let Command::Scp { paths, .. } = &cli.command {
+        scp_refusal(paths)?;
+    }
+
     // `scan` shares the discovery below and then stops, because a listing and a search look for the
     // same thing and differ only in what they do with it. It connects to nothing at all: that is
     // what makes it the safe command to reach for when a robot cannot be reached, and it is also why
     // it can only report what an advertisement carries.
     let list_only = matches!(cli.command, Command::Scan);
-    // `ip` and `open` want one field out of an advertisement, so they read it the way `scan` does —
-    // and unlike `scan` they connect after all when no advertisement carried one. Cheap read first,
-    // call second: without the fallback these two commands would fail on exactly the laptops that
-    // use them most, because a robot bonded to this Mac often stops advertising the service to it.
-    let resolving = matches!(cli.command, Command::Ip | Command::Open { .. });
+    // `ip`, `open`, `ssh` and `scp` want one field out of an advertisement, so they read it the way
+    // `scan` does — and unlike `scan` they connect after all when no advertisement carried one.
+    // Cheap read first, call second: without the fallback these commands would fail on exactly the
+    // laptops that use them most, because a robot bonded to this Mac often stops advertising the
+    // service to it.
+    let resolving = matches!(
+        cli.command,
+        Command::Ip | Command::Open { .. } | Command::Ssh { .. } | Command::Scp { .. }
+    );
 
     let manager = Manager::new().await?;
     let adapter = manager
@@ -1471,7 +1669,10 @@ async fn run() -> Result<(), Box<dyn std::error::Error>> {
             .await?;
     }
 
-    let mut reassembler = Reassembler::new();
+    // `for_replies`, not `new`: this is the client end, and the robot's answers are bounded by
+    // `MAX_REPLY_LINE` rather than by the tighter cap that limits what a radio peer may send. A
+    // `logs` tail is the reply that outgrew the other one.
+    let mut reassembler = Reassembler::for_replies();
     // The deadline is **idle**, not total: it is pushed back by every notification that arrives,
     // because a robot sending progress is a robot that is working. See `REPLY_TIMEOUT`.
     let mut deadline = tokio::time::Instant::now() + timeout;
@@ -1522,6 +1723,17 @@ async fn run() -> Result<(), Box<dyn std::error::Error>> {
                 };
             }
 
+            // `logs` asked for text, so it prints text. A journal tail rendered as a JSON array
+            // of escaped strings is the one reply nobody can read, and reading it is the whole
+            // point of the command. A refusal still prints as JSON below, because the refusal
+            // names the units it would have accepted and that is worth seeing whole.
+            if let Command::Logs { service, boot, .. } = &cli.command
+                && value.get("error").is_none()
+            {
+                let _ = peripheral.disconnect().await;
+                return print_journal(&value["result"], service, *boot);
+            }
+
             println!("{}", serde_json::to_string_pretty(&value)?);
             let _ = peripheral.disconnect().await;
             // A JSON-RPC error is the robot answering, not this tool failing — so it is
@@ -1546,6 +1758,49 @@ async fn run() -> Result<(), Box<dyn std::error::Error>> {
     }
 }
 
+/// Print a journal tail: the lines on stdout, everything about them on stderr.
+///
+/// The split is what makes `duckctl logs robotd | grep panic` work — a truncation note or an
+/// empty-tail explanation in that pipe would be a line the robot never logged.
+fn print_journal(
+    result: &serde_json::Value,
+    service: &str,
+    boot: i32,
+) -> Result<(), Box<dyn std::error::Error>> {
+    let unit = result["unit"].as_str().unwrap_or(service);
+    let Some(lines) = result["lines"].as_array() else {
+        // A well-formed answer in a shape this build does not know. Printed rather than
+        // paraphrased, because the reply itself is the only evidence of what happened.
+        return Err(format!(
+            "the robot answered system.logs with no `lines`, which this version of duckctl              cannot read:\n{}",
+            serde_json::to_string_pretty(result)?
+        )
+        .into());
+    };
+
+    for line in lines {
+        match line.as_str() {
+            Some(text) => println!("{text}"),
+            None => println!("{line}"),
+        }
+    }
+
+    if lines.is_empty() {
+        // Not an error: a daemon that has not run this boot is a real answer, and it is a
+        // different one from a daemon that is running and silent. `system.services` tells them
+        // apart, so that is where this points.
+        eprintln!(
+            "no lines for {unit} in boot {boot} — it may not have run then. `duckctl call              system.services` says whether it is running now."
+        );
+    }
+    if result["truncated"] == serde_json::Value::Bool(true) {
+        eprintln!(
+            "note: older lines were dropped to fit what BLE can carry. Ask for fewer with              `-n`, or read the whole journal over ssh — `duckctl ip` has the address."
+        );
+    }
+    Ok(())
+}
+
 /// How a wait for the next notification ended.
 ///
 /// Three outcomes rather than two, because "nothing arrived" hides the one that is diagnosable:
@@ -1665,7 +1920,7 @@ async fn read_line(
     notifications: &mut (impl futures::Stream<Item = btleplug::api::ValueNotification> + Unpin),
     timeout: Duration,
 ) -> Result<String, Box<dyn std::error::Error>> {
-    let mut reassembler = Reassembler::new();
+    let mut reassembler = Reassembler::for_replies();
     let deadline = tokio::time::Instant::now() + timeout;
 
     loop {
@@ -1774,7 +2029,9 @@ fn request_line(command: &Command) -> Result<(String, Duration), Box<dyn std::er
         // The fallback, reached only when no advertisement carried an address. `net.status` is what
         // the advertisement is made of — `btd` re-reads it every five seconds — so this asks the
         // same question over a connection that costs a bond and a PIN.
-        Command::Ip | Command::Open { .. } => ("net.status", serde_json::json!({}), REPLY_TIMEOUT),
+        Command::Ip | Command::Open { .. } | Command::Ssh { .. } | Command::Scp { .. } => {
+            ("net.status", serde_json::json!({}), REPLY_TIMEOUT)
+        }
         Command::Version => (
             "hello",
             serde_json::json!({ "api_version": duck_ipc_proto::API_VERSION }),
@@ -1782,6 +2039,18 @@ fn request_line(command: &Command) -> Result<(String, Duration), Box<dyn std::er
         ),
         Command::Update(update) => return update_request_line(update),
         Command::Info => ("system.info", serde_json::json!({}), REPLY_TIMEOUT),
+        // A journal read is a `journalctl` spawn on the robot plus a reply several times larger
+        // than any other, chunked at 20 bytes a notification — seconds rather than milliseconds,
+        // so it gets the slow budget for the same reason `wifi scan` does.
+        Command::Logs {
+            service,
+            lines,
+            boot,
+        } => (
+            proto::method::SYSTEM_LOGS,
+            serde_json::json!({ "unit": service, "lines": lines, "boot": boot }),
+            SLOW_REPLY_TIMEOUT,
+        ),
         Command::Health => ("robot.health", serde_json::json!({}), REPLY_TIMEOUT),
         Command::Name { name } => (
             "system.setName",
@@ -2649,6 +2918,104 @@ mod tests {
         ));
     }
 
+    /// `ssh` takes a user and a trailing command, and the user falls back the documented way: the
+    /// flag, a non-empty `DUCK_BOARD_USER`, then the image's account. An emptied variable is unset,
+    /// not a login of `@host`.
+    #[test]
+    fn ssh_resolves_its_user_and_passes_the_command_through() {
+        let cli = Cli::try_parse_from(["duckctl", "ssh", "--user", "pierre"]).expect("parses");
+        let Command::Ssh { user, command } = &cli.command else {
+            panic!("not an ssh command");
+        };
+        assert_eq!(user.as_deref(), Some("pierre"));
+        assert!(command.is_empty());
+
+        let cli = Cli::try_parse_from(["duckctl", "ssh", "--", "sudo", "robotctl", "pad", "pair"])
+            .expect("a trailing command parses");
+        let Command::Ssh { user, command } = &cli.command else {
+            panic!("not an ssh command");
+        };
+        assert_eq!(user, &None);
+        assert_eq!(
+            ssh_argv(&ssh_user(user.as_deref(), None), "192.168.10.136", command),
+            ["radxa@192.168.10.136", "sudo", "robotctl", "pad", "pair"]
+        );
+
+        assert_eq!(ssh_user(Some("pierre"), Some("antoine".into())), "pierre");
+        assert_eq!(ssh_user(None, Some("antoine".into())), "antoine");
+        assert_eq!(ssh_user(None, Some("".into())), "radxa");
+        assert_eq!(ssh_user(None, None), "radxa");
+    }
+
+    /// A leading `:` is the robot, in either operand, and everything else reaches `scp` as typed.
+    #[test]
+    fn scp_points_colon_paths_at_the_robot_and_leaves_the_rest_alone() {
+        let up = scp_argv("radxa", "192.168.10.136", &paths(&["report.md", ":/tmp/"]));
+        assert_eq!(up, ["report.md", "radxa@192.168.10.136:/tmp/"]);
+
+        let down = scp_argv(
+            "pierre",
+            "192.168.10.136",
+            &paths(&[":/var/log/robotd.log", "."]),
+        );
+        assert_eq!(down, ["pierre@192.168.10.136:/var/log/robotd.log", "."]);
+
+        // Flags, several sources, and a bare `:` for the home directory — all of it passes
+        // through, because the rewrite only ever looks at the first character.
+        let many = scp_argv("radxa", "192.168.10.136", &paths(&["-r", "a", "b:c", ":"]));
+        assert_eq!(many, ["-r", "a", "b:c", "radxa@192.168.10.136:"]);
+    }
+
+    /// The two refusals `scp`'s own usage error could not have explained: a copy that names no
+    /// path on the robot, and a source with nothing to copy it to.
+    #[test]
+    fn scp_refuses_a_copy_the_robot_has_nothing_to_do_with() {
+        let local = scp_refusal(&paths(&["a", "b"])).expect_err("neither side is the robot");
+        assert!(local.contains("leading `:`"), "names the rule: {local}");
+        assert!(local.contains("duckctl scp"), "shows the shape: {local}");
+
+        let lonely = scp_refusal(&paths(&[":/tmp/x"])).expect_err("a source with no destination");
+        assert!(
+            lonely.contains("destination"),
+            "says what is missing: {lonely}"
+        );
+
+        scp_refusal(&paths(&["report.md", ":/tmp/"])).expect("a copy that touches the robot");
+        scp_refusal(&paths(&["-r", ":/tmp/logs", "."])).expect("a flag is not an operand");
+    }
+
+    /// `scp` takes the same `--user` as `ssh`, its paths are trailing, and it needs at least one.
+    #[test]
+    fn scp_parses_its_user_and_requires_a_path() {
+        let cli = Cli::try_parse_from(["duckctl", "scp", "--user", "pierre", "x", ":/tmp/"])
+            .expect("parses");
+        let Command::Scp { user, paths } = &cli.command else {
+            panic!("not an scp command");
+        };
+        assert_eq!(user.as_deref(), Some("pierre"));
+        assert_eq!(paths, &["x".to_owned(), ":/tmp/".to_owned()]);
+
+        // `--` ends `duckctl`'s flags, so an `scp` flag of the same shape is not mistaken for one.
+        let cli = Cli::try_parse_from(["duckctl", "scp", "--", "-r", "logs/", ":/tmp/"])
+            .expect("a flag for scp parses after `--`");
+        let Command::Scp { paths, .. } = &cli.command else {
+            panic!("not an scp command");
+        };
+        assert_eq!(
+            paths,
+            &["-r".to_owned(), "logs/".to_owned(), ":/tmp/".to_owned()]
+        );
+
+        assert!(
+            Cli::try_parse_from(["duckctl", "scp"]).is_err(),
+            "scp with nothing to copy"
+        );
+    }
+
+    fn paths(paths: &[&str]) -> Vec<String> {
+        paths.iter().map(|path| (*path).to_owned()).collect()
+    }
+
     #[test]
     fn a_robot_broadcasts_where_it_is() {
         let (properties, duck) = advertised(
@@ -2724,6 +3091,48 @@ mod tests {
         assert!(!answers_to("duck-c51b [", "duck-c51b"));
     }
 
+    /// A negative boot offset is an argument, not a mistyped flag.
+    ///
+    /// `--boot -1` is the whole reason this command is worth having — "what did it say before it
+    /// restarted" — and clap rejects a value starting with `-` unless the argument says
+    /// otherwise. Pinned because the failure is at parse time, on the one invocation nobody
+    /// reaches for until something is already wrong.
+    #[test]
+    fn the_boot_before_this_one_can_be_asked_for() {
+        let wire = |args: &[&str]| {
+            let cli = Cli::try_parse_from([&["duckctl"], args].concat()).expect("parses");
+            request_line(&cli.command).expect("a request").0
+        };
+
+        let previous = wire(&["logs", "btd", "--boot", "-1"]);
+        assert!(
+            previous.contains(duck_ipc_proto::method::SYSTEM_LOGS),
+            "{previous}"
+        );
+        assert!(previous.contains(r#""boot":-1"#), "{previous}");
+
+        let default = wire(&["logs", "btd"]);
+        assert!(default.contains(r#""boot":0"#), "{default}");
+        assert!(default.contains(r#""lines":40"#), "{default}");
+        // The unit goes over verbatim, suffix and all: the robot resolves it against its own
+        // list, so this tool has no list to keep in step.
+        assert!(
+            wire(&["logs", "NetworkManager.service"])
+                .contains(r#""unit":"NetworkManager.service""#)
+        );
+    }
+
+    /// A journal read spawns `journalctl` and carries a reply several times larger than any
+    /// other, chunked at 20 bytes a notification. The reply budget has to match.
+    #[test]
+    fn reading_a_journal_gets_the_slow_budget() {
+        let cli = Cli::try_parse_from(["duckctl", "logs", "robotd", "-n", "500"]).expect("parses");
+        assert_eq!(
+            request_line(&cli.command).expect("a request").1,
+            SLOW_REPLY_TIMEOUT
+        );
+    }
+
     /// **The Hub commands take the budget their work needs**, because the failure otherwise
     /// looks like a robot that stopped talking rather than a mirror having a bad day.
     #[test]
diff --git a/hooks/postinstall b/hooks/postinstall
index ad5e6513..0a3001e5 100755
--- a/hooks/postinstall
+++ b/hooks/postinstall
@@ -62,6 +62,16 @@ if [ -f "$script" ]; then
         || echo "postinstall: the login-shell files did not install; they are cosmetic" >&2
 fi
 
+# Apt off the boot path: Armbian's `@reboot` simulated upgrade and the stock apt-daily timers. Here
+# rather than in setup-board.sh alone because every board in the field was provisioned with them
+# running, and this hook is what reaches those boards. Never fatal — a slower boot is not worth a
+# rollback.
+script=scripts/setup-quiet-boot.sh
+if [ -f "$script" ]; then
+    sh "$script" \
+        || echo "postinstall: could not take apt off the boot path; boot stays slower than it needs to be" >&2
+fi
+
 # The robot's voice bank, rendered from the SoC serial by the release's own generator.
 # Idempotent — a marker records the seed and bank version, and a current bank is a no-op —
 # so this runs on every install and only actually renders on the first one (or when the
@@ -84,6 +94,16 @@ if [ -f "$script" ]; then
         || echo "postinstall: policies were not seeded; robotctl health will say so" >&2
 fi
 
+# The duck detector, the same way and for the same reason: `mediad` reads it from
+# /opt/robot/detector/current, a retrain is a tag on the Hub rather than a daemon release, and the
+# seeder never touches a set it did not install. Warned about, never fatal — the detector is
+# off by default, and a robot asked to look for ducks with no model says so in mediad's journal.
+script=scripts/seed-detector.sh
+if [ -f "$script" ]; then
+    sh "$script" \
+        || echo "postinstall: the duck detector was not seeded; mediad will say so if asked for it" >&2
+fi
+
 [ -d systemd ] || exit 0
 
 # Users and groups before units: a unit naming a `User=` that does not exist fails to start, and
diff --git a/kinematics/src/hand.rs b/kinematics/src/hand.rs
index 8ca49019..1b08ec4c 100644
--- a/kinematics/src/hand.rs
+++ b/kinematics/src/hand.rs
@@ -143,7 +143,9 @@ impl Tracker {
             }
         }
 
-        if in_band.len() < self.config.min_zones {
+        // The band must hold at least one zone whatever `min_zones` says: at 0 the length
+        // check passes on an empty band, and the percentile index below would panic on it.
+        if in_band.len() < self.config.min_zones.max(1) {
             // Hold the last hand briefly. This is the whole anti-chop mechanism: the note
             // rides over a dropout, and stops when one lasts.
             return match self.last {
@@ -318,6 +320,21 @@ mod tests {
         assert!(tracker.track(&distance, &status, Instant::now()).is_some());
     }
 
+    /// `min_zones = 0` is a legal config, and an empty band then passes the length check —
+    /// straight into a percentile index that has nothing to index. No zones is no hand,
+    /// whatever the floor is.
+    #[test]
+    fn an_empty_band_is_not_a_hand_even_with_min_zones_zero() {
+        let mut tracker = Tracker::new(Config {
+            min_zones: 0,
+            ..Config::default()
+        });
+        assert_eq!(tracker.track(&[], &[], Instant::now()), None);
+        // But a single usable zone still is one: the floor is on emptiness, not on count.
+        let (distance, status) = frame(0.25, 5, 1);
+        assert!(tracker.track(&distance, &status, Instant::now()).is_some());
+    }
+
     /// A negative distance under a believed status is a failed convergence, and a frame
     /// shorter than the grid must not panic or read past its end — the wire carries vectors,
     /// and a peer from another release can send fewer.
diff --git a/kinematics/src/head.rs b/kinematics/src/head.rs
index 95e1ec5e..4e43b0b8 100644
--- a/kinematics/src/head.rs
+++ b/kinematics/src/head.rs
@@ -31,6 +31,9 @@ pub struct HeadFk {
     /// true position, a couple of centimetres from the camera it would
     /// otherwise borrow.
     tof: Option<SiteId>,
+    /// The MJCF's `head_imu` site (the BMI088 on the HAT), when the asset carries one. Tilted
+    /// relative to the camera — the mount is not axis-aligned.
+    head_imu: Option<SiteId>,
     joints: [usize; 4],
 }
 
@@ -44,6 +47,7 @@ impl HeadFk {
                 .site("head_camera")
                 .expect("model has a head_camera site"),
             tof: model.site("tof"),
+            head_imu: model.site("head_imu"),
             joints: HEAD_JOINTS
                 .map(|name| model.joint_index(name).expect("model has the head joints")),
         }
@@ -84,6 +88,16 @@ impl HeadFk {
         }
     }
 
+    /// Head-IMU (BMI088) pose in the trunk frame, when the asset has a `head_imu` site.
+    ///
+    /// The site frame is the sensor's own axes as mounted — tilted, not aligned with the camera.
+    /// Rotating a sensor-frame vector by the result's quat expresses it in the trunk, which is how
+    /// a consumer places `head_imu.stream` samples in the robot frame. `None` for an asset with no
+    /// such site (the caller then has no mount and must skip the transform).
+    pub fn head_imu_in_trunk(&self, joints: [f64; 4]) -> Option<Pose> {
+        self.head_imu.map(|site| self.site_in_trunk(site, joints))
+    }
+
     /// A head-chain site posed by the four head joints, everything else at
     /// zero.
     fn site_in_trunk(&self, site: SiteId, joints: [f64; 4]) -> Pose {
diff --git a/kinematics/src/lib.rs b/kinematics/src/lib.rs
index 48898f31..5a0407af 100644
--- a/kinematics/src/lib.rs
+++ b/kinematics/src/lib.rs
@@ -59,6 +59,13 @@ pub struct Model {
     /// Per site, the flattened root→site chain (the site's own rest pose is the
     /// final, joint-less link).
     chains: Vec<Box<[Link]>>,
+    /// The body tree, in MJCF order (a body's parent always precedes it), for
+    /// whole-skeleton FK. Parallel arrays: name, parent index (`None` = root),
+    /// rest pose in the parent frame, and the hinge joint to the parent.
+    body_names: Vec<String>,
+    body_parents: Vec<Option<usize>>,
+    body_rest: Vec<Pose>,
+    body_joint: Vec<Option<(usize, [f64; 3])>>,
     /// The trunk's standing height above the floor, metres — the scene's drop
     /// height for `trunk_base`, which is where the training world puts the
     /// floor relative to the trunk frame.
@@ -75,12 +82,18 @@ impl Model {
         let mut joint_names = Vec::new();
         let mut joint_ranges = Vec::new();
         let mut body_joint: Vec<Option<(usize, [f64; 3])>> = Vec::with_capacity(tree.bodies.len());
+        let mut body_names = Vec::with_capacity(tree.bodies.len());
+        let mut body_parents = Vec::with_capacity(tree.bodies.len());
+        let mut body_rest = Vec::with_capacity(tree.bodies.len());
         for body in &tree.bodies {
             body_joint.push(body.joint.as_ref().map(|j| {
                 joint_names.push(j.name.clone());
                 joint_ranges.push(j.range);
                 (joint_names.len() - 1, j.axis)
             }));
+            body_names.push(body.name.clone());
+            body_parents.push(body.parent);
+            body_rest.push(body.rest);
         }
 
         let mut site_names = Vec::with_capacity(tree.sites.len());
@@ -115,6 +128,10 @@ impl Model {
             joint_ranges,
             site_names,
             chains,
+            body_names,
+            body_parents,
+            body_rest,
+            body_joint,
             trunk_height: tree.trunk_pos[2],
         })
     }
@@ -188,6 +205,44 @@ impl Model {
         }
         t
     }
+
+    /// Every body's pose in the trunk frame, in [`Model::body_names`] order, at
+    /// these angles — the whole skeleton, of which the sites are a few leaves.
+    ///
+    /// One pass in tree order (a parent always precedes its children, so its
+    /// pose is already known): a body is its parent's pose, moved by its rest
+    /// offset, then turned by its own hinge. `angles` covers every joint or it
+    /// panics, the same contract as [`Model::site_pose`].
+    pub fn body_poses(&self, angles: &[f64]) -> Vec<Pose> {
+        assert_eq!(
+            angles.len(),
+            self.joint_names.len(),
+            "angle slice must cover every joint"
+        );
+        let mut poses = vec![Pose::IDENTITY; self.body_names.len()];
+        for i in 0..self.body_names.len() {
+            let mut t = match self.body_parents[i] {
+                Some(p) => poses[p] * self.body_rest[i],
+                None => self.body_rest[i], // the root's world drop is stripped: it rests at identity
+            };
+            if let Some((idx, axis)) = self.body_joint[i] {
+                t.quat = t.quat * Quat::from_axis_angle(axis, angles[idx]);
+            }
+            poses[i] = t;
+        }
+        poses
+    }
+
+    /// Body names in [`Model::body_poses`] order.
+    pub fn body_names(&self) -> impl Iterator<Item = &str> {
+        self.body_names.iter().map(String::as_str)
+    }
+
+    /// Each body's parent index in [`Model::body_poses`] order (`None` = root) —
+    /// the skeleton's edges, for drawing it or matching visual meshes to links.
+    pub fn body_parents(&self) -> &[Option<usize>] {
+        &self.body_parents
+    }
 }
 
 #[cfg(test)]
@@ -238,6 +293,50 @@ mod tests {
         assert_eq!(model.site_pose(origin, &[0.0, 0.0]).pos, [0.0; 3]);
     }
 
+    #[test]
+    fn body_poses_place_the_whole_skeleton() {
+        let model = Model::parse(ARM).expect("parses");
+        let names: Vec<&str> = model.body_names().collect();
+        assert_eq!(names, ["trunk_base", "upper", "lower"]);
+        assert_eq!(model.body_parents(), &[None, Some(0), Some(1)]);
+
+        // Straight: upper sits one out from the root, lower one further.
+        let p = model.body_poses(&[0.0, 0.0]);
+        assert!((p[1].pos[0] - 1.0).abs() < 1e-12 && p[1].pos[1].abs() < 1e-12);
+        assert!((p[2].pos[0] - 2.0).abs() < 1e-12 && p[2].pos[1].abs() < 1e-12);
+
+        // Shoulder at 90°: upper's origin does not move (a hinge turns the frame
+        // in place), but lower swings out along +y.
+        let p = model.body_poses(&[std::f64::consts::FRAC_PI_2, 0.0]);
+        assert!(
+            (p[1].pos[0] - 1.0).abs() < 1e-12,
+            "upper x: {}",
+            p[1].pos[0]
+        );
+        assert!(
+            (p[2].pos[0] - 1.0).abs() < 1e-12,
+            "lower x: {}",
+            p[2].pos[0]
+        );
+        assert!(
+            (p[2].pos[1] - 1.0).abs() < 1e-12,
+            "lower y: {}",
+            p[2].pos[1]
+        );
+
+        // The body under a site agrees with the site FK, minus the site offset.
+        let tip = model.site("tip").expect("tip");
+        let s = model.site_pose(tip, &[0.3, -0.4]);
+        let lower = model.body_poses(&[0.3, -0.4])[2];
+        // The tip site sits [1,0,0] out in `lower`; walking it back lands on lower's origin.
+        let back = lower
+            * Pose {
+                pos: [1.0, 0.0, 0.0],
+                quat: Quat::IDENTITY,
+            };
+        assert!((s.pos[0] - back.pos[0]).abs() < 1e-12 && (s.pos[1] - back.pos[1]).abs() < 1e-12);
+    }
+
     #[test]
     fn the_embedded_alpha_model_has_what_the_daemon_asks_for() {
         let model = Model::alpha();
diff --git a/kinematics/src/mjcf.rs b/kinematics/src/mjcf.rs
index 374b538d..7860e4f2 100644
--- a/kinematics/src/mjcf.rs
+++ b/kinematics/src/mjcf.rs
@@ -36,6 +36,8 @@ pub enum ParseError {
 }
 
 pub(crate) struct Body {
+    /// The MJCF `name`, retained for whole-skeleton FK (matching a pose to a link).
+    pub name: String,
     /// Index into `Tree::bodies`. `None` only for the root (trunk_base).
     pub parent: Option<usize>,
     /// Rest pose of this body in its parent's frame (identity for the root).
@@ -94,6 +96,7 @@ pub(crate) fn parse(xml: &str) -> Result<Tree, ParseError> {
     // The root is anchored at identity — its MJCF `pos` is where MuJoCo drops
     // the robot into the world, which trunk-frame FK must not inherit.
     tree.bodies.push(Body {
+        name: trunk.attribute("name").unwrap_or("trunk_base").to_owned(),
         parent: None,
         rest: Pose::IDENTITY,
         joint: None,
@@ -130,6 +133,7 @@ fn walk_body(node: roxmltree::Node, parent: usize, tree: &mut Tree) -> Result<()
 
     let idx = tree.bodies.len();
     tree.bodies.push(Body {
+        name: node.attribute("name").unwrap_or("").to_owned(),
         parent: Some(parent),
         rest: rest_pose(node)?,
         joint,
diff --git a/kinematics/src/tof.rs b/kinematics/src/tof.rs
index 35cc94e4..9fc152fc 100644
--- a/kinematics/src/tof.rs
+++ b/kinematics/src/tof.rs
@@ -31,7 +31,7 @@ const N_ZONES: usize = ROWS * COLS;
 
 /// The sensor's square field of view, degrees per axis — 45°×45° per ST's
 /// datasheet for both generations, the value the prototype's beam table used.
-const FOV_DEG: f64 = 45.0;
+pub const FOV_DEG: f64 = 45.0;
 
 /// What one zone's return turned out to be, once it has a place in the world.
 #[derive(Debug, Clone, Copy, PartialEq)]
diff --git a/mediad/Cargo.toml b/mediad/Cargo.toml
index e77b50ff..1fa76ed2 100644
--- a/mediad/Cargo.toml
+++ b/mediad/Cargo.toml
@@ -16,14 +16,24 @@ description = "Camera, mic, WebRTC — and the remote gateway"
 # that other, and the cost is a sysroot the whole workspace now builds against.
 
 [dependencies]
+# One function: `read_access_token`. The crate that performs the login is the one that defines the
+# credential's file format, so the reader lives next to the writer and a test there pins the key
+# this depends on — rather than a two-field struct here and a test in `updater` describing it.
+hf-robot-account = "0.1"
 duck-ipc-proto = { path = "../duck-ipc-proto" }
-# `[media]` and `[detect]` in /etc/robot/robotd.toml — what this daemon streams, and what it looks
+# `[media]` and `[duck_detector]` in /etc/robot/robotd.toml — what this daemon streams, and what it looks
 # for. The same crate `robotd` parses that file with and the same one `robotctl configure` edits it
 # through, so the schema, the defaults and the editor cannot drift from what is read here.
 robotd-params = { path = "../robotd-params" }
 anyhow = "1"
+# `getgrnam` and `chown`, to hand the frame socket to the `robot` group after binding — the same
+# thing `tof` and `padd` do with theirs. Mode 0660 alone would leave it `mediad:mediad`, and the
+# operator is only ever added to `robot`.
+libc = "0.2"
 # The detector itself: the letterbox+turn, the NPU binding, the ONNX fallback and the decoder.
 duck-detect = { path = "../duck-detect" }
+# JPEG for the frame stream and PNG for lossless console snapshots.
+image = { version = "0.25", default-features = false, features = ["jpeg", "png"] }
 # The console's one route. Already in `Cargo.lock` — `updater` uses it for its test mirror — so it
 # is known-good against this toolchain and the cross build. The alternative was a hand-rolled
 # HTTP/1.1 responder: about sixty lines of hand-written request parsing bound to 0.0.0.0, written to
@@ -34,6 +44,36 @@ duck-detect = { path = "../duck-detect" }
 # tracing middleware are all weight for routes that do not exist.
 axum = { version = "0.8.9", default-features = false, features = ["http1", "tokio"] }
 clap = { workspace = true, features = ["derive"] }
+# The relay's half of the bridge: HTTPS to the rendezvous service — SSE inbound, `POST /send`
+# outbound. Same line `updater` uses, minus `form` (nothing here posts a form), so the TLS stack
+# and its version are the ones already resolved for this workspace and its cross build.
+# `stream` is what makes the SSE body readable as it arrives rather than at the end.
+reqwest = { version = "0.13.4", default-features = false, features = ["rustls", "json", "stream", "http2", "charset"] }
+# Server-Sent Events framing — `event:`/`data:` lines, multi-line data, comments and the
+# reconnection field. Sixty lines to hand-roll and one of them would be the bug: a `data:` split
+# across two TCP reads.
+eventsource-stream = "0.2.3"
+# Parsing, not fetching: the one endpoint this daemon sends the account token to is
+# checked before the token can reach it, and "is this loopback" and "does this carry
+# userinfo" are the two questions a hand-rolled split on `:` gets wrong. Already in the
+# lock via `reqwest`.
+url.workspace = true
+# `StreamExt`, for the byte stream `reqwest` hands over. Already in the lock via `updater`.
+futures-util = "0.3.33"
+# The local half of the bridge: a WebSocket client to `webrtcsink`'s own signalling server on
+# 127.0.0.1:8443, where this daemon is a *consumer* — the same role the console page plays on a
+# LAN. `ws://` only, on loopback, so no TLS: `connect` and `handshake` and nothing else.
+# `rustls-tls-webpki-roots` because the frame stream dials a `wss://` Space, where the
+# signalling bridge only ever dialled `ws://127.0.0.1`. The roots are webpki's rather
+# than the platform's: a board's trust store is whatever the image shipped, and a
+# consumer that stops working after an OS update is a worse failure than a pinned set.
+tokio-tungstenite = { version = "0.30", default-features = false, features = ["connect", "handshake", "rustls-tls-webpki-roots"] }
+# Jitter on the reconnect backoff, so a fleet coming back after a service restart does not arrive
+# in lockstep. Already in the lock.
+rand = "0.10.2"
+# The relay's message types. `serde_json` was enough while every JSON object here was forwarded
+# verbatim; the rendezvous protocol is the first one this daemon has to *write*.
+serde = { workspace = true, features = ["derive"] }
 serde_json.workspace = true
 tokio = { workspace = true, features = ["rt", "rt-multi-thread", "net", "io-util", "sync", "time", "macros"] }
 tracing.workspace = true
@@ -69,4 +109,10 @@ glib = "0.21"
 duck-ipc-proto = { path = "../duck-ipc-proto", features = ["test-support"] }
 # Fake daemons on real unix sockets, which is how the pipe is tested without a WebRTC peer.
 tempfile = "3"
+# The fake rendezvous service the relay is tested against: `axum` needs a `Stream` to serve SSE
+# from, and one `async_stream::stream!` is what a hand-written `Stream` impl would be.
+async-stream = "0.3.6"
+# `ws` for the fake signalling server the bridge is tested against — the local side of a session
+# is a WebSocket, and a test that faked it with a channel would not exercise the framing.
+axum = { version = "0.8.9", default-features = false, features = ["http1", "tokio", "json", "ws"] }
 tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
diff --git a/mediad/src/camera.rs b/mediad/src/camera.rs
new file mode 100644
index 00000000..860aea79
--- /dev/null
+++ b/mediad/src/camera.rs
@@ -0,0 +1,460 @@
+//! What the camera's geometry is, so a consumer can do more than look at the picture.
+//!
+//! A frame is pixels. Turning pixels into directions — which is what SLAM, visual odometry, or
+//! "how far away is that duck" all need — takes the **intrinsics**: the focal length in pixels and
+//! where the optical axis crosses the image. Without them a monocular reconstruction is
+//! scale-free and its angles are wrong; with them it maps a room.
+//!
+//! # Derived from the field of view, so it can be checked rather than trusted
+//!
+//! The IMX219's full array is 3280×2464 at a 1.12 µm pitch — 3.67 mm wide — behind the head
+//! camera's ~3.05 mm M12 lens, a **horizontal field of view of ~62°** across the full width. On
+//! this board's Rockchip driver the production **1920×1080@30** mode is a *scaled full-frame
+//! readout* (the whole 62° width, downscaled and cropped to 16:9), **not** the native-pixel 39°
+//! crop the datasheet's "1080p" implies — validated on hardware 2026-09-08: a calibration of
+//! confirmed-1920×1080 frames solves to 62°, and the family default in `robotd-params` carries it
+//! (`fx` ≈ 1062 at 1280×720). So the **field of view** — not a native focal length — is what the
+//! nominal geometry rests on, because the field of view is what stays fixed as the ISP scales the
+//! frame to whatever `[media] quality` asks for:
+//!
+//! - Focal length in pixels of a delivered frame `W` wide: `fx = (W/2) / tan(62°/2)`, so 1280 wide
+//!   gives `fx` ≈ 1065; a uniform scale moves `fy`, `cx`, `cy` with it.
+//! - The vertical is the 16:9 crop of that, and the principal point is *assumed* central — which is
+//!   the part a real calibration corrects (the measured `cy` sits ~110 px low).
+//!
+//! # And when the pinned mode is not confirmed, this publishes nothing
+//!
+//! `pin_sensor_mode` shells out to `media-ctl` and can fail — a board without `v4l-utils`, an
+//! entity name that moved. Capture still works from the 3280×2464 boot mode (also ~62°, at 21 fps),
+//! but its exact 4:3→16:9 framing is not the pinned mode's, so this withholds nominal intrinsics
+//! rather than publish a geometry it cannot vouch for. **Numbers that are quietly wrong are worse
+//! than none**: a consumer told nothing knows it must calibrate.
+//!
+//! # Nominal is not calibrated, and the wire says which
+//!
+//! Everything above is the *design* of the camera, not a measurement of the one on this robot:
+//! lens focal lengths vary by a few percent unit to unit, the principal point is never exactly the
+//! centre, and nothing here models distortion at all. That is enough for a room-scale map and not
+//! enough for photogrammetry, so a record built from them carries `calibrated: false`. In practice
+//! every alpha robot publishes a measurement: `robotd-params` ships the family's solve as the
+//! `[media.intrinsics]` default (the camera and lens are one part), and a robot with its own solve
+//! written there publishes that. The nominal path is the fallback for a camera nobody has solved.
+
+/// The head camera's horizontal field of view, degrees — the full IMX219 array (3.67 mm wide)
+/// behind the ~3.05 mm M12 lens. The one physical number the nominal geometry rests on, and the one
+/// the family calibration confirms (it solves to 62.2°). See the module header.
+const FULL_FIELD_HFOV_DEG: f64 = 62.0;
+
+/// The MuJoCo twin head camera's vertical field of view. The MJCF sets no `fovy`, so MuJoCo's
+/// default 45° applies; see [`Intrinsics::sim`].
+const SIM_VFOV_DEG: f64 = 45.0;
+
+/// Horizontal focal length in pixels for a delivered frame `width` wide, from [`FULL_FIELD_HFOV_DEG`].
+/// The delivered field of view is the sensor's full width in every mode this driver offers, so this
+/// depends only on the output width, not on which sensor mode fed it.
+fn nominal_focal_px(width: u32) -> f64 {
+    f64::from(width) / 2.0 / (FULL_FIELD_HFOV_DEG / 2.0).to_radians().tan()
+}
+
+/// The sensor readout mode `pipeline::pin_sensor_mode` puts the IMX219 in — carried so
+/// [`Intrinsics::nominal`] can tell "the mode we pinned" from "we could not confirm it", and refuse
+/// a delivered frame whose aspect ratio is not the mode's.
+///
+/// # Both modes this driver offers are the full ~62° field
+///
+/// The IMX219's full array is 3280×2464 at a 1.12 µm pitch behind the ~3.05 mm M12 lens — `2·atan(
+/// 3280·1.12µm / 2 / 3.05mm)` ≈ **62°** horizontally. On this board's Rockchip driver `1920×1080`
+/// is a *scaled full-frame* readout, not a native crop, so it is the same 62° field (validated on
+/// hardware; see the module header):
+///
+/// | mode | how | horizontal FOV | note |
+/// |---|---|---|---|
+/// | 1920×1080 | full field, scaled/cropped to 16:9 | **62°** | what this daemon pins, at 30 fps |
+/// | 3280×2464 | full 4:3 array | **62°** | the boot mode, at 21 fps |
+///
+/// So the field of view does not change with the mode — only the resolution and frame rate do, and
+/// the geometry a consumer needs is the same either way. `1920×1080` is pinned for the frame rate;
+/// there is no wide-vs-fast trade to make here, because the wide field is already the fast mode.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct SensorMode {
+    pub width: u32,
+    pub height: u32,
+}
+
+impl SensorMode {
+    /// The mode `pipeline::pin_sensor_mode` asks for: the full field at 30 fps.
+    pub const PINNED: Self = Self {
+        width: 1920,
+        height: 1080,
+    };
+}
+
+/// Where the optical axis is and how long the focal length is, in pixels of a delivered frame.
+///
+/// **For the frame as it is sent**, which is not rotated: the camera is mounted a quarter turn off
+/// and nothing on the robot turns the pixels back (`pipeline`'s header says why). A consumer that
+/// rotates the image has to rotate these too — `cx` and `cy` swap, and so do `fx` and `fy` — and
+/// the `rotate` field alongside these in `media.video` is what tells it by how much.
+/// Where a published calibration came from — so a consumer can tell *this* robot's own solve from
+/// the family's, which look identical in the numbers.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Source {
+    /// A `[media.intrinsics]` calibration measured on this robot.
+    Robot,
+    /// The hardware family's shared calibration (`robotd-params` ships it): a real solve of the
+    /// same camera-and-lens part, not of this particular unit.
+    Family,
+    /// The module's design figures — arithmetic from the datasheet, not a measurement.
+    Nominal,
+    /// The MuJoCo twin's rendered camera — exact geometry from the simulator's field of view, not a
+    /// physical measurement (there is no physical sensor). Lets twin recordings self-describe.
+    Sim,
+}
+
+#[derive(Debug, Clone, PartialEq, serde::Serialize)]
+pub struct Intrinsics {
+    pub fx: f64,
+    pub fy: f64,
+    pub cx: f64,
+    pub cy: f64,
+    /// **Whether these came from a real solve.** `false` is `Source::Nominal` — the module's design
+    /// figures, no distortion model, enough for a room-scale map rather than metrology. `true`
+    /// covers both a per-robot and the family calibration; [`Intrinsics::source`] says which, so a
+    /// consumer that needs *this* robot's own solve can tell it must still ask.
+    pub calibrated: bool,
+    /// Whose solve this is: this robot's, the family's, or none (the datasheet). See [`Source`].
+    pub source: Source,
+    /// Radial and tangential terms in OpenCV's order — `k1 k2 p1 p2 k3` — or empty for "no model
+    /// of the distortion", which is what a nominal record has.
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub distortion: Vec<f64>,
+}
+
+impl Intrinsics {
+    /// The design figures for a delivered frame, or `None` when the geometry is not known.
+    ///
+    /// `None` has one cause and it is worth surfacing rather than papering over: the sensor is not
+    /// in the mode this code pins, so how much of the sensor a frame covers is unknown.
+    pub fn nominal(mode: Option<SensorMode>, width: u32, height: u32) -> Option<Self> {
+        let mode = mode?;
+        if width == 0 || height == 0 || mode.width == 0 || mode.height == 0 {
+            return None;
+        }
+
+        // The delivered frame has to be a uniform scale of the mode — the same 16:9 aspect. The ISP
+        // *can* scale the axes independently, and then part of the frame was cropped or squashed on
+        // the way out, which the output size alone cannot tell apart from a resize.
+        let scale_x = f64::from(width) / f64::from(mode.width);
+        let scale_y = f64::from(height) / f64::from(mode.height);
+        if (scale_x - scale_y).abs() > 0.01 {
+            return None;
+        }
+
+        // The focal length is fixed by the field of view and the delivered width. The field of view
+        // is the sensor's full ~62° in every mode, so it does not depend on which mode fed the frame.
+        let focal = nominal_focal_px(width);
+        Some(Self {
+            fx: focal,
+            fy: focal,
+            // The principal point is *assumed* central, which is what makes this nominal: on a real
+            // module it is a few pixels off (the measured cy sits ~110 px low), only a calibration
+            // knows in which direction.
+            cx: f64::from(width) / 2.0,
+            cy: f64::from(height) / 2.0,
+            calibrated: false,
+            source: Source::Nominal,
+            distortion: Vec::new(),
+        })
+    }
+
+    /// A calibration, scaled from the resolution it was measured at to the one being delivered.
+    ///
+    /// Scaling a calibration is exact for a uniform resize — every intrinsic is in pixels and
+    /// pixels all change size together — and wrong for a crop, which is why the record carries the
+    /// resolution it was taken at rather than assuming one. An aspect change between the two means
+    /// the second image is not the first one resized, so this refuses it.
+    pub fn scaled_from(
+        measured: &robotd_params::CameraIntrinsics,
+        width: u32,
+        height: u32,
+    ) -> Option<Self> {
+        Self::scaled(measured, width, height, Source::Robot)
+    }
+
+    /// A calibration scaled to the delivered frame, tagged with whose solve it is. `Robot` for a
+    /// per-robot `[media.intrinsics]` table, `Family` for the shipped family default.
+    fn scaled(
+        measured: &robotd_params::CameraIntrinsics,
+        width: u32,
+        height: u32,
+        source: Source,
+    ) -> Option<Self> {
+        if measured.width == 0 || measured.height == 0 || width == 0 || height == 0 {
+            return None;
+        }
+        let scale_x = f64::from(width) / f64::from(measured.width);
+        let scale_y = f64::from(height) / f64::from(measured.height);
+        if (scale_x - scale_y).abs() > 0.01 {
+            tracing::warn!(
+                measured = format!("{}x{}", measured.width, measured.height),
+                delivered = format!("{width}x{height}"),
+                "the calibration was measured at a different aspect ratio than the stream, so it \
+                 cannot be scaled to it; publishing nominal intrinsics instead"
+            );
+            return None;
+        }
+        Some(Self {
+            fx: measured.fx * scale_x,
+            fy: measured.fy * scale_y,
+            cx: measured.cx * scale_x,
+            cy: measured.cy * scale_y,
+            calibrated: true,
+            source,
+            // Distortion coefficients are dimensionless in normalised image coordinates, so a
+            // uniform resize leaves them alone.
+            distortion: measured.distortion.clone(),
+        })
+    }
+
+    /// The hardware family's calibration, scaled to the delivered frame. The camera and lens are
+    /// one part across a revision, so this is a real solve of the same optics — just not of this
+    /// particular unit, which is why it is published as `Source::Family` rather than `Robot`.
+    ///
+    /// Gated on a known sensor mode for the same reason [`Intrinsics::nominal`] is: the solve was
+    /// taken in the pinned mode, and an unconfirmed one (the boot mode — the same ~62° field, but a
+    /// different 4:3→16:9 framing and principal point) would place it slightly wrong — so an
+    /// unconfirmed mode publishes nothing rather than the family's numbers off by that framing.
+    pub fn family(mode: Option<SensorMode>, width: u32, height: u32) -> Option<Self> {
+        mode?;
+        Self::scaled(
+            &robotd_params::CameraIntrinsics::alpha(),
+            width,
+            height,
+            Source::Family,
+        )
+    }
+
+    /// The MuJoCo twin's head camera. The MJCF sets no `fovy` on the camera, so MuJoCo's default
+    /// **45° VERTICAL** field applies over the rendered height: `fx = fy = (height/2)/tan(45°/2)`,
+    /// principal point central, no distortion (a rendered pinhole has none). Exact for the simulator,
+    /// so twin recordings self-describe and need no `--calib`. Tagged [`Source::Sim`], `calibrated`
+    /// false (it is not a measurement of a physical sensor). If a scene ever sets a custom camera
+    /// `fovy`, update `SIM_VFOV_DEG`.
+    pub fn sim(width: u32, height: u32) -> Option<Self> {
+        if width == 0 || height == 0 {
+            return None;
+        }
+        let focal = f64::from(height) / 2.0 / (SIM_VFOV_DEG / 2.0).to_radians().tan();
+        Some(Self {
+            fx: focal,
+            fy: focal,
+            cx: f64::from(width) / 2.0,
+            cy: f64::from(height) / 2.0,
+            calibrated: false,
+            source: Source::Sim,
+            distortion: Vec::new(),
+        })
+    }
+
+    /// What to publish, in order of preference: this robot's own `[media.intrinsics]` calibration;
+    /// else the hardware family's, which every unit shares; else the module's design figures. Each
+    /// carries its [`Source`], so "calibrated" never has to stand in for "measured on *this* robot".
+    pub fn published(
+        configured: Option<&robotd_params::CameraIntrinsics>,
+        mode: Option<SensorMode>,
+        width: u32,
+        height: u32,
+    ) -> Option<Self> {
+        configured
+            .and_then(|measured| Self::scaled_from(measured, width, height))
+            .or_else(|| Self::family(mode, width, height))
+            .or_else(|| Self::nominal(mode, width, height))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn measured(width: u32, height: u32) -> robotd_params::CameraIntrinsics {
+        robotd_params::CameraIntrinsics {
+            width,
+            height,
+            fx: 1800.0,
+            fy: 1802.0,
+            cx: 646.0,
+            cy: 358.0,
+            distortion: vec![-0.31, 0.12, 0.0, 0.0, -0.02],
+        }
+    }
+
+    /// The one physical number, and the focal length it produces.
+    #[test]
+    fn nominal_focal_length_comes_from_the_field_of_view() {
+        // 62° across a 1280-wide frame. Written out so a wrong constant is a failing test rather
+        // than a plausible-looking number in an SDP nobody checks.
+        assert!(
+            (nominal_focal_px(1280) - 1065.14).abs() < 0.1,
+            "{}",
+            nominal_focal_px(1280)
+        );
+        // And it implies the 62° it was built from.
+        let hfov = 2.0 * (640.0 / nominal_focal_px(1280)).atan().to_degrees();
+        assert!((hfov - 62.0).abs() < 0.01, "{hfov}");
+    }
+
+    /// 1280x720 out of the pinned 1920x1080 mode: the 62° field at that width.
+    #[test]
+    fn the_pinned_mode_scales_to_what_is_streamed() {
+        let at_720p = Intrinsics::nominal(Some(SensorMode::PINNED), 1280, 720).expect("known");
+        assert!((at_720p.fx - 1065.14).abs() < 0.1, "{}", at_720p.fx);
+        assert_eq!(at_720p.fy, at_720p.fx, "square pixels, uniform scale");
+        assert_eq!((at_720p.cx, at_720p.cy), (640.0, 360.0));
+        assert!(
+            !at_720p.calibrated,
+            "these are the module's, not this robot's"
+        );
+        assert!(
+            at_720p.distortion.is_empty(),
+            "nominal models no distortion"
+        );
+
+        // The field of view is the same at the mode's own resolution — only the pixel count grows.
+        let at_1080p = Intrinsics::nominal(Some(SensorMode::PINNED), 1920, 1080).expect("known");
+        assert!((at_1080p.fx - nominal_focal_px(1920)).abs() < 0.01);
+        let hfov = 2.0 * (960.0 / at_1080p.fx).atan().to_degrees();
+        assert!((hfov - 62.0).abs() < 0.01, "{hfov}");
+    }
+
+    /// The twin's 45° vertical FOV over a 640x360 render — a wider (~72.7°) horizontal field than the
+    /// real camera's 62°, which is why the nominal K skews twin maps.
+    #[test]
+    fn sim_geometry_from_the_default_fovy() {
+        let k = Intrinsics::sim(640, 360).expect("nonzero");
+        assert!((k.fy - 434.57).abs() < 0.1, "{}", k.fy);
+        assert_eq!(k.fx, k.fy, "square pixels");
+        assert_eq!((k.cx, k.cy), (320.0, 180.0), "principal point central");
+        assert_eq!(k.source, Source::Sim);
+        assert!(!k.calibrated && k.distortion.is_empty());
+        let hfov = 2.0 * (320.0 / k.fx).atan().to_degrees();
+        assert!((hfov - 72.7).abs() < 0.5, "{hfov}");
+    }
+
+    /// The delivered field of view is the sensor's full ~62° at every resolution — the production
+    /// 1920x1080 mode is a scaled full-frame readout, not a crop, so the FOV does not change.
+    #[test]
+    fn the_delivered_field_of_view_is_the_full_62_degrees() {
+        for w in [640_u32, 1280, 1920] {
+            let h = w * 9 / 16;
+            let k = Intrinsics::nominal(Some(SensorMode::PINNED), w, h).expect("known");
+            let hfov = 2.0 * (f64::from(w) / 2.0 / k.fx).atan().to_degrees();
+            assert!((hfov - 62.0).abs() < 0.5, "{w}w -> {hfov}");
+        }
+    }
+
+    /// **A sensor whose pinned mode we could not confirm publishes nothing.**
+    ///
+    /// `pin_sensor_mode` can fail, leaving the sensor in its 3280x2464 boot mode — also ~62°, but a
+    /// different 4:3→16:9 framing than the pinned mode the calibration is for. Numbers that are
+    /// quietly wrong are worse than none — a consumer told nothing calibrates.
+    #[test]
+    fn an_unknown_sensor_mode_yields_no_intrinsics() {
+        assert!(Intrinsics::nominal(None, 1280, 720).is_none());
+        assert!(Intrinsics::published(None, None, 1280, 720).is_none());
+    }
+
+    /// A frame whose aspect ratio is not the mode's has been cropped or squashed on the way out,
+    /// and which of those cannot be told from the size.
+    #[test]
+    fn a_changed_aspect_ratio_is_refused_rather_than_guessed() {
+        assert!(
+            Intrinsics::nominal(Some(SensorMode::PINNED), 640, 480).is_none(),
+            "4:3 out of a 16:9 mode is not a resize"
+        );
+        assert!(Intrinsics::nominal(Some(SensorMode::PINNED), 1280, 0).is_none());
+    }
+
+    /// A calibration wins, and scales.
+    #[test]
+    fn a_calibration_is_preferred_and_carried_to_the_streamed_size() {
+        // Measured at 1280x720, delivered at 640x360: everything halves.
+        let published = Intrinsics::published(
+            Some(&measured(1280, 720)),
+            Some(SensorMode::PINNED),
+            640,
+            360,
+        )
+        .expect("a calibration");
+        assert!(published.calibrated);
+        assert!((published.fx - 900.0).abs() < 0.01);
+        assert!((published.cx - 323.0).abs() < 0.01);
+        assert_eq!(
+            published.distortion,
+            vec![-0.31, 0.12, 0.0, 0.0, -0.02],
+            "distortion is dimensionless, so a resize leaves it alone"
+        );
+
+        // And at the resolution it was measured at, it is published as measured.
+        let same = Intrinsics::published(Some(&measured(1280, 720)), None, 1280, 720)
+            .expect("as measured");
+        assert_eq!(
+            (same.fx, same.fy, same.cx, same.cy),
+            (1800.0, 1802.0, 646.0, 358.0)
+        );
+    }
+
+    /// A per-robot calibration that cannot be scaled falls back to the family's, not to nothing —
+    /// a real solve of the same optics, published as `family` so a consumer can see this robot's
+    /// own record was unusable and someone should fix it.
+    #[test]
+    fn an_unusable_robot_calibration_falls_back_to_the_family() {
+        let published = Intrinsics::published(
+            Some(&measured(640, 480)),
+            Some(SensorMode::PINNED),
+            1280,
+            720,
+        )
+        .expect("the family calibration");
+        assert_eq!(published.source, Source::Family);
+        assert!(
+            published.calibrated,
+            "the family solve is a real measurement"
+        );
+        // The alpha solve is 1280x720, delivered 1280x720, so it is carried across unscaled.
+        assert!((published.fx - 1061.81).abs() < 0.01, "{}", published.fx);
+    }
+
+    /// With no per-robot table, a robot in a known mode publishes the family's calibration, tagged
+    /// so a consumer can tell it is not this unit's own solve.
+    #[test]
+    fn the_family_fills_in_when_the_robot_has_no_table() {
+        let published = Intrinsics::published(None, Some(SensorMode::PINNED), 640, 360)
+            .expect("the family calibration");
+        assert_eq!(published.source, Source::Family);
+        assert!(published.calibrated);
+        // Half of the 1280x720 solve.
+        assert!((published.fx - 530.9).abs() < 0.5, "{}", published.fx);
+        let json = serde_json::to_value(&published).unwrap();
+        assert_eq!(json["source"], "family");
+        assert_eq!(json["calibrated"], true);
+    }
+
+    /// The shape a consumer reads. `calibrated` is not optional in the JSON: a consumer that has
+    /// to guess whether numbers were measured will guess that they were.
+    #[test]
+    fn the_wire_shape_names_what_it_is() {
+        let json =
+            serde_json::to_value(Intrinsics::nominal(Some(SensorMode::PINNED), 1280, 720).unwrap())
+                .unwrap();
+        assert_eq!(json["calibrated"], false);
+        assert_eq!(json["source"], "nominal");
+        assert!((json["fx"].as_f64().unwrap() - 1065.14).abs() < 0.1);
+        assert_eq!(json["cx"], 640.0);
+        assert!(
+            json.get("distortion").is_none(),
+            "an empty distortion model is absent rather than an empty list: a consumer reading \
+             `[]` has to know that means `unknown` rather than `none`"
+        );
+    }
+}
diff --git a/mediad/src/config.rs b/mediad/src/config.rs
index ff38b936..a029a115 100644
--- a/mediad/src/config.rs
+++ b/mediad/src/config.rs
@@ -1,7 +1,7 @@
 //! What this daemon streams and what it looks for, out of the config file `robotd` already reads.
 //!
 //! `[media]` in `/etc/robot/robotd.toml` — camera or test pattern, frame size, rate, bitrate — and
-//! `[detect]` beside it, which is this daemon's too because the frames are on this daemon's tee.
+//! `[duck_detector]` beside it, which is this daemon's too because the frames are on this daemon's tee.
 //! The schema, the defaults and the validation are `robotd_params`'s, which is the point: the crate
 //! read here is the one `robotctl configure` writes through, so the editor cannot offer a value
 //! this daemon would not understand.
@@ -45,7 +45,7 @@ pub fn load(path: &Path, explicit: bool) -> Params {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use robotd_params::MediaParams;
+    use robotd_params::{MediaParams, MediaSource};
 
     fn write(dir: &Path, text: &str) -> PathBuf {
         let path = dir.join("robotd.toml");
@@ -62,7 +62,11 @@ mod tests {
         assert_eq!(media.quality.size(), (640, 360));
         assert_eq!(media.quality.fps(), 30);
         assert_eq!(media.bitrate_resolved(), media.quality.default_bitrate());
-        assert!(media.camera, "untouched keys keep their defaults");
+        assert_eq!(
+            media.source,
+            MediaSource::Camera,
+            "untouched keys keep their defaults"
+        );
     }
 
     /// A robot with no file at the default path streams its camera, and says nothing about it.
@@ -71,7 +75,7 @@ mod tests {
         let dir = tempfile::tempdir().unwrap();
         let media = load(&dir.path().join("absent.toml"), false).media;
         assert_eq!(media.quality, MediaParams::default().quality);
-        assert!(media.camera);
+        assert_eq!(media.source, MediaSource::Camera);
     }
 
     /// The claim the doc comment makes, pinned: a params file `robotd` will not start on still
@@ -82,7 +86,7 @@ mod tests {
         let path = write(dir.path(), "[media\nquality = ");
         let media = load(&path, true).media;
         assert_eq!(media.quality, MediaParams::default().quality);
-        assert!(media.camera);
+        assert_eq!(media.source, MediaSource::Camera);
     }
 
     /// A `[media]` section from a build that had a key this one does not is ignored key by key,
diff --git a/mediad/src/detect.rs b/mediad/src/detect.rs
index 2320d86b..db990b74 100644
--- a/mediad/src/detect.rs
+++ b/mediad/src/detect.rs
@@ -139,7 +139,9 @@ pub fn spawn_first(
         }
     }
     anyhow::bail!(
-        "no model would load ({}). For the NPU: sudo /usr/local/sbin/robot-setup-npu",
+        "no model would load ({}). A missing file means the set was never installed — \
+         `sudo robotctl duck-detector update` fetches it from the Hub; for the NPU: \
+         sudo /usr/local/sbin/robot-setup-npu",
         refused.join("; ")
     )
 }
diff --git a/mediad/src/exposure.rs b/mediad/src/exposure.rs
index 7264d588..9860ccc5 100644
--- a/mediad/src/exposure.rs
+++ b/mediad/src/exposure.rs
@@ -424,6 +424,7 @@ mod tests {
             width: 1280,
             height: 720,
             format: CAPTURE_FORMAT,
+            captured_at: std::time::SystemTime::UNIX_EPOCH,
             data,
         }
     }
diff --git a/mediad/src/frame.rs b/mediad/src/frame.rs
new file mode 100644
index 00000000..3e80376e
--- /dev/null
+++ b/mediad/src/frame.rs
@@ -0,0 +1,501 @@
+//! A local `media.frame` endpoint for a recorder or perception process on the robot.
+//!
+//! A frame stays out of the WebRTC control channel: at the default geometry the UYVY payload is
+//! about 1.8 MiB, so JSON/base64 would make a control request several MiB and let a slow peer tie
+//! camera data to the network. This socket sends one JSON-RPC response header, then precisely
+//! `bytes` raw bytes, which keeps the metadata inspectable without copying pixels through a text
+//! encoding.
+//!
+//! **It asks for a frame rather than taking the last one.** [`Frames`] is a rendezvous, not a
+//! cache: the capture branch copies a buffer only when a reader has asked for one
+//! ([`crate::pipeline::Frames`] explains why — 1.84 MiB thirty times a second for readers that
+//! want two). So a caller here waits for the capture that answers it, bounded by
+//! [`pipeline::FRAME_TIMEOUT`], and a camera that has stopped is reported as a timeout rather than
+//! answered with the frame it stopped on.
+//!
+//! The socket is group-readable like the other observation sockets: whoever may watch
+//! `robot.state` may ask for a picture.
+
+use std::os::unix::fs::PermissionsExt;
+use std::path::Path;
+use std::sync::Arc;
+use std::time::{Duration, UNIX_EPOCH};
+
+use anyhow::{Context, Result};
+use duck_ipc_proto as proto;
+
+use tokio::io::{AsyncBufReadExt, AsyncReadExt, AsyncWriteExt, BufReader};
+use tokio::net::{UnixListener, UnixStream};
+
+use crate::pipeline::Frames;
+
+const SOCKET_MODE: u32 = 0o660;
+
+/// The group that may ask for a frame. Deliberately the same one as `robotd`'s socket, `padd`'s
+/// tap and `tof`'s stream: whoever may watch the robot may watch what it sees.
+const GROUP: &str = "robot";
+
+/// The longest request this endpoint will read. `media.frame` takes no parameters worth naming, so
+/// anything approaching this is a client that has lost the plot.
+const MAX_REQUEST_BYTES: usize = 4096;
+
+/// Claim the socket without replacing a live listener or a non-socket file.
+pub async fn bind(socket: &Path) -> Result<(std::fs::File, UnixListener)> {
+    use std::os::unix::fs::FileTypeExt;
+    if let Some(parent) = socket.parent().filter(|p| !p.as_os_str().is_empty()) {
+        std::fs::create_dir_all(parent)?;
+    }
+    // Keep the lock inode for the listener's lifetime, including the stale-socket probe.
+    let mut lock_path = socket.as_os_str().to_os_string();
+    lock_path.push(".lock");
+    let lock = std::fs::OpenOptions::new()
+        .create(true)
+        .truncate(false)
+        .read(true)
+        .write(true)
+        .open(lock_path)?;
+    lock.try_lock()
+        .context("another mediad owns the frame socket")?;
+    let listener = match UnixListener::bind(socket) {
+        Ok(listener) => listener,
+        Err(error) if error.kind() == std::io::ErrorKind::AddrInUse => {
+            if !std::fs::symlink_metadata(socket)?.file_type().is_socket() {
+                return Err(error.into());
+            }
+            match tokio::time::timeout(Duration::from_secs(1), UnixStream::connect(socket)).await {
+                Ok(Err(probe)) if probe.kind() == std::io::ErrorKind::ConnectionRefused => {
+                    std::fs::remove_file(socket)?;
+                    UnixListener::bind(socket)?
+                }
+                _ => return Err(error.into()),
+            }
+        }
+        Err(error) => return Err(error.into()),
+    };
+    std::fs::set_permissions(socket, std::fs::Permissions::from_mode(SOCKET_MODE))
+        .with_context(|| format!("setting permissions on {}", socket.display()))?;
+    if let Err(error) = give_to_group(socket, GROUP) {
+        // Not fatal, and said out loud with what it means: the socket exists, and only `mediad`
+        // and root can reach it. On a board that is a broken install; on a laptop it is a machine
+        // with no `robot` group, which is ordinary.
+        tracing::warn!(
+            error = %error, group = GROUP, socket = %socket.display(),
+            "media.frame stays private to mediad — nothing else can ask for a picture"
+        );
+    }
+    tracing::info!(
+        path = %socket.display(),
+        mode = format!("{SOCKET_MODE:o}"),
+        "serving media.frame locally"
+    );
+
+    Ok((lock, listener))
+}
+
+/// Bound both simultaneous clients and the lifetime of silent or slow clients.
+///
+/// `rotate` is degrees clockwise the camera is mounted from upright, reported in every frame
+/// header. It is the caller's business whether the pipeline already applied it.
+pub async fn serve(listener: UnixListener, frames: Frames, rotate: u32) -> Result<()> {
+    let slots = Arc::new(tokio::sync::Semaphore::new(16));
+    loop {
+        match listener.accept().await {
+            Ok((stream, _)) => {
+                let Ok(permit) = slots.clone().try_acquire_owned() else {
+                    continue;
+                };
+                let frames = frames.clone();
+                tokio::spawn(async move {
+                    let _permit = permit;
+                    let _ = tokio::time::timeout(
+                        Duration::from_secs(5),
+                        handle(stream, frames, rotate),
+                    )
+                    .await;
+                });
+            }
+            Err(error) => tracing::warn!(error = %error, "media.frame accept failed"),
+        }
+    }
+}
+
+async fn handle(stream: UnixStream, frames: Frames, rotate: u32) -> Result<()> {
+    let (read, mut write) = stream.into_split();
+    // Bounded *before* the line is buffered. Checking the length afterwards would mean a client
+    // could make this process hold an arbitrarily long line first, which is the thing the cap is
+    // for. One byte over the cap is read so that "too large" stays distinguishable from a request
+    // that exactly fills it.
+    let mut reader = BufReader::new(read);
+    loop {
+        let mut line = Vec::new();
+        let read = (&mut reader)
+            .take(MAX_REQUEST_BYTES as u64 + 1)
+            .read_until(b'\n', &mut line)
+            .await?;
+        if read == 0 {
+            return Ok(());
+        }
+        if line.len() > MAX_REQUEST_BYTES {
+            write_response(
+                &mut write,
+                proto::Response::err(
+                    None,
+                    proto::Error::new(proto::code::INVALID_PARAMS, "request is too large"),
+                ),
+            )
+            .await?;
+            return Ok(());
+        }
+        let request: proto::Request = match serde_json::from_slice(&line) {
+            Ok(request) => request,
+            Err(error) => {
+                write_response(
+                    &mut write,
+                    proto::Response::err(
+                        None,
+                        proto::Error::new(proto::code::PARSE_ERROR, error.to_string()),
+                    ),
+                )
+                .await?;
+                return Ok(());
+            }
+        };
+        if request.method == proto::method::HELLO {
+            write_response(
+                &mut write,
+                proto::Response::ok(
+                    request.id,
+                    &proto::HelloResult {
+                        api_version: proto::API_VERSION,
+                        daemon_version: proto::semver::Version::parse(env!("CARGO_PKG_VERSION"))
+                            .ok(),
+                        revision: proto::build_info!().revision.map(str::to_owned),
+                    },
+                ),
+            )
+            .await?;
+            continue;
+        }
+        if request.method != proto::method::MEDIA_FRAME {
+            write_response(
+                &mut write,
+                proto::Response::err(
+                    request.id,
+                    proto::Error::new(
+                        proto::code::METHOD_NOT_FOUND,
+                        format!("{} is not served by mediad", request.method),
+                    ),
+                ),
+            )
+            .await?;
+            continue;
+        }
+        // `next_frame` registers the demand and parks on a condvar until the capture that answers it
+        // lands, so it cannot run on the runtime's thread.
+        let frame = tokio::task::spawn_blocking(move || frames.next_frame()).await?;
+        let Some(frame) = frame else {
+            write_response(
+                &mut write,
+                proto::Response::err(
+                    request.id,
+                    proto::Error::new(
+                        proto::code::INTERNAL_ERROR,
+                        "no frame arrived within the capture timeout",
+                    ),
+                ),
+            )
+            .await?;
+            return Ok(());
+        };
+        let captured_at_unix_us = frame
+            .captured_at
+            .duration_since(UNIX_EPOCH)
+            .unwrap_or_default()
+            .as_micros();
+        let header = proto::MediaFrameHeader {
+            width: frame.width,
+            height: frame.height,
+            format: frame.format.to_owned(),
+            bytes: frame.data.len(),
+            captured_at_unix_us,
+            rotate,
+        };
+        write_response(&mut write, proto::Response::ok(request.id, &header)).await?;
+        write.write_all(&frame.data).await?;
+        write.flush().await?;
+        return Ok(());
+    }
+}
+
+/// Hand the socket to `GROUP`. Mirrors `tof`'s stream and `padd`'s tap, including that a missing
+/// group is a warning rather than a failure.
+fn give_to_group(socket: &Path, group: &str) -> std::io::Result<()> {
+    use std::ffi::CString;
+    use std::os::unix::ffi::OsStrExt;
+
+    let name = CString::new(group).map_err(std::io::Error::other)?;
+    // SAFETY: `getgrnam` reads the group database and returns a pointer into storage it owns. The
+    // name is a valid C string for the length of the call, and nothing else in this process calls
+    // into the group database.
+    let entry = unsafe { libc::getgrnam(name.as_ptr()) };
+    if entry.is_null() {
+        return Err(std::io::Error::other(format!(
+            "no {group} group on this system"
+        )));
+    }
+    // SAFETY: checked non-null immediately above, and `struct group` is fully initialised by
+    // `getgrnam` when it returns a pointer at all.
+    let gid = unsafe { (*entry).gr_gid };
+
+    let path = CString::new(socket.as_os_str().as_bytes()).map_err(std::io::Error::other)?;
+    // SAFETY: a valid C string path; `-1` for the owner is the documented "leave it alone".
+    if unsafe { libc::chown(path.as_ptr(), u32::MAX, gid) } != 0 {
+        return Err(std::io::Error::last_os_error());
+    }
+    Ok(())
+}
+
+async fn write_response(
+    write: &mut tokio::net::unix::OwnedWriteHalf,
+    response: proto::Response,
+) -> Result<()> {
+    let mut line = serde_json::to_vec(&response)?;
+    line.push(b'\n');
+    write.write_all(&line).await?;
+    write.flush().await?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use std::time::{Duration, UNIX_EPOCH};
+
+    use super::*;
+    use crate::pipeline::Frame;
+    use tokio::io::AsyncReadExt;
+
+    #[tokio::test]
+    async fn hello_and_unknown_method_keep_the_connection_for_a_frame() {
+        let frames = Frames::default();
+        let producer = answer_once(
+            frames.clone(),
+            Frame {
+                width: 2,
+                height: 1,
+                format: "UYVY",
+                captured_at: UNIX_EPOCH,
+                data: vec![128, 16, 128, 235],
+            },
+        );
+        let (mut client, server) = UnixStream::pair().unwrap();
+        let task = tokio::spawn(handle(server, frames, 90));
+        client.write_all(b"{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"hello\"}\n{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"unknown\"}\n{\"jsonrpc\":\"2.0\",\"id\":3,\"method\":\"media.frame\"}\n").await.unwrap();
+        let mut reader = BufReader::new(client);
+        for id in 1..=3 {
+            let mut line = String::new();
+            reader.read_line(&mut line).await.unwrap();
+            let response: proto::Response = serde_json::from_str(&line).unwrap();
+            assert_eq!(response.id, Some(proto::Id::Number(id)));
+            if id == 1 {
+                assert_eq!(response.result.unwrap()["api_version"], proto::API_VERSION);
+            }
+            if id == 2 {
+                assert_eq!(response.error.unwrap().code, proto::code::METHOD_NOT_FOUND);
+            }
+        }
+        let mut bytes = Vec::new();
+        reader.read_to_end(&mut bytes).await.unwrap();
+        assert_eq!(bytes, [128, 16, 128, 235]);
+        task.await.unwrap().unwrap();
+        producer.join().unwrap();
+    }
+
+    #[tokio::test]
+    async fn invalid_utf8_gets_a_parse_error() {
+        let (mut client, server) = UnixStream::pair().unwrap();
+        let task = tokio::spawn(handle(server, Frames::default(), 90));
+        client.write_all(&[255, b'\n']).await.unwrap();
+        let mut line = String::new();
+        BufReader::new(client).read_line(&mut line).await.unwrap();
+        let response: proto::Response = serde_json::from_str(&line).unwrap();
+        assert_eq!(response.error.unwrap().code, proto::code::PARSE_ERROR);
+        task.await.unwrap().unwrap();
+    }
+
+    #[tokio::test]
+    async fn socket_claim_preserves_files_and_live_listeners_but_recovers_stale_sockets() {
+        let dir = tempfile::tempdir().unwrap();
+        let regular = dir.path().join("regular");
+        std::fs::write(&regular, b"keep").unwrap();
+        assert!(bind(&regular).await.is_err());
+        assert_eq!(std::fs::read(&regular).unwrap(), b"keep");
+        let live = dir.path().join("live");
+        let listener = UnixListener::bind(&live).unwrap();
+        assert!(bind(&live).await.is_err());
+        assert!(UnixStream::connect(&live).await.is_ok());
+        drop(listener);
+        let (lock, listener) = bind(&live).await.unwrap();
+        assert!(bind(&live).await.is_err());
+        drop(listener);
+        drop(lock);
+        assert!(bind(&live).await.is_ok());
+    }
+
+    #[tokio::test]
+    async fn idle_clients_are_bounded_and_expire() {
+        let dir = tempfile::tempdir().unwrap();
+        let socket = dir.path().join("media.sock");
+        let listener = UnixListener::bind(&socket).unwrap();
+        let server = tokio::spawn(serve(listener, Frames::default(), 90));
+        let mut clients = Vec::new();
+        for _ in 0..16 {
+            let mut client = UnixStream::connect(&socket).await.unwrap();
+            client
+                .write_all(b"{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"hello\"}\n")
+                .await
+                .unwrap();
+            let mut reader = BufReader::new(client);
+            let mut line = String::new();
+            reader.read_line(&mut line).await.unwrap();
+            assert!(!line.is_empty());
+            clients.push(reader);
+        }
+        let mut excess = UnixStream::connect(&socket).await.unwrap();
+        let mut byte = [0];
+        assert_eq!(
+            tokio::time::timeout(Duration::from_secs(1), excess.read(&mut byte))
+                .await
+                .unwrap()
+                .unwrap(),
+            0
+        );
+        assert_eq!(
+            tokio::time::timeout(Duration::from_secs(6), clients[0].read(&mut byte))
+                .await
+                .unwrap()
+                .unwrap(),
+            0
+        );
+        server.abort();
+    }
+
+    /// Stand in for the capture branch: wait for the demand this endpoint registers, then answer
+    /// it once. Mirrors what `wire_frames` does on a buffer somebody asked for.
+    fn answer_once(frames: Frames, frame: Frame) -> std::thread::JoinHandle<()> {
+        std::thread::spawn(move || {
+            let deadline = std::time::Instant::now() + Duration::from_secs(5);
+            while !frames.take_request() {
+                assert!(
+                    std::time::Instant::now() < deadline,
+                    "the endpoint never asked for a frame"
+                );
+                std::thread::yield_now();
+            }
+            frames.deliver(frame);
+        })
+    }
+
+    async fn reply(frames: Frames, request: &str) -> proto::Response {
+        let (mut client, server) = UnixStream::pair().unwrap();
+        let task = tokio::spawn(handle(server, frames, 90));
+        client.write_all(request.as_bytes()).await.unwrap();
+        client.shutdown().await.unwrap();
+        let mut text = String::new();
+        BufReader::new(client).read_line(&mut text).await.unwrap();
+        task.await.unwrap().unwrap();
+        serde_json::from_str(text.trim()).unwrap()
+    }
+
+    /// A camera that never delivers is a timeout, not a silent hang and not a stale frame.
+    #[tokio::test]
+    async fn a_capture_that_never_comes_is_an_explicit_error() {
+        let response = reply(
+            Frames::default(),
+            "{\"jsonrpc\":\"2.0\",\"id\":7,\"method\":\"media.frame\",\"params\":{}}\n",
+        )
+        .await;
+        assert_eq!(response.id, Some(proto::Id::Number(7)));
+        assert_eq!(response.error.unwrap().code, proto::code::INTERNAL_ERROR);
+    }
+
+    /// Refused before any demand is registered, so an unknown method cannot make the capture
+    /// branch copy 1.8 MiB for nothing.
+    #[tokio::test]
+    async fn an_unknown_method_is_refused_without_asking_for_a_frame() {
+        let frames = Frames::default();
+        let response = reply(
+            frames.clone(),
+            "{\"jsonrpc\":\"2.0\",\"id\":\"request\",\"method\":\"media.other\"}\n",
+        )
+        .await;
+        assert_eq!(response.id, Some(proto::Id::Text("request".into())));
+        assert_eq!(response.error.unwrap().code, proto::code::METHOD_NOT_FOUND);
+        assert!(
+            !frames.take_request(),
+            "a refused method must not leave demand behind"
+        );
+    }
+
+    #[tokio::test]
+    async fn an_oversized_request_is_rejected_before_it_is_parsed() {
+        let request = format!("{}\n", "x".repeat(MAX_REQUEST_BYTES + 1));
+        let response = reply(Frames::default(), &request).await;
+        assert_eq!(response.id, None);
+        assert_eq!(response.error.unwrap().code, proto::code::INVALID_PARAMS);
+    }
+
+    /// The read is bounded before the line is buffered, so a client that never sends a newline
+    /// cannot make this process hold an unbounded string.
+    #[tokio::test]
+    async fn a_request_without_a_newline_is_still_bounded() {
+        let (mut client, server) = UnixStream::pair().unwrap();
+        let task = tokio::spawn(handle(server, Frames::default(), 90));
+        client
+            .write_all("y".repeat(MAX_REQUEST_BYTES * 4).as_bytes())
+            .await
+            .unwrap();
+        client.shutdown().await.unwrap();
+        let mut text = String::new();
+        BufReader::new(client).read_line(&mut text).await.unwrap();
+        task.await.unwrap().unwrap();
+        let response: proto::Response = serde_json::from_str(text.trim()).unwrap();
+        assert_eq!(response.error.unwrap().code, proto::code::INVALID_PARAMS);
+    }
+
+    #[tokio::test]
+    async fn a_frame_reply_names_and_follows_with_exactly_its_pixels() {
+        let frames = Frames::default();
+        let producer = answer_once(
+            frames.clone(),
+            Frame {
+                width: 2,
+                height: 1,
+                format: "UYVY",
+                captured_at: UNIX_EPOCH + Duration::from_secs(1),
+                data: vec![128, 32, 128, 64],
+            },
+        );
+        let (mut client, server) = UnixStream::pair().unwrap();
+        let task = tokio::spawn(handle(server, frames, 90));
+        client
+            .write_all(b"{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"media.frame\"}\n")
+            .await
+            .unwrap();
+        let mut reader = BufReader::new(client);
+        let mut line = String::new();
+        reader.read_line(&mut line).await.unwrap();
+        let response: proto::Response = serde_json::from_str(line.trim()).unwrap();
+        let result = response.result.unwrap();
+        assert_eq!(result["width"], 2);
+        assert_eq!(result["height"], 1);
+        assert_eq!(result["format"], "UYVY");
+        assert_eq!(result["bytes"], 4);
+        assert_eq!(result["captured_at_unix_us"], 1_000_000);
+        assert_eq!(result["rotate"], 90);
+        let mut pixels = [0; 4];
+        reader.read_exact(&mut pixels).await.unwrap();
+        assert_eq!(pixels, [128, 32, 128, 64]);
+        task.await.unwrap().unwrap();
+        producer.join().unwrap();
+    }
+}
diff --git a/mediad/src/lib.rs b/mediad/src/lib.rs
index cf7ee95a..fbb8bd02 100644
--- a/mediad/src/lib.rs
+++ b/mediad/src/lib.rs
@@ -17,10 +17,22 @@
 //! signalling server in this process, `mpph264enc` in front of it, and a `control` datachannel per
 //! peer wired to [`session::run`].
 
+/// What the camera's geometry is — the intrinsics a consumer needs to turn pixels into
+/// directions, and which sensor mode they belong to.
+pub mod camera;
 pub mod config;
+/// The account credential `updaterd` writes, read by the two things here that need it.
 pub mod producer;
+/// The outward connection to the rendezvous service — what makes a duck reachable from off its
+/// own LAN. `docs/design/remote-access-design.md` §3.
+pub mod relay;
 pub mod route;
 pub mod session;
+mod snapshot;
+pub mod stream;
+/// Relay candidates, so a robot behind a router is reachable from a network that cannot punch a
+/// hole to it. `docs/design/remote-access-design.md` §6.
+pub mod turn;
 pub mod upstream;
 pub mod web;
 
@@ -38,3 +50,9 @@ pub mod exposure;
 /// reads the same raw branch, in the same pixel format the pipeline names.
 #[cfg(target_os = "linux")]
 pub mod detect;
+
+/// The local, on-demand raw-frame endpoint. Linux only because it reads the pipeline's frame
+/// rendezvous, which is; the WebRTC control channel deliberately does not carry camera-sized
+/// replies. `npu-bringup.md` §"media.frame".
+#[cfg(target_os = "linux")]
+pub mod frame;
diff --git a/mediad/src/main.rs b/mediad/src/main.rs
index 6289656d..9855a29c 100644
--- a/mediad/src/main.rs
+++ b/mediad/src/main.rs
@@ -37,6 +37,39 @@ struct Args {
     #[arg(long, default_value_t = 8443)]
     port: u32,
 
+    /// The rendezvous service this robot registers with, so it can be reached from off its LAN.
+    ///
+    /// Defaults to the Space the mini's fleet uses. A flag rather than a config key because there
+    /// is nothing to choose on a real robot — what it is for is pointing a board at a fake, or at
+    /// a self-hosted copy on the day somebody wants one. `docs/design/remote-access-design.md` §4.
+    #[arg(long, default_value = mediad::relay::DEFAULT_RENDEZVOUS)]
+    rendezvous_url: String,
+
+    /// The account credential `updaterd` writes, which the relay needs to prove whose robot this
+    /// is. Absent means nobody has signed this robot in, and remote access is simply off.
+    #[arg(long, default_value = mediad::relay::DEFAULT_TOKEN_PATH)]
+    token: PathBuf,
+
+    /// Where short-lived TURN credentials come from.
+    ///
+    /// Hugging Face hosts this proxy and mints Cloudflare credentials for the account the token
+    /// belongs to, which is why offering a relay needs no new secret on the robot. A flag for
+    /// pointing a board at a fake; there is nothing to choose on a real one.
+    ///
+    /// Checked here rather than trusted: this is the one URL the account token is sent to, and
+    /// `parse_endpoint` says what it will not send it over.
+    #[arg(long, default_value = mediad::turn::DEFAULT_TURN_ENDPOINT,
+          value_parser = mediad::turn::parse_endpoint)]
+    turn_url: String,
+
+    /// Do not register with the rendezvous service, whatever the token file says.
+    ///
+    /// For a board that is signed in and being worked on: a duck registering from a bench while
+    /// somebody drives the same account's robot elsewhere is a producer in a list nobody wants,
+    /// and evicting it means finding this flag afterwards.
+    #[arg(long)]
+    no_remote: bool,
+
     /// Where the console is served. `http://<robot>:8080/`, and nothing else to run.
     ///
     /// **Two ports, and only this one is ever typed.** `webrtcsink` owns the listener on `--port`
@@ -75,12 +108,15 @@ struct Args {
 
     /// How far the camera is mounted from upright, clockwise: 0, 90, 180 or 270.
     ///
-    /// **90, because the head camera is mounted a quarter turn off**, and this is the one place that
-    /// fact is written down. It no longer means "rotate the pixels": it is told to whoever displays
-    /// the video, and they rotate for free — the console with a CSS transform on the GPU. Rotating
-    /// here cost 145% of a core and 22 fps; `pipeline::Rotation` has the numbers.
-    #[arg(long, default_value_t = 90)]
-    rotate: u32,
+    /// **90 by default, because the head camera is mounted a quarter turn off**, and this is the one
+    /// place that fact is written down. It no longer means "rotate the pixels": it is told to
+    /// whoever displays the video, and they rotate for free — the console with a CSS transform on
+    /// the GPU. Rotating here cost 145% of a core and 22 fps; `pipeline::Rotation` has the numbers.
+    ///
+    /// True of a simulated camera too: the one in MuJoCo is rolled to match the mount, so a frame
+    /// from a duck in the twin needs the same quarter turn as a frame from a duck on the desk.
+    #[arg(long)]
+    rotate: Option<u32>,
 
     /// Leave the exposure where `--exposure` and `--analogue-gain` put it, instead of metering.
     ///
@@ -93,6 +129,17 @@ struct Args {
     #[arg(long)]
     no_auto_exposure: bool,
 
+    /// Take frames from a duck in MuJoCo at `host:port` instead of a camera.
+    ///
+    /// The geometry has to match the simulator's camera — set `[media] quality` (the rung `mediad`
+    /// streams; `mediad` has no `--width`/`--height` of its own) to the resolution and rate the body
+    /// renders at — because the frames arrive raw and length-prefixed with no handshake, and a
+    /// mismatch is a picture nobody can read rather than an error the pipeline can recover from.
+    /// `mediad` says so and refuses the frame if the sizes disagree.
+    /// Takes precedence over `[media] source`, which is a fact about a robot and not about this.
+    #[arg(long)]
+    sim_camera: Option<String>,
+
     /// Rotate in the pipeline as well, so the *encoded stream* comes out upright.
     ///
     /// **Off by default because it is expensive in a way that does not look like rotation.** It
@@ -101,6 +148,51 @@ struct Args {
     /// Worth it only for a consumer that cannot rotate for itself.
     #[arg(long)]
     flip_in_pipeline: bool,
+
+    /// Where the daemons listen, when not at `proto::socket`'s paths.
+    ///
+    /// On a robot the defaults are right and none of these is ever typed. They exist for the twin
+    /// (`scripts/duck-sim`), where every duck's `robotd` and `tofd` listen under a per-duck state
+    /// directory — without them a peer's `control` channel reaches a `mediad` whose routes all end
+    /// at `/run/*.sock`, and every call but `media.video` answers "not answering".
+    #[arg(long)]
+    robot_socket: Option<std::path::PathBuf>,
+    #[arg(long)]
+    tof_socket: Option<std::path::PathBuf>,
+    #[arg(long)]
+    config_socket: Option<std::path::PathBuf>,
+    #[arg(long)]
+    pad_socket: Option<std::path::PathBuf>,
+    #[arg(long)]
+    updater_socket: Option<std::path::PathBuf>,
+    /// Local raw camera snapshot endpoint (not the control datachannel).
+    #[arg(long, default_value = duck_ipc_proto::socket::MEDIA)]
+    frame_socket: std::path::PathBuf,
+}
+
+// Gated with the `main` that calls it: off Linux there is no pipeline, so there is nothing to
+// point at a socket and `-D warnings` would call this dead.
+#[cfg(target_os = "linux")]
+impl Args {
+    fn sockets(&self) -> mediad::upstream::Sockets {
+        let mut s = mediad::upstream::Sockets::default();
+        if let Some(p) = &self.robot_socket {
+            s.robot = p.clone();
+        }
+        if let Some(p) = &self.tof_socket {
+            s.tof = p.clone();
+        }
+        if let Some(p) = &self.config_socket {
+            s.config = p.clone();
+        }
+        if let Some(p) = &self.pad_socket {
+            s.pad = p.clone();
+        }
+        if let Some(p) = &self.updater_socket {
+            s.updater = p.clone();
+        }
+        s
+    }
 }
 
 #[cfg(target_os = "linux")]
@@ -130,15 +222,20 @@ fn main() -> ExitCode {
     // should say so rather than opening a camera first.
     // Validated even when the pipeline will not use it, because it is still what every consumer is
     // told about the mount — a typo should not reach the console as a rotation nobody can apply.
-    let mount = match mediad::pipeline::Rotation::from_degrees(args.rotate) {
+    // 90 whatever the source. The head camera is mounted a quarter turn off and every consumer is
+    // told so — and the *simulated* camera is rolled the same way on purpose, so that a frame from a
+    // duck in MuJoCo needs the same turn as a frame from a duck on the desk. Overridable, because a
+    // scene could mount it differently, but there is one default and it is the robot's.
+    let rotate = args.rotate.unwrap_or(90);
+    let mount = match mediad::pipeline::Rotation::from_degrees(rotate) {
         Ok(rotation) => rotation,
         Err(e) => {
             tracing::error!(error = %e, "mediad cannot start");
             return ExitCode::FAILURE;
         }
     };
-    // What the stream is and what it looks for, from `[media]` and `[detect]` — see
-    // `--config` and `mediad::config`. One file, one read: `[detect]` is `mediad`'s section
+    // What the stream is and what it looks for, from `[media]` and `[duck_detector]` — see
+    // `--config` and `mediad::config`. One file, one read: `[duck_detector]` is `mediad`'s section
     // too, and a second config file for the second daemon that wants one is how a fleet ends
     // up with settings nobody can find.
     let explicit = args.config.is_some();
@@ -147,30 +244,46 @@ fn main() -> ExitCode {
         .clone()
         .unwrap_or_else(mediad::config::default_path);
     let params = mediad::config::load(&config, explicit);
-    let (media, detect) = (params.media, params.detect);
+    let (media, detect) = (params.media, params.duck_detector);
+
+    // **What will actually run, not what is configured.** `[media] quality` is the rung a camera
+    // streams at; a test pattern ignores it and runs at `TEST_PATTERN_GEOMETRY`, so a log line
+    // reporting the rung on a board with no camera named a resolution nothing was producing.
+    //
+    // `--sim-camera` wins over `[media] source`, exactly as the source selection further down
+    // does: a simulated camera is a camera, and it renders the configured rung.
+    let (width, height, fps) = if args.sim_camera.is_some() {
+        (
+            media.quality.width(),
+            media.quality.height(),
+            media.quality.fps(),
+        )
+    } else {
+        media.geometry()
+    };
     tracing::info!(
-        camera = media.camera,
+        source = media.source.label(),
         quality = media.quality.label(),
-        width = media.quality.width(),
-        height = media.quality.height(),
-        fps = media.quality.fps(),
+        width,
+        height,
+        fps,
         bitrate = media.bitrate_resolved(),
         congestion_control = media.congestion_control.nick(),
         "streaming"
     );
     // The same angle the detector needs, in its own vocabulary: it folds the turn into the
     // resampling it already does, which is why nothing in the pipeline has to.
-    let turn = match duck_detect::Turn::from_degrees(args.rotate) {
+    let turn = match duck_detect::Turn::from_degrees(rotate) {
         Some(turn) => turn,
         None => {
-            tracing::error!(degrees = args.rotate, "mediad cannot start");
+            tracing::error!(degrees = rotate, "mediad cannot start");
             return ExitCode::FAILURE;
         }
     };
 
     let rotation = if args.flip_in_pipeline {
         tracing::warn!(
-            degrees = args.rotate,
+            degrees = rotate,
             "--flip-in-pipeline: rotating in the pipeline costs the encoder its zero-copy path"
         );
         mount
@@ -188,8 +301,9 @@ fn main() -> ExitCode {
         // neither. So this is logged at error and the daemon carries on.
         let page = mediad::web::page(args.port);
         let (web_host, web_port) = (args.host.clone(), args.web_port);
+        let web_frame_socket = args.frame_socket.clone();
         tokio::spawn(async move {
-            if let Err(e) = mediad::web::serve(&web_host, web_port, page).await {
+            if let Err(e) = mediad::web::serve(&web_host, web_port, page, web_frame_socket).await {
                 tracing::error!(
                     error = %format!("{e:#}"),
                     "the console is not being served; video and control are unaffected"
@@ -201,9 +315,9 @@ fn main() -> ExitCode {
         // producer that registered without a name would keep it until this daemon restarts. Costs a
         // unix-socket round trip on a boot where `configd` may not be up yet, which is why it is
         // bounded and why a failure is a warning rather than an exit.
+        let sockets = args.sockets();
         let producer =
-            mediad::producer::Producer::learn(Default::default(), duck_ipc_proto::build_info!())
-                .await;
+            mediad::producer::Producer::learn(sockets.clone(), duck_ipc_proto::build_info!()).await;
         tracing::info!(
             name = producer.name.as_deref().unwrap_or("unknown"),
             release = %producer.release,
@@ -211,14 +325,75 @@ fn main() -> ExitCode {
             "producing as"
         );
 
-        let source = if media.camera {
-            mediad::pipeline::Source::Camera(mediad::pipeline::Camera {
-                device: args.camera_device.clone(),
-                exposure: args.exposure,
-                analogue_gain: args.analogue_gain,
-            })
+        // Relay candidates, so a consumer on a network that cannot punch a hole to this robot
+        // still reaches it. Spawned whatever the account state — it is inert without a token and
+        // starts on its own when a login lands — and *before* the pipeline, because the first
+        // consumer's offer is built as the pipeline comes up.
+        let relays = mediad::turn::Relays::empty();
+        tokio::spawn(mediad::turn::maintain(
+            std::sync::Arc::clone(&relays),
+            args.token.clone(),
+            args.turn_url.clone(),
+        ));
+
+        // What a control lane can say about this robot's own media: the picture's geometry, and
+        // the frame streamer. Empty until the pipeline is up — `sensor_mode()` is only truthful
+        // once something has tried to set it, and there are no frames to encode before then — and
+        // the relay below is spawned before that on purpose, so the answer has to be able to
+        // arrive late rather than be a value passed in now.
+        let (video_tx, video_rx) =
+            tokio::sync::watch::channel::<Option<mediad::session::Media>>(None);
+
+        // The outward half of remote access, and it is deliberately *after* the producer is
+        // learned: the name a client sees in the service's listing comes from the same place the
+        // local `meta` gets it, and a relay that registered first would publish an unnamed robot
+        // until the next restart.
+        //
+        // Spawned whatever happens next. It is inert without a token, it holds no lock, and a
+        // pipeline that fails to build should not take remote access down with it — a robot that
+        // appears in its owner's list and cannot stream is still a robot somebody can reach to
+        // find out why.
+        if args.no_remote {
+            tracing::info!("--no-remote: this robot will not register with the rendezvous service");
         } else {
-            mediad::pipeline::Source::Test
+            match mediad::relay::Meta::of(&producer, None) {
+                None => tracing::warn!(
+                    "no serial and no machine id, so this robot has no stable identity to \
+                     register with; remote access is off"
+                ),
+                Some(meta) => {
+                    if let Some(relay) =
+                        mediad::relay::Relay::new(&args.rendezvous_url, &args.token, meta)
+                    {
+                        // The bridge is a *consumer* of the signalling server this same process
+                        // runs, so it has to be told the port `--port` chose rather than assuming
+                        // the default — a robot moved off 8443 would otherwise register happily
+                        // and fail every session.
+                        tokio::spawn(
+                            relay
+                                .with_local_signalling(format!("ws://127.0.0.1:{}", args.port))
+                                .with_video(video_rx.clone())
+                                .run(),
+                        );
+                    }
+                }
+            }
+        }
+
+        // Matched rather than tested, so a source added to `MediaSource` fails the build here
+        // instead of quietly arriving as a test pattern.
+        let source = match args.sim_camera.clone() {
+            Some(addr) => mediad::pipeline::Source::Sim(addr),
+            None => match media.source {
+                robotd_params::MediaSource::Camera => {
+                    mediad::pipeline::Source::Camera(mediad::pipeline::Camera {
+                        device: args.camera_device.clone(),
+                        exposure: args.exposure,
+                        analogue_gain: args.analogue_gain,
+                    })
+                }
+                robotd_params::MediaSource::Test => mediad::pipeline::Source::Test,
+            },
         };
 
         // Frame size and rate are still pinned rather than negotiated — both branches of the tee
@@ -231,9 +406,9 @@ fn main() -> ExitCode {
             port: args.port,
             bitrate: media.bitrate_resolved(),
             congestion_control: media.congestion_control,
-            width: media.quality.width(),
-            height: media.quality.height(),
-            fps: media.quality.fps(),
+            width,
+            height,
+            fps,
             rotation,
         };
 
@@ -241,17 +416,44 @@ fn main() -> ExitCode {
         // `get_frame` surface in `architecture.md` §5.3 is what the rest of it is for. The branch
         // runs from the start rather than being added later, because a tee inserted into a live
         // pipeline is a different and much harder problem than a tee that was always there.
-        let (_pipeline, mut channels, frames) =
-            match mediad::pipeline::start(source.clone(), &producer, &settings) {
-                Ok(started) => started,
-                Err(e) => {
-                    // The message names which step failed and what usually causes it — a missing
-                    // plugin, a missing library, or a device node nobody can open. Those look
-                    // identical from a log line that only says "failed".
-                    tracing::error!(error = %format!("{e:#}"), "mediad cannot start");
-                    return ExitCode::FAILURE;
-                }
-            };
+        let (_pipeline, mut channels, frames, stream_branch) = match mediad::pipeline::start(
+            source.clone(),
+            &producer,
+            &settings,
+            std::sync::Arc::clone(&relays),
+        ) {
+            Ok(started) => started,
+            Err(e) => {
+                // The message names which step failed and what usually causes it — a missing
+                // plugin, a missing library, or a device node nobody can open. Those look
+                // identical from a log line that only says "failed".
+                tracing::error!(error = %format!("{e:#}"), "mediad cannot start");
+                return ExitCode::FAILURE;
+            }
+        };
+
+        // A recorder or perception process asks the local Unix socket for one raw frame. It is
+        // deliberately not the datachannel: a snapshot is camera-sized, and control has to stay
+        // prompt even while a slow local reader is being served. `npu-bringup.md` names this.
+        let (frame_lock, frame_listener) = match mediad::frame::bind(&args.frame_socket).await {
+            Ok(bound) => bound,
+            Err(error) => {
+                tracing::error!(error = %error, "cannot bind media.frame; refusing a partial start");
+                return ExitCode::FAILURE;
+            }
+        };
+        let frame_source = frames.clone();
+        // The mount angle every frame header carries — and zero when the pipeline was asked to
+        // flip, for the detector's sampler and the JPEG streamer's reason: those pixels arrive
+        // upright already, and turning them twice is a picture on its side with nothing to say why.
+        let frame_rotate = if args.flip_in_pipeline { 0 } else { rotate };
+        tokio::spawn(async move {
+            let _lock = frame_lock;
+            if let Err(error) = mediad::frame::serve(frame_listener, frame_source, frame_rotate).await
+            {
+                tracing::error!(error = %format!("{error:#}"), "media.frame endpoint stopped");
+            }
+        });
 
         // After the pipeline, because it meters the pipeline's own frames — and only with a real
         // camera, since a test pattern has no sensor to write and the loop would spend the daemon's
@@ -275,9 +477,11 @@ fn main() -> ExitCode {
                 None
             }
             (mediad::pipeline::Source::Test, _) => None,
+            // A simulated camera has no sensor to write, and its brightness is the renderer's.
+            (mediad::pipeline::Source::Sim(_), _) => None,
         };
 
-        // **The duck detector, from the same config file as everything else.** `[detect]` lives in
+        // **The duck detector, from the same config file as everything else.** `[duck_detector]` lives in
         // robotd.toml because that is the file `robotctl configure` edits and a robot has one place
         // for its switches — even though it is this daemon that reads that section.
         //
@@ -286,7 +490,7 @@ fn main() -> ExitCode {
         // boot because a model file moved" is a bad trade.
         let models = detect.models();
         let detector = if models.is_empty() {
-            tracing::info!("duck detector off ([detect] enabled = false, or no model)");
+            tracing::info!("duck detector off ([duck_detector] enabled = false, or no model)");
             None
         } else {
             // The frames on the tee are as the camera took them — unless the pipeline was asked
@@ -317,18 +521,96 @@ fn main() -> ExitCode {
 
         // What every peer is told about the picture. The geometry is the *encoded* frame — the
         // pipeline does not rotate, so it is the capture geometry — and the rotation is the mount.
+        // The camera's geometry, for a consumer that has to turn pixels into directions. Read
+        // *after* the pipeline is up, because which sensor mode is in force is only known once
+        // something tried to set it — and a mode nobody knows the field of view of publishes
+        // nothing rather than a plausible wrong number. `mediad::camera` has the arithmetic.
+        let intrinsics = if args.sim_camera.is_some() {
+            // The MuJoCo twin renders a known field of view, so publish its exact geometry — twin
+            // recordings then self-describe (no `--calib` needed on the duckslam side).
+            mediad::camera::Intrinsics::sim(width, height)
+        } else {
+            mediad::camera::Intrinsics::published(
+                media.intrinsics.as_ref(),
+                mediad::pipeline::sensor_mode(),
+                width,
+                height,
+            )
+        };
+        match &intrinsics {
+            Some(geometry) => tracing::info!(
+                fx = geometry.fx,
+                fy = geometry.fy,
+                cx = geometry.cx,
+                cy = geometry.cy,
+                calibrated = geometry.calibrated,
+                "camera geometry"
+            ),
+            None => tracing::info!(
+                "no camera geometry to publish: the sensor is not in a mode whose field of view \
+                 is known, so a consumer is told nothing rather than something wrong"
+            ),
+        }
+
         let video = mediad::session::Video {
-            width: media.quality.width(),
-            height: media.quality.height(),
-            rotate: args.rotate,
+            width,
+            height,
+            rotate,
+            intrinsics,
         };
 
+        // Frames out to a WebSocket this robot dials, when something asks for them. Built here
+        // because it needs the tee — and given the same `turn` the detector's sampler gets, for
+        // the same reason: a pipeline that was asked to flip has already turned the frames, and
+        // turning them twice is a picture on its side with nothing to say why.
+        let streamer = std::sync::Arc::new(mediad::stream::Streamer::new(
+            mediad::stream::Encoders {
+                // The same `turn` the detector's sampler gets, and for the same reason: a pipeline
+                // asked to flip has already turned the frames, and turning them twice is a
+                // picture on its side with nothing to say why.
+                jpeg: mediad::stream::jpeg_encoder(
+                    frames.clone(),
+                    if args.flip_in_pipeline {
+                        duck_detect::Turn::None
+                    } else {
+                        turn
+                    },
+                ),
+                // The H.264 branch turns nothing: it is downstream of the same tee, so the flip —
+                // or its absence — is already in the pixels it encodes.
+                h264: stream_branch.clone().map(mediad::stream::h264_encoder),
+                gate: stream_branch.clone().map(|branch| {
+                    std::sync::Arc::new(move |open: bool| {
+                        if open {
+                            branch.open();
+                        } else {
+                            branch.close();
+                        }
+                    }) as std::sync::Arc<dyn Fn(bool) + Send + Sync>
+                }),
+            },
+            producer.clone(),
+            // The resolved mount angle, not the flag: `--rotate` is an `Option` now and the
+            // default lives in one place at the top of `main`.
+            rotate,
+            &args.token,
+        ));
+
+        let media = mediad::session::Media {
+            video: video.clone(),
+            streamer: std::sync::Arc::clone(&streamer),
+        };
+
+        // The relay has been up since before the pipeline; this is the point its control lanes can
+        // start answering for the robot's own media.
+        let _ = video_tx.send(Some(media.clone()));
+
         // One session per peer, each with its own connections to the services it talks to. Per
         // peer rather than shared, so one peer's minutes-long update cannot silence another's
         // telemetry — which is the same reason a session keeps one connection per lane.
         while let Some(channel) = channels.recv().await {
             let (replies_tx, mut replies_rx) = tokio::sync::mpsc::channel::<String>(256);
-            let pool = mediad::upstream::Pool::new(Default::default(), replies_tx);
+            let pool = mediad::upstream::Pool::new(sockets.clone(), replies_tx);
 
             let to_peer = channel.outbound.clone();
             tokio::spawn(async move {
@@ -343,7 +625,7 @@ fn main() -> ExitCode {
             // (`media.video`), which is why that path exists and this one is best-effort.
             {
                 let to_peer = channel.outbound.clone();
-                let line = mediad::session::video_notification(video);
+                let line = mediad::session::video_notification(&video);
                 tokio::spawn(async move {
                     let _ = to_peer.send(line).await;
                 });
@@ -380,7 +662,10 @@ fn main() -> ExitCode {
                 channel.inbound,
                 channel.outbound,
                 pool,
-                video,
+                // Cloned per session: it carries the camera's intrinsics and a handle to the
+                // frame streamer. Always `Some` here — a datachannel exists because the pipeline
+                // handed over a consumer, so by definition there is media behind it.
+                Some(media.clone()),
             ));
         }
 
diff --git a/mediad/src/pipeline.rs b/mediad/src/pipeline.rs
index ac96d756..600b8eee 100644
--- a/mediad/src/pipeline.rs
+++ b/mediad/src/pipeline.rs
@@ -69,6 +69,12 @@
 //! without the capture path existing. The camera arrives as a different source element behind the
 //! same encoder, and `media-bringup.md` records why capture cannot simply be `v4l2src`.
 //!
+//! **It runs at `robotd_params::TEST_PATTERN_GEOMETRY` rather than `[media] quality`**, and that is
+//! a CPU decision. A camera's frames come off the ISP in hardware; a test pattern's are drawn by
+//! this process, so at the configured rung an idle board with no camera burned 29.4% of a core
+//! against a real camera's 6.1% — synthesising 1.84 MB of UYVY thirty times a second for a tee
+//! whose readers had all said no. The session it exists to provide needs none of those pixels.
+//!
 //! ## What is not verified
 //!
 //! **Nothing in a signal handler here may panic.** These closures are invoked from C, so a panic
@@ -83,6 +89,7 @@
 //! naming the arity rather than as an abort.
 
 use std::sync::{Arc, Mutex};
+use std::time::SystemTime;
 
 use anyhow::{Context, Result, anyhow, bail};
 use duck_ipc_proto as proto;
@@ -193,6 +200,14 @@ pub enum Source {
     Test,
     /// The head camera, through the rkisp capture path.
     Camera(Camera),
+    /// A simulated head camera, at `host:port`: what a duck in MuJoCo sees.
+    ///
+    /// Frames arrive length-prefixed and raw rather than as JSON, unlike the rest of the simulator
+    /// links — 640x360 UYVY is 460,800 bytes, and at 15 fps that is 6.9 MB/s. There is no handshake,
+    /// because there is nothing to negotiate that both ends do not already have to agree on to be
+    /// useful: the geometry is fixed on both sides — `[media] quality` here, the body's camera
+    /// there — or nothing works.
+    Sim(String),
 }
 
 /// The head camera, and the two things it will not work without.
@@ -219,6 +234,10 @@ pub struct Frame {
     /// The GStreamer format name — [`CAPTURE_FORMAT`], carried rather than assumed so a consumer
     /// reading this cannot silently misinterpret the bytes if the capture format changes again.
     pub format: &'static str,
+    /// When this buffer was taken, for a consumer joining a frame to a separately sampled
+    /// robot state. Observation time, not a scheduling clock: it is never used to pace capture,
+    /// so an NTP step cannot reach the pipeline through it.
+    pub captured_at: SystemTime,
     /// Tightly packed as the caps describe it, in `format`.
     pub data: Vec<u8>,
 }
@@ -323,14 +342,19 @@ impl Frames {
 
     /// Whether a reader is waiting, taking the request if one is. The callback's whole cost on a
     /// frame nobody asked for.
-    fn take_request(&self) -> bool {
+    ///
+    /// `pub(crate)` so that [`crate::frame`]'s tests can stand in for the capture branch: the
+    /// endpoint's behaviour on a real delivery is only testable by driving this rendezvous.
+    pub(crate) fn take_request(&self) -> bool {
         self.0
             .wanted
             .swap(false, std::sync::atomic::Ordering::Relaxed)
     }
 
     /// Hand the captured frame to whoever is waiting for it.
-    fn deliver(&self, frame: Frame) {
+    ///
+    /// `pub(crate)` for the same reason as [`Frames::take_request`].
+    pub(crate) fn deliver(&self, frame: Frame) {
         let mut latest = self.0.latest.lock().expect("frame lock");
         latest.frame = Some(frame);
         latest.generation = latest.generation.wrapping_add(1);
@@ -357,7 +381,13 @@ pub fn start(
     source: Source,
     producer: &crate::producer::Producer,
     settings: &Settings,
-) -> Result<(gst::Pipeline, mpsc::Receiver<Channel>, Frames)> {
+    relays: Arc<crate::turn::Relays>,
+) -> Result<(
+    gst::Pipeline,
+    mpsc::Receiver<Channel>,
+    Frames,
+    Option<StreamBranch>,
+)> {
     let &Settings {
         port,
         bitrate,
@@ -404,6 +434,7 @@ pub fn start(
             src
         }
         Source::Camera(camera) => camera_source(camera, fps)?,
+        Source::Sim(addr) => sim_source(addr, width, height, fps)?,
     };
 
     // Pinned rather than negotiated, because both branches of the tee depend on the answer, and a
@@ -557,7 +588,7 @@ pub fn start(
 
     let consumers: Consumers = Arc::new(std::sync::atomic::AtomicU32::new(0));
     let (channels_tx, channels_rx) = mpsc::channel::<Channel>(4);
-    wire_consumers(&sink, channels_tx, runtime, consumers.clone())?;
+    wire_consumers(&sink, channels_tx, runtime, consumers.clone(), relays)?;
 
     // ── the raw branch ──────────────────────────────────────────────────────
     //
@@ -595,6 +626,27 @@ pub fn start(
         .build();
     wire_frames(&appsink, frames.clone(), out_width, out_height);
 
+    // ── the H.264 branch, for a Space this robot streams to ─────────────────
+    //
+    // A third branch off the same raw tee, and **valved shut**: with `drop=true` nothing reaches
+    // the encoder, so a second encode costs nothing until `media.stream` asks for it. Built once
+    // rather than added on demand, because adding elements to a live pipeline means pad-blocking
+    // surgery and this file's history with a `videoflip` is a warning about touching this path.
+    //
+    // `webrtcsink` owns the encoder on the other branch and is handed raw video on purpose (see
+    // the header): with pre-encoded input its congestion control cannot reach the encoder. So
+    // there is nothing to tap and this is a second encoder — cheap on a VPU at a few frames a
+    // second, and the reason the rate and the size are pinned here rather than left to the caller.
+    let stream_branch = build_stream_branch(&pipeline, out_width, out_height, fps)
+        .inspect_err(|error| {
+            tracing::warn!(
+                error = %format!("{error:#}"),
+                "no H.264 branch, so this robot cannot stream frames to a Space; the rest of the \
+                 pipeline is unaffected"
+            );
+        })
+        .ok();
+
     if let Some(flip) = flip.as_ref() {
         pipeline
             .add(flip)
@@ -642,6 +694,10 @@ pub fn start(
     // two links are separate from the `link_many` chains above.
     link_tee_branch(&tee, &video_queue).context("could not attach the video branch to the tee")?;
     link_tee_branch(&tee, &raw_queue).context("could not attach the raw branch to the tee")?;
+    if let Some(branch) = stream_branch.as_ref() {
+        link_tee_branch(&tee, branch.head())
+            .context("could not attach the H.264 branch to the tee")?;
+    }
 
     // **Watch the bus, or every media failure is silent.**
     //
@@ -669,7 +725,341 @@ pub fn start(
         fps,
         "signalling server listening"
     );
-    Ok((pipeline, channels_rx, frames))
+    Ok((pipeline, channels_rx, frames, stream_branch))
+}
+
+/// Build the valved H.264 branch: `queue ! valve ! videorate ! videoscale ! videoconvert ! enc !
+/// parse ! appsink`.
+///
+/// Fails rather than degrades when there is no encoder to use, and the caller carries on without a
+/// branch: a robot that cannot stream to a Space is still a robot that walks, and `media.stream`
+/// then refuses with a reason instead of accepting and sending nothing.
+fn build_stream_branch(
+    pipeline: &gst::Pipeline,
+    width: u32,
+    height: u32,
+    fps: u32,
+) -> Result<StreamBranch> {
+    // Rate and size for the streamed copy, independent of what the video track carries. Five a
+    // second at 640 is what a model wants and a fraction of the encode the WebRTC branch does.
+    const STREAM_FPS: u32 = 5;
+    const STREAM_LONGEST: u32 = 640;
+
+    let make = |name: &str| -> Result<gst::Element> {
+        gst::ElementFactory::make(name)
+            .build()
+            .map_err(|_| anyhow!("no {name} element"))
+    };
+
+    // Leaky like the raw branch: a stalled encoder must never become the video track's problem.
+    let queue = gst::ElementFactory::make("queue")
+        .property("max-size-buffers", 2u32)
+        .property("max-size-bytes", 0u32)
+        .property("max-size-time", 0u64)
+        .property_from_str("leaky", "downstream")
+        .build()
+        .map_err(|_| anyhow!("no queue element"))?;
+
+    let valve = gst::ElementFactory::make("valve")
+        // **Shut until asked.** This is what makes a second encoder free while nobody streams.
+        .property("drop", true)
+        .build()
+        .map_err(|_| anyhow!("no valve element"))?;
+
+    // `drop-only` so it never duplicates a frame to hit a rate — a repeated frame costs the
+    // encoder a whole access unit to say nothing happened.
+    let rate = gst::ElementFactory::make("videorate")
+        .property("drop-only", true)
+        .property("max-rate", STREAM_FPS as i32)
+        .build()
+        .map_err(|_| anyhow!("no videorate element"))?;
+
+    let scale = make("videoscale")?;
+
+    // The turn already happened before the tee, so this branch's input is upright and the aspect
+    // ratio here is the upright one.
+    let scale = (scale, {
+        let longest = width.max(height) as f32;
+        let factor = (STREAM_LONGEST as f32 / longest).min(1.0);
+        // Even dimensions: H.264 chroma is subsampled, and an odd width is a negotiation failure
+        // on some encoders and a green column on others.
+        let even = |value: f32| ((value.round() as u32).max(2) / 2) * 2;
+        gst::Caps::builder("video/x-raw")
+            .field("width", even(width as f32 * factor) as i32)
+            .field("height", even(height as f32 * factor) as i32)
+            .build()
+    });
+    let caps = gst::ElementFactory::make("capsfilter")
+        .property("caps", &scale.1)
+        .build()
+        .map_err(|_| anyhow!("no capsfilter element"))?;
+    let scale = scale.0;
+
+    // The tee carries `UYVY` (see the capture caps above) and neither encoder takes it: `x264enc`
+    // wants planar YUV, `mpph264enc` NV12. Without this the branch **fails to link at build time**,
+    // `start` returns the error, and mediad does not start at all on a machine without `mpph264enc`
+    // — which is every laptop, and the sim twin with it. A passthrough when formats already agree,
+    // so it costs the board nothing.
+    let convert = make("videoconvert")?;
+
+    // `mpph264enc` is the board's hardware encoder — the same one `webrtcsink` uses through the
+    // patched plugin the header describes. `x264enc` is the fallback for a laptop and for a board
+    // whose MPP is missing, which is a slow encode rather than a broken one.
+    let encoder = make("mpph264enc")
+        .or_else(|_| {
+            tracing::info!("no mpph264enc; falling back to x264enc for the frame stream");
+            make("x264enc")
+        })
+        .context("neither mpph264enc nor x264enc is available")?;
+
+    // `config-interval=-1` repeats SPS and PPS in front of every keyframe, which is what lets a
+    // receiver that connects mid-stream decode from the next one without having been sent
+    // anything it missed. Without it a reconnecting Space needs the parameter sets it never saw.
+    let parse = gst::ElementFactory::make("h264parse")
+        .property("config-interval", -1i32)
+        .build()
+        .map_err(|_| anyhow!("no h264parse element"))?;
+
+    let encoded = Encoded::default();
+    let appsink = gst_app::AppSink::builder()
+        .caps(
+            &gst::Caps::builder("video/x-h264")
+                .field("stream-format", "byte-stream")
+                .field("alignment", "au")
+                .build(),
+        )
+        // One WebSocket message is one access unit, which is what `alignment=au` above buys.
+        .sync(false)
+        // **`async=false`, or this sink holds the whole pipeline in PAUSED.** A sink prerolls on
+        // its first buffer, and the bin does not finish going to PLAYING until every async sink
+        // has. This branch's first buffer only arrives once somebody opens the valve — so with the
+        // default the pipeline never completed its state change, and the *raw* appsink one branch
+        // over, which had prerolled, waited for PLAYING for ever: no callbacks, no frames, and the
+        // duck detector and the auto-exposure loop starved on a camera that was capturing at 30
+        // fps. The video track kept working because `webrtcsink` is live and does not preroll,
+        // which is what made this invisible from the console.
+        .async_(false)
+        .max_buffers(ENCODED_DEPTH as u32)
+        .drop(false)
+        .build();
+
+    {
+        let encoded = encoded.clone();
+        appsink.set_callbacks(
+            gst_app::AppSinkCallbacks::builder()
+                .new_sample(move |sink| {
+                    let sample = sink.pull_sample().map_err(|_| gst::FlowError::Eos)?;
+                    let buffer = sample.buffer().ok_or(gst::FlowError::Error)?;
+                    let map = buffer.map_readable().map_err(|_| gst::FlowError::Error)?;
+                    // A keyframe is a buffer *without* the delta-unit flag. Reading it the other
+                    // way round would mark every P-frame a keyframe and defeat the whole queue.
+                    let keyframe = !buffer.flags().contains(gst::BufferFlags::DELTA_UNIT);
+                    encoded.push(map.as_slice().to_vec(), keyframe);
+                    Ok(gst::FlowSuccess::Ok)
+                })
+                .build(),
+        );
+    }
+
+    pipeline
+        .add_many([
+            &queue,
+            &valve,
+            &rate,
+            &scale,
+            &caps,
+            &convert,
+            &encoder,
+            &parse,
+            appsink.upcast_ref(),
+        ])
+        .context("could not add the H.264 branch to the pipeline")?;
+    gst::Element::link_many([
+        &queue,
+        &valve,
+        &rate,
+        &scale,
+        &caps,
+        &convert,
+        &encoder,
+        &parse,
+        appsink.upcast_ref(),
+    ])
+    .context("could not link the H.264 branch")?;
+
+    tracing::info!(
+        encoder = %encoder.factory().map(|f| f.name().to_string()).unwrap_or_default(),
+        fps = STREAM_FPS,
+        "an H.264 branch is available for streaming, shut until something asks"
+    );
+    let _ = fps;
+    Ok(StreamBranch {
+        head: queue,
+        valve,
+        encoder,
+        encoded,
+    })
+}
+
+/// The H.264 branch's output: access units in order, with gaps closed to the next keyframe.
+///
+/// **Not [`Frames`], and the difference is the whole point.** `Frames` is last-value-wins: a slow
+/// reader gets the newest picture and the older ones are discarded, which is exactly right for an
+/// independent frame and exactly wrong for a predicted one. A P-frame whose reference was dropped
+/// decodes to garbage that looks like a broken camera rather than a broken transport, so a reader
+/// that falls behind here is given the next *keyframe* and nothing between.
+///
+/// A short queue rather than one slot for the same reason: a group of pictures has to arrive whole.
+#[derive(Clone, Default)]
+pub struct Encoded(Arc<EncodedShared>);
+
+#[derive(Default)]
+struct EncodedShared {
+    units: Mutex<EncodedQueue>,
+    arrived: std::sync::Condvar,
+}
+
+#[derive(Default)]
+struct EncodedQueue {
+    /// `(bytes, keyframe)`, oldest first.
+    ready: std::collections::VecDeque<(Vec<u8>, bool)>,
+    /// Set when the queue overflowed: everything until the next keyframe is unusable to a reader
+    /// that missed what came before it.
+    awaiting_key: bool,
+    /// How many units were discarded, for the stream's own counters.
+    dropped: u64,
+}
+
+/// How many access units to hold. Two seconds at 15 fps, which is longer than any keyframe
+/// interval worth setting — so a reader that stalls briefly recovers without waiting for one.
+const ENCODED_DEPTH: usize = 32;
+
+impl Encoded {
+    /// Take the next unit, waiting up to `FRAME_TIMEOUT` for one.
+    ///
+    /// `None` means the encoder produced nothing in that time, which on a valved branch is the
+    /// ordinary state: nobody is streaming, so nothing is being encoded.
+    pub fn next_unit(&self) -> Option<(Vec<u8>, bool)> {
+        let mut units = self.0.units.lock().expect("not poisoned");
+        loop {
+            while let Some((bytes, keyframe)) = units.ready.pop_front() {
+                if units.awaiting_key && !keyframe {
+                    units.dropped += 1;
+                    continue;
+                }
+                units.awaiting_key = false;
+                return Some((bytes, keyframe));
+            }
+            let (again, timed_out) = self
+                .0
+                .arrived
+                .wait_timeout(units, FRAME_TIMEOUT)
+                .expect("not poisoned");
+            units = again;
+            if timed_out.timed_out() && units.ready.is_empty() {
+                return None;
+            }
+        }
+    }
+
+    /// Units discarded because a reader was behind. Cumulative.
+    pub fn dropped(&self) -> u64 {
+        self.0.units.lock().expect("not poisoned").dropped
+    }
+
+    fn push(&self, bytes: Vec<u8>, keyframe: bool) {
+        let mut units = self.0.units.lock().expect("not poisoned");
+        if units.ready.len() >= ENCODED_DEPTH {
+            // Behind by two seconds of video. Throwing away one unit would leave a hole that
+            // corrupts everything referring across it, so the queue is emptied and the stream
+            // resumes at the next keyframe.
+            units.dropped += units.ready.len() as u64;
+            units.ready.clear();
+            units.awaiting_key = true;
+        }
+        units.ready.push_back((bytes, keyframe));
+        drop(units);
+        self.0.arrived.notify_one();
+    }
+}
+
+/// Turn the H.264 branch on or off, and ask its encoder for a keyframe.
+///
+/// **A valve rather than adding and removing elements.** The branch is built once and gated: with
+/// `drop=true` no buffer reaches the encoder, so the second encode costs nothing while nobody is
+/// streaming — and turning it on is a property write rather than pad-blocking surgery on a live
+/// pipeline. `remote-webrtc.md`'s note that the encoder is this board's budget is why it is gated
+/// at all, and `pipeline.rs`'s own history with a `videoflip` is why it is not rebuilt.
+#[derive(Clone)]
+pub struct StreamBranch {
+    /// The branch's first element — its `queue`, which is what the tee's request pad links to.
+    ///
+    /// **Separate from the valve, and it cost a panic on the board to learn why.** Both were one
+    /// field called `valve`, holding the queue because that is what has to be linked; `open()`
+    /// then set `drop` on it and glib panicked with `property 'drop' of type 'GstQueue' not
+    /// found`. It killed the task handling the call rather than the daemon, so the symptom was a
+    /// `media.stream` that never answered — silence, from a robot that was otherwise fine.
+    head: gst::Element,
+    valve: gst::Element,
+    encoder: gst::Element,
+    pub encoded: Encoded,
+}
+
+impl StreamBranch {
+    /// What the tee links to: the head of the branch, not the valve behind it.
+    pub fn head(&self) -> &gst::Element {
+        &self.head
+    }
+
+    /// Open the valve, and ask for a keyframe so a receiver has something to start on.
+    ///
+    /// Without the request a receiver waits for the encoder's own keyframe interval before its
+    /// first decodable picture — seconds of nothing, indistinguishable from a stream that is not
+    /// working. `h264parse config-interval=-1` puts SPS and PPS in front of it, so that keyframe
+    /// is enough on its own.
+    pub fn open(&self) {
+        self.gate(false);
+        self.request_keyframe();
+    }
+
+    pub fn close(&self) {
+        self.gate(true);
+    }
+
+    /// Set the valve's `drop`, and **do not panic if it is the wrong element**.
+    ///
+    /// `set_property` panics on a name the element does not have, and this one ran on a tokio
+    /// worker inside the task answering `media.stream` — so the first version of this file killed
+    /// that task and the call simply never came back. A robot that is otherwise healthy, silent
+    /// on one method, is a much worse failure than a refusal. The element is right now; the guard
+    /// is for the next time somebody moves a field.
+    fn gate(&self, drop: bool) {
+        if self
+            .valve
+            .has_property_with_type("drop", bool::static_type())
+        {
+            self.valve.set_property("drop", drop);
+        } else {
+            tracing::error!(
+                element = %self.valve.factory().map(|f| f.name().to_string()).unwrap_or_default(),
+                "the frame stream's valve has no `drop` property, so it cannot be gated"
+            );
+        }
+    }
+
+    /// Ask the encoder for a keyframe now.
+    pub fn request_keyframe(&self) {
+        if let Some(pad) = self.encoder.static_pad("sink") {
+            // Upstream, on the encoder's sink pad: the event travels to the encoder, which is the
+            // element that can honour it. `all_headers` is what repeats SPS/PPS with it.
+            let event = gst_video::UpstreamForceKeyUnitEvent::builder()
+                .all_headers(true)
+                .build();
+            if !pad.send_event(event) {
+                tracing::debug!("the encoder would not take a keyframe request");
+            }
+        }
+    }
 }
 
 /// Request a source pad from the tee and link it to a branch's sink pad.
@@ -720,6 +1110,9 @@ fn wire_frames(appsink: &gst_app::AppSink, frames: Frames, width: u32, height: u
                     width,
                     height,
                     format: CAPTURE_FORMAT,
+                    // Taken here rather than at delivery: this is the moment the buffer existed,
+                    // and it costs one clock read on a frame someone already asked for.
+                    captured_at: SystemTime::now(),
                     data: map.as_slice().to_vec(),
                 });
 
@@ -894,6 +1287,102 @@ fn camera_source(camera: &Camera, fps: u32) -> Result<gst::Element> {
     Ok(src)
 }
 
+/// A simulated camera as an `appsrc`, fed by a thread reading frames off a socket.
+///
+/// **`is-live` and `do-timestamp`, both of them.** A camera is live by construction; an `appsrc` is
+/// not, and without saying so the pipeline races ahead of the clock and `webrtcsink` sees a source
+/// that can be pulled faster than real time. And without timestamps every downstream element has to
+/// invent them, which shows up as a stream that plays at the wrong speed rather than as an error.
+///
+/// The reader owns the reconnect: MuJoCo restarts whenever the number of ducks changes, and a
+/// camera that goes away must not take the pipeline with it — the encoder simply has no new frames
+/// until it comes back, which is what a real camera being unplugged looks like too.
+fn sim_source(addr: &str, width: u32, height: u32, fps: u32) -> Result<gst::Element> {
+    use gst_app::prelude::*;
+
+    let caps = gst::Caps::builder("video/x-raw")
+        .field("format", CAPTURE_FORMAT)
+        .field("width", width as i32)
+        .field("height", height as i32)
+        .field("framerate", gst::Fraction::new(fps as i32, 1))
+        .build();
+
+    let src = gst_app::AppSrc::builder()
+        .caps(&caps)
+        .is_live(true)
+        .do_timestamp(true)
+        .format(gst::Format::Time)
+        .build();
+
+    let expected = (width as usize) * (height as usize) * 2;
+    let announce = addr.to_owned();
+    let addr = addr.to_owned();
+    let pushable = src.clone();
+    std::thread::Builder::new()
+        .name("sim-camera".into())
+        .spawn(move || {
+            let mut complained = false;
+            loop {
+                match read_frames(&addr, expected, &pushable) {
+                    // A clean close means it had connected and streamed; clear the flag so the
+                    // *next* failure is logged, as `tofd`'s `sim_loop` and `RemoteIo` both do.
+                    Ok(()) => {
+                        complained = false;
+                        tracing::warn!(%addr, "the simulated camera closed");
+                    }
+                    Err(e) if !complained => {
+                        complained = true;
+                        tracing::warn!(%addr, error = %e, "no simulated camera; retrying");
+                    }
+                    Err(_) => {}
+                }
+                std::thread::sleep(std::time::Duration::from_secs(1));
+            }
+        })
+        .map(|_| ())
+        .unwrap_or_else(
+            |e| tracing::error!(error = %e, "no reader thread for the simulated camera"),
+        );
+
+    tracing::info!(addr = %announce, width, height, fps, "simulated head camera");
+    Ok(src.upcast())
+}
+
+/// Length-prefixed frames from the simulator into an `appsrc`, until it stops or the frames stop.
+fn read_frames(addr: &str, expected: usize, src: &gst_app::AppSrc) -> std::io::Result<()> {
+    use std::io::Read;
+
+    let stream = std::net::TcpStream::connect(addr)?;
+    stream.set_nodelay(true)?;
+    let mut reader = std::io::BufReader::new(stream);
+    let mut header = [0u8; 4];
+    let mut frame = vec![0u8; expected];
+    tracing::info!(%addr, "the simulated camera is feeding the pipeline");
+
+    loop {
+        reader.read_exact(&mut header)?;
+        let len = u32::from_le_bytes(header) as usize;
+        // A frame of the wrong size means the two ends disagree about the geometry, and pushing it
+        // would be a picture nobody can read. Said once, loudly, rather than a stream of noise.
+        if len != expected {
+            return Err(std::io::Error::other(format!(
+                "the simulator sent a {len}-byte frame and this pipeline expects {expected} — the simulator's camera must match `[media] quality`"
+            )));
+        }
+        reader.read_exact(&mut frame)?;
+        let mut buffer = gst::Buffer::with_size(len).map_err(std::io::Error::other)?;
+        buffer
+            .get_mut()
+            .expect("a fresh buffer is writable")
+            .map_writable()
+            .map_err(std::io::Error::other)?
+            .copy_from_slice(&frame);
+        if src.push_buffer(buffer).is_err() {
+            return Ok(()); // the pipeline is gone
+        }
+    }
+}
+
 /// What the tee carries, and what both branches therefore see.
 ///
 /// Single-plane on purpose: `v4l2src` cannot drive rkisp's two-plane `NM12` at full rate, and
@@ -1020,6 +1509,20 @@ fn raise_capture_buffers(src: &gst::Element) -> Result<()> {
     Ok(())
 }
 
+/// Which sensor mode this process managed to put the camera in, once it has tried.
+///
+/// A `OnceLock` rather than a value threaded up through the pipeline builder, because that is what
+/// it is: one fact about this process's camera, established while the pipeline is built and read
+/// afterwards by whatever answers `media.video`. `None` — never set, or set after a failed switch
+/// — means the geometry is unknown, and `crate::camera` publishes no intrinsics for it.
+static SENSOR_MODE: std::sync::OnceLock<Option<crate::camera::SensorMode>> =
+    std::sync::OnceLock::new();
+
+/// The sensor mode in force, or `None` when there is no camera or the switch did not take.
+pub fn sensor_mode() -> Option<crate::camera::SensorMode> {
+    *SENSOR_MODE.get().unwrap_or(&None)
+}
+
 /// Switch the IMX219 out of its boot mode, which caps capture at 21 fps.
 ///
 /// The sensor boots in 3280x2464 and the rkisp scaler will happily give us 1280x720 from it — at
@@ -1046,9 +1549,13 @@ fn pin_sensor_mode(fps: u32) -> Result<()> {
             %media, %entity,
             why = %String::from_utf8_lossy(&output.stderr).trim(),
             "media-ctl would not set the 1920x1080 sensor mode — capture stays in the boot \
-             mode, which caps it at 21 fps"
+             mode, which caps it at 21 fps, and `media.video` publishes no camera intrinsics \
+             because the exact framing is then the boot mode's (same ~62 deg field, different \
+             4:3->16:9 crop) rather than the pinned mode the calibration is for"
         );
+        let _ = SENSOR_MODE.set(None);
     } else {
+        let _ = SENSOR_MODE.set(Some(crate::camera::SensorMode::PINNED));
         tracing::info!(%media, %entity, target_fps = fps, "sensor mode 1920x1080");
     }
     Ok(())
@@ -1360,6 +1867,7 @@ fn wire_consumers(
     channels: mpsc::Sender<Channel>,
     runtime: tokio::runtime::Handle,
     consumers: Consumers,
+    relays: Arc<crate::turn::Relays>,
 ) -> Result<()> {
     // Counted here rather than inferred from the log, so `robotctl health` can say whether anyone
     // is actually watching. `consumer-removed` is guarded the same way `consumer-added` is: a
@@ -1400,6 +1908,10 @@ fn wire_consumers(
             .and_then(|v| v.get::<String>().ok())
             .unwrap_or_else(|| "?".into());
 
+        // Before the datachannel, because this is what the *offer* needs and the offer is
+        // generated as soon as this handler returns. §6 of `remote-access-design.md`.
+        offer_relay_candidates(&webrtcbin, &peer, &relays);
+
         match open_control_channel(&webrtcbin, &peer, &runtime) {
             Ok(channel) => {
                 // A full queue means nobody is accepting sessions, which is a bug rather than
@@ -1415,6 +1927,47 @@ fn wire_consumers(
     Ok(())
 }
 
+/// Add this robot's TURN servers to one consumer's `webrtcbin`, so its offer carries a `relay`.
+///
+/// **Runs on the thread that builds the offer, and must not block it.** `Relays::uris` reads a
+/// cache and never does I/O for exactly this reason: a fetch here would delay every consumer's
+/// connection, including the LAN ones that will never use a relay. An empty list is the ordinary
+/// state right after boot and on a robot nobody has signed in — host and srflx candidates are
+/// enough for anything on the same network.
+///
+/// Nothing here is fatal. A robot that cannot offer a relay is reachable from most places; one
+/// whose negotiation broke because a credential was malformed is reachable from none.
+fn offer_relay_candidates(webrtcbin: &gst::Element, peer: &str, relays: &Arc<crate::turn::Relays>) {
+    let uris = relays.uris();
+    if uris.is_empty() {
+        tracing::debug!(peer, "no relay servers held; offering host and srflx only");
+        return;
+    }
+    // Checked before it is emitted, for the reason `open_control_channel` checks its own signal:
+    // `emit_by_name` panics when a signal is absent or its signature has changed, and a panic in
+    // a C closure aborts the process instead of unwinding.
+    if glib::subclass::signal::SignalId::lookup("add-turn-server", webrtcbin.type_()).is_none() {
+        tracing::warn!(
+            peer,
+            "webrtcbin has no add-turn-server signal; this consumer gets no relay candidate"
+        );
+        return;
+    }
+    let mut added = 0;
+    for uri in uris.iter() {
+        // The return is whether the server was accepted; a rejected URI is worth a line and not
+        // an abandoned session.
+        if webrtcbin.emit_by_name::<bool>("add-turn-server", &[&uri.as_str()]) {
+            added += 1;
+        } else {
+            // The host only. **A TURN URI carries a password**, and a log line is the one place
+            // it must never appear.
+            tracing::warn!(peer, "a relay server was refused by webrtcbin");
+        }
+    }
+    tracing::info!(peer, relays = added, "offering relay candidates");
+}
+
 /// Create the `control` datachannel on one peer's `webrtcbin` and bridge it to channels.
 fn open_control_channel(
     webrtcbin: &gst::Element,
@@ -1489,12 +2042,71 @@ fn open_control_channel(
 mod tests {
     use super::*;
 
+    /// **A reader gets a frame out of the real pipeline.** The rendezvous tests below stand in
+    /// for the appsink; this one runs the appsink, on the test pattern, with every branch the
+    /// robot has — because the bug this guards was between branches. The valved H.264 sink
+    /// prerolled nothing, so the bin never finished going to PLAYING, and the raw appsink sat in
+    /// preroll holding its first buffer for ever: `starved=20` on every detector report and no
+    /// `metering` line from auto-exposure, on a robot whose console video was fine.
+    ///
+    /// Skipped, and loudly, where the plugins are not installed: CI has GStreamer's base and bad
+    /// sets but neither `webrtcsink` nor an H.264 encoder, and a test that fails for want of a
+    /// plugin says nothing about the pipeline. A machine set up to run `mediad` has them.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn a_reader_gets_a_frame_from_the_running_pipeline() {
+        gst::init().expect("gstreamer");
+        let missing: Vec<&str> = ["videotestsrc", "webrtcsink", "valve", "h264parse"]
+            .into_iter()
+            .filter(|name| gst::ElementFactory::find(name).is_none())
+            .collect();
+        let no_encoder = ["mpph264enc", "x264enc"]
+            .iter()
+            .all(|name| gst::ElementFactory::find(name).is_none());
+        if !missing.is_empty() || no_encoder {
+            eprintln!("skipping: no {missing:?} / no H.264 encoder on this machine");
+            return;
+        }
+
+        let producer = crate::producer::Producer::local(duck_ipc_proto::build_info!());
+        let settings = Settings {
+            host: "127.0.0.1".into(),
+            // Not 8443, so a `mediad` already running on this machine is left alone.
+            port: 18_443,
+            bitrate: 500_000,
+            congestion_control: robotd_params::CongestionControl::default(),
+            width: 320,
+            height: 240,
+            fps: 15,
+            rotation: Rotation::None,
+        };
+        let (pipeline, _channels, frames, _stream) = start(
+            Source::Test,
+            &producer,
+            &settings,
+            crate::turn::Relays::empty(),
+        )
+        .expect("the pipeline starts on the test pattern");
+
+        // Several asks, because the first can legitimately land before the source has produced
+        // anything; what must not happen is every one of them timing out.
+        let frame = tokio::task::spawn_blocking(move || (0..10).find_map(|_| frames.next_frame()))
+            .await
+            .expect("the reader thread");
+        let _ = pipeline.set_state(gst::State::Null);
+
+        let frame = frame.expect("a frame within five seconds; the raw branch is starved");
+        assert_eq!((frame.width, frame.height), (320, 240));
+        assert_eq!(frame.format, CAPTURE_FORMAT);
+        assert_eq!(frame.data.len(), 320 * 240 * 2, "packed UYVY");
+    }
+
     /// A frame whose every byte is `tag`, so a test can say *which* capture came back.
     fn frame(tag: u8) -> Frame {
         Frame {
             width: 4,
             height: 2,
             format: CAPTURE_FORMAT,
+            captured_at: SystemTime::UNIX_EPOCH + std::time::Duration::from_secs(tag as u64),
             data: vec![tag; 16],
         }
     }
diff --git a/mediad/src/relay.rs b/mediad/src/relay.rs
new file mode 100644
index 00000000..68964a39
--- /dev/null
+++ b/mediad/src/relay.rs
@@ -0,0 +1,2506 @@
+//! The robot's half of the bridge to the rendezvous service.
+//!
+//! A LAN client reaches `webrtcsink`'s signalling server directly and nothing here is involved.
+//! This is what makes a duck reachable from *outside* its network: it connects **outward** to
+//! `reachy_mini_central` holding the account token, registers as a **producer**, and the service
+//! shows a client only the robots its own account owns. `docs/design/remote-access-design.md` §3
+//! owns the argument; this module owns the connection.
+//!
+//! # What it does
+//!
+//! **Registration and liveness** (§8, slice 2): the robot appears in the service's listing and
+//! stays there, for as long as the account token on disk is the one it connected with.
+//!
+//! **And it carries a session** (slice 4). A remote consumer cannot reach `webrtcsink`'s
+//! signalling server — it is on a loopback address behind somebody's router — so when one asks
+//! the rendezvous for a session, [`bridge`] opens that socket *as the consumer on its behalf* and
+//! carries envelopes between the two, rewriting the `sessionId` each hop names and reading none
+//! of the payload. One session at a time; a second is refused by name.
+//!
+//! # A control lane that needs no candidate pair, and why there is one
+//!
+//! The bridge above carries a *negotiation*: SDP and ICE, so that a consumer and the robot can
+//! find a path between them and speak WebRTC over it. When they cannot find one, everything built
+//! on it is gone. A relay candidate is what keeps that from happening (§6) — and it is a
+//! dependency rather than a guarantee: it is somebody else's service, metered per account, and
+//! the control channel is SCTP over whatever pair ICE settled on, so a relay that stops being
+//! available takes a JSON-RPC call of a few hundred bytes down with the video.
+//!
+//! So the JSON-RPC a consumer wants to send does not have to go through WebRTC at all, and the
+//! rendezvous turns out to already carry it: `handle_peer_message` in their `app.py` relays
+//! **every key of a `peer` envelope except `type` and `sessionId`** verbatim to the session
+//! partner, without looking at `sdp` or `ice`. A `peer` message carrying an `rpc` key is therefore
+//! a control call, relayed opaquely, with no change to a service the mini fleet also depends on.
+//!
+//! ```text
+//!   consumer ──POST /send {type:peer, sessionId, rpc:{…}}──► rendezvous ──SSE──► this relay
+//!            ◄─────────── SSE {type:peer, sessionId, rpc:{…}} ◄──POST /send────────┘
+//! ```
+//!
+//! `session::run` is what answers it, unchanged: its own header says it is transport-agnostic so
+//! that "a WebSocket surface could reuse it unchanged", and this is that surface. Same routing
+//! table, same per-lane sockets, same refusal to parse a reply. No ICE, no DTLS, no TURN.
+//!
+//! **What it is not is a teleop lane.** The rendezvous allows 1200 requests per 60 s per peer, so
+//! roughly twenty a second shared with the heartbeat — four calls to install and run a policy is
+//! nothing, and a 50 Hz intent stream is over budget in a second. Worse, exceeding it earns a
+//! `429` on the *whole peer*, which would take the robot's own lease down with it: a client could
+//! knock a robot off the rendezvous by subscribing to telemetry. Hence [`Budget`], which bounds
+//! notifications and never a reply — replies are one-per-request and so already bounded by
+//! whatever the client itself can afford to send.
+//!
+//! # Why the transport is HTTP, which is not what `remote-webrtc.md` §7 assumed
+//!
+//! The envelopes are the gst signalling protocol's — the same messages a LAN client exchanges —
+//! but they arrive over **SSE** and are sent with **`POST /send`**, with per-hop peer and session
+//! ids. So the payload stays opaque and the envelope does not: this is a translator with an
+//! opaque payload rather than a relay. §3.2 has the two sides side by side.
+//!
+//! # Three things read out of their source that shape the code below
+//!
+//! - **`POST /send` before `GET /events` is a 400.** The peer does not exist until the stream
+//!   does — identity comes from the bearer token, and the token is bound to a peer by the
+//!   `/events` connection. So the stream is opened *first* and registration follows the welcome,
+//!   which happens to be the order §3.4 wanted anyway for a different reason.
+//! - **The lease is refreshed by inbound `POST`, not by a healthy stream.** Thirty seconds, and a
+//!   half-open TCP connection absorbs server-pushed keepalives silently for minutes — during
+//!   which the robot believes it is reachable and is not. Hence [`heartbeat`-cadence] re-posts of
+//!   `setPeerStatus`, and hence the split-brain poll.
+//! - **Only producers carrying `meta.hardware_id` are swept.** A producer without it is never
+//!   evicted, so a crashed daemon would leave a ghost in somebody's robot list forever. This
+//!   always sends one — the SoC serial, or `/etc/machine-id` where there is no serial to read.
+//!
+//! [`heartbeat`-cadence]: Welcome::heartbeat
+//!
+//! # It is a task, not a daemon
+//!
+//! In `mediad` rather than a `relayd` for §3.5's reasons: a separate unit would need its own copy
+//! of the producer identity, its own config and its own restart story, and would still be useless
+//! without `mediad` running. Nothing here touches GStreamer — the boundary `pipeline.rs`'s
+//! no-panic rule lives on — and nothing here is `cfg(target_os)`-gated, so the whole of it is
+//! testable on a laptop against a fake service.
+
+use std::path::{Path, PathBuf};
+use std::time::Duration;
+
+use eventsource_stream::Eventsource as _;
+use futures_util::StreamExt;
+use serde::{Deserialize, Serialize};
+
+/// The Space the mini's fleet already registers against. §4.
+pub const DEFAULT_RENDEZVOUS: &str = "https://pollen-robotics-reachy-mini-central.hf.space";
+
+/// Where `updaterd` keeps the account credential.
+///
+/// **A cross-daemon file format, and `hf_robot_account` owns it.** `updaterd` performs the login
+/// and that crate writes the file; a test there pins the one key `read_access_token` takes out of
+/// it, because the writer is what can break the contract.
+/// Read on every connect attempt rather than cached: a login that happens while this task is
+/// waiting has to take effect without a restart, and re-reading a small file on a path that
+/// already sleeps for thirty seconds costs nothing.
+pub const DEFAULT_TOKEN_PATH: &str = "/etc/robot/hf-token";
+
+/// How long to wait between looks at a token file that is not there yet.
+///
+/// This is the `waiting for token` state, and it is the ordinary state of a robot nobody has
+/// signed in — so it must be quiet in the journal and cheap on the board.
+const NO_TOKEN_POLL: Duration = Duration::from_secs(30);
+
+/// How long a read from the event stream may go quiet before the connection is presumed dead.
+///
+/// The service emits `event: ping` after 30 s of idle, whose only job is to keep the proxy in
+/// front of the Space from killing the connection. Sixty seconds is two missed pings, which is
+/// what `reachy_mini`'s relay uses. §3.3.
+const READ_TIMEOUT: Duration = Duration::from_secs(60);
+
+/// How long the welcome gets to arrive before the connection is abandoned.
+const WELCOME_TIMEOUT: Duration = Duration::from_secs(20);
+
+/// The fallback heartbeat cadence, when the welcome names none.
+///
+/// The service publishes `recommended_heartbeat_interval_seconds: 10.0` and **no `lease_seconds`**
+/// — so `reachy_mini`'s middle rung, `lease_seconds / 3`, is unreachable here and is not
+/// reproduced. Five seconds is a sixth of the lease, which survives a missed post.
+const HEARTBEAT_FALLBACK: Duration = Duration::from_secs(5);
+
+/// The cadence is clamped, so a misconfigured service can neither ask for a request storm nor
+/// talk us into a cadence slower than our own eviction.
+const HEARTBEAT_BOUNDS: (Duration, Duration) = (Duration::from_secs(1), Duration::from_secs(60));
+
+/// How often to ask the service whether it still lists this robot. §3.4, split-brain.
+const STATUS_POLL: Duration = Duration::from_secs(30);
+
+/// How many consecutive times the service may fail to list this robot before reconnecting.
+///
+/// Two rather than one: `/api/robot-status` is a separate request from the stream, and one lost
+/// answer is not evidence of anything.
+const MISSES_BEFORE_RECONNECT: u32 = 2;
+
+/// Reconnect backoff: where it starts, where it stops, and how much noise goes on top.
+const BACKOFF_START: Duration = Duration::from_secs(5);
+const BACKOFF_MAX: Duration = Duration::from_secs(60);
+const BACKOFF_JITTER: f64 = 0.10;
+
+/// How long a request that is not the event stream gets.
+const REQUEST_TIMEOUT: Duration = Duration::from_secs(20);
+
+/// How long the robot's own signalling server gets to hand over a session.
+///
+/// It is in this process — `webrtcsink` runs it — so this is generous rather than tuned. What it
+/// guards against is a pipeline that never reached PLAYING, which produces a server with no
+/// producer and a handshake that would otherwise wait for one forever.
+const LOCAL_HANDSHAKE_TIMEOUT: Duration = Duration::from_secs(10);
+
+/// Where the robot's own signalling server listens.
+///
+/// `webrtcsink` runs it in this process with `signalling-server-host` and `-port`, so this is the
+/// same 8443 `mediad`'s `--port` defaults to. Loopback, because the bridge and the server are one
+/// process — a remote peer reaches this robot through the rendezvous, never through this socket.
+pub const DEFAULT_LOCAL_SIGNALLING: &str = "ws://127.0.0.1:8443";
+
+/// Every interval this task runs on, in one place.
+///
+/// A value rather than the constants directly, and it exists for the tests: §3.4's four failure
+/// modes are all *timing* failures — a lease that stops being refreshed, a service that goes on
+/// answering while it has forgotten us, a fleet reconnecting in lockstep — and none of them can be
+/// reproduced on demand by hand on a board. With the intervals injectable, each one is a test that
+/// runs in under a second. Production always uses [`Timings::default`], which is the constants
+/// above.
+#[derive(Debug, Clone, Copy)]
+pub struct Timings {
+    pub no_token_poll: Duration,
+    pub read_timeout: Duration,
+    pub welcome_timeout: Duration,
+    pub heartbeat_fallback: Duration,
+    pub heartbeat_bounds: (Duration, Duration),
+    pub status_poll: Duration,
+    pub backoff_start: Duration,
+    pub backoff_max: Duration,
+}
+
+impl Default for Timings {
+    fn default() -> Self {
+        Self {
+            no_token_poll: NO_TOKEN_POLL,
+            read_timeout: READ_TIMEOUT,
+            welcome_timeout: WELCOME_TIMEOUT,
+            heartbeat_fallback: HEARTBEAT_FALLBACK,
+            heartbeat_bounds: HEARTBEAT_BOUNDS,
+            status_poll: STATUS_POLL,
+            backoff_start: BACKOFF_START,
+            backoff_max: BACKOFF_MAX,
+        }
+    }
+}
+
+// ── what a client sees in the listing ────────────────────────────────────────
+
+/// What this robot calls itself to the service.
+///
+/// Free-form to the protocol and **not to the server**, which reads three of these keys — see the
+/// module header on `hardware_id`. The rest are for whoever is looking at a list of robots.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+pub struct Meta {
+    /// The stable-identity key: same physical robot across reinstalls, renames and new tokens.
+    ///
+    /// The server evicts an older producer of the same user carrying the same value, which is how
+    /// a re-flashed board or a restarted daemon stops showing up as a second robot. It is also
+    /// what makes this robot sweepable at all.
+    pub hardware_id: String,
+    /// What a person sees. Absent when `configd` did not answer in time, as elsewhere.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    /// `microduck`, which is what lets one client list two families of robot without opening a
+    /// session to ask what it found.
+    pub kind: &'static str,
+    /// The release this robot is running, for the reason the local `meta` carries it.
+    pub release: String,
+    pub api_version: u32,
+}
+
+impl Meta {
+    /// This robot's `meta`, from what the local producer already learned.
+    ///
+    /// `hardware_id` falls back to `/etc/machine-id` when there is no SoC serial to read — a
+    /// developer's laptop, or a board whose device tree has no `serial-number`. Stable per
+    /// install rather than per robot, which is weaker and still correct for the purpose: it keeps
+    /// one machine from being listed twice, and it keeps the producer sweepable. `sounds` makes
+    /// exactly this substitution for exactly this reason.
+    pub fn of(producer: &crate::producer::Producer, machine_id: Option<String>) -> Option<Self> {
+        let hardware_id = producer
+            .serial
+            .clone()
+            .or(machine_id)
+            .or_else(|| read_machine_id(Path::new("/etc/machine-id")))?;
+        Some(Self {
+            hardware_id,
+            name: producer.name.clone(),
+            kind: "microduck",
+            release: producer.release.clone(),
+            api_version: producer.api_version,
+        })
+    }
+}
+
+fn read_machine_id(path: &Path) -> Option<String> {
+    let id = std::fs::read_to_string(path).ok()?.trim().to_owned();
+    (!id.is_empty()).then_some(id)
+}
+
+// ── the wire ─────────────────────────────────────────────────────────────────
+
+/// What the service sends down the event stream.
+///
+/// Unknown types are a variant rather than an error: this is somebody else's service and it is
+/// allowed to grow messages we do not handle. The ones named here are the ones acted on.
+///
+/// **`Peer` carries the whole envelope rather than its fields**, and that is the design rather
+/// than laziness: an SDP or an ICE candidate passes through this process untouched, and the only
+/// thing rewritten is the `sessionId` around it. Deserialising the payload would mean owning a
+/// copy of a schema that belongs to WebRTC, and re-serialising it would mean re-encoding SDP that
+/// arrived perfectly good. §3.2 — a translator with an opaque payload.
+#[derive(Debug, Clone, PartialEq)]
+enum Inbound {
+    Welcome(Welcome),
+    /// A consumer wants a session, which is what the bridge exists to serve.
+    StartSession {
+        session_id: String,
+    },
+    /// The other side gave up, or the service ended it.
+    EndSession {
+        session_id: Option<String>,
+    },
+    /// SDP or ICE for a session in flight.
+    Peer(serde_json::Value),
+    Other,
+}
+
+/// Read a message off the wire far enough to route it, and no further.
+fn classify(raw: &str) -> Result<Inbound, String> {
+    let value: serde_json::Value =
+        serde_json::from_str(raw).map_err(|e| format!("unparseable message: {e}"))?;
+    let session_id = |value: &serde_json::Value| value["sessionId"].as_str().map(str::to_owned);
+    Ok(match value["type"].as_str().unwrap_or_default() {
+        "welcome" => Inbound::Welcome(
+            serde_json::from_value(value)
+                .map_err(|e| format!("a welcome this page cannot read: {e}"))?,
+        ),
+        "startSession" => match session_id(&value) {
+            Some(session_id) => Inbound::StartSession { session_id },
+            // A `startSession` with no id is not something to answer: there is nothing to answer
+            // *about*, and inventing one would open a session the service cannot route.
+            None => return Err("a startSession with no sessionId".to_owned()),
+        },
+        "endSession" => Inbound::EndSession {
+            session_id: session_id(&value),
+        },
+        "peer" => Inbound::Peer(value),
+        _ => Inbound::Other,
+    })
+}
+
+/// The first message on a healthy stream, and the only one that has to arrive.
+///
+/// **Two casings in one object**, which is the service's and not a mistake here: `peerId` is
+/// camelCase like every other envelope field, and `recommended_heartbeat_interval_seconds` is
+/// snake_case like every `meta` key. A blanket `rename_all` silently reads the cadence as absent
+/// and falls back to five seconds — a robot that works while posting twice as often as asked, and
+/// nothing anywhere says why. So that one field is named outright.
+#[derive(Debug, Clone, PartialEq, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct Welcome {
+    /// The id this connection is known by, which `/api/robot-status` reports back. Kept so the
+    /// split-brain poll can look for *this* robot rather than for any robot.
+    peer_id: String,
+    /// The account the token belongs to, as the service resolved it. Logged once: it is the
+    /// answer to "whose robot does the service think this is".
+    #[serde(default)]
+    username: Option<String>,
+    /// What the service asks for, in seconds. Absent on a service that does not say.
+    #[serde(default, rename = "recommended_heartbeat_interval_seconds")]
+    recommended_heartbeat_interval_seconds: Option<f64>,
+}
+
+impl Welcome {
+    /// The cadence to post at: what was asked for, clamped, or the fallback.
+    fn heartbeat(&self, timings: &Timings) -> Duration {
+        let (min, max) = timings.heartbeat_bounds;
+        match self.recommended_heartbeat_interval_seconds {
+            Some(seconds) if seconds.is_finite() && seconds > 0.0 => {
+                Duration::from_secs_f64(seconds).clamp(min, max)
+            }
+            _ => timings.heartbeat_fallback,
+        }
+    }
+}
+
+/// What this robot sends. `POST /send`, one object per request.
+#[derive(Debug, Serialize)]
+#[serde(tag = "type", rename_all = "camelCase")]
+enum Outbound<'a> {
+    /// Registration, and every heartbeat after it: the same message, which is why the lease is
+    /// keyed on the request rather than on its contents.
+    SetPeerStatus {
+        roles: [&'static str; 1],
+        meta: &'a Meta,
+    },
+    /// How this slice refuses a session it cannot serve yet.
+    #[serde(rename_all = "camelCase")]
+    EndSession {
+        session_id: &'a str,
+        reason: &'a str,
+    },
+}
+
+/// What `/api/robot-status` answers. Only the ids are read.
+#[derive(Debug, Deserialize)]
+struct RobotStatus {
+    #[serde(default)]
+    robots: Vec<RobotStatusEntry>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct RobotStatusEntry {
+    peer_id: String,
+}
+
+// ── the task ─────────────────────────────────────────────────────────────────
+
+/// Why a connection ended, which is what decides how long to wait before the next one.
+#[derive(Debug)]
+enum Ended {
+    /// The stream closed or went quiet, or a post failed. Ordinary; back off and reconnect.
+    Reconnect(String),
+    /// The service accepted the token and stopped listing this robot anyway. §3.4.
+    SplitBrain,
+    /// The service refused the token. Backing off does not fix this — a login does — so this
+    /// waits on the token file instead of on a timer.
+    Unauthorised,
+    /// The credential on disk is not the one this connection is using: a `logout`, or a
+    /// `login --force` onto another account.
+    ///
+    /// **This is what makes `account.logout` mean anything here.** The token is read once per
+    /// connection, so without this the relay would go on refreshing the lease with a credential
+    /// its owner had deleted — a robot signed out of an account and still listed under it, which
+    /// is precisely the claim `remote-access-design.md` §2.6 makes about being revocable.
+    /// Dropping the stream is the deregistration: a clean disconnect evicts the peer at once, and
+    /// the 30 s sweep is only there for sockets that never report closing.
+    CredentialChanged,
+}
+
+/// The relay, as the task that owns the outward connection.
+pub struct Relay {
+    base: String,
+    token_path: PathBuf,
+    meta: Meta,
+    client: reqwest::Client,
+    timings: Timings,
+    local_signalling: String,
+    /// What the pipeline knows, for the two calls [`crate::session::run`] answers itself.
+    ///
+    /// **A watch rather than a value, because the relay starts before the answer exists.** It is
+    /// spawned deliberately early — a robot that appears in its owner's list and cannot stream is
+    /// still a robot somebody can reach to find out why — while the frame geometry is only
+    /// truthful *after* the pipeline is up, since which sensor mode is in force is not known until
+    /// something has tried to set it. So `main` hands over a receiver and fills it in later, and a
+    /// lane reads whatever is current when it opens. Empty means `media.video` is refused rather
+    /// than answered with zeros.
+    video: Option<tokio::sync::watch::Receiver<Option<crate::session::Media>>>,
+    /// Where each service listens, for the control lane's pool. Overridable for the same reason
+    /// `--rendezvous-url` is: the whole of this module is meant to be exercisable on a laptop,
+    /// and a lane whose sockets were hardcoded to `/run/robot` could only be tested on a board.
+    sockets: crate::upstream::Sockets,
+}
+
+impl Relay {
+    /// Build one. Fails only if the HTTP client will not build, which means no TLS stack.
+    pub fn new(
+        base: impl Into<String>,
+        token_path: impl Into<PathBuf>,
+        meta: Meta,
+    ) -> Option<Self> {
+        let client = reqwest::Client::builder()
+            .connect_timeout(Duration::from_secs(10))
+            .user_agent(concat!("mediad/", env!("CARGO_PKG_VERSION")))
+            .build()
+            .map_err(|e| {
+                tracing::error!(
+                    error = %e,
+                    "no HTTP client, so this robot cannot be reached from outside its network"
+                );
+            })
+            .ok()?;
+        Some(Self {
+            base: base.into().trim_end_matches('/').to_owned(),
+            token_path: token_path.into(),
+            meta,
+            client,
+            timings: Timings::default(),
+            local_signalling: DEFAULT_LOCAL_SIGNALLING.to_owned(),
+            video: None,
+            sockets: Default::default(),
+        })
+    }
+
+    /// Where the services this lane routes to are listening.
+    pub fn with_sockets(mut self, sockets: crate::upstream::Sockets) -> Self {
+        self.sockets = sockets;
+        self
+    }
+
+    /// Where to read the video's geometry when a control lane opens.
+    ///
+    /// A builder rather than a fourth argument to [`Relay::new`] because the video is discovered
+    /// later than the relay is built, and because every test here is about the wire rather than
+    /// about the camera.
+    pub fn with_video(
+        mut self,
+        video: tokio::sync::watch::Receiver<Option<crate::session::Media>>,
+    ) -> Self {
+        self.video = Some(video);
+        self
+    }
+
+    /// Point the bridge at a signalling server other than `webrtcsink`'s own.
+    ///
+    /// For tests, and for a `mediad` whose `--port` is not the default: the bridge connects to
+    /// the server this same process is running, so the two numbers have to agree.
+    pub fn with_local_signalling(mut self, url: impl Into<String>) -> Self {
+        self.local_signalling = url.into();
+        self
+    }
+
+    /// Run on intervals other than the shipped ones. See [`Timings`]; tests only.
+    #[doc(hidden)]
+    pub fn with_timings(mut self, timings: Timings) -> Self {
+        self.timings = timings;
+        self
+    }
+
+    /// Stay registered for as long as this process runs.
+    ///
+    /// Never returns. Every failure is a reconnect, because there is no state here worth keeping
+    /// across one: the service's view of this robot is rebuilt by the next `setPeerStatus`.
+    pub async fn run(self) {
+        let mut backoff = self.timings.backoff_start;
+        loop {
+            let Some(token) = self.token() else {
+                // At `debug`: a robot nobody has signed in is not a robot with a problem, and
+                // this is every thirty seconds forever.
+                tracing::debug!(
+                    path = %self.token_path.display(),
+                    "no account token yet; this robot is reachable on its own network only"
+                );
+                tokio::time::sleep(self.timings.no_token_poll).await;
+                continue;
+            };
+
+            match self.session(&token).await {
+                Ended::Unauthorised => {
+                    tracing::warn!(
+                        "the rendezvous service refused this robot's account token; a new login \
+                         is what fixes it"
+                    );
+                    tokio::time::sleep(self.timings.no_token_poll).await;
+                }
+                Ended::CredentialChanged => {
+                    // No backoff: either there is a new token to use immediately, or there is
+                    // none and the loop above is about to wait on the file anyway.
+                    tracing::info!(
+                        "this robot's account credential changed; the rendezvous connection is \
+                         dropped, which takes the robot out of the service's listing"
+                    );
+                    backoff = self.timings.backoff_start;
+                }
+                Ended::SplitBrain => {
+                    // Reconnect immediately rather than backing off: the connection looked
+                    // healthy, so there is nothing to wait for, and every second here is a
+                    // second the robot is not reachable while believing it is.
+                    tracing::warn!(
+                        "the service no longer lists this robot although the stream was healthy; \
+                         reconnecting"
+                    );
+                    backoff = self.timings.backoff_start;
+                }
+                Ended::Reconnect(why) => {
+                    tracing::info!(%why, retry_in = ?backoff, "remote access is off; will retry");
+                    tokio::time::sleep(jittered(backoff)).await;
+                    backoff = (backoff * 2).min(self.timings.backoff_max);
+                }
+            }
+        }
+    }
+
+    /// The access token, or `None` when this robot belongs to nobody.
+    ///
+    /// `hf_robot_account` owns the reading of it: it is the crate that writes the file, and the
+    /// TURN credentials need the same token out of the same place.
+    fn token(&self) -> Option<String> {
+        hf_robot_account::read_access_token(&self.token_path)
+    }
+
+    /// One connection: open the stream, register, then hold the lease until something breaks.
+    async fn session(&self, token: &str) -> Ended {
+        let mut events = match self.open_stream(token).await {
+            Ok(events) => events,
+            Err(ended) => return ended,
+        };
+
+        let welcome = match self.await_welcome(&mut events).await {
+            Ok(welcome) => welcome,
+            Err(ended) => return ended,
+        };
+
+        // Registered *before* anything reports this robot as reachable, so no observer can see
+        // "remote access enabled" while the service does not yet know the robot exists. §3.4.
+        if let Err(ended) = self.set_peer_status(token).await {
+            return ended;
+        }
+        let heartbeat = welcome.heartbeat(&self.timings);
+        tracing::info!(
+            peer_id = %welcome.peer_id,
+            account = welcome.username.as_deref().unwrap_or("unknown"),
+            ?heartbeat,
+            "registered with the rendezvous service; this robot is reachable from outside its \
+             network"
+        );
+
+        // At most one at a time. The service gates this too (`sessionRejected` with `robot_busy`),
+        // so this is belt-and-braces — and it stays, because two remote peers writing into one
+        // intent slot is `remote-webrtc.md` §9's interleaving bug with the pad replaced by a
+        // second continent. §3.4.
+        let mut bridged: Option<Bridged> = None;
+
+        // The control lane, which is independent of the one above: a consumer may hold one, the
+        // other, or both. Built on the first `rpc` envelope of a session and dropped with it.
+        let mut control: Option<Control> = None;
+
+        let mut heartbeats = tokio::time::interval(heartbeat);
+        heartbeats.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
+        heartbeats.tick().await; // the first tick is immediate, and registration just happened
+        let mut polls = tokio::time::interval(self.timings.status_poll);
+        polls.tick().await;
+        let mut misses = 0;
+
+        loop {
+            tokio::select! {
+                _ = heartbeats.tick() => {
+                    // Checked here rather than on its own timer: the heartbeat is already the
+                    // fastest thing in this loop, so a `logout` takes effect within one cadence
+                    // — ten seconds — and re-reading a small file that often costs nothing.
+                    if self.token().as_deref() != Some(token) {
+                        return Ended::CredentialChanged;
+                    }
+                    if let Err(ended) = self.set_peer_status(token).await {
+                        return ended;
+                    }
+                }
+                _ = polls.tick() => {
+                    match self.lists_us(token, &welcome.peer_id).await {
+                        Ok(true) => misses = 0,
+                        Ok(false) => {
+                            misses += 1;
+                            tracing::warn!(
+                                misses,
+                                peer_id = %welcome.peer_id,
+                                "the service did not list this robot"
+                            );
+                            if misses >= MISSES_BEFORE_RECONNECT {
+                                return Ended::SplitBrain;
+                            }
+                        }
+                        // A failed poll is not a miss: it says nothing about whether the service
+                        // lists us, and treating it as one would reconnect a healthy stream
+                        // every time the network hiccuped twice.
+                        Err(why) => tracing::debug!(%why, "could not ask whether we are listed"),
+                    }
+                }
+                // A session that ended on its own — the peer left, the pipeline stopped — is
+                // reaped here rather than being noticed the next time one is asked for, so
+                // `account.status` and the service agree about whether this robot is busy.
+                _ = async {
+                    match bridged.as_mut() {
+                        Some(session) => (&mut session.task).await.ok(),
+                        // Nothing to wait for; this branch must never be the one that fires.
+                        None => std::future::pending().await,
+                    }
+                }, if bridged.is_some() => {
+                    tracing::debug!("the bridged session finished");
+                    bridged = None;
+                }
+                event = tokio::time::timeout(self.timings.read_timeout, events.next()) => {
+                    match event {
+                        Err(_) => return Ended::Reconnect(format!(
+                            "nothing arrived on the event stream for {:?}, which is two missed \
+                             pings",
+                            self.timings.read_timeout
+                        )),
+                        Ok(None) => return Ended::Reconnect(
+                            "the service closed the event stream".to_owned(),
+                        ),
+                        Ok(Some(Err(e))) => return Ended::Reconnect(
+                            format!("the event stream failed: {e}"),
+                        ),
+                        Ok(Some(Ok(message))) => {
+                            if let Some(ended) =
+                                self.handle(token, message, &mut bridged, &mut control).await
+                            {
+                                return ended;
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    /// `GET /events`, as a stream of parsed messages.
+    async fn open_stream(
+        &self,
+        token: &str,
+    ) -> Result<impl futures_util::Stream<Item = Result<Inbound, String>> + Unpin, Ended> {
+        let url = format!("{}/events", self.base);
+        let response = self
+            .client
+            .get(&url)
+            .bearer_auth(token)
+            .header("accept", "text/event-stream")
+            .send()
+            .await
+            .map_err(|e| Ended::Reconnect(format!("GET {url}: {e}")))?;
+
+        if response.status() == reqwest::StatusCode::UNAUTHORIZED {
+            return Err(Ended::Unauthorised);
+        }
+        if !response.status().is_success() {
+            return Err(Ended::Reconnect(format!(
+                "GET {url}: HTTP {}",
+                response.status()
+            )));
+        }
+
+        // `eventsource-stream` owns the framing: `data:` split across TCP reads, multi-line
+        // payloads, comments and the fields we do not use. What is left here is JSON.
+        let events = response
+            .bytes_stream()
+            .eventsource()
+            .filter_map(|event| async move {
+                match event {
+                    Err(e) => Some(Err(format!("{e}"))),
+                    // The service's keepalive carries no data and means only "still here".
+                    Ok(event) if event.data.trim().is_empty() => None,
+                    Ok(event) => Some(classify(&event.data)),
+                }
+            });
+        Ok(Box::pin(events))
+    }
+
+    /// Read until the welcome, which is the message that says the peer now exists.
+    async fn await_welcome(
+        &self,
+        events: &mut (impl futures_util::Stream<Item = Result<Inbound, String>> + Unpin),
+    ) -> Result<Welcome, Ended> {
+        let deadline = tokio::time::Instant::now() + self.timings.welcome_timeout;
+        loop {
+            let event = tokio::time::timeout_at(deadline, events.next())
+                .await
+                .map_err(|_| {
+                    Ended::Reconnect(format!(
+                        "no welcome within {:?}",
+                        self.timings.welcome_timeout
+                    ))
+                })?;
+            match event {
+                None => {
+                    return Err(Ended::Reconnect(
+                        "the stream closed before the welcome".to_owned(),
+                    ));
+                }
+                Some(Err(why)) => {
+                    // A message we cannot read is not a reason to drop a stream that is otherwise
+                    // working; the welcome may be the next one.
+                    tracing::debug!(%why, "skipping a message while waiting for the welcome");
+                }
+                Some(Ok(Inbound::Welcome(welcome))) => return Ok(welcome),
+                Some(Ok(_)) => {}
+            }
+        }
+    }
+
+    /// Register, and refresh the lease. The same request does both.
+    async fn set_peer_status(&self, token: &str) -> Result<(), Ended> {
+        self.send(
+            token,
+            &Outbound::SetPeerStatus {
+                roles: ["producer"],
+                meta: &self.meta,
+            },
+        )
+        .await
+    }
+
+    /// One `POST /send`.
+    async fn send(&self, token: &str, message: &Outbound<'_>) -> Result<(), Ended> {
+        let url = format!("{}/send", self.base);
+        let response = self
+            .client
+            .post(&url)
+            .bearer_auth(token)
+            .timeout(REQUEST_TIMEOUT)
+            .json(message)
+            .send()
+            .await
+            .map_err(|e| Ended::Reconnect(format!("POST {url}: {e}")))?;
+
+        match response.status() {
+            status if status.is_success() => Ok(()),
+            reqwest::StatusCode::UNAUTHORIZED => Err(Ended::Unauthorised),
+            // 400 here means the peer does not exist — the stream this token was bound to is
+            // gone. Reconnecting is what rebuilds it, and it is the whole reason the stream is
+            // opened before anything is posted.
+            status => Err(Ended::Reconnect(format!("POST {url}: HTTP {status}"))),
+        }
+    }
+
+    /// Whether the service still lists this robot. §3.4, split-brain.
+    async fn lists_us(&self, token: &str, peer_id: &str) -> Result<bool, String> {
+        let url = format!("{}/api/robot-status", self.base);
+        let response = self
+            .client
+            .get(&url)
+            .bearer_auth(token)
+            .timeout(REQUEST_TIMEOUT)
+            .send()
+            .await
+            .map_err(|e| format!("GET {url}: {e}"))?;
+        if !response.status().is_success() {
+            return Err(format!("GET {url}: HTTP {}", response.status()));
+        }
+        let status: RobotStatus = response
+            .json()
+            .await
+            .map_err(|e| format!("GET {url}: {e}"))?;
+        Ok(status.robots.iter().any(|robot| robot.peer_id == peer_id))
+    }
+
+    /// One message from the service. `Some` ends the connection.
+    async fn handle(
+        &self,
+        token: &str,
+        message: Inbound,
+        bridged: &mut Option<Bridged>,
+        control: &mut Option<Control>,
+    ) -> Option<Ended> {
+        match message {
+            // A second welcome on one stream would mean the service rebound this token, which is
+            // what happens when another process registers with it. Reconnecting is how we find
+            // out whose peer we are now.
+            Inbound::Welcome(_) => Some(Ended::Reconnect(
+                "the service sent a second welcome on the same stream".to_owned(),
+            )),
+            Inbound::StartSession { session_id } => {
+                if bridged.as_ref().is_some_and(Bridged::live) {
+                    // Refused by name rather than dropped: an unanswered `startSession` leaves a
+                    // peer waiting on a robot that is never going to answer, and the owner
+                    // looking at a robot that reads as broken rather than busy.
+                    tracing::info!(%session_id, "refusing a second remote session");
+                    return self
+                        .send(
+                            token,
+                            &Outbound::EndSession {
+                                session_id: &session_id,
+                                reason: "this robot is already in a remote session",
+                            },
+                        )
+                        .await
+                        .err();
+                }
+
+                let (to_local, from_remote) = tokio::sync::mpsc::channel(64);
+                let hub = Hub {
+                    client: self.client.clone(),
+                    base: self.base.clone(),
+                    token: token.to_owned(),
+                };
+                let local_url = self.local_signalling.clone();
+                let remote_id = session_id.clone();
+                let task = tokio::spawn(async move {
+                    if let Err(why) = bridge(hub, local_url, remote_id, from_remote).await {
+                        tracing::warn!(%why, "a remote session could not be bridged");
+                    }
+                });
+                *bridged = Some(Bridged {
+                    remote_id: session_id,
+                    to_local,
+                    task,
+                });
+                None
+            }
+            Inbound::Peer(envelope) => {
+                // **`rpc` first, because it needs no session to have been negotiated.** A
+                // consumer that never intends to speak WebRTC still had to `startSession` to get
+                // a session id — `handle_peer_message` drops an envelope naming a session the
+                // service does not know — but it has no offer to send and none to answer. So a
+                // control call is dispatched before the bridge is consulted, and a robot whose
+                // media never connected still answers.
+                if !envelope["rpc"].is_null() {
+                    return self.control(token, &envelope, control).await;
+                }
+
+                // The envelope is forwarded whole and the payload is never read. What decides
+                // where it goes is the session it names — and a `peer` for a session this robot
+                // is not in is dropped rather than guessed at.
+                let Some(session) = bridged.as_ref() else {
+                    tracing::debug!("a peer message arrived with no session to carry it");
+                    return None;
+                };
+                let names_it = envelope["sessionId"].as_str() == Some(session.remote_id.as_str());
+                if !names_it {
+                    tracing::debug!(
+                        session = ?envelope["sessionId"].as_str(),
+                        "a peer message for another session; dropping it"
+                    );
+                    return None;
+                }
+                if session.to_local.send(envelope).await.is_err() {
+                    tracing::debug!("the bridged session went away before its message arrived");
+                    *bridged = None;
+                }
+                None
+            }
+            Inbound::EndSession { session_id } => {
+                // Dropping `Bridged` aborts the task, which closes the local socket — that is
+                // what tells `webrtcsink` the consumer is gone.
+                if control
+                    .as_ref()
+                    .is_some_and(|c| session_id.as_deref().is_none_or(|id| id == c.remote_id))
+                {
+                    tracing::info!(?session_id, "the service ended the control lane");
+                    *control = None;
+                }
+                if bridged
+                    .as_ref()
+                    .is_some_and(|s| session_id.as_deref().is_none_or(|id| id == s.remote_id))
+                {
+                    tracing::info!(?session_id, "the service ended the bridged session");
+                    *bridged = None;
+                } else if control.is_none() {
+                    tracing::debug!(?session_id, "the service ended a session we do not have");
+                }
+                None
+            }
+            Inbound::Other => None,
+        }
+    }
+}
+
+// ── the control lane: JSON-RPC over the rendezvous, with no candidate pair ───
+
+/// How many notifications a control lane may post per window.
+///
+/// The rendezvous allows 1200 requests per 60 s **per peer**, and exceeding it earns a `429` on
+/// everything that token does — including the heartbeat that holds this robot's lease. So a
+/// consumer subscribing to 50 Hz telemetry would not merely get a slow stream, it would take the
+/// robot off its owner's listing. Half the allowance is left for the heartbeat, the status poll
+/// and whatever a person is actually doing.
+const NOTIFICATIONS_PER_WINDOW: u32 = 400;
+const NOTIFICATION_WINDOW: Duration = Duration::from_secs(60);
+
+/// A sliding allowance for lines nobody asked for.
+///
+/// **Replies are deliberately not subject to it.** One reply answers one request, and a request
+/// cost the consumer a `POST` of its own, so replies are already bounded by whatever the consumer
+/// can afford — throttling them would only break callers. Notifications have no such bound: a
+/// subscription is one request and then an unbounded stream.
+struct Budget {
+    allowance: u32,
+    window: Duration,
+    spent: u32,
+    dropped: u64,
+    since: tokio::time::Instant,
+}
+
+impl Budget {
+    fn new(allowance: u32, window: Duration) -> Self {
+        Self {
+            allowance,
+            window,
+            spent: 0,
+            dropped: 0,
+            since: tokio::time::Instant::now(),
+        }
+    }
+
+    /// Whether one notification may go out now.
+    fn take(&mut self) -> bool {
+        let now = tokio::time::Instant::now();
+        if now.duration_since(self.since) >= self.window {
+            if self.dropped > 0 {
+                tracing::info!(
+                    dropped = self.dropped,
+                    "notifications dropped on the control lane: it is not a telemetry transport, \
+                     and the alternative is a rate limit that would end this robot's lease"
+                );
+                self.dropped = 0;
+            }
+            self.spent = 0;
+            self.since = now;
+        }
+        if self.spent < self.allowance {
+            self.spent += 1;
+            true
+        } else {
+            self.dropped += 1;
+            false
+        }
+    }
+}
+
+/// One consumer's control lane, and the task that owns both its halves.
+struct Control {
+    /// The id the *service* knows this session by, which is what every envelope has to name.
+    remote_id: String,
+    /// Lines on their way into [`crate::session::run`].
+    to_session: tokio::sync::mpsc::Sender<String>,
+    task: tokio::task::JoinHandle<()>,
+}
+
+impl Control {
+    fn live(&self) -> bool {
+        !self.task.is_finished()
+    }
+}
+
+impl Drop for Control {
+    fn drop(&mut self) {
+        // The task owns the session and its pool of unix sockets; aborting it closes every one,
+        // which is what ends a subscription a consumer walked away from.
+        self.task.abort();
+    }
+}
+
+impl Relay {
+    /// One `peer` envelope carrying `rpc`.
+    ///
+    /// Opens the lane if this session has none yet, which is what makes a control-only consumer
+    /// need no cooperation from the media path: it says `startSession`, the service gives it an
+    /// id, and its first call is what builds everything on this side.
+    async fn control(
+        &self,
+        token: &str,
+        envelope: &serde_json::Value,
+        control: &mut Option<Control>,
+    ) -> Option<Ended> {
+        let Some(session_id) = envelope["sessionId"].as_str() else {
+            tracing::debug!("an rpc envelope with no sessionId; dropping it");
+            return None;
+        };
+
+        // A new session supersedes an old lane rather than being refused. Unlike a media session
+        // — where two consumers writing into one intent slot is `remote-webrtc.md` §9's
+        // interleaving bug — a lane holds no hardware: it is a socket per service, and the
+        // service's own concurrency gate already means one consumer at a time.
+        let reusable = control
+            .as_ref()
+            .is_some_and(|c| c.remote_id == session_id && c.live());
+        if !reusable {
+            *control = Some(self.open_control(token, session_id));
+        }
+
+        // The payload goes in as the line `session::run` expects, which is the object itself
+        // rather than a string containing one: this transport is JSON all the way down, so
+        // encoding a JSON-RPC object *inside* a JSON string would be an escaping bug waiting for
+        // its first apostrophe.
+        let line = envelope["rpc"].to_string();
+        let lane = control.as_ref().expect("just built");
+        if lane.to_session.send(line).await.is_err() {
+            tracing::debug!("the control lane went away before its call arrived");
+            *control = None;
+        }
+        None
+    }
+
+    /// Build a lane: a session, a pool of upstream sockets, and the task that posts its answers.
+    fn open_control(&self, token: &str, session_id: &str) -> Control {
+        let (to_session, from_consumer) = tokio::sync::mpsc::channel::<String>(64);
+        // Deeper than the inbound half on purpose: one call can answer with a stream, and the
+        // budget below would rather drop a notification than have a service block writing it.
+        let (to_consumer, mut from_session) = tokio::sync::mpsc::channel::<String>(256);
+
+        let hub = Hub {
+            client: self.client.clone(),
+            base: self.base.clone(),
+            token: token.to_owned(),
+        };
+        let pool = crate::upstream::Pool::new(self.sockets.clone(), to_consumer.clone());
+        // Read now rather than held as a receiver: a lane's answer to `media.video` should be
+        // whatever was true when the consumer connected, and a picture that changed shape
+        // mid-session is a `media.video` notification's job on the media path.
+        let video = self.video.as_ref().and_then(|watch| watch.borrow().clone());
+        let remote_id = session_id.to_owned();
+        let session_id = session_id.to_owned();
+
+        let task = tokio::spawn(async move {
+            let session = tokio::spawn(crate::session::run(
+                from_consumer,
+                to_consumer,
+                pool,
+                // `None` on a board with no camera, and on a lane opened before the pipeline has
+                // said what the video is — which is possible because the relay starts first, on
+                // purpose. `session::run` refuses `media.video` rather than answering with zeros.
+                video,
+            ));
+
+            let mut budget = Budget::new(NOTIFICATIONS_PER_WINDOW, NOTIFICATION_WINDOW);
+            while let Some(line) = from_session.recv().await {
+                let Ok(payload) = serde_json::from_str::<serde_json::Value>(&line) else {
+                    // `session::run` builds every line through `duck-ipc-proto`, and a service's
+                    // own output is forwarded verbatim — so this is a daemon emitting something
+                    // that is not JSON, which is worth a line rather than a silent drop.
+                    tracing::warn!(line = %line.chars().take(120).collect::<String>(),
+                        "a control lane answer that is not JSON; dropping it");
+                    continue;
+                };
+                // An answer has an id because the call it answers had one. Everything else is a
+                // notification, and only notifications are rationed.
+                let answers = !payload["id"].is_null();
+                if !answers && !budget.take() {
+                    continue;
+                }
+                let envelope = serde_json::json!({
+                    "type": "peer",
+                    "sessionId": session_id,
+                    "rpc": payload,
+                });
+                if let Err(why) = hub.send(&envelope).await {
+                    // The stream this token is bound to has gone, or the service refused. Either
+                    // way the connection loop is about to find out on its own; this lane just
+                    // stops.
+                    tracing::info!(%why, "a control lane could not reach the service");
+                    break;
+                }
+            }
+            session.abort();
+        });
+
+        tracing::info!(%remote_id, "a control lane is open: JSON-RPC without a candidate pair");
+        Control {
+            remote_id,
+            to_session,
+            task,
+        }
+    }
+}
+
+// ── the local half: one bridged session ──────────────────────────────────────
+//
+// A remote consumer wants a session with this robot. On the LAN that consumer would open a
+// WebSocket to `webrtcsink`'s own signalling server and ask it for one; from off the LAN it cannot
+// reach that socket at all, so **this task plays the consumer on its behalf**: it opens the local
+// WebSocket, asks for a session with the local producer, and then carries envelopes between the
+// two sides, rewriting the one field whose value differs per hop.
+//
+// The roles are inverted on the two sides, and that is the whole shape of it (§3.1): to the
+// rendezvous this process *is* the robot, and to `webrtcsink` it is a peer asking for a session.
+//
+// **One local connection per bridged session**, opened when the session starts and dropped when it
+// ends. A long-lived local socket multiplexing several sessions would need the session table §3.2
+// describes; one connection per session makes that table a single pair of ids, and the concurrent
+// session the table would have existed for is refused anyway — the service gates it, and §3.4 says
+// to keep gating it here too.
+
+/// What the bridge needs to talk to the rendezvous while a session is in flight.
+#[derive(Clone)]
+struct Hub {
+    client: reqwest::Client,
+    base: String,
+    token: String,
+}
+
+impl Hub {
+    /// `POST /send`, for a task that has no `Relay` to hand.
+    async fn send(&self, message: &serde_json::Value) -> Result<(), String> {
+        let url = format!("{}/send", self.base);
+        let response = self
+            .client
+            .post(&url)
+            .bearer_auth(&self.token)
+            .timeout(REQUEST_TIMEOUT)
+            .json(message)
+            .send()
+            .await
+            .map_err(|e| format!("POST {url}: {e}"))?;
+        if !response.status().is_success() {
+            return Err(format!("POST {url}: HTTP {}", response.status()));
+        }
+        Ok(())
+    }
+
+    /// Tell the service a session is over. Best effort: a failure here is a session that is
+    /// already gone, and the peer finds out when the media stops either way.
+    async fn end(&self, session_id: &str, reason: &str) {
+        let message = serde_json::json!({
+            "type": "endSession", "sessionId": session_id, "reason": reason,
+        });
+        if let Err(why) = self.send(&message).await {
+            tracing::debug!(%why, "could not tell the service the session ended");
+        }
+    }
+}
+
+/// A bridged session, from the rendezvous side's point of view.
+struct Bridged {
+    /// The id the *service* knows this session by.
+    remote_id: String,
+    /// Envelopes from the service, on their way to the local signalling server.
+    to_local: tokio::sync::mpsc::Sender<serde_json::Value>,
+    task: tokio::task::JoinHandle<()>,
+}
+
+impl Bridged {
+    /// Whether the task carrying this session is still running.
+    fn live(&self) -> bool {
+        !self.task.is_finished()
+    }
+}
+
+impl Drop for Bridged {
+    fn drop(&mut self) {
+        // The task owns a WebSocket and a channel; aborting it closes both, which is what tells
+        // `webrtcsink` the consumer went away.
+        self.task.abort();
+    }
+}
+
+/// Carry one session, and **tell the service when it is over however that happens**.
+///
+/// The wrapper exists for that second half. A consumer whose session ends without being told sits
+/// looking at a robot it believes is connecting, forever — and the failure that produces it is
+/// never the ordinary path, it is an early return from somewhere in the middle. So there is one
+/// place that posts `endSession` and every exit goes through it.
+async fn bridge(
+    hub: Hub,
+    local_url: String,
+    remote_id: String,
+    from_remote: tokio::sync::mpsc::Receiver<serde_json::Value>,
+) -> Result<(), String> {
+    let outcome = carry(&hub, &local_url, &remote_id, from_remote).await;
+    match &outcome {
+        Ok(why) => {
+            hub.end(&remote_id, why).await;
+            tracing::info!(remote = %remote_id, %why, "the bridged session ended");
+        }
+        Err(why) => {
+            tracing::warn!(remote = %remote_id, %why, "the bridged session failed");
+            hub.end(&remote_id, why).await;
+        }
+    }
+    outcome.map(|_| ())
+}
+
+/// One session, from the local handshake to whichever side stops first.
+///
+/// `Ok` carries why it ended, which is what the consumer is told.
+async fn carry(
+    hub: &Hub,
+    local_url: &str,
+    remote_id: &str,
+    mut from_remote: tokio::sync::mpsc::Receiver<serde_json::Value>,
+) -> Result<String, String> {
+    use futures_util::SinkExt;
+    use tokio_tungstenite::tungstenite::Message;
+
+    let (mut socket, _) = tokio_tungstenite::connect_async(local_url)
+        .await
+        .map_err(|e| format!("{local_url}: {e}"))?;
+
+    // The consumer's own handshake against `webrtcsink`'s server: a welcome, then ask what is
+    // producing, then ask that producer for a session. Exactly what the console page does over a
+    // LAN, which is why the page was the reference for this rather than the protocol document.
+    let mut producer = None;
+    let mut local_id = None;
+    let deadline = tokio::time::Instant::now() + LOCAL_HANDSHAKE_TIMEOUT;
+    while local_id.is_none() {
+        let message = tokio::time::timeout_at(deadline, socket.next())
+            .await
+            .map_err(|_| {
+                format!("{local_url} did not start a session within {LOCAL_HANDSHAKE_TIMEOUT:?}")
+            })?
+            .ok_or_else(|| format!("{local_url} closed during the handshake"))?
+            .map_err(|e| format!("{local_url}: {e}"))?;
+        let Message::Text(text) = message else {
+            continue;
+        };
+
+        // Read as the envelope it is rather than through `classify`: two of these three types
+        // exist only on this side of the bridge, and giving them variants in the rendezvous's
+        // vocabulary would put local-only messages in a remote-only enum.
+        let value: serde_json::Value =
+            serde_json::from_str(&text).map_err(|e| format!("{local_url}: {e}"))?;
+        match value["type"].as_str().unwrap_or_default() {
+            "welcome" => {
+                socket
+                    .send(Message::text(r#"{"type":"list"}"#))
+                    .await
+                    .map_err(|e| format!("{local_url}: {e}"))?;
+            }
+            "list" => {
+                let first = value["producers"].get(0).and_then(|p| p["id"].as_str());
+                let Some(id) = first else {
+                    return Err(
+                        "the robot's own signalling server lists no producer, so there is \
+                         nothing to bridge — its pipeline has not reached PLAYING"
+                            .to_owned(),
+                    );
+                };
+                producer = Some(id.to_owned());
+                let request = serde_json::json!({ "type": "startSession", "peerId": id });
+                socket
+                    .send(Message::text(request.to_string()))
+                    .await
+                    .map_err(|e| format!("{local_url}: {e}"))?;
+            }
+            "sessionStarted" => {
+                local_id = value["sessionId"].as_str().map(str::to_owned);
+            }
+            _ => {}
+        }
+    }
+
+    let local_id = local_id.expect("the loop above does not end until it is set");
+    tracing::info!(
+        remote = %remote_id,
+        local = %local_id,
+        producer = producer.as_deref().unwrap_or("unknown"),
+        "a remote session is bridged to this robot's own signalling server"
+    );
+
+    // From here it is two directions and one rewritten field.
+    let outcome = loop {
+        tokio::select! {
+            // The local producer: SDP, ICE, or the end of the session.
+            message = socket.next() => {
+                let Some(message) = message else {
+                    break Err("the robot's signalling server closed the session".to_owned());
+                };
+                let message = message.map_err(|e| format!("{local_url}: {e}"))?;
+                let Message::Text(text) = message else { continue };
+                match classify(&text)? {
+                    Inbound::Peer(mut envelope) => {
+                        envelope["sessionId"] = serde_json::Value::String(remote_id.to_owned());
+                        hub.send(&envelope).await?;
+                    }
+                    Inbound::EndSession { .. } => {
+                        break Ok("the robot ended the session".to_owned());
+                    }
+                    _ => {}
+                }
+            }
+            // The remote consumer, by way of the event stream this session arrived on.
+            envelope = from_remote.recv() => {
+                let Some(mut envelope) = envelope else {
+                    break Ok("the rendezvous connection went away".to_owned());
+                };
+                envelope["sessionId"] = serde_json::Value::String(local_id.clone());
+                socket
+                    .send(Message::text(envelope.to_string()))
+                    .await
+                    .map_err(|e| format!("{local_url}: {e}"))?;
+            }
+        }
+    };
+
+    // The local side is told with a message rather than a dropped socket, so `webrtcsink` frees
+    // its consumer immediately instead of on a timeout. The remote side is told by the caller,
+    // which is the only place that does it.
+    let farewell = serde_json::json!({ "type": "endSession", "sessionId": local_id });
+    let _ = socket.send(Message::text(farewell.to_string())).await;
+    let _ = socket.close(None).await;
+    outcome
+}
+
+/// A duration plus up to [`BACKOFF_JITTER`] of itself, so a fleet does not reconnect in lockstep.
+fn jittered(base: Duration) -> Duration {
+    let spread = base.mul_f64(BACKOFF_JITTER);
+    base + spread.mul_f64(rand::random::<f64>())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn meta() -> Meta {
+        Meta {
+            hardware_id: "3fa1c51b".to_owned(),
+            name: Some("olducky".to_owned()),
+            kind: "microduck",
+            release: "0.10.0".to_owned(),
+            api_version: duck_ipc_proto::API_VERSION,
+        }
+    }
+
+    /// The cadence the welcome asks for is used, and a service that asks for something absurd is
+    /// clamped rather than obeyed.
+    #[test]
+    fn the_heartbeat_cadence_is_the_services_within_reason() {
+        let welcome = |seconds: Option<f64>| Welcome {
+            peer_id: "peer-1".to_owned(),
+            username: None,
+            recommended_heartbeat_interval_seconds: seconds,
+        };
+
+        let timings = Timings::default();
+        assert_eq!(
+            welcome(Some(10.0)).heartbeat(&timings),
+            Duration::from_secs(10),
+            "what this service actually publishes"
+        );
+        assert_eq!(
+            welcome(None).heartbeat(&timings),
+            HEARTBEAT_FALLBACK,
+            "a service that says nothing gets a sixth of the lease"
+        );
+        assert_eq!(
+            welcome(Some(0.001)).heartbeat(&timings),
+            HEARTBEAT_BOUNDS.0,
+            "a request storm is refused"
+        );
+        assert_eq!(
+            welcome(Some(600.0)).heartbeat(&timings),
+            HEARTBEAT_BOUNDS.1,
+            "and so is a cadence slower than the lease it is meant to refresh"
+        );
+        assert_eq!(
+            welcome(Some(f64::NAN)).heartbeat(&timings),
+            HEARTBEAT_FALLBACK
+        );
+        assert_eq!(welcome(Some(-1.0)).heartbeat(&timings), HEARTBEAT_FALLBACK);
+    }
+
+    /// The messages this robot has to recognise, as the service spells them.
+    #[test]
+    fn the_wire_is_read_as_the_service_writes_it() {
+        let welcome = classify(
+            r#"{"type":"welcome","peerId":"p-1","username":"PierreRouanet",
+                "recommended_heartbeat_interval_seconds":10.0}"#,
+        )
+        .unwrap();
+        let Inbound::Welcome(welcome) = welcome else {
+            panic!("{welcome:?}");
+        };
+        assert_eq!(welcome.peer_id, "p-1");
+        assert_eq!(welcome.username.as_deref(), Some("PierreRouanet"));
+        assert_eq!(
+            welcome.heartbeat(&Timings::default()),
+            Duration::from_secs(10)
+        );
+
+        assert_eq!(
+            classify(r#"{"type":"startSession","peerId":"p-2","sessionId":"s-1"}"#).unwrap(),
+            Inbound::StartSession {
+                session_id: "s-1".to_owned()
+            },
+        );
+        // A `peer` keeps its whole envelope, payload included — that is what makes this a
+        // translator rather than a parser.
+        let peer =
+            classify(r#"{"type":"peer","sessionId":"s-1","sdp":{"type":"offer","sdp":"v=0\r\n"}}"#)
+                .unwrap();
+        let Inbound::Peer(envelope) = &peer else {
+            panic!("{peer:?}")
+        };
+        assert_eq!(envelope["sdp"]["sdp"], "v=0\r\n");
+
+        // Messages this slice does not act on must not be errors: it is somebody else's service
+        // and it is allowed to grow.
+        for other in [
+            r#"{"type":"list","producers":[]}"#,
+            r#"{"type":"peerStatusChanged","peerId":"p-1","roles":["producer"],"meta":{}}"#,
+            r#"{"type":"sessionRejected","reason":"robot_busy","activeApp":"whatever"}"#,
+            r#"{"type":"somethingAddedNextYear"}"#,
+        ] {
+            assert_eq!(classify(other).unwrap(), Inbound::Other, "{other}");
+        }
+    }
+
+    /// What is posted, spelled the way the server reads it.
+    #[test]
+    fn registration_says_producer_and_carries_the_stable_id() {
+        let meta = meta();
+        let json = serde_json::to_value(Outbound::SetPeerStatus {
+            roles: ["producer"],
+            meta: &meta,
+        })
+        .unwrap();
+
+        assert_eq!(json["type"], "setPeerStatus");
+        assert_eq!(json["roles"][0], "producer");
+        assert_eq!(
+            json["meta"]["hardware_id"], "3fa1c51b",
+            "the key the server sweeps and evicts on — snake_case, as it reads it"
+        );
+        assert_eq!(json["meta"]["kind"], "microduck");
+        assert_eq!(json["meta"]["name"], "olducky");
+
+        let json = serde_json::to_value(Outbound::EndSession {
+            session_id: "s-1",
+            reason: "nope",
+        })
+        .unwrap();
+        assert_eq!(json["type"], "endSession");
+        assert_eq!(
+            json["sessionId"], "s-1",
+            "camelCase, as the server sends it"
+        );
+    }
+
+    /// A robot with no serial still gets a stable id, because a producer without one is never
+    /// swept — it would haunt its owner's robot list after a crash.
+    #[test]
+    fn a_board_with_no_serial_falls_back_to_the_machine_id() {
+        let producer = crate::producer::Producer {
+            name: Some("olducky".to_owned()),
+            serial: None,
+            release: "0.10.0".to_owned(),
+            api_version: duck_ipc_proto::API_VERSION,
+        };
+
+        let meta = Meta::of(&producer, Some("machine-1".to_owned())).expect("a stable id");
+        assert_eq!(meta.hardware_id, "machine-1");
+
+        let with_serial = crate::producer::Producer {
+            serial: Some("3fa1c51b".to_owned()),
+            ..producer
+        };
+        assert_eq!(
+            Meta::of(&with_serial, Some("machine-1".to_owned()))
+                .unwrap()
+                .hardware_id,
+            "3fa1c51b",
+            "the serial wins: it survives a reinstall, and the machine id does not"
+        );
+    }
+
+    #[test]
+    fn an_empty_machine_id_file_is_no_machine_id() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("machine-id");
+        std::fs::write(&path, "\n").unwrap();
+        assert_eq!(read_machine_id(&path), None);
+        std::fs::write(&path, "  abc123 \n").unwrap();
+        assert_eq!(read_machine_id(&path), Some("abc123".to_owned()));
+    }
+
+    /// The token file is `updaterd`'s, and this reads one field out of it — including when the
+    /// record grows fields this does not know.
+    #[test]
+    fn the_credential_is_read_for_the_one_field_that_matters() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("hf-token");
+        let relay = Relay::new("http://127.0.0.1:1", &path, meta()).unwrap();
+
+        assert_eq!(
+            relay.token(),
+            None,
+            "no file is a robot signed in to nobody"
+        );
+
+        std::fs::write(
+            &path,
+            r#"{"access_token":"hf_abc","refresh_token":"r","expires_at":1,"username":"x",
+                "something_added_later":true}"#,
+        )
+        .unwrap();
+        assert_eq!(relay.token().as_deref(), Some("hf_abc"));
+
+        std::fs::write(&path, r#"{"refresh_token":"only"}"#).unwrap();
+        assert_eq!(
+            relay.token(),
+            None,
+            "a record with no access token is no use"
+        );
+
+        std::fs::write(&path, "{ not json").unwrap();
+        assert_eq!(
+            relay.token(),
+            None,
+            "and a corrupt one is signed out, not fatal"
+        );
+    }
+
+    // ── against a fake rendezvous service ───────────────────────────────────
+    //
+    // The four failure modes §3.4 names are all timing failures, and this is where they are
+    // reproduced on demand: a service that stops listing a robot whose stream is fine, a lease
+    // that has to be refreshed by traffic rather than by a socket looking healthy, a session
+    // arriving that this slice cannot serve, and a token that is not there yet.
+
+    /// A stand-in for `reachy_mini_central`, holding what it was told and what it will say next.
+    struct FakeService {
+        base: String,
+        state: std::sync::Arc<Fake>,
+        _task: tokio::task::JoinHandle<()>,
+    }
+
+    #[derive(Default)]
+    struct Fake {
+        /// Every `POST /send` body, in order.
+        posts: std::sync::Mutex<Vec<serde_json::Value>>,
+        /// How many times the event stream has been opened.
+        streams: std::sync::atomic::AtomicUsize,
+        /// How many times an event stream has been dropped by the client, which is what a clean
+        /// disconnect looks like from here — and what evicts a producer on the real service.
+        closed: std::sync::atomic::AtomicUsize,
+        /// The bearer token each stream was opened with, in order.
+        bearers: std::sync::Mutex<Vec<String>>,
+        /// Whether `/api/robot-status` admits this robot exists.
+        lists_us: std::sync::atomic::AtomicBool,
+        /// What the welcome asks for, and messages to push after it.
+        heartbeat_seconds: std::sync::Mutex<Option<f64>>,
+        push: std::sync::Mutex<Option<tokio::sync::mpsc::UnboundedSender<String>>>,
+        /// A status to answer `POST /send` with instead of 200.
+        refuse_posts: std::sync::Mutex<Option<u16>>,
+    }
+
+    impl Fake {
+        fn posts(&self) -> Vec<serde_json::Value> {
+            self.posts.lock().unwrap().clone()
+        }
+
+        fn bearers(&self) -> Vec<String> {
+            self.bearers.lock().unwrap().clone()
+        }
+
+        fn closed(&self) -> usize {
+            self.closed.load(std::sync::atomic::Ordering::SeqCst)
+        }
+
+        fn streams(&self) -> usize {
+            self.streams.load(std::sync::atomic::Ordering::SeqCst)
+        }
+
+        fn of_type(&self, kind: &str) -> Vec<serde_json::Value> {
+            self.posts()
+                .into_iter()
+                .filter(|post| post["type"] == kind)
+                .collect()
+        }
+
+        /// Push a message down the open stream, as the service would.
+        fn push(&self, message: serde_json::Value) {
+            let sender = self.push.lock().unwrap().clone().expect("a stream is open");
+            sender
+                .send(message.to_string())
+                .expect("the stream is live");
+        }
+    }
+
+    /// Increments the fake's `closed` count when the stream it lives in is dropped.
+    struct Closing(std::sync::Arc<Fake>);
+
+    impl Drop for Closing {
+        fn drop(&mut self) {
+            self.0
+                .closed
+                .fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+        }
+    }
+
+    const PEER_ID: &str = "peer-under-test";
+
+    async fn fake_service() -> FakeService {
+        use axum::extract::State;
+        use axum::routing::{get, post};
+
+        let state = std::sync::Arc::new(Fake::default());
+        state
+            .lists_us
+            .store(true, std::sync::atomic::Ordering::SeqCst);
+
+        let app = axum::Router::new()
+            .route(
+                "/events",
+                get(|State(fake): State<std::sync::Arc<Fake>>,
+                     headers: axum::http::HeaderMap| async move {
+                    fake.streams
+                        .fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+                    fake.bearers.lock().unwrap().push(
+                        headers
+                            .get("authorization")
+                            .and_then(|value| value.to_str().ok())
+                            .unwrap_or("")
+                            .to_owned(),
+                    );
+                    let closing = Closing(std::sync::Arc::clone(&fake));
+                    let (tx, mut rx) = tokio::sync::mpsc::unbounded_channel::<String>();
+                    *fake.push.lock().unwrap() = Some(tx);
+
+                    let cadence = *fake.heartbeat_seconds.lock().unwrap();
+                    let welcome = match cadence {
+                        Some(seconds) => serde_json::json!({
+                            "type": "welcome",
+                            "peerId": PEER_ID,
+                            "username": "PierreRouanet",
+                            "recommended_heartbeat_interval_seconds": seconds,
+                        }),
+                        None => serde_json::json!({
+                            "type": "welcome", "peerId": PEER_ID, "username": "PierreRouanet",
+                        }),
+                    };
+
+                    // The framing the real service uses: `data:` lines, and a comment-only ping
+                    // when there is nothing to say.
+                    let events = async_stream::stream! {
+                        // Moved in, so it is dropped when the client hangs up — which is how the
+                        // real service learns to evict a producer.
+                        let _closing = closing;
+                        yield Ok::<_, std::io::Error>(format!("data: {welcome}\n\n"));
+                        while let Some(message) = rx.recv().await {
+                            yield Ok(format!("data: {message}\n\n"));
+                        }
+                    };
+                    (
+                        [("content-type", "text/event-stream")],
+                        axum::body::Body::from_stream(events),
+                    )
+                }),
+            )
+            .route(
+                "/send",
+                post(
+                    |State(fake): State<std::sync::Arc<Fake>>, body: String| async move {
+                        let message: serde_json::Value =
+                            serde_json::from_str(&body).expect("the relay posts JSON");
+                        fake.posts.lock().unwrap().push(message);
+                        match *fake.refuse_posts.lock().unwrap() {
+                            None => axum::http::StatusCode::OK,
+                            Some(status) => axum::http::StatusCode::from_u16(status).unwrap(),
+                        }
+                    },
+                ),
+            )
+            .route(
+                "/api/robot-status",
+                get(|State(fake): State<std::sync::Arc<Fake>>| async move {
+                    let robots = if fake.lists_us.load(std::sync::atomic::Ordering::SeqCst) {
+                        serde_json::json!([{ "peerId": PEER_ID, "busy": false }])
+                    } else {
+                        serde_json::json!([])
+                    };
+                    axum::Json(serde_json::json!({ "robots": robots }))
+                }),
+            )
+            .with_state(std::sync::Arc::clone(&state));
+
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let base = format!("http://{}", listener.local_addr().unwrap());
+        let task = tokio::spawn(async move {
+            let _ = axum::serve(listener, app).await;
+        });
+        FakeService {
+            base,
+            state,
+            _task: task,
+        }
+    }
+
+    /// Intervals small enough that a test does not wait for a robot's afternoon.
+    fn brisk() -> Timings {
+        Timings {
+            no_token_poll: Duration::from_millis(50),
+            read_timeout: Duration::from_secs(5),
+            welcome_timeout: Duration::from_secs(2),
+            heartbeat_fallback: Duration::from_millis(50),
+            heartbeat_bounds: (Duration::from_millis(20), Duration::from_secs(60)),
+            status_poll: Duration::from_millis(50),
+            backoff_start: Duration::from_millis(20),
+            backoff_max: Duration::from_millis(50),
+        }
+    }
+
+    fn signed_in(dir: &tempfile::TempDir) -> PathBuf {
+        let path = dir.path().join("hf-token");
+        std::fs::write(
+            &path,
+            r#"{"access_token":"hf_abc","username":"PierreRouanet"}"#,
+        )
+        .unwrap();
+        path
+    }
+
+    /// Wait for something to become true, or fail saying what never happened.
+    async fn until(what: &str, mut ready: impl FnMut() -> bool) {
+        for _ in 0..200 {
+            if ready() {
+                return;
+            }
+            tokio::time::sleep(Duration::from_millis(25)).await;
+        }
+        panic!("{what} did not happen");
+    }
+
+    /// The whole of slice 2: the stream opens, the welcome arrives, the robot registers as a
+    /// producer, and the lease keeps being refreshed after that.
+    ///
+    /// The ordering assertion is the one worth having: **nothing is posted before the welcome**.
+    /// `POST /send` on this service is a 400 until the token has been bound to a peer by the
+    /// event stream, so a relay that registered first would work only by accident of scheduling.
+    #[tokio::test]
+    async fn it_registers_as_a_producer_and_holds_the_lease() {
+        let dir = tempfile::tempdir().unwrap();
+        let service = fake_service().await;
+        *service.state.heartbeat_seconds.lock().unwrap() = Some(0.05);
+
+        let relay = Relay::new(&service.base, signed_in(&dir), meta())
+            .unwrap()
+            .with_timings(brisk());
+        let task = tokio::spawn(relay.run());
+
+        until("registration", || {
+            !service.state.of_type("setPeerStatus").is_empty()
+        })
+        .await;
+
+        let first = service.state.of_type("setPeerStatus")[0].clone();
+        assert_eq!(first["roles"][0], "producer");
+        assert_eq!(first["meta"]["hardware_id"], "3fa1c51b");
+        assert_eq!(first["meta"]["kind"], "microduck");
+        assert_eq!(
+            service
+                .state
+                .streams
+                .load(std::sync::atomic::Ordering::SeqCst),
+            1,
+            "one stream, and it was opened before anything was posted"
+        );
+
+        // The lease is refreshed by traffic, not by a socket that looks healthy: a service that
+        // saw one post and then silence would evict this robot after thirty seconds.
+        until("a second heartbeat", || {
+            service.state.of_type("setPeerStatus").len() >= 3
+        })
+        .await;
+        task.abort();
+    }
+
+    /// Split-brain: the stream is healthy and the service has forgotten us.
+    ///
+    /// Nothing in the connection notices, which is the entire problem — so the poll is what
+    /// notices, and two consecutive misses force a reconnect. One miss must not: a single lost
+    /// answer says nothing about whether we are listed.
+    #[tokio::test]
+    async fn a_service_that_stops_listing_this_robot_is_reconnected() {
+        let dir = tempfile::tempdir().unwrap();
+        let service = fake_service().await;
+
+        let relay = Relay::new(&service.base, signed_in(&dir), meta())
+            .unwrap()
+            .with_timings(brisk());
+        let task = tokio::spawn(relay.run());
+        until("the first stream", || {
+            service
+                .state
+                .streams
+                .load(std::sync::atomic::Ordering::SeqCst)
+                >= 1
+        })
+        .await;
+
+        service
+            .state
+            .lists_us
+            .store(false, std::sync::atomic::Ordering::SeqCst);
+
+        until("a reconnect", || {
+            service
+                .state
+                .streams
+                .load(std::sync::atomic::Ordering::SeqCst)
+                >= 2
+        })
+        .await;
+        task.abort();
+    }
+
+    /// A robot nobody has signed in does not talk to anybody, and starts as soon as it is.
+    ///
+    /// This is the ordinary state of a duck out of a box, so it must be quiet — and the token has
+    /// to be picked up without a restart, because the login that writes it happens over BLE while
+    /// this task is already running.
+    #[tokio::test]
+    async fn nothing_happens_until_the_robot_belongs_to_somebody() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("hf-token");
+        let service = fake_service().await;
+
+        let relay = Relay::new(&service.base, &path, meta())
+            .unwrap()
+            .with_timings(brisk());
+        let task = tokio::spawn(relay.run());
+
+        tokio::time::sleep(Duration::from_millis(200)).await;
+        assert_eq!(
+            service
+                .state
+                .streams
+                .load(std::sync::atomic::Ordering::SeqCst),
+            0,
+            "a robot with no account must not reach the service at all"
+        );
+
+        // The login lands, over BLE, while this is running.
+        std::fs::write(&path, r#"{"access_token":"hf_abc"}"#).unwrap();
+        until("registration after a login", || {
+            !service.state.of_type("setPeerStatus").is_empty()
+        })
+        .await;
+        task.abort();
+    }
+
+    /// Signing the robot out takes it out of the service's listing, promptly.
+    ///
+    /// The token is read once per connection, so nothing about a `logout` reaches this task on its
+    /// own: without the check on the heartbeat tick the relay would go on refreshing the lease
+    /// with a credential its owner had deleted — a robot signed out of an account and still
+    /// listed under it. §2.6 claims `account.logout` is one of the three things that make a LAN
+    /// peer's login acceptable, so it has to be true here and not only in `updaterd`.
+    ///
+    /// Dropping the stream *is* the deregistration: a clean disconnect evicts the peer at once on
+    /// the real service, and the 30 s sweep exists only for sockets that never report closing.
+    #[tokio::test]
+    async fn signing_the_robot_out_drops_the_connection() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = signed_in(&dir);
+        let service = fake_service().await;
+        *service.state.heartbeat_seconds.lock().unwrap() = Some(0.05);
+
+        let relay = Relay::new(&service.base, &path, meta())
+            .unwrap()
+            .with_timings(brisk());
+        let task = tokio::spawn(relay.run());
+        until("registration", || {
+            !service.state.of_type("setPeerStatus").is_empty()
+        })
+        .await;
+
+        // `account logout` on the robot is exactly this.
+        std::fs::remove_file(&path).unwrap();
+
+        until("the stream to be dropped", || service.state.closed() >= 1).await;
+        let posts_when_signed_out = service.state.of_type("setPeerStatus").len();
+        tokio::time::sleep(Duration::from_millis(300)).await;
+        assert_eq!(
+            service.state.of_type("setPeerStatus").len(),
+            posts_when_signed_out,
+            "a robot signed out must stop refreshing its lease"
+        );
+        assert_eq!(
+            service.state.streams(),
+            1,
+            "and must not reconnect: there is nothing to connect with"
+        );
+        task.abort();
+    }
+
+    /// Signing in to a *different* account moves the robot, rather than leaving it where it was.
+    ///
+    /// `login --force` is how a robot changes hands, and the connection it changes hands over is
+    /// authenticated by the old owner's token. So the same check that notices a logout has to
+    /// notice a replacement, and reconnect with the new credential.
+    #[tokio::test]
+    async fn a_relogin_reconnects_with_the_new_token() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = signed_in(&dir);
+        let service = fake_service().await;
+        *service.state.heartbeat_seconds.lock().unwrap() = Some(0.05);
+
+        let relay = Relay::new(&service.base, &path, meta())
+            .unwrap()
+            .with_timings(brisk());
+        let task = tokio::spawn(relay.run());
+        until("registration", || {
+            !service.state.of_type("setPeerStatus").is_empty()
+        })
+        .await;
+        assert_eq!(service.state.bearers()[0], "Bearer hf_abc");
+
+        std::fs::write(&path, r#"{"access_token":"hf_somebody_else"}"#).unwrap();
+
+        until("a reconnect on the new token", || {
+            service.state.bearers().len() >= 2
+        })
+        .await;
+        assert_eq!(
+            service.state.bearers()[1],
+            "Bearer hf_somebody_else",
+            "the second connection belongs to whoever the robot belongs to now"
+        );
+        assert!(
+            service.state.closed() >= 1,
+            "and the first one was closed, which is what un-lists the robot for the old account"
+        );
+        task.abort();
+    }
+
+    /// A token the service refuses is not something backing off can fix.
+    ///
+    /// It waits on the file instead: the remedy is a login, and hammering a 401 every five
+    /// seconds until somebody performs one is a request storm against somebody else's Space.
+    #[tokio::test]
+    async fn a_refused_token_waits_for_a_new_one_rather_than_hammering() {
+        let dir = tempfile::tempdir().unwrap();
+        let service = fake_service().await;
+        *service.state.refuse_posts.lock().unwrap() = Some(401);
+
+        let relay = Relay::new(&service.base, signed_in(&dir), meta())
+            .unwrap()
+            .with_timings(Timings {
+                no_token_poll: Duration::from_secs(30),
+                ..brisk()
+            });
+        let task = tokio::spawn(relay.run());
+
+        until("the first attempt", || {
+            !service.state.of_type("setPeerStatus").is_empty()
+        })
+        .await;
+        tokio::time::sleep(Duration::from_millis(300)).await;
+        assert_eq!(
+            service.state.of_type("setPeerStatus").len(),
+            1,
+            "a 401 must not be retried on the reconnect timer"
+        );
+        task.abort();
+    }
+
+    // ── the local half ──────────────────────────────────────────────────────
+    //
+    // A stand-in for `webrtcsink`'s own signalling server, which is the one thing about this
+    // module that cannot be a channel: the bridge is a WebSocket client, and the framing is part
+    // of what it gets wrong if it gets anything wrong.
+
+    // ── the control lane ────────────────────────────────────────────────────
+    //
+    // The property under test is the one the lane exists for: **a call crosses with no candidate
+    // pair, no offer and no answer.** Every test here pushes an `rpc` envelope at a relay whose
+    // media path was never negotiated, which is exactly the state a consumer behind a NAT is left
+    // in while §6's TURN endpoint has no DNS.
+
+    /// A daemon that reads one line and replies with the next canned one, remembering what it saw.
+    ///
+    /// Lifted from `session.rs`'s tests rather than shared, for now: two fakes of five lines are
+    /// cheaper than a test-support surface that both have to agree on.
+    fn fake_daemon(
+        path: &Path,
+        replies: Vec<String>,
+    ) -> tokio::sync::mpsc::UnboundedReceiver<String> {
+        use tokio::io::{AsyncBufReadExt as _, AsyncWriteExt as _, BufReader};
+
+        let listener = std::os::unix::net::UnixListener::bind(path).unwrap();
+        listener.set_nonblocking(true).unwrap();
+        let listener = tokio::net::UnixListener::from_std(listener).unwrap();
+        let (seen_tx, seen_rx) = tokio::sync::mpsc::unbounded_channel();
+
+        tokio::spawn(async move {
+            while let Ok((stream, _)) = listener.accept().await {
+                let seen = seen_tx.clone();
+                let mut replies = replies.clone().into_iter();
+                tokio::spawn(async move {
+                    let (read, mut write) = stream.into_split();
+                    let mut lines = BufReader::new(read).lines();
+                    while let Ok(Some(line)) = lines.next_line().await {
+                        let _ = seen.send(line);
+                        if let Some(reply) = replies.next() {
+                            let _ = write.write_all(format!("{reply}\n").as_bytes()).await;
+                            let _ = write.flush().await;
+                        }
+                    }
+                });
+            }
+        });
+        seen_rx
+    }
+
+    /// Sockets pointing at a directory, so a lane can be driven on a laptop.
+    fn sockets_in(dir: &Path) -> crate::upstream::Sockets {
+        crate::upstream::Sockets {
+            updater: dir.join("updater.sock"),
+            robot: dir.join("robot.sock"),
+            config: dir.join("config.sock"),
+            pad: dir.join("pad.sock"),
+            tof: dir.join("tof.sock"),
+        }
+    }
+
+    /// **A call crosses the rendezvous and its answer comes back, with no WebRTC anywhere.**
+    ///
+    /// This is the whole of the lane: `POST /send {type:peer, rpc}` in, a JSON-RPC line out to
+    /// the service that owns the answer, and the answer back out as another `peer` envelope. No
+    /// `startSession` is bridged, no offer is exchanged, and nothing in the path can be defeated
+    /// by a NAT — which is the point, because the media path currently can be.
+    #[tokio::test]
+    async fn a_call_crosses_the_rendezvous_with_no_candidate_pair() {
+        let dir = tempfile::tempdir().unwrap();
+        let service = fake_service().await;
+        let sockets = sockets_in(dir.path());
+
+        // `robot.policies` is routed to `robotd`, and this is what a duck answers with.
+        let answer = serde_json::json!({
+            "jsonrpc": "2.0", "id": 1,
+            "result": { "mode": "walk", "enabled": true, "slots": [] },
+        })
+        .to_string();
+        let mut robotd = fake_daemon(&sockets.robot, vec![answer.clone()]);
+
+        let relay = Relay::new(&service.base, signed_in(&dir), meta())
+            .unwrap()
+            .with_timings(brisk())
+            .with_sockets(sockets);
+        let task = tokio::spawn(relay.run());
+        until("registration", || {
+            !service.state.of_type("setPeerStatus").is_empty()
+        })
+        .await;
+
+        service.state.push(serde_json::json!({
+            "type": "peer",
+            "sessionId": "remote-session-1",
+            "rpc": { "jsonrpc": "2.0", "id": 1, "method": "robot.policies", "params": {} },
+        }));
+
+        // The daemon sees the line the consumer wrote, verbatim: this transport routes and does
+        // not rewrite.
+        let asked = tokio::time::timeout(Duration::from_secs(5), robotd.recv())
+            .await
+            .expect("robotd was asked within five seconds")
+            .expect("a line");
+        let asked: serde_json::Value = serde_json::from_str(&asked).unwrap();
+        assert_eq!(asked["method"], "robot.policies");
+        assert_eq!(asked["id"], 1);
+
+        // And the answer comes back as a `peer` envelope naming the same session.
+        until("the answer to reach the service", || {
+            service
+                .state
+                .of_type("peer")
+                .iter()
+                .any(|posted| !posted["rpc"].is_null())
+        })
+        .await;
+        let posted = service
+            .state
+            .of_type("peer")
+            .into_iter()
+            .find(|posted| !posted["rpc"].is_null())
+            .unwrap();
+        assert_eq!(
+            posted["sessionId"], "remote-session-1",
+            "the answer names the session the service routes on"
+        );
+        assert_eq!(
+            posted["rpc"],
+            serde_json::from_str::<serde_json::Value>(&answer).unwrap(),
+            "and the payload is the daemon's own line, unparsed and unwrapped"
+        );
+        task.abort();
+    }
+
+    /// A method this transport refuses is refused *here*, without reaching a daemon.
+    ///
+    /// `route::permits` is what says so, and it is the same table the datachannel uses — so this
+    /// asserts the lane consults it rather than that the answer is what it is. A lane that
+    /// forwarded everything would make the rendezvous a way around a per-transport rule, and the
+    /// pairing PIN is the one that would matter: a peer that can rewrite it locks a phone out of
+    /// the recovery path.
+    #[tokio::test]
+    async fn the_lane_refuses_what_the_route_table_refuses() {
+        let dir = tempfile::tempdir().unwrap();
+        let service = fake_service().await;
+        let sockets = sockets_in(dir.path());
+        // Deliberately no daemon at all: a refusal must not depend on one being there.
+
+        let relay = Relay::new(&service.base, signed_in(&dir), meta())
+            .unwrap()
+            .with_timings(brisk())
+            .with_sockets(sockets);
+        let task = tokio::spawn(relay.run());
+        until("registration", || {
+            !service.state.of_type("setPeerStatus").is_empty()
+        })
+        .await;
+
+        service.state.push(serde_json::json!({
+            "type": "peer",
+            "sessionId": "remote-session-1",
+            "rpc": { "jsonrpc": "2.0", "id": 7, "method": "system.pairingPin", "params": {} },
+        }));
+
+        until("the refusal", || {
+            service
+                .state
+                .of_type("peer")
+                .iter()
+                .any(|posted| !posted["rpc"]["error"].is_null())
+        })
+        .await;
+        let posted = service
+            .state
+            .of_type("peer")
+            .into_iter()
+            .find(|posted| !posted["rpc"]["error"].is_null())
+            .unwrap();
+        assert_eq!(
+            posted["rpc"]["id"], 7,
+            "a refusal answers the call that earned it"
+        );
+        task.abort();
+    }
+
+    /// `media.video` is refused rather than answered with zeros when there is no picture.
+    ///
+    /// The lane can open before the pipeline has said what the video is — the relay starts first,
+    /// on purpose — and it carries no media of its own in any case. A consumer told the frame is
+    /// 0×0 and upright has been handed a wrong number that looks like a right one; told there is
+    /// no video, it can act.
+    #[tokio::test]
+    async fn a_lane_with_no_picture_says_so() {
+        let dir = tempfile::tempdir().unwrap();
+        let service = fake_service().await;
+        let relay = Relay::new(&service.base, signed_in(&dir), meta())
+            .unwrap()
+            .with_timings(brisk())
+            .with_sockets(sockets_in(dir.path()));
+        let task = tokio::spawn(relay.run());
+        until("registration", || {
+            !service.state.of_type("setPeerStatus").is_empty()
+        })
+        .await;
+
+        service.state.push(serde_json::json!({
+            "type": "peer",
+            "sessionId": "remote-session-1",
+            "rpc": { "jsonrpc": "2.0", "id": 3, "method": "media.video", "params": {} },
+        }));
+
+        until("the answer", || {
+            service
+                .state
+                .of_type("peer")
+                .iter()
+                .any(|posted| !posted["rpc"].is_null())
+        })
+        .await;
+        let posted = service
+            .state
+            .of_type("peer")
+            .into_iter()
+            .find(|posted| !posted["rpc"].is_null())
+            .unwrap();
+        assert!(
+            posted["rpc"]["error"]["message"]
+                .as_str()
+                .unwrap_or_default()
+                .contains("not publishing video"),
+            "said {:?}",
+            posted["rpc"]
+        );
+        task.abort();
+    }
+
+    /// What the fake local server saw and said.
+    #[derive(Default)]
+    struct Local {
+        /// Everything the bridge sent it, in order.
+        seen: std::sync::Mutex<Vec<serde_json::Value>>,
+        /// A sender for pushing messages *to* the bridge, once it has connected.
+        push: std::sync::Mutex<Option<tokio::sync::mpsc::UnboundedSender<String>>>,
+    }
+
+    impl Local {
+        fn seen(&self) -> Vec<serde_json::Value> {
+            self.seen.lock().unwrap().clone()
+        }
+
+        fn of_type(&self, kind: &str) -> Vec<serde_json::Value> {
+            self.seen()
+                .into_iter()
+                .filter(|m| m["type"] == kind)
+                .collect()
+        }
+
+        fn push(&self, message: serde_json::Value) {
+            let sender = self
+                .push
+                .lock()
+                .unwrap()
+                .clone()
+                .expect("the bridge has connected");
+            sender
+                .send(message.to_string())
+                .expect("the bridge is listening");
+        }
+    }
+
+    const LOCAL_PRODUCER: &str = "the-robots-own-producer";
+    const LOCAL_SESSION: &str = "local-session-1";
+
+    /// A signalling server that answers the consumer handshake and then relays.
+    ///
+    /// `producers` controls the one interesting failure: a server with none, which is what a
+    /// pipeline that never reached PLAYING looks like from here.
+    async fn fake_signalling(producers: bool) -> (String, std::sync::Arc<Local>) {
+        use axum::extract::State;
+        use axum::extract::ws::{Message, WebSocketUpgrade};
+        use axum::routing::any;
+
+        let local = std::sync::Arc::new(Local::default());
+
+        let app = axum::Router::new()
+            .route(
+                "/",
+                any(move |upgrade: WebSocketUpgrade,
+                     State(local): State<std::sync::Arc<Local>>| async move {
+                    upgrade.on_upgrade(move |mut socket| async move {
+                        let (tx, mut rx) = tokio::sync::mpsc::unbounded_channel::<String>();
+                        *local.push.lock().unwrap() = Some(tx);
+
+                        // The welcome, unprompted, as the real server sends it.
+                        let welcome = serde_json::json!({ "type": "welcome", "peerId": "the-bridge" });
+                        if socket.send(Message::text(welcome.to_string())).await.is_err() {
+                            return;
+                        }
+
+                        loop {
+                            tokio::select! {
+                                incoming = socket.recv() => {
+                                    let Some(Ok(Message::Text(text))) = incoming else { return };
+                                    let message: serde_json::Value =
+                                        serde_json::from_str(&text).expect("the bridge sends JSON");
+                                    let kind = message["type"].as_str().unwrap_or("").to_owned();
+                                    local.seen.lock().unwrap().push(message);
+
+                                    let answer = match kind.as_str() {
+                                        "list" => Some(serde_json::json!({
+                                            "type": "list",
+                                            "producers": if producers {
+                                                serde_json::json!([{ "id": LOCAL_PRODUCER, "meta": {} }])
+                                            } else {
+                                                serde_json::json!([])
+                                            },
+                                        })),
+                                        "startSession" => Some(serde_json::json!({
+                                            "type": "sessionStarted",
+                                            "peerId": LOCAL_PRODUCER,
+                                            "sessionId": LOCAL_SESSION,
+                                        })),
+                                        _ => None,
+                                    };
+                                    if let Some(answer) = answer
+                                        && socket.send(Message::text(answer.to_string())).await.is_err()
+                                    {
+                                        return;
+                                    }
+                                }
+                                pushed = rx.recv() => {
+                                    let Some(pushed) = pushed else { return };
+                                    if socket.send(Message::text(pushed)).await.is_err() {
+                                        return;
+                                    }
+                                }
+                            }
+                        }
+                    })
+                }),
+            )
+            .with_state(std::sync::Arc::clone(&local));
+
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let url = format!("ws://{}/", listener.local_addr().unwrap());
+        tokio::spawn(async move {
+            let _ = axum::serve(listener, app).await;
+        });
+        (url, local)
+    }
+
+    /// **The whole of slice 4: a session's envelopes cross, and their ids are rewritten.**
+    ///
+    /// The two assertions that matter are the two rewrites. An offer from the robot's own
+    /// producer must reach the service carrying the *remote* session id, because that is the id
+    /// the service routes on — and the consumer's answer must reach the local server carrying the
+    /// *local* one, for the same reason on the other side. Getting either backwards produces a
+    /// session where signalling is exchanged and no media ever flows, with nothing in any log to
+    /// say why, which is why this is pinned rather than tried by hand.
+    #[tokio::test]
+    async fn a_remote_session_is_bridged_to_the_local_signalling_server() {
+        let dir = tempfile::tempdir().unwrap();
+        let service = fake_service().await;
+        let (local_url, local) = fake_signalling(true).await;
+
+        let relay = Relay::new(&service.base, signed_in(&dir), meta())
+            .unwrap()
+            .with_timings(brisk())
+            .with_local_signalling(&local_url);
+        let task = tokio::spawn(relay.run());
+        until("registration", || {
+            !service.state.of_type("setPeerStatus").is_empty()
+        })
+        .await;
+
+        // A consumer asks the service for a session with this robot.
+        service.state.push(serde_json::json!({
+            "type": "startSession", "peerId": "a-consumer", "sessionId": "remote-session-1",
+        }));
+
+        // The bridge plays the consumer on the local side: welcome, list, startSession.
+        until("the local handshake", || {
+            !local.of_type("startSession").is_empty()
+        })
+        .await;
+        assert_eq!(
+            local.of_type("startSession")[0]["peerId"],
+            LOCAL_PRODUCER,
+            "the session is asked of the robot's own producer"
+        );
+
+        // The producer offers. `webrtcsink` knows what it is sending, so the offer comes from it.
+        local.push(serde_json::json!({
+            "type": "peer",
+            "sessionId": LOCAL_SESSION,
+            "sdp": { "type": "offer", "sdp": "v=0\r\no=- 1 2 IN IP4 127.0.0.1\r\n" },
+        }));
+
+        until("the offer to reach the service", || {
+            !service.state.of_type("peer").is_empty()
+        })
+        .await;
+        let forwarded = service.state.of_type("peer")[0].clone();
+        assert_eq!(
+            forwarded["sessionId"], "remote-session-1",
+            "outbound envelopes carry the id the *service* routes on"
+        );
+        assert_eq!(
+            forwarded["sdp"]["sdp"], "v=0\r\no=- 1 2 IN IP4 127.0.0.1\r\n",
+            "and the payload is untouched — this process never parses SDP"
+        );
+
+        // The consumer answers, by way of the service.
+        service.state.push(serde_json::json!({
+            "type": "peer",
+            "sessionId": "remote-session-1",
+            "sdp": { "type": "answer", "sdp": "v=0\r\nanswer\r\n" },
+        }));
+
+        until("the answer to reach the robot", || {
+            !local.of_type("peer").is_empty()
+        })
+        .await;
+        let delivered = local.of_type("peer")[0].clone();
+        assert_eq!(
+            delivered["sessionId"], LOCAL_SESSION,
+            "inbound envelopes carry the id the robot's own server routes on"
+        );
+        assert_eq!(delivered["sdp"]["sdp"], "v=0\r\nanswer\r\n");
+
+        task.abort();
+    }
+
+    /// A second consumer is refused by name while one is being carried.
+    ///
+    /// The service gates this itself, so this is the belt-and-braces §3.4 asks for — and the
+    /// reason it stays is that two remote peers writing into one intent slot is the interleaving
+    /// bug `remote-webrtc.md` §9 defers, with a second continent instead of a gamepad.
+    #[tokio::test]
+    async fn a_second_remote_session_is_refused_while_one_is_live() {
+        let dir = tempfile::tempdir().unwrap();
+        let service = fake_service().await;
+        let (local_url, local) = fake_signalling(true).await;
+
+        let relay = Relay::new(&service.base, signed_in(&dir), meta())
+            .unwrap()
+            .with_timings(brisk())
+            .with_local_signalling(&local_url);
+        let task = tokio::spawn(relay.run());
+        until("registration", || {
+            !service.state.of_type("setPeerStatus").is_empty()
+        })
+        .await;
+
+        service.state.push(serde_json::json!({
+            "type": "startSession", "peerId": "first", "sessionId": "remote-1",
+        }));
+        until("the first session", || {
+            !local.of_type("startSession").is_empty()
+        })
+        .await;
+
+        service.state.push(serde_json::json!({
+            "type": "startSession", "peerId": "second", "sessionId": "remote-2",
+        }));
+        until("a refusal", || {
+            !service.state.of_type("endSession").is_empty()
+        })
+        .await;
+
+        let refusal = service.state.of_type("endSession")[0].clone();
+        assert_eq!(
+            refusal["sessionId"], "remote-2",
+            "the second one is what is refused"
+        );
+        assert!(
+            refusal["reason"].as_str().unwrap().contains("already"),
+            "and the reason says the robot is busy rather than broken: {refusal}"
+        );
+        assert_eq!(
+            local.of_type("startSession").len(),
+            1,
+            "the robot's own server was asked for one session, not two"
+        );
+        task.abort();
+    }
+
+    /// A robot whose pipeline never started has no producer to bridge to, and says so.
+    ///
+    /// The peer is told the session is over rather than left waiting on media that is never
+    /// coming — the failure this shape has to avoid is a client that looks connected forever.
+    #[tokio::test]
+    async fn a_robot_with_no_producer_ends_the_session_rather_than_hanging() {
+        let dir = tempfile::tempdir().unwrap();
+        let service = fake_service().await;
+        let (local_url, _local) = fake_signalling(false).await;
+
+        let relay = Relay::new(&service.base, signed_in(&dir), meta())
+            .unwrap()
+            .with_timings(brisk())
+            .with_local_signalling(&local_url);
+        let task = tokio::spawn(relay.run());
+        until("registration", || {
+            !service.state.of_type("setPeerStatus").is_empty()
+        })
+        .await;
+
+        service.state.push(serde_json::json!({
+            "type": "startSession", "peerId": "a-consumer", "sessionId": "remote-session-1",
+        }));
+
+        until("the session to be ended", || {
+            !service.state.of_type("endSession").is_empty()
+        })
+        .await;
+        assert_eq!(
+            service.state.of_type("endSession")[0]["sessionId"],
+            "remote-session-1"
+        );
+        task.abort();
+    }
+
+    /// Jitter is added, and it never shortens the wait.
+    #[test]
+    fn backoff_jitter_only_ever_adds() {
+        for _ in 0..100 {
+            let waited = jittered(Duration::from_secs(10));
+            assert!(waited >= Duration::from_secs(10), "{waited:?}");
+            assert!(waited <= Duration::from_secs(11), "{waited:?}");
+        }
+    }
+}
diff --git a/mediad/src/route.rs b/mediad/src/route.rs
index 47fa7421..977cc11a 100644
--- a/mediad/src/route.rs
+++ b/mediad/src/route.rs
@@ -82,7 +82,7 @@ fn permits(call: &proto::Call) -> bool {
         // camera: it is looking at the robot, which is precisely what a phone in the room over
         // Bluetooth was not. Permitted for that reason, and it would be worth revisiting if a
         // control-only session without video ever becomes a normal thing.
-        RobotEnable(_) | RobotInit | RobotRelax => true,
+        RobotEnable(_) | RobotInit | RobotRelax | RobotRebootMotors(_) => true,
 
         // `robot.stop` is permitted here and refused over BLE, and the difference is honesty
         // rather than authority. BLE's objection was that a stop button over "an unbonded,
@@ -141,6 +141,9 @@ fn permits(call: &proto::Call) -> bool {
         // reads below, and a remote client watching a gait misbehave has an obvious use for it.
         RobotPolicies => true,
 
+        // The robot's static geometry, for a mapper on the other end of the video: a read.
+        RobotModel => true,
+
         // Re-reading the slots goes with loading one: a client that can change what drives the
         // robot wants the case where something else changed it too.
         RobotReloadPolicies => true,
@@ -159,6 +162,10 @@ fn permits(call: &proto::Call) -> bool {
         // neighbour can already replace with `robot.loadPolicy`.
         PolicyFetch(_) | PolicyInstall(_) => true,
 
+        // The detector's set, the same way. Installing one restarts *this* daemon, which ends the
+        // session that asked — the answer is sent before the restart, and the peer reconnects.
+        DetectorCheck | DetectorInstall(_) => true,
+
         // ── the account, permitted, and this one is worth reading ────────────
         //
         // The console is the obvious place to sign a robot in from: it is a page with the robot
@@ -204,6 +211,8 @@ fn permits(call: &proto::Call) -> bool {
         // "it will be through `mediad`'s video path, where depth belongs next to the frame it
         // annotates".
         TofStream => true,
+        // The head IMU rides the same video path, for the same reason: it annotates the frames.
+        HeadImuStream => true,
 
         // ── reading the robot's software ─────────────────────────────────────
         //
@@ -214,6 +223,11 @@ fn permits(call: &proto::Call) -> bool {
 
         // ── identity and status ─────────────────────────────────────────────
         SystemInfo | SystemServices | SystemSetName(_) => true,
+        // A daemon's journal tail. Read-only, and the question that follows a unit reported as
+        // `failed` — which `SystemServices` above can now say and could not explain. Permitted
+        // here for the reason `Show` is: a datachannel has room for a reply BLE has to trim,
+        // so the console is the transport where a whole screenful is cheap.
+        SystemLogs(_) => true,
         // Drops this session, and unlike an update leaves nothing mid-transition: the robot comes
         // back and the client reconnects. It is what you offer a confused robot.
         SystemReboot => true,
@@ -379,6 +393,9 @@ mod tests {
                 // a decision.
                 proto::method::POLICY_INSTALL,
                 proto::method::POLICY_FETCH,
+                // Replacing the detector, which restarts this daemon. Permitted for the policy
+                // set's reason; the session ends and the peer reconnects.
+                proto::method::DETECTOR_INSTALL,
                 // Binding this robot to a Hugging Face account, and unbinding it. The argument
                 // is in the table above — briefly: the console is where somebody would sign a
                 // robot in, a robot that already belongs to somebody refuses without `force`,
@@ -432,6 +449,7 @@ mod tests {
                     | proto::Call::RobotStop
                     | proto::Call::RobotSubscribe(_)
                     | proto::Call::TofStream
+                    | proto::Call::HeadImuStream
                     | proto::Call::PadInput
             );
             if wanted {
@@ -497,6 +515,8 @@ mod tests {
                 query: "microduck".to_owned(),
             }),
             proto::Call::PolicyInstall(proto::PolicyInstallParams::default()),
+            proto::Call::DetectorCheck,
+            proto::Call::DetectorInstall(proto::PolicyInstallParams::default()),
         ] {
             assert!(
                 matches!(route_for(&call), Route::To(..)),
diff --git a/mediad/src/session.rs b/mediad/src/session.rs
index 2b013b42..6c65132e 100644
--- a/mediad/src/session.rs
+++ b/mediad/src/session.rs
@@ -40,16 +40,34 @@ use crate::upstream::Pool;
 /// and the console showed a sideways picture with nothing in the log to say why. The push is kept
 /// as a courtesy for a client that only listens; `media.video` as a *call* is what the console uses,
 /// because a question it asks when it is ready cannot arrive too early.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq)]
 pub struct Video {
     pub width: u32,
     pub height: u32,
     /// Degrees clockwise the camera is mounted from upright.
     pub rotate: u32,
+    /// The camera's geometry, for a consumer that has to turn pixels into directions — SLAM,
+    /// visual odometry, "how far is that". `None` when there is no camera or its mode is not one
+    /// `crate::camera` knows the field of view of, which is a robot that should not be believed
+    /// rather than one to guess about.
+    pub intrinsics: Option<crate::camera::Intrinsics>,
 }
 
-/// The method a peer asks with. Answered here rather than routed: no service owns it.
+/// The methods a peer asks with. Answered here rather than routed: no service owns them.
 const VIDEO_METHOD: &str = "media.video";
+const STREAM_METHOD: &str = "media.stream";
+
+/// What this daemon can answer about its own media, when it has a pipeline to answer from.
+///
+/// One handle rather than two Options, because the two arrive together: both are known only once
+/// the pipeline is up — `sensor_mode()` is not truthful before then, and there are no frames to
+/// encode either — and both are absent for the same reasons, a board with no camera or a lane
+/// opened before the pipeline started. A peer asking either gets a refusal that says which.
+#[derive(Clone)]
+pub struct Media {
+    pub video: Video,
+    pub streamer: std::sync::Arc<crate::stream::Streamer>,
+}
 
 /// What the video is, told to a peer once when its channel opens.
 ///
@@ -61,29 +79,59 @@ const VIDEO_METHOD: &str = "media.video";
 ///
 /// A notification, with no id, because the page already treats an id-less line as something that
 /// streams (`robot.state` is the other one) — no new mechanism at either end.
-pub fn video_notification(video: Video) -> String {
-    let Video {
-        width,
-        height,
-        rotate,
-    } = video;
-    format!(
-        r#"{{"jsonrpc":"2.0","method":"{VIDEO_METHOD}","params":{{"width":{width},"height":{height},"rotate":{rotate}}}}}"#
-    )
+pub fn video_notification(video: &Video) -> String {
+    // Built with `serde_json` rather than `format!` since it gained a nested object: one escaping
+    // mistake in a hand-written line is a peer that cannot parse anything this daemon says.
+    serde_json::json!({
+        "jsonrpc": "2.0",
+        "method": VIDEO_METHOD,
+        "params": video_params(video),
+    })
+    .to_string()
+}
+
+/// The video's description, which the notification pushes and the call answers with.
+///
+/// One function for both, because a peer that asks and a peer that listens must be told the same
+/// thing — and the console does both, a push when the channel opens and a call when it is ready.
+fn video_params(video: &Video) -> serde_json::Value {
+    let mut params = serde_json::json!({
+        "width": video.width,
+        "height": video.height,
+        "rotate": video.rotate,
+        // The two clocks at one instant: RTCP sender reports state RTP time in wall-clock
+        // (`real_ns`), `robot.state`/`tof.frame` stamp with `mono_ns`'s clock. A peer that has both
+        // can put the picture on the robot's axis.
+        "mono_ns": proto::clock::monotonic_ns(),
+        "real_ns": proto::clock::realtime_ns(),
+    });
+    // Absent rather than null when the geometry is unknown: a consumer reading a missing key knows
+    // it must calibrate, where one reading `null` has to be told what that meant.
+    if let Some(intrinsics) = &video.intrinsics {
+        params["intrinsics"] = serde_json::to_value(intrinsics).expect("intrinsics serialise");
+    }
+    params
 }
 
+/// `media` is `None` when there is no pipeline to answer for.
+///
+/// A datachannel always has one — it exists because `webrtcsink` handed over a consumer — but the
+/// rendezvous control lane (`relay::Relay::control`) is JSON-RPC with no media beside it, and it
+/// can open before the pipeline has started. Answering `media.video` with zeros in that case would
+/// be a consumer told the picture is 0×0 and upright, which is worse than being told there is no
+/// picture: one is actionable, the other is a wrong number that looks like a right one.
 pub async fn run(
     mut inbound: mpsc::Receiver<String>,
     outbound: mpsc::Sender<String>,
     mut pool: Pool,
-    video: Video,
+    media: Option<Media>,
 ) {
     while let Some(line) = inbound.recv().await {
         let line = line.trim().to_string();
         if line.is_empty() {
             continue;
         }
-        if let Some(reply) = handle(&line, &mut pool, video).await {
+        if let Some(reply) = handle(&line, &mut pool, media.as_ref()).await {
             // A closed outbound means the peer is gone; there is nothing left to do for it.
             if outbound.send(reply).await.is_err() {
                 break;
@@ -95,7 +143,7 @@ pub async fn run(
 
 /// Route one line. Returns a reply to send back only when this transport answers it itself —
 /// which is to say, only when it refuses.
-async fn handle(line: &str, pool: &mut Pool, video: Video) -> Option<String> {
+async fn handle(line: &str, pool: &mut Pool, media: Option<&Media>) -> Option<String> {
     let request: proto::Request = match serde_json::from_str(line) {
         Ok(request) => request,
         Err(e) => {
@@ -117,17 +165,52 @@ async fn handle(line: &str, pool: &mut Pool, video: Video) -> Option<String> {
     // Answered here, before anything tries to make a `Call` of it: this is `mediad`'s own question
     // about `mediad`'s own pipeline, and there is no service to route it to.
     if request.method == VIDEO_METHOD {
-        return Some(
-            serde_json::to_string(&proto::Response::ok(
+        return Some(match media {
+            Some(media) => {
+                serde_json::to_string(&proto::Response::ok(id, &video_params(&media.video)))
+                    .expect("Response serialises")
+            }
+            None => error_line(
                 id,
-                &serde_json::json!({
-                    "width": video.width,
-                    "height": video.height,
-                    "rotate": video.rotate,
-                }),
-            ))
-            .expect("Response serialises"),
-        );
+                proto::Error::new(
+                    proto::code::INTERNAL_ERROR,
+                    "this robot is not publishing video, so there is no geometry to describe",
+                ),
+            ),
+        });
+    }
+
+    // **The one call that makes this robot send its camera somewhere it was told about.**
+    //
+    // Answered here rather than routed for the same reason `media.video` is — the pipeline is
+    // `mediad`'s and no service owns it — and it is the reason a frame stream needs no relay
+    // candidate: the robot dials out, so a NAT is not a participant. `stream.rs`'s header has the
+    // argument; this is where a peer asks for it.
+    if request.method == STREAM_METHOD {
+        let Some(media) = media else {
+            return Some(error_line(
+                id,
+                proto::Error::new(
+                    proto::code::INTERNAL_ERROR,
+                    "this robot has no camera to stream",
+                ),
+            ));
+        };
+        return Some(match stream_request(&request.params) {
+            // No `url` key at all is a question rather than an instruction, which is what lets a
+            // client show what is streaming without having to remember what it asked for.
+            Ask::Status => {
+                serde_json::to_string(&proto::Response::ok(id, &media.streamer.status()))
+                    .expect("Response serialises")
+            }
+            Ask::Stop => serde_json::to_string(&proto::Response::ok(id, &media.streamer.stop()))
+                .expect("Response serialises"),
+            Ask::Start(config) => match media.streamer.start(config) {
+                Ok(answer) => serde_json::to_string(&proto::Response::ok(id, &answer))
+                    .expect("Response serialises"),
+                Err(why) => error_line(id, proto::Error::new(proto::code::INVALID_PARAMS, why)),
+            },
+        });
     }
 
     let call = match request.as_call() {
@@ -169,6 +252,59 @@ async fn handle(line: &str, pool: &mut Pool, video: Video) -> Option<String> {
 
 /// One refusal, as a line. Built through [`proto::Response`] rather than by hand so the envelope
 /// has exactly one definition — the same reason `duck-ipc-proto` exists.
+/// What a `media.stream` call is asking for.
+///
+/// `url` present is start, `url: null` is stop, no `url` key is a question. The same three-way
+/// reading `robot.loadPolicy` gives `slot` and `path`, and for the same reason: one method that a
+/// client can use to look, to change and to put back is one method to route and one to permit.
+enum Ask {
+    Status,
+    Stop,
+    Start(crate::stream::Config),
+}
+
+fn stream_request(params: &Option<serde_json::Value>) -> Ask {
+    use crate::stream::Config;
+
+    // Absent params is the same question as params with no `url`: a client asking what is
+    // streaming should not have to send `{}` to be understood.
+    let params = match params {
+        None => return Ask::Status,
+        Some(params) => params,
+    };
+    match params.get("url") {
+        None => Ask::Status,
+        Some(serde_json::Value::Null) => Ask::Stop,
+        Some(url) => Ask::Start(Config {
+            url: url.as_str().unwrap_or_default().to_owned(),
+            // Every number is optional: what a caller almost always wants is "stream to here",
+            // and a default that is cheap enough to ignore is better than four required fields.
+            fps: params
+                .get("fps")
+                .and_then(serde_json::Value::as_f64)
+                .unwrap_or(Config::DEFAULT_FPS),
+            longest: params
+                .get("longest")
+                .and_then(serde_json::Value::as_u64)
+                .unwrap_or(Config::DEFAULT_LONGEST as u64) as u32,
+            quality: params
+                .get("quality")
+                .and_then(serde_json::Value::as_u64)
+                .unwrap_or(Config::DEFAULT_QUALITY as u64)
+                .min(100) as u8,
+            // H.264 unless asked otherwise: the encode is the VPU's rather than a core's, and
+            // inter-frame prediction is worth five to fifteen times the bytes over the same
+            // wifi. JPEG stays reachable because it needs no keyframe to start and no decoder
+            // state to keep, which is what a receiver that reconnects constantly wants.
+            encoding: params
+                .get("encoding")
+                .and_then(serde_json::Value::as_str)
+                .and_then(crate::stream::Encoding::parse)
+                .unwrap_or_default(),
+        }),
+    }
+}
+
 fn error_line(id: Option<proto::Id>, error: proto::Error) -> String {
     // A `Response` cannot fail to serialise: every field is a `String`, an `Id` or an `Error`.
     serde_json::to_string(&proto::Response::err(id, error)).expect("Response serialises")
@@ -238,11 +374,36 @@ mod tests {
             inbound,
             outbound,
             pool,
-            Video {
-                width: 1280,
-                height: 720,
-                rotate: 90,
-            },
+            Some(Media {
+                video: Video {
+                    width: 1280,
+                    height: 720,
+                    rotate: 90,
+                    intrinsics: crate::camera::Intrinsics::nominal(
+                        Some(crate::camera::SensorMode::PINNED),
+                        1280,
+                        720,
+                    ),
+                },
+                // A streamer whose encoder produces nothing, which is all this needs: the tests
+                // here are about which method is answered by whom, and an encoder that touched a
+                // pipeline would make the whole file unbuildable off a board.
+                streamer: std::sync::Arc::new(crate::stream::Streamer::new(
+                    crate::stream::Encoders {
+                        jpeg: std::sync::Arc::new(|_| None),
+                        h264: Some(std::sync::Arc::new(|_| None)),
+                        gate: None,
+                    },
+                    crate::producer::Producer {
+                        name: Some("olducky".to_owned()),
+                        serial: Some("3fa1c51b".to_owned()),
+                        release: "0.10.0".to_owned(),
+                        api_version: proto::API_VERSION,
+                    },
+                    90,
+                    dir.path().join("hf-token"),
+                )),
+            }),
         ));
         Harness {
             to_peer,
@@ -406,16 +567,22 @@ mod tests {
         assert!(reply.contains("robot.teleport"), "{reply}");
     }
 
-    /// The line that tells a page how the camera is mounted.
+    /// The line that tells a page how the camera is mounted, and a consumer what its geometry is.
     ///
-    /// Hand-built JSON, so this is the only thing between a console that rotates the picture and one
-    /// that shows it sideways and says nothing.
+    /// This is the only thing between a console that rotates the picture and one that shows it
+    /// sideways and says nothing — and now also between a perception consumer that can turn a
+    /// pixel into a direction and one that has to guess a focal length.
     #[test]
-    fn the_video_notification_carries_the_mount_rotation() {
-        let line = video_notification(Video {
+    fn the_video_notification_carries_the_mount_rotation_and_the_geometry() {
+        let line = video_notification(&Video {
             width: 1280,
             height: 720,
             rotate: 90,
+            intrinsics: crate::camera::Intrinsics::nominal(
+                Some(crate::camera::SensorMode::PINNED),
+                1280,
+                720,
+            ),
         });
         let parsed: serde_json::Value = serde_json::from_str(&line).expect("valid json");
         assert_eq!(parsed["method"], "media.video");
@@ -423,6 +590,35 @@ mod tests {
         assert_eq!(parsed["params"]["width"], 1280);
         assert_eq!(parsed["params"]["height"], 720);
         assert_eq!(parsed["params"]["rotate"], 90);
+
+        let intrinsics = &parsed["params"]["intrinsics"];
+        assert!(
+            (intrinsics["fx"].as_f64().unwrap() - 1065.14).abs() < 0.1,
+            "{intrinsics}"
+        );
+        assert_eq!(intrinsics["cx"], 640.0);
+        assert_eq!(
+            intrinsics["calibrated"], false,
+            "the module's design figures, and a consumer has to be able to tell"
+        );
+    }
+
+    /// A robot whose camera geometry is unknown omits the key rather than sending a null.
+    ///
+    /// Which is every robot streaming a test pattern, and any board where `media-ctl` would not
+    /// set the sensor mode. A consumer reading a missing key knows it has to calibrate; one
+    /// reading `null` has to be told what that meant.
+    #[test]
+    fn an_unknown_geometry_is_absent_from_the_line() {
+        let line = video_notification(&Video {
+            width: 1280,
+            height: 720,
+            rotate: 0,
+            intrinsics: None,
+        });
+        let parsed: serde_json::Value = serde_json::from_str(&line).expect("valid json");
+        assert!(parsed["params"].get("intrinsics").is_none(), "{line}");
+        assert_eq!(parsed["params"]["width"], 1280);
     }
 
     /// `media.video` is answered by the session, not routed to a service.
@@ -430,6 +626,59 @@ mod tests {
     /// This is the path the console uses, and it exists because pushing the same information when
     /// the channel appears races the browser's datachannel and loses — a sideways picture with
     /// nothing in the log. A question the page asks when it is ready cannot arrive too early.
+    /// `media.stream` reads three ways off one key, and the validation is here rather than later.
+    ///
+    /// No `url` is a question, so a client can show what is streaming without remembering what it
+    /// asked for. And a url that is not a WebSocket is refused *before* a thread and a socket are
+    /// spawned for it — a robot that accepted `http://` would sit in a reconnect loop against
+    /// something that can never upgrade, having told the caller yes.
+    #[tokio::test]
+    async fn media_stream_answers_the_question_and_refuses_a_bad_url() {
+        let dir = tempfile::tempdir().unwrap();
+        let mut h = harness(sockets_in(dir.path()), dir);
+
+        async fn ask(h: &mut Harness, line: &str) -> serde_json::Value {
+            h.from_peer.send(line.into()).await.unwrap();
+            serde_json::from_str(&h.to_peer.recv().await.unwrap()).expect("valid json")
+        }
+
+        let answer = ask(
+            &mut h,
+            r#"{"jsonrpc":"2.0","id":1,"method":"media.stream"}"#,
+        )
+        .await;
+        assert_eq!(answer["result"]["streaming"], false, "{answer}");
+        assert_eq!(answer["result"]["sent"], 0);
+
+        let answer = ask(
+            &mut h,
+            r#"{"jsonrpc":"2.0","id":2,"method":"media.stream","params":{"url":"http://a.b"}}"#,
+        )
+        .await;
+        assert_eq!(
+            answer["error"]["code"],
+            proto::code::INVALID_PARAMS,
+            "{answer}"
+        );
+        assert!(
+            answer["error"]["message"]
+                .as_str()
+                .unwrap()
+                .contains("ws://"),
+            "the refusal says what a url has to be: {answer}"
+        );
+
+        // Stopping something that was never started is not an error: a client tidying up after
+        // itself should not have to know whether there was anything to tidy.
+        let answer = ask(
+            &mut h,
+            r#"{"jsonrpc":"2.0","id":3,"method":"media.stream","params":{"url":null}}"#,
+        )
+        .await;
+        assert_eq!(answer["result"]["streaming"], false, "{answer}");
+        assert_eq!(answer["result"]["was"], serde_json::Value::Null);
+    }
+
     #[tokio::test]
     async fn the_page_can_ask_what_the_video_is() {
         let dir = tempfile::tempdir().unwrap();
diff --git a/mediad/src/snapshot.rs b/mediad/src/snapshot.rs
new file mode 100644
index 00000000..d19fa25e
--- /dev/null
+++ b/mediad/src/snapshot.rs
@@ -0,0 +1,134 @@
+//! A bounded local snapshot client for the HTTP console; camera bytes never enter control routing.
+use anyhow::{Context, Result, ensure};
+use duck_ipc_proto as proto;
+use std::path::Path;
+use tokio::io::{AsyncBufReadExt, AsyncReadExt, AsyncWriteExt, BufReader};
+use tokio::net::UnixStream;
+
+pub(crate) async fn fetch(socket: &Path) -> Result<(proto::MediaFrameHeader, Vec<u8>)> {
+    tokio::time::timeout(std::time::Duration::from_secs(3), async {
+        let stream = UnixStream::connect(socket).await?;
+        let (read, mut write) = stream.into_split();
+        let mut reader = BufReader::new(read);
+        // A normal version handshake, followed by the deliberately unrouted binary method.
+        let request = proto::Request::call(
+            proto::Id::Number(1),
+            &proto::Call::Hello(proto::HelloParams {
+                api_version: proto::API_VERSION,
+            }),
+        );
+        let mut line = serde_json::to_vec(&request)?;
+        line.push(b'\n');
+        write.write_all(&line).await?;
+        let hello = response(&mut reader, 1).await?;
+        let hello: proto::HelloResult = serde_json::from_value(hello)?;
+        ensure!(
+            hello.api_version == proto::API_VERSION,
+            "camera API version mismatch"
+        );
+        let request = proto::Request {
+            jsonrpc: "2.0".into(),
+            id: Some(proto::Id::Number(2)),
+            method: proto::method::MEDIA_FRAME.into(),
+            params: None,
+        };
+        let mut line = serde_json::to_vec(&request)?;
+        line.push(b'\n');
+        write.write_all(&line).await?;
+        let header: proto::MediaFrameHeader =
+            serde_json::from_value(response(&mut reader, 2).await?)?;
+        ensure!(
+            header.valid_uyvy(),
+            "invalid camera geometry or payload size"
+        );
+        let mut data = vec![0; header.bytes];
+        reader.read_exact(&mut data).await?;
+        Ok((header, data))
+    })
+    .await
+    .context("camera snapshot timed out")?
+}
+
+async fn response(
+    reader: &mut (impl tokio::io::AsyncBufRead + Unpin),
+    id: u64,
+) -> Result<serde_json::Value> {
+    let mut line = Vec::new();
+    reader.take(4097).read_until(b'\n', &mut line).await?;
+    ensure!(
+        line.len() <= 4096 && line.ends_with(b"\n"),
+        "invalid camera response length"
+    );
+    let response: proto::Response = serde_json::from_slice(&line)?;
+    ensure!(
+        response.jsonrpc == "2.0" && response.id == Some(proto::Id::Number(id)),
+        "camera response ID mismatch"
+    );
+    if let Some(error) = response.error {
+        anyhow::bail!("camera: {}", error.message);
+    }
+    response.result.context("camera response has no result")
+}
+
+/// Encode the frame as a PNG, upright.
+///
+/// **This is the one consumer that has nowhere to put the rotation.** A PNG opened in a browser
+/// or piped into a viewer carries no `rotate` alongside it, so a snapshot route that returned the
+/// sensor's own orientation would hand every human a sideways picture and no way to know why. The
+/// raw UYVY path keeps its "told, not applied" contract — the header names the angle and the
+/// recorder turns it — but here the header *is* the thing being thrown away.
+///
+/// It costs nothing the hot path would notice: this runs once per request on a blocking thread,
+/// not thirty times a second in front of the encoder, which is what made `videoflip` expensive.
+pub(crate) fn png(header: proto::MediaFrameHeader, data: Vec<u8>) -> Result<Vec<u8>> {
+    use image::ImageEncoder;
+    let turn = duck_detect::Turn::from_degrees(header.rotate)
+        .context("camera reported a mount that is not a quarter turn")?;
+    let mut rgb = Vec::new();
+    // The turned dimensions, not the header's: a quarter turn swaps the axes, and encoding the
+    // capture geometry over rotated pixels is a diagonally sheared image rather than an error.
+    let (width, height) = duck_detect::rgb_from_uyvy(
+        &data,
+        header.width as usize,
+        header.height as usize,
+        // No downscale. `max` is the same either side of a quarter turn, so this stays the
+        // longest edge whichever way the frame is about to go.
+        header.width.max(header.height) as usize,
+        turn,
+        &mut rgb,
+    );
+    let mut encoded = Vec::new();
+    image::codecs::png::PngEncoder::new(&mut encoded).write_image(
+        &rgb,
+        width as u32,
+        height as u32,
+        image::ExtendedColorType::Rgb8,
+    )?;
+    Ok(encoded)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[tokio::test]
+    async fn malformed_or_unmatched_headers_fail_before_pixels_are_allocated() {
+        for bytes in [
+            vec![b'x'; 4097],
+            vec![255, b'\n'],
+            b"{\"jsonrpc\":\"2.0\",\"id\":99,\"result\":{}}\n".to_vec(),
+        ] {
+            let mut reader = BufReader::new(bytes.as_slice());
+            assert!(response(&mut reader, 2).await.is_err());
+        }
+    }
+    #[tokio::test]
+    async fn silent_camera_has_a_deadline() {
+        let dir = tempfile::tempdir().unwrap();
+        let socket = dir.path().join("media.sock");
+        let _listener = tokio::net::UnixListener::bind(&socket).unwrap();
+        let result = tokio::time::timeout(std::time::Duration::from_secs(5), fetch(&socket))
+            .await
+            .unwrap();
+        assert!(result.unwrap_err().to_string().contains("timed out"));
+    }
+}
diff --git a/mediad/src/stream.rs b/mediad/src/stream.rs
new file mode 100644
index 00000000..168c5061
--- /dev/null
+++ b/mediad/src/stream.rs
@@ -0,0 +1,983 @@
+//! Frames out to a WebSocket **this robot dials**, for a Space that runs a model on them.
+//!
+//! # This is the fallback, and WebRTC is the default
+//!
+//! **A consumer should use WebRTC**, which carries encrypted media, a control channel on the same
+//! session and a return path, and which reaches a data centre because the robot offers a relay
+//! candidate (`remote-access-design.md` §6). `docs/faq.md` is the decision, in the shape somebody
+//! arrives at it. This module is for the narrow case WebRTC serves badly: a **program** consuming
+//! **frames only** on a **long-running** stream, where a relay's metered bandwidth is the cost
+//! that matters.
+//!
+//! In that case an outbound WebSocket needs nobody's relay. **The robot already proves this every
+//! second it is reachable**: `relay.rs` holds an outbound HTTPS stream to a Space right now, and
+//! nothing about a home router objects. So the frames go the same way the registration does —
+//! outward — and NAT stops being a participant.
+//!
+//! ```text
+//!   Space  ──media.stream {url: "wss://…/frames"}──►  rendezvous  ──►  this robot
+//!   robot  ═══════════ JPEG frames, outbound wss, direct ═══════════►  Space
+//! ```
+//!
+//! The rendezvous carries **the instruction and not the pixels**, which is the property that makes
+//! this scale where relaying payload through a shared service would not: one small envelope per
+//! session, on a service the mini fleet also depends on, and the bytes go point to point.
+//!
+//! **This was written when the relay endpoint was dead and WebRTC could not connect from a data
+//! centre at all.** That is fixed (§6), so the reason this exists is now the narrow one above and
+//! not "the alternative does not work". What survives of the original argument is the cost: a
+//! relay is metered per Hugging Face account at 10 GB a month, and a stream that runs all day
+//! spends an allowance its owner also needs for being *watched*.
+//!
+//! # What it is not
+//!
+//! **Not a replacement for WebRTC, and not the path to reach for first.** There is no return
+//! media path and no control channel, so nothing here helps a browser *watch* a robot, carries
+//! audio, or closes a teleop loop; driving means a separate JSON-RPC call over the rendezvous.
+//! Encryption is the receiver's TLS rather than DTLS-SRTP, terminating at a server instead of at
+//! the peer. A consumer that is not all three of program, frames-only and long-running wants §6.
+//!
+//! # This half is portable, and that is deliberate
+//!
+//! [`pump`] takes a channel of already-encoded frames and knows nothing about GStreamer, so the
+//! reconnect, the backoff, the framing and the counters are all exercised on a laptop against a
+//! fake server. What touches [`crate::pipeline::Frames`] is [`encode_frames`], which is the thin
+//! linux-only half: read a frame, turn it upright, JPEG it, hand it over. The same split
+//! `session.rs` has, for the same reason — every failure worth testing here is a timing failure.
+
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
+use std::time::Duration;
+
+use futures_util::{SinkExt as _, StreamExt as _};
+#[cfg(target_os = "linux")]
+use image::ImageEncoder as _;
+
+/// What the frames are, on the wire.
+///
+/// The hello carries this, so a receiver branches on it rather than sniffing bytes — and so that
+/// adding the second one was a field rather than a protocol.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub enum Encoding {
+    /// One JPEG per message, every one independently decodable.
+    Jpeg,
+    /// H.264 access units, SPS/PPS in front of every keyframe.
+    ///
+    /// **Cheaper on the board and on the wire, and not free.** The encode is the VPU's rather than
+    /// the CPU's and inter-frame prediction is worth five to fifteen times the bytes — but a
+    /// receiver joining mid-stream can decode nothing until a keyframe arrives, and a dropped
+    /// frame corrupts every frame after it until the next one. Both of those are handled here
+    /// rather than wished away: see [`Streamer::start`]'s drop policy and
+    /// `pipeline::force_keyframe`.
+    #[default]
+    H264,
+}
+
+impl Encoding {
+    pub fn wire_name(self) -> &'static str {
+        match self {
+            Self::Jpeg => "jpeg",
+            Self::H264 => "h264",
+        }
+    }
+
+    pub fn parse(name: &str) -> Option<Self> {
+        match name.to_ascii_lowercase().as_str() {
+            "jpeg" | "jpg" | "mjpeg" => Some(Self::Jpeg),
+            "h264" | "avc" => Some(Self::H264),
+            _ => None,
+        }
+    }
+}
+
+/// One encoded thing to send: a JPEG, or an H.264 access unit.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Unit {
+    pub bytes: Vec<u8>,
+    /// Whether a receiver could start decoding here. Always true for JPEG; true for an H.264 IDR.
+    ///
+    /// **This is what makes the drop policy correct.** Discarding the oldest and keeping the
+    /// newest is right for independent frames and wrong for a predicted stream: the newest P-frame
+    /// refers to one that was thrown away, so a receiver decodes garbage until the next keyframe.
+    /// Knowing which is which is the difference between dropping a frame and corrupting a second.
+    pub keyframe: bool,
+}
+
+/// What to send, and where.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Config {
+    /// `wss://…` for anything that is not on this network. `ws://` is accepted because a laptop
+    /// on the bench serving a receiver over TLS is a certificate nobody wants to make, and it is
+    /// logged either way — the destination of this robot's camera is worth a line in the journal.
+    pub url: String,
+    /// Frames a second. Not the capture rate: every frame costs a colour conversion and a JPEG on
+    /// the CPU, and what receives them is a model that does not want thirty.
+    pub fps: f64,
+    /// The longest side, in pixels. Downscale only.
+    pub longest: u32,
+    /// JPEG quality, 1..=100. Ignored for H.264, whose bitrate is the pipeline's.
+    pub quality: u8,
+    pub encoding: Encoding,
+}
+
+impl Config {
+    /// What a caller gets for asking for nothing: enough for a model, cheap enough to ignore.
+    pub const DEFAULT_FPS: f64 = 5.0;
+    pub const DEFAULT_LONGEST: u32 = 640;
+    pub const DEFAULT_QUALITY: u8 = 70;
+
+    /// How long to wait between pulls, which is nothing when the source paces itself.
+    ///
+    /// A JPEG is made on demand from whatever the camera last captured, so the rate is this
+    /// thread's to keep. An H.264 unit arrives when the encoder emits one, and the rate was
+    /// already imposed by a `videorate` in the pipeline — so waiting here would delay a frame
+    /// that exists rather than avoid making one.
+    pub fn interval(&self) -> Duration {
+        if self.encoding == Encoding::H264 {
+            return Duration::ZERO;
+        }
+        let fps = if self.fps.is_finite() {
+            self.fps
+        } else {
+            Self::DEFAULT_FPS
+        };
+        Duration::from_secs_f64(1.0 / fps.clamp(0.2, 15.0))
+    }
+}
+
+/// What a stream has done so far, for `media.stream`'s answer.
+#[derive(Debug, Default)]
+pub struct Counters {
+    pub connected: AtomicBool,
+    /// Frames handed to the socket.
+    pub sent: AtomicU64,
+    /// Frames encoded and thrown away because the socket was not keeping up.
+    ///
+    /// **Dropping is correct, and what to drop depends on the encoding.** For JPEG the newest
+    /// frame is what a model wants, so the oldest goes. For H.264 a gap corrupts everything until
+    /// the next keyframe, so the stream is abandoned to the next one instead — which is why this
+    /// can jump by a whole group of pictures at a time.
+    pub dropped: AtomicU64,
+    /// Text frames the far end sent back — a model's answers, if it sends any.
+    pub replies: AtomicU64,
+    pub reconnects: AtomicU64,
+}
+
+/// How long to wait before redialling, and how much of itself to add as jitter.
+///
+/// A struct rather than constants for the reason `relay::Timings` is one: every failure worth
+/// testing here is a timing failure, and a test that waited two real seconds per reconnect would
+/// be a test nobody runs. `tokio`'s paused clock would do it too, at the cost of a feature on the
+/// dependency for the whole crate.
+#[derive(Debug, Clone, Copy)]
+pub struct Timings {
+    pub backoff_start: Duration,
+    pub backoff_max: Duration,
+    pub jitter: f64,
+}
+
+impl Default for Timings {
+    fn default() -> Self {
+        Self {
+            backoff_start: Duration::from_secs(2),
+            backoff_max: Duration::from_secs(30),
+            jitter: 0.2,
+        }
+    }
+}
+
+/// Dial `url`, send `hello`, then forward every frame until told to stop.
+///
+/// Reconnects for as long as `running` says so: a Space restarts on every push and sleeps when
+/// nobody is looking at it, so a receiver going away is the ordinary case rather than the end of
+/// the stream. Frames encoded while there is no socket are dropped, not queued — see
+/// [`Counters::dropped`].
+pub async fn pump(
+    url: String,
+    token: Option<String>,
+    hello: String,
+    mut frames: tokio::sync::mpsc::Receiver<Vec<u8>>,
+    counters: Arc<Counters>,
+    running: Arc<AtomicBool>,
+    timings: Timings,
+) {
+    let mut backoff = timings.backoff_start;
+    while running.load(Ordering::Relaxed) {
+        match connect(&url, token.as_deref()).await {
+            Err(why) => {
+                counters.connected.store(false, Ordering::Relaxed);
+                tracing::warn!(%url, %why, "the frame receiver could not be reached");
+            }
+            Ok(mut socket) => {
+                counters.connected.store(true, Ordering::Relaxed);
+                backoff = timings.backoff_start;
+                tracing::info!(%url, "streaming frames to a receiver this robot dialled");
+
+                let outcome = carry(&mut socket, &hello, &mut frames, &counters, &running).await;
+                counters.connected.store(false, Ordering::Relaxed);
+                // Closed politely, so the far end knows this was not a crash.
+                let _ = socket.close(None).await;
+                match outcome {
+                    Carried::Stopped => break,
+                    Carried::Lost(why) => tracing::info!(%url, %why, "the frame stream dropped"),
+                }
+            }
+        }
+        if !running.load(Ordering::Relaxed) {
+            break;
+        }
+        counters.reconnects.fetch_add(1, Ordering::Relaxed);
+        tokio::time::sleep(jittered(backoff, timings.jitter)).await;
+        backoff = (backoff * 2).min(timings.backoff_max);
+    }
+    counters.connected.store(false, Ordering::Relaxed);
+    tracing::info!(%url, "the frame stream ended");
+}
+
+type Socket =
+    tokio_tungstenite::WebSocketStream<tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>>;
+
+/// Why [`carry`] returned, which decides whether to redial.
+enum Carried {
+    /// Asked to stop. Nothing to redial.
+    Stopped,
+    Lost(String),
+}
+
+async fn connect(url: &str, token: Option<&str>) -> Result<Socket, String> {
+    use tokio_tungstenite::tungstenite::client::IntoClientRequest as _;
+
+    let mut request = url
+        .into_client_request()
+        .map_err(|e| format!("{url} is not a WebSocket url: {e}"))?;
+    if let Some(token) = token {
+        // **The robot's own credential, as the handshake header.** The receiver is a public
+        // endpoint, so it has to be able to say whose camera this is — the same `whoami-v2`
+        // resolution the rendezvous does with this token. Without it a Space would take frames
+        // from anybody and show them to anybody.
+        let value = format!("Bearer {token}")
+            .parse()
+            .map_err(|_| "the account token is not a header value".to_owned())?;
+        request.headers_mut().insert("authorization", value);
+    }
+    let (socket, _) = tokio_tungstenite::connect_async(request)
+        .await
+        .map_err(|e| e.to_string())?;
+    Ok(socket)
+}
+
+async fn carry(
+    socket: &mut Socket,
+    hello: &str,
+    frames: &mut tokio::sync::mpsc::Receiver<Vec<u8>>,
+    counters: &Counters,
+    running: &AtomicBool,
+) -> Carried {
+    use tokio_tungstenite::tungstenite::Message;
+
+    // **What is coming, before any of it arrives.** A receiver reading binary frames has no way to
+    // know their size, their rate or which robot's camera they are, and guessing from the first
+    // JPEG is a decoder's job rather than a protocol.
+    if let Err(e) = socket.send(Message::Text(hello.into())).await {
+        return Carried::Lost(format!("the hello would not send: {e}"));
+    }
+
+    loop {
+        tokio::select! {
+            frame = frames.recv() => match frame {
+                None => return Carried::Stopped,
+                Some(frame) => {
+                    if !running.load(Ordering::Relaxed) {
+                        return Carried::Stopped;
+                    }
+                    if let Err(e) = socket.send(Message::Binary(frame.into())).await {
+                        return Carried::Lost(format!("a frame would not send: {e}"));
+                    }
+                    counters.sent.fetch_add(1, Ordering::Relaxed);
+                }
+            },
+            // **Read, or the connection dies of politeness.** tungstenite answers pings while the
+            // stream is polled and not otherwise, so a sender that only ever writes stops
+            // answering keepalives and the far end hangs up. Whatever the receiver says back — a
+            // model's answer — is counted and logged rather than acted on: nothing on this robot
+            // has asked to be driven by it.
+            inbound = socket.next() => match inbound {
+                None => return Carried::Lost("the receiver closed the socket".to_owned()),
+                Some(Err(e)) => return Carried::Lost(e.to_string()),
+                Some(Ok(Message::Close(_))) => {
+                    return Carried::Lost("the receiver said goodbye".to_owned());
+                }
+                Some(Ok(Message::Text(text))) => {
+                    counters.replies.fetch_add(1, Ordering::Relaxed);
+                    tracing::debug!(reply = %text.chars().take(200).collect::<String>(),
+                        "the frame receiver answered");
+                }
+                Some(Ok(_)) => {}
+            },
+        }
+    }
+}
+
+fn jittered(base: Duration, jitter: f64) -> Duration {
+    base + base.mul_f64(jitter).mul_f64(rand::random::<f64>())
+}
+
+/// One encoded frame, on demand, at the size and quality asked for.
+///
+/// A closure rather than a `Frames` handle, and that is what keeps this module portable:
+/// everything that touches GStreamer lives on the far side of it, and the linux-only half is
+/// [`jpeg_encoder`] alone. On a laptop a test supplies a closure that returns bytes.
+pub type Encode = Arc<dyn Fn(&Config) -> Option<Unit> + Send + Sync>;
+
+/// The ways this robot can encode what it streams, and the gate on the expensive one.
+///
+/// Both are held rather than one chosen at startup, because `media.stream` names an encoding per
+/// call: H.264 by default, and JPEG for a receiver that reconnects constantly enough to care more
+/// about starting instantly than about bytes.
+pub struct Encoders {
+    pub jpeg: Encode,
+    /// `None` on a board with no H.264 encoder at all, where asking for it is refused with that
+    /// as the reason rather than accepted and silently served as JPEG.
+    pub h264: Option<Encode>,
+    /// Opens and shuts the H.264 branch's valve. `true` on start, `false` on stop.
+    pub gate: Option<Arc<dyn Fn(bool) + Send + Sync>>,
+}
+
+/// The robot's frame stream: at most one, started and stopped by `media.stream`.
+///
+/// **One at a time**, and unlike the media path that is a resource decision rather than a
+/// protocol one: every frame costs a colour conversion and a JPEG on a CPU that is also running a
+/// control loop, so two receivers would be two of that. A second `media.stream` replaces the
+/// first, which is also the only way to change the rate without a stop.
+pub struct Streamer {
+    encoders: Encoders,
+    producer: crate::producer::Producer,
+    /// The mount angle, for the hello — these frames are already upright, and a receiver has to be
+    /// told that rather than left to apply it twice.
+    rotate: u32,
+    token_path: std::path::PathBuf,
+    timings: Timings,
+    live: std::sync::Mutex<Option<Live>>,
+}
+
+struct Live {
+    config: Config,
+    running: Arc<AtomicBool>,
+    counters: Arc<Counters>,
+}
+
+impl Drop for Live {
+    fn drop(&mut self) {
+        // Both halves watch this: the encoder thread stops reading frames, and the pump stops
+        // redialling. Dropping the channel is what actually wakes the pump.
+        self.running.store(false, Ordering::Relaxed);
+    }
+}
+
+impl Streamer {
+    pub fn new(
+        encoders: Encoders,
+        producer: crate::producer::Producer,
+        rotate: u32,
+        token_path: impl Into<std::path::PathBuf>,
+    ) -> Self {
+        Self {
+            encoders,
+            producer,
+            rotate,
+            token_path: token_path.into(),
+            timings: Timings::default(),
+            live: std::sync::Mutex::new(None),
+        }
+    }
+
+    pub fn with_timings(mut self, timings: Timings) -> Self {
+        self.timings = timings;
+        self
+    }
+
+    /// Start streaming, replacing whatever was streaming before.
+    pub fn start(&self, config: Config) -> Result<serde_json::Value, String> {
+        if config.url.is_empty() {
+            return Err("no url to stream to".to_owned());
+        }
+        if !(config.url.starts_with("ws://") || config.url.starts_with("wss://")) {
+            return Err(format!("{} is not a ws:// or wss:// url", config.url));
+        }
+        if !(1..=100).contains(&config.quality) {
+            return Err("quality is 1..=100".to_owned());
+        }
+
+        // **Logged before anything is sent, at info.** This is the one call that makes a robot
+        // hand its camera to somewhere it was told about rather than somewhere it knows, so where
+        // that was has to be in the journal whether or not anybody was watching the page that
+        // asked. `remote-webrtc.md` §4 leaves this transport ungated on purpose; a line in the
+        // log is what makes that decision auditable rather than invisible.
+        tracing::info!(
+            url = %config.url, fps = config.fps, longest = config.longest,
+            "asked to stream frames out"
+        );
+
+        let encode = match config.encoding {
+            Encoding::Jpeg => Arc::clone(&self.encoders.jpeg),
+            Encoding::H264 => match self.encoders.h264.as_ref() {
+                Some(encode) => Arc::clone(encode),
+                None => {
+                    return Err(
+                        "this robot has no H.264 encoder, so it can only stream jpeg — ask for \
+                         `\"encoding\": \"jpeg\"`"
+                            .to_owned(),
+                    );
+                }
+            },
+        };
+        // Opened before the encoder thread reads, or its first pull waits a whole frame timeout
+        // for a branch nothing is flowing through.
+        if let Some(gate) = self.encoders.gate.as_ref() {
+            gate(config.encoding == Encoding::H264);
+        }
+
+        let running = Arc::new(AtomicBool::new(true));
+        let counters = Arc::new(Counters::default());
+        // Two deep: the newest frame and one in flight. A model wants the freshest picture, so a
+        // frame encoded while the socket is behind is dropped rather than queued — a backlog is
+        // latency that never comes back, and `Counters::dropped` is how a caller sees it happening.
+        let (to_socket, from_encoder) = tokio::sync::mpsc::channel::<Vec<u8>>(2);
+
+        let interval = config.interval();
+        let for_encoder = config.clone();
+        let encoding = Arc::clone(&running);
+        let counted = Arc::clone(&counters);
+        std::thread::Builder::new()
+            .name("frame-stream".to_owned())
+            .spawn(move || {
+                // Set after a drop on a predicted stream: everything until the next keyframe
+                // would decode against a frame the receiver never got, so it is skipped rather
+                // than sent. For JPEG this never becomes true — every unit is a keyframe.
+                let mut awaiting_key = false;
+
+                while encoding.load(Ordering::Relaxed) {
+                    let began = std::time::Instant::now();
+                    if let Some(unit) = encode(&for_encoder) {
+                        if awaiting_key && !unit.keyframe {
+                            counted.dropped.fetch_add(1, Ordering::Relaxed);
+                            continue;
+                        }
+                        awaiting_key = false;
+                        match to_socket.try_send(unit.bytes) {
+                            Ok(()) => {}
+                            Err(tokio::sync::mpsc::error::TrySendError::Full(_)) => {
+                                counted.dropped.fetch_add(1, Ordering::Relaxed);
+                                // A gap has happened. On a predicted stream the only safe thing
+                                // to send next is a keyframe.
+                                awaiting_key = !unit.keyframe || awaiting_key;
+                                if for_encoder.encoding == Encoding::H264 {
+                                    awaiting_key = true;
+                                }
+                            }
+                            // The pump is gone, so there is nowhere left to send.
+                            Err(tokio::sync::mpsc::error::TrySendError::Closed(_)) => return,
+                        }
+                    }
+                    // Zero for a source that paces itself: an H.264 appsink blocks until the
+                    // encoder produces, and `videorate` upstream is what limits the rate. Sleeping
+                    // on top of that would only add latency to frames that already exist.
+                    if let Some(rest) = interval.checked_sub(began.elapsed()) {
+                        std::thread::sleep(rest);
+                    }
+                }
+            })
+            .map_err(|e| format!("no thread for the frame stream: {e}"))?;
+
+        tokio::spawn(pump(
+            config.url.clone(),
+            hf_robot_account::read_access_token(&self.token_path),
+            hello(&config, &self.producer, self.rotate),
+            from_encoder,
+            Arc::clone(&counters),
+            Arc::clone(&running),
+            self.timings,
+        ));
+
+        let answer = describe(Some(&config), &counters);
+        *self.live.lock().expect("not poisoned") = Some(Live {
+            config,
+            running,
+            counters,
+        });
+        Ok(answer)
+    }
+
+    /// Stop streaming. Answers whether there was anything to stop.
+    pub fn stop(&self) -> serde_json::Value {
+        let was = self.live.lock().expect("not poisoned").take();
+        // Shut the branch whatever it was streaming: a valve left open is a second encode for
+        // nobody, which is the cost this whole arrangement exists to avoid.
+        if let Some(gate) = self.encoders.gate.as_ref() {
+            gate(false);
+        }
+        match &was {
+            Some(live) => tracing::info!(url = %live.config.url, "the frame stream was stopped"),
+            None => tracing::debug!("nothing was streaming"),
+        }
+        serde_json::json!({ "streaming": false, "was": was.as_ref().map(|l| l.config.url.clone()) })
+    }
+
+    /// What is streaming and how it is going.
+    pub fn status(&self) -> serde_json::Value {
+        let live = self.live.lock().expect("not poisoned");
+        match live.as_ref() {
+            None => describe(None, &Counters::default()),
+            Some(live) => describe(Some(&live.config), &live.counters),
+        }
+    }
+}
+
+fn describe(config: Option<&Config>, counters: &Counters) -> serde_json::Value {
+    let mut answer = serde_json::json!({
+        "streaming": config.is_some(),
+        "sent": counters.sent.load(Ordering::Relaxed),
+        "dropped": counters.dropped.load(Ordering::Relaxed),
+        "replies": counters.replies.load(Ordering::Relaxed),
+        "reconnects": counters.reconnects.load(Ordering::Relaxed),
+        "connected": counters.connected.load(Ordering::Relaxed),
+    });
+    if let Some(config) = config {
+        answer["url"] = config.url.clone().into();
+        answer["fps"] = config.fps.into();
+        answer["longest"] = config.longest.into();
+        answer["quality"] = config.quality.into();
+    }
+    answer
+}
+
+/// The line that opens a stream, so a receiver knows what it is about to be sent.
+pub fn hello(config: &Config, producer: &crate::producer::Producer, rotate: u32) -> String {
+    serde_json::json!({
+        "type": "hello",
+        "robot": {
+            "name": producer.name,
+            "serial": producer.serial,
+            "release": producer.release,
+            "api_version": producer.api_version,
+            "kind": "microduck",
+        },
+        "frames": {
+            "encoding": config.encoding.wire_name(),
+            "longest": config.longest,
+            "fps": config.fps,
+            "quality": config.quality,
+            // Zero, always, and said out loud: unlike the WebRTC path, these frames are turned
+            // upright before they are encoded. A receiver that honoured a mount angle here would
+            // rotate an already-upright picture.
+            "rotate": 0,
+            "mount_rotate": rotate,
+            // H.264 only, and stated because it decides how a receiver frames what arrives: one
+            // WebSocket message is one access unit, with SPS and PPS repeated in front of every
+            // keyframe (`h264parse config-interval=-1`), so a receiver that joins mid-stream needs
+            // nothing from the messages it missed.
+            "annexb": config.encoding == Encoding::H264,
+        },
+    })
+    .to_string()
+}
+
+/// The linux half for H.264: take the next access unit the branch's encoder produced.
+///
+/// Nothing is converted or copied here beyond the unit itself — the VPU did the work, upstream of
+/// an appsink — which is the whole reason to prefer this over JPEG on a board. The rate was
+/// imposed by a `videorate` in the branch, so this blocks until there is something and never
+/// paces anything itself ([`Config::interval`] returns zero for it).
+///
+/// Opening the valve is [`Encoders::gate`]'s job rather than this closure's, so that a stream
+/// which stops shuts it again: a second encoder running for nobody is what the valve exists to
+/// prevent.
+#[cfg(target_os = "linux")]
+pub fn h264_encoder(branch: crate::pipeline::StreamBranch) -> Encode {
+    Arc::new(move |_config: &Config| {
+        let (bytes, keyframe) = branch.encoded.next_unit()?;
+        Some(Unit { bytes, keyframe })
+    })
+}
+
+/// The linux half: read a frame off the tee, turn it upright, and JPEG it.
+///
+/// **The only part of this module that knows a pipeline exists.** Everything above takes bytes
+/// from a channel, which is what lets the reconnect and the framing be tested on a laptop; this is
+/// four lines of pixels and a call into `duck-detect`, where the UYVY arithmetic already lives
+/// because the detector needed exactly the same conversion.
+///
+/// `next_frame` blocks on a condvar until the *next* capture, so this runs on its own thread —
+/// [`Streamer::start`] gives it one, the same way the detector and the exposure loop have theirs.
+/// A frame is asked for rather than published, which is the whole design of `Frames`: at 5 fps
+/// this copies five of thirty rather than all thirty.
+#[cfg(target_os = "linux")]
+pub fn jpeg_encoder(frames: crate::pipeline::Frames, turn: duck_detect::Turn) -> Encode {
+    // Reused across frames: at 640×480 the RGB buffer is 920 KB, and allocating that five times a
+    // second forever is a page fault storm for no reason. A `Mutex` because `Encode` is `Fn` — one
+    // thread ever takes it, so it is uncontended by construction.
+    let scratch = std::sync::Mutex::new((Vec::<u8>::new(), Vec::<u8>::new()));
+
+    Arc::new(move |config: &Config| {
+        let frame = frames.next_frame()?;
+        if frame.format != crate::pipeline::CAPTURE_FORMAT {
+            // The caps changed under us. Refusing beats encoding one format as another, which
+            // produces a picture that is wrong in a way a receiver cannot detect.
+            tracing::warn!(
+                format = frame.format,
+                expected = crate::pipeline::CAPTURE_FORMAT,
+                "not streaming a frame in a format this encoder does not know"
+            );
+            return None;
+        }
+
+        let mut held = scratch.lock().expect("not poisoned");
+        let (rgb, jpeg) = &mut *held;
+        let (width, height) = duck_detect::rgb_from_uyvy(
+            &frame.data,
+            frame.width as usize,
+            frame.height as usize,
+            config.longest as usize,
+            turn,
+            rgb,
+        );
+
+        jpeg.clear();
+        let encoder =
+            image::codecs::jpeg::JpegEncoder::new_with_quality(&mut *jpeg, config.quality);
+        match encoder.write_image(
+            rgb,
+            width as u32,
+            height as u32,
+            image::ExtendedColorType::Rgb8,
+        ) {
+            // Every JPEG is a keyframe by construction, which is the property that makes this
+            // encoding worth keeping: a receiver that reconnects can decode the very next
+            // message, where H.264 has to wait for one.
+            Ok(()) => Some(Unit {
+                bytes: jpeg.clone(),
+                keyframe: true,
+            }),
+            Err(e) => {
+                tracing::warn!(error = %e, "a frame would not encode");
+                None
+            }
+        }
+    })
+}
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// What a fake receiver saw.
+    #[derive(Default)]
+    struct Seen {
+        hello: std::sync::Mutex<Vec<String>>,
+        frames: std::sync::Mutex<Vec<Vec<u8>>>,
+        bearers: std::sync::Mutex<Vec<Option<String>>>,
+        /// Sockets to hang up on rather than serve, for the reconnect test.
+        hang_up: std::sync::atomic::AtomicU32,
+    }
+
+    /// A receiver that records the hello and the frames, and can be told to drop the first N.
+    async fn receiver(seen: Arc<Seen>) -> String {
+        use axum::extract::{State, WebSocketUpgrade, ws};
+
+        let app = axum::Router::new()
+            .route(
+                "/frames",
+                axum::routing::get(
+                    |State(seen): State<Arc<Seen>>,
+                     headers: axum::http::HeaderMap,
+                     upgrade: WebSocketUpgrade| async move {
+                        seen.bearers.lock().unwrap().push(
+                            headers
+                                .get("authorization")
+                                .and_then(|v| v.to_str().ok())
+                                .map(str::to_owned),
+                        );
+                        upgrade.on_upgrade(move |mut socket| async move {
+                            if seen.hang_up.fetch_saturating_sub() {
+                                return;
+                            }
+                            while let Some(Ok(message)) = socket.recv().await {
+                                match message {
+                                    ws::Message::Text(text) => {
+                                        seen.hello.lock().unwrap().push(text.to_string())
+                                    }
+                                    ws::Message::Binary(bytes) => {
+                                        seen.frames.lock().unwrap().push(bytes.to_vec())
+                                    }
+                                    ws::Message::Close(_) => return,
+                                    _ => {}
+                                }
+                            }
+                        })
+                    },
+                ),
+            )
+            .with_state(seen);
+
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let port = listener.local_addr().unwrap().port();
+        tokio::spawn(async move { axum::serve(listener, app).await.unwrap() });
+        format!("ws://127.0.0.1:{port}/frames")
+    }
+
+    trait Saturating {
+        /// True if there was a hang-up left to spend.
+        fn fetch_saturating_sub(&self) -> bool;
+    }
+
+    impl Saturating for std::sync::atomic::AtomicU32 {
+        fn fetch_saturating_sub(&self) -> bool {
+            self.fetch_update(Ordering::SeqCst, Ordering::SeqCst, |n| {
+                Some(n.saturating_sub(1))
+            })
+            .is_ok_and(|previous| previous > 0)
+        }
+    }
+
+    async fn until(what: &str, mut ready: impl FnMut() -> bool) {
+        for _ in 0..200 {
+            if ready() {
+                return;
+            }
+            tokio::time::sleep(Duration::from_millis(25)).await;
+        }
+        panic!("timed out waiting for {what}");
+    }
+
+    fn config(url: &str) -> Config {
+        Config {
+            url: url.to_owned(),
+            fps: 5.0,
+            longest: 640,
+            quality: 70,
+            encoding: Encoding::H264,
+        }
+    }
+
+    /// The hello, printed, so the other end's parser can be checked against it.
+    ///
+    /// `spaces/vision-demo/receiver.py` reads `robot.name` out of this line and files the stream
+    /// under it. A field renamed on one side of that is a stream that arrives labelled "a duck"
+    /// forever, which nothing fails on — so the shape is asserted here and the receiver's own test
+    /// reads this test's output.
+    #[test]
+    fn the_hello_names_the_robot_where_the_receiver_looks() {
+        let producer = crate::producer::Producer {
+            name: Some("olducky".to_owned()),
+            serial: Some("3fa1c51b".to_owned()),
+            release: "0.10.0".to_owned(),
+            api_version: 23,
+        };
+        let line = hello(&config("wss://x/frames"), &producer, 90);
+        let parsed: serde_json::Value = serde_json::from_str(&line).unwrap();
+
+        assert_eq!(parsed["type"], "hello");
+        assert_eq!(
+            parsed["robot"]["name"], "olducky",
+            "where the receiver looks for the name"
+        );
+        assert_eq!(parsed["robot"]["kind"], "microduck");
+        assert_eq!(
+            parsed["frames"]["encoding"], "h264",
+            "the default, and what the VPU makes"
+        );
+        assert_eq!(
+            parsed["frames"]["annexb"], true,
+            "one message is one access unit"
+        );
+        // Upright already, and the mount angle reported separately so a receiver cannot apply a
+        // turn that has been applied.
+        assert_eq!(parsed["frames"]["rotate"], 0);
+        assert_eq!(parsed["frames"]["mount_rotate"], 90);
+        println!("{line}");
+
+        // And the other one, because a receiver has to be able to tell them apart on this field
+        // alone: JPEG needs no keyframe and carries no stream state, which is why it stays
+        // reachable at all.
+        let mut jpeg = config("wss://x/frames");
+        jpeg.encoding = Encoding::Jpeg;
+        let line = hello(&jpeg, &producer, 90);
+        let parsed: serde_json::Value = serde_json::from_str(&line).unwrap();
+        assert_eq!(parsed["frames"]["encoding"], "jpeg");
+        assert_eq!(parsed["frames"]["annexb"], false);
+        println!("{line}");
+    }
+
+    /// **The hello, the bearer and the frames**, which is the whole of the wire a Space reads.
+    #[tokio::test]
+    async fn frames_reach_a_receiver_the_robot_dialled() {
+        let seen = Arc::new(Seen::default());
+        let url = receiver(Arc::clone(&seen)).await;
+
+        let (to_socket, from_encoder) = tokio::sync::mpsc::channel::<Vec<u8>>(2);
+        let counters = Arc::new(Counters::default());
+        let running = Arc::new(AtomicBool::new(true));
+        let task = tokio::spawn(pump(
+            url.clone(),
+            Some("a-robot-token".to_owned()),
+            r#"{"type":"hello"}"#.to_owned(),
+            from_encoder,
+            Arc::clone(&counters),
+            Arc::clone(&running),
+            Timings::default(),
+        ));
+
+        to_socket.send(vec![0xff, 0xd8, 1, 2]).await.unwrap();
+        to_socket.send(vec![0xff, 0xd8, 3, 4]).await.unwrap();
+        until("two frames", || seen.frames.lock().unwrap().len() == 2).await;
+
+        assert_eq!(
+            seen.bearers.lock().unwrap()[0].as_deref(),
+            Some("Bearer a-robot-token"),
+            "the receiver has to be able to say whose camera this is"
+        );
+        assert_eq!(
+            seen.hello.lock().unwrap()[0],
+            r#"{"type":"hello"}"#,
+            "and what it is about to be sent, before the first frame"
+        );
+        assert_eq!(seen.frames.lock().unwrap()[1], vec![0xff, 0xd8, 3, 4]);
+        assert_eq!(counters.sent.load(Ordering::Relaxed), 2);
+        assert!(counters.connected.load(Ordering::Relaxed));
+
+        // Stopping is dropping the encoder's end: the pump drains and returns.
+        running.store(false, Ordering::Relaxed);
+        drop(to_socket);
+        tokio::time::timeout(Duration::from_secs(5), task)
+            .await
+            .expect("the pump stops when its frames do")
+            .unwrap();
+        assert!(!counters.connected.load(Ordering::Relaxed));
+    }
+
+    /// **A gap in a predicted stream is abandoned to the next keyframe, not patched over.**
+    ///
+    /// The drop policy is the one thing H.264 changed about this module, and it is the one thing
+    /// that fails invisibly: keeping the newest unit is right for JPEG and wrong here, because a
+    /// P-frame whose reference was dropped decodes to garbage that looks like a bad camera rather
+    /// than a bad transport. So once anything is dropped, everything is dropped until a keyframe.
+    ///
+    /// Driven through the real [`Streamer`], with an encoder that hands out a scripted stream and
+    /// a receiver that never reads — which is what makes the channel fill.
+    #[tokio::test]
+    async fn a_dropped_h264_unit_is_followed_by_a_wait_for_a_keyframe() {
+        let dir = tempfile::tempdir().unwrap();
+        // A never-answering receiver: the pump keeps redialling, so nothing is ever drained and
+        // the encoder's channel fills after two units. Port 1 is reliably nobody.
+        let handed = Arc::new(std::sync::Mutex::new(Vec::new()));
+        let script = Arc::new(std::sync::Mutex::new(
+            // key, then four predicted, then a key. The first two get into the channel; the rest
+            // arrive while it is full.
+            vec![true, false, false, false, false, true, false]
+                .into_iter()
+                .collect::<std::collections::VecDeque<bool>>(),
+        ));
+
+        let seen = Arc::clone(&handed);
+        let remaining = Arc::clone(&script);
+        let encode: Encode = Arc::new(move |_config| {
+            let keyframe = remaining.lock().unwrap().pop_front()?;
+            seen.lock().unwrap().push(keyframe);
+            Some(Unit {
+                bytes: vec![if keyframe { 0x65 } else { 0x41 }],
+                keyframe,
+            })
+        });
+
+        let streamer = Streamer::new(
+            Encoders {
+                jpeg: Arc::clone(&encode),
+                h264: Some(encode),
+                gate: None,
+            },
+            crate::producer::Producer {
+                name: Some("olducky".to_owned()),
+                serial: None,
+                release: "0.10.0".to_owned(),
+                api_version: 23,
+            },
+            90,
+            dir.path().join("hf-token"),
+        )
+        .with_timings(Timings {
+            backoff_start: Duration::from_millis(10),
+            backoff_max: Duration::from_millis(10),
+            jitter: 0.0,
+        });
+
+        let mut config = config("ws://127.0.0.1:1/frames");
+        config.encoding = Encoding::H264;
+        streamer.start(config).expect("started");
+
+        // Everything the script offered is consumed, and the drops are counted.
+        until("the script to be exhausted", || {
+            handed.lock().unwrap().len() == 7
+        })
+        .await;
+        let status = streamer.status();
+        assert!(
+            status["dropped"].as_u64().unwrap() >= 4,
+            "the units after the gap were dropped: {status}"
+        );
+        assert_eq!(
+            status["sent"].as_u64().unwrap(),
+            0,
+            "nothing ever connected: {status}"
+        );
+        streamer.stop();
+    }
+
+    /// **A receiver going away is the ordinary case, not the end of the stream.**
+    ///
+    /// A Space restarts on every push and sleeps when nobody is looking at it, so the first dial
+    /// landing on a socket that hangs up immediately is what a robot should expect. What must
+    /// survive it is the stream: the next frame goes to the next connection, and the hello goes
+    /// with it, because the receiver on the other end of a redial is a new process that was told
+    /// nothing.
+    #[tokio::test]
+    async fn a_receiver_that_hangs_up_is_redialled() {
+        let seen = Arc::new(Seen::default());
+        seen.hang_up.store(1, Ordering::SeqCst);
+        let url = receiver(Arc::clone(&seen)).await;
+
+        let (to_socket, from_encoder) = tokio::sync::mpsc::channel::<Vec<u8>>(2);
+        let counters = Arc::new(Counters::default());
+        let running = Arc::new(AtomicBool::new(true));
+        tokio::spawn(pump(
+            url,
+            None,
+            r#"{"type":"hello"}"#.to_owned(),
+            from_encoder,
+            Arc::clone(&counters),
+            Arc::clone(&running),
+            // Milliseconds rather than seconds: this asserts a reconnect happens, not how patient
+            // the real one is.
+            Timings {
+                backoff_start: Duration::from_millis(20),
+                backoff_max: Duration::from_millis(40),
+                jitter: 0.1,
+            },
+        ));
+
+        until("the first dial to be hung up on", || {
+            counters.reconnects.load(Ordering::Relaxed) >= 1
+        })
+        .await;
+
+        to_socket.send(vec![0xff, 0xd8, 9]).await.unwrap();
+        until("a frame after the redial", || {
+            !seen.frames.lock().unwrap().is_empty()
+        })
+        .await;
+        assert_eq!(seen.frames.lock().unwrap()[0], vec![0xff, 0xd8, 9]);
+        assert!(
+            !seen.hello.lock().unwrap().is_empty(),
+            "every connection opens with its own hello, since the receiver is new each time"
+        );
+        running.store(false, Ordering::Relaxed);
+    }
+}
diff --git a/mediad/src/turn.rs b/mediad/src/turn.rs
new file mode 100644
index 00000000..a5cf51e4
--- /dev/null
+++ b/mediad/src/turn.rs
@@ -0,0 +1,561 @@
+//! Relay candidates, so a consumer that cannot reach this robot directly still can.
+//!
+//! `webrtcsink` gathers **host** candidates (this robot's own addresses) and **srflx** ones (what
+//! a STUN server says its public address is). Between two peers on one network the host
+//! candidates pair immediately. Between a robot behind a home router and a consumer behind
+//! whatever a cloud provider gives a container, srflx-to-srflx needs both NATs to allow a hole to
+//! be punched — often they do, and often enough they do not, and the failure looks like a session
+//! that negotiates perfectly and carries nothing.
+//!
+//! A **TURN** server is a relay in the middle: a peer reserves an address on it and hands that out
+//! as a `relay` candidate, and the other side simply sends there. It always works, at the cost of
+//! somebody's bandwidth, which is why it is the last resort ICE tries rather than the first.
+//!
+//! # Only the robot offers one, and that is not a simplification
+//!
+//! A connection needs **one** relay candidate, not two: if this robot offers one, a consumer that
+//! can reach the internet at all can use it. So the credentials live here and a consumer needs
+//! none — which matters more than it sounds, because `aiortc`'s STUN client works where its TURN
+//! client does not, so a Python consumer *cannot* be the side that relays.
+//! `reachy_mini`'s #1182 established this and it is the same arrangement here.
+//!
+//! # The credentials are short-lived, and fetching them must never be in the way
+//!
+//! Hugging Face hosts a proxy that mints Cloudflare TURN credentials for an account, which is why
+//! this needs the same token the relay signs in with and no new secret anywhere. They expire, so
+//! a task refreshes them at half their lifetime.
+//!
+//! **[`Relays::uris`] never blocks and never fails**, and that is the whole design of this module.
+//! Its only caller runs inside GStreamer's `consumer-added` signal, where the SDP offer for that
+//! consumer is not generated until the handler returns — so an HTTP request there would delay
+//! every connection, including the LAN ones that will never use a relay, by however long the
+//! proxy takes to answer. It reads what the refresher last stored, or nothing.
+
+use std::path::PathBuf;
+use std::sync::{Arc, RwLock};
+use std::time::Duration;
+
+use serde::Deserialize;
+
+/// Hugging Face's TURN credentials proxy, addressed as the Space it is.
+///
+/// **Not `turn.fastrtc.org`**, the vanity name `fastrtc`'s own code points at and `reachy_mini`
+/// #1182 copied. That name is a dangling delegation: the `.org` registry still names four Route53
+/// nameservers for the zone, the hosted zone behind them is gone, and all four answer `REFUSED`
+/// for the zone they are authoritative for. The service never stopped answering — only the name
+/// in front of it did — so this addresses `fastrtc/turn-service` directly.
+///
+/// Which also takes a name that can be *taken over* out of the path: a signed-in robot sends its
+/// account token down this URL every five minutes, and whoever wins a race to have AWS assign
+/// them one of those four delegated nameservers would serve records for the name, pass DNS
+/// validation for a certificate on it, and be handed the token. `reachy_mini` #1408 made the same
+/// move and measured a relay pair carrying video through it.
+pub const DEFAULT_TURN_ENDPOINT: &str = "https://fastrtc-turn-service.hf.space/credentials";
+
+/// A `--turn-url` worth handing the account token to, or the reason it is not one.
+///
+/// The token goes out as a bearer header on every refresh, so the destination is checked before
+/// it can: **`https`**, unless the host is loopback and the endpoint is therefore a test fake or
+/// a stand-in on the board itself. Userinfo is refused because one credential per request is
+/// enough, and a query or fragment because [`fetch`] appends `?ttl=` to whatever it is given —
+/// silently landing the TTL in a fragment, or as a second value of an existing parameter.
+///
+/// A `clap` `value_parser`, so a wrong value stops the daemon while somebody is still looking at
+/// the terminal. An endpoint that is wrong rather than refused becomes a warning every thirty
+/// seconds for the life of the daemon, which is how a log stops being read.
+pub fn parse_endpoint(value: &str) -> Result<String, String> {
+    let url = url::Url::parse(value).map_err(|why| format!("not a URL: {why}"))?;
+
+    if !url.username().is_empty() || url.password().is_some() {
+        return Err("carries userinfo, and one credential per request is enough".to_owned());
+    }
+    if url.query().is_some() || url.fragment().is_some() {
+        return Err("carries a query or a fragment, and the ttl is appended to it".to_owned());
+    }
+
+    let loopback = match url.host() {
+        Some(url::Host::Domain(name)) => name == "localhost",
+        Some(url::Host::Ipv4(address)) => address.is_loopback(),
+        Some(url::Host::Ipv6(address)) => address.is_loopback(),
+        None => return Err("names no host".to_owned()),
+    };
+    match url.scheme() {
+        "https" => {}
+        "http" if loopback => {}
+        "http" => {
+            return Err("is plain http, which puts the account token on the wire".to_owned());
+        }
+        other => return Err(format!("{other} is not a scheme these can be fetched over")),
+    }
+
+    Ok(url.into())
+}
+
+/// How long to ask for the credentials to be valid.
+const TTL: Duration = Duration::from_secs(600);
+
+/// Refresh at half of [`TTL`], so a credential is replaced well before it expires.
+const REFRESH_RATIO: f64 = 0.5;
+
+/// How long to wait after a *transient* failure.
+///
+/// Only a transient one earns the short retry. A robot nobody has signed in has nothing to retry
+/// for, and this task runs for the daemon's whole life — retrying that fast would put a line in
+/// the journal every half minute forever.
+const RETRY_AFTER_FAILURE: Duration = Duration::from_secs(30);
+
+const HTTP_TIMEOUT: Duration = Duration::from_secs(10);
+
+/// What the proxy answers with, of which two fields are read.
+///
+/// `iceServers` is camelCase on the wire — it is the browser's `RTCConfiguration` shape, which is
+/// where these dicts are destined — while the keys *inside* a `meta` on the rendezvous are
+/// snake_case. Two conventions in one system, and the cost of assuming either is a field that
+/// silently deserialises to empty.
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct Credentials {
+    #[serde(default)]
+    ice_servers: Vec<IceServer>,
+}
+
+#[derive(Debug, Deserialize)]
+struct IceServer {
+    /// One URL or several; the proxy sends both shapes.
+    urls: Urls,
+    #[serde(default)]
+    username: Option<String>,
+    #[serde(default)]
+    credential: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(untagged)]
+enum Urls {
+    One(String),
+    Many(Vec<String>),
+}
+
+impl Urls {
+    fn iter(&self) -> impl Iterator<Item = &String> {
+        match self {
+            Urls::One(url) => std::slice::from_ref(url).iter(),
+            Urls::Many(urls) => urls.iter(),
+        }
+    }
+}
+
+/// The relay servers this robot currently holds, if any.
+#[derive(Debug, Default)]
+pub struct Relays {
+    /// Replaced whole rather than mutated, so a reader sees the previous set or the new one and
+    /// never half of either.
+    uris: RwLock<Arc<[String]>>,
+}
+
+impl Relays {
+    /// A holder with nothing in it, which is also what a robot has until the first refresh.
+    pub fn empty() -> Arc<Self> {
+        Arc::new(Self::default())
+    }
+
+    /// The `turn://` URIs to offer, or empty.
+    ///
+    /// **Never blocks and never panics.** `try_read` rather than `read`: the writer holds the lock
+    /// for one assignment, so contention is close to impossible — and if it happens, offering
+    /// host and srflx candidates for one consumer is a far better outcome than stalling a
+    /// GStreamer signal handler, which stalls that consumer's offer.
+    pub fn uris(&self) -> Arc<[String]> {
+        match self.uris.try_read() {
+            Ok(held) => Arc::clone(&held),
+            Err(_) => Arc::from([] as [String; 0]),
+        }
+    }
+
+    fn store(&self, uris: Vec<String>) {
+        if let Ok(mut held) = self.uris.write() {
+            *held = Arc::from(uris);
+        }
+    }
+}
+
+/// Keep [`Relays`] fresh for as long as this process runs.
+///
+/// Spawned once at startup, whatever the account state: a robot signed in later starts offering
+/// relay candidates without a restart, which is the same property the relay itself has.
+pub async fn maintain(relays: Arc<Relays>, token_path: PathBuf, endpoint: String) {
+    let period = TTL.mul_f64(REFRESH_RATIO);
+    let mut said_there_is_no_token = false;
+
+    loop {
+        let wait = match hf_robot_account::read_access_token(&token_path) {
+            None => {
+                // The steady state of a robot nobody has signed in. Said once, because it is not
+                // news every five minutes for the life of the daemon.
+                if !said_there_is_no_token {
+                    said_there_is_no_token = true;
+                    tracing::info!(
+                        "no account token, so this robot offers no relay candidates; a login is \
+                         what lets it be reached from a network that cannot punch a hole to it"
+                    );
+                }
+                period
+            }
+            Some(token) => {
+                said_there_is_no_token = false;
+                match fetch(&endpoint, &token).await {
+                    Ok(uris) if uris.is_empty() => {
+                        // The proxy answered and offered no relay. Not worth hammering.
+                        tracing::info!("the TURN proxy offered no relay servers");
+                        period
+                    }
+                    Ok(uris) => {
+                        tracing::info!(
+                            servers = uris.len(),
+                            hosts = ?uris.iter().map(|uri| hostname(uri)).collect::<Vec<_>>(),
+                            "refreshed the relay credentials"
+                        );
+                        relays.store(uris);
+                        period
+                    }
+                    // Best effort, always: a robot with no relay candidates is reachable from
+                    // most places, and one that refused to stream because a proxy was down would
+                    // be reachable from none.
+                    Err(why) => {
+                        tracing::warn!(%why, "could not fetch relay credentials");
+                        RETRY_AFTER_FAILURE
+                    }
+                }
+            }
+        };
+        tokio::time::sleep(wait).await;
+    }
+}
+
+/// One request to the proxy, turned into the URIs `webrtcbin` takes.
+async fn fetch(endpoint: &str, token: &str) -> Result<Vec<String>, String> {
+    let client = reqwest::Client::builder()
+        .timeout(HTTP_TIMEOUT)
+        .build()
+        .map_err(|e| format!("no HTTP client: {e}"))?;
+
+    // The TTL in the URL rather than through `query`, which wants a `reqwest` feature this
+    // workspace does not enable — and one integer needs no encoder.
+    let separator = if endpoint.contains('?') { '&' } else { '?' };
+    let url = format!("{endpoint}{separator}ttl={}", TTL.as_secs());
+    let response = client
+        .get(&url)
+        .bearer_auth(token)
+        .send()
+        .await
+        .map_err(|e| format!("GET {endpoint}: {}", because(&e)))?;
+    if !response.status().is_success() {
+        return Err(format!("GET {endpoint}: HTTP {}", response.status()));
+    }
+    let credentials: Credentials = response
+        .json()
+        .await
+        .map_err(|e| format!("GET {endpoint}: {}", because(&e)))?;
+    Ok(turn_uris(&credentials.ice_servers))
+}
+
+/// `{"urls", "username", "credential"}` to `turn://user:pass@host:port`.
+///
+/// `stun:` entries and entries with no credentials are skipped: `webrtcbin` takes a STUN server
+/// through its own property, and `add-turn-server` rejects a URI with no userinfo.
+fn turn_uris(servers: &[IceServer]) -> Vec<String> {
+    let mut uris = Vec::new();
+    for server in servers {
+        let (Some(user), Some(secret)) = (&server.username, &server.credential) else {
+            continue;
+        };
+        for url in server.urls.iter() {
+            let (scheme, rest) = match url.split_once(':') {
+                Some(parts) => parts,
+                None => continue,
+            };
+            if !matches!(scheme.to_ascii_lowercase().as_str(), "turn" | "turns") || rest.is_empty()
+            {
+                continue;
+            }
+            // Percent-encoded, so a password containing `:`, `@` or `/` cannot corrupt the URI —
+            // and these are generated secrets, so it will eventually contain one of them.
+            uris.push(format!(
+                "{scheme}://{}:{}@{rest}",
+                encode(user),
+                encode(secret)
+            ));
+        }
+    }
+    uris
+}
+
+/// The userinfo half of a URI, with everything that has meaning there escaped.
+fn encode(value: &str) -> String {
+    let mut out = String::with_capacity(value.len());
+    for byte in value.bytes() {
+        match byte {
+            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'.' | b'_' | b'~' => {
+                out.push(byte as char);
+            }
+            other => out.push_str(&format!("%{other:02X}")),
+        }
+    }
+    out
+}
+
+/// An error and everything under it, on one line.
+///
+/// **`reqwest`'s own message stops at "error sending request"**, and the half that matters is
+/// underneath: a name that does not resolve, a refused connection and a certificate that does not
+/// verify all print identically otherwise. This cost an afternoon of wondering whether a robot had
+/// no network, when the answer was that the endpoint's whole domain had no DNS records —
+/// unresolvable from the board and from three public resolvers alike.
+fn because(error: &(dyn std::error::Error + 'static)) -> String {
+    let mut out = error.to_string();
+    let mut source = error.source();
+    while let Some(cause) = source {
+        // Repeated text is worse than none: `reqwest` wraps `hyper` wraps `io`, and each layer
+        // often restates the one below it.
+        let text = cause.to_string();
+        if !out.contains(&text) {
+            out.push_str(": ");
+            out.push_str(&text);
+        }
+        source = cause.source();
+    }
+    out
+}
+
+/// A URI with its credentials removed, which is the only form that may be logged.
+fn hostname(uri: &str) -> String {
+    uri.rsplit_once('@')
+        .map(|(_, host)| host.to_owned())
+        .unwrap_or_else(|| uri.to_owned())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn servers(json: &str) -> Vec<IceServer> {
+        serde_json::from_str::<Credentials>(json)
+            .unwrap()
+            .ice_servers
+    }
+
+    /// What the proxy sends, in both shapes it sends it.
+    #[test]
+    fn credentials_become_uris_webrtcbin_accepts() {
+        let uris = turn_uris(&servers(
+            r#"{"iceServers":[
+                {"urls":"stun:stun.cloudflare.com:3478"},
+                {"urls":["turn:turn.cloudflare.com:3478?transport=udp",
+                         "turns:turn.cloudflare.com:5349?transport=tcp"],
+                 "username":"user-1","credential":"secret-1"}
+            ]}"#,
+        ));
+
+        assert_eq!(
+            uris,
+            vec![
+                "turn://user-1:secret-1@turn.cloudflare.com:3478?transport=udp",
+                "turns://user-1:secret-1@turn.cloudflare.com:5349?transport=tcp",
+            ],
+            "one URI per URL, and the STUN entry is not one of them"
+        );
+    }
+
+    /// A generated secret contains `:` and `/` sooner or later, and an unescaped one silently
+    /// produces a URI naming the wrong host — with credentials in it, so it cannot be logged to
+    /// find out.
+    #[test]
+    fn credentials_are_escaped_rather_than_interpolated() {
+        let uris = turn_uris(&servers(
+            r#"{"iceServers":[{"urls":"turn:relay:3478",
+                "username":"a:b@c","credential":"p/q?r=s"}]}"#,
+        ));
+        assert_eq!(uris, vec!["turn://a%3Ab%40c:p%2Fq%3Fr%3Ds@relay:3478"]);
+    }
+
+    /// An entry with no credentials is not a relay this robot can offer.
+    #[test]
+    fn entries_without_credentials_are_skipped() {
+        assert!(turn_uris(&servers(r#"{"iceServers":[{"urls":"turn:relay:3478"}]}"#)).is_empty());
+        assert!(turn_uris(&servers(r#"{"iceServers":[]}"#)).is_empty());
+    }
+
+    /// **The default is one the guard accepts.** A default that fails its own check is a daemon
+    /// that will not start at all, on every robot at once.
+    #[test]
+    fn the_default_endpoint_is_one_the_token_may_be_sent_to() {
+        assert_eq!(
+            parse_endpoint(DEFAULT_TURN_ENDPOINT).as_deref(),
+            Ok(DEFAULT_TURN_ENDPOINT),
+            "and it survives the round trip unchanged, so `fetch` appends `?ttl=` to what was set"
+        );
+    }
+
+    /// What the guard is for: the destinations the account token must not go to.
+    #[test]
+    fn an_endpoint_that_would_leak_the_token_is_refused_at_argument_parsing() {
+        for (endpoint, because) in [
+            ("http://turn.example/credentials", "plain http"),
+            ("https://user:pass@turn.example/credentials", "userinfo"),
+            ("https://turn.example/credentials?ttl=1", "query"),
+            ("https://turn.example/credentials#f", "fragment"),
+            ("ftp://turn.example/credentials", "scheme"),
+            ("/credentials", "relative"),
+        ] {
+            assert!(
+                parse_endpoint(endpoint).is_err(),
+                "{endpoint} was accepted, and it should have been refused for its {because}"
+            );
+        }
+    }
+
+    /// And loopback http is not one of them — every test below dials one.
+    #[test]
+    fn a_loopback_fake_needs_no_certificate() {
+        for endpoint in [
+            "http://127.0.0.1:8080/credentials",
+            "http://localhost:8080/credentials",
+            "http://[::1]:8080/credentials",
+        ] {
+            assert!(parse_endpoint(endpoint).is_ok(), "{endpoint}");
+        }
+    }
+
+    /// An unreachable endpoint says *why* it was unreachable.
+    #[tokio::test]
+    async fn a_failure_names_its_cause_and_not_just_itself() {
+        // A domain that cannot resolve, which is exactly what the real endpoint did.
+        let error = fetch("https://turn.invalid./credentials", "hf_abc")
+            .await
+            .expect_err("`.invalid` does not resolve, by RFC 2606");
+        assert!(
+            error.to_lowercase().contains("dns") || error.to_lowercase().contains("resolve"),
+            "the cause has to survive to the log line: {error}"
+        );
+    }
+
+    /// **Credentials must never reach a log line.**
+    #[test]
+    fn only_the_host_is_loggable() {
+        assert_eq!(
+            hostname("turns://user-1:secret-1@turn.cloudflare.com:5349"),
+            "turn.cloudflare.com:5349"
+        );
+        assert!(!hostname("turns://user-1:secret-1@relay:5349").contains("secret-1"));
+        // A URI with no userinfo cannot leak one, and is logged whole.
+        assert_eq!(hostname("turn:relay:3478"), "turn:relay:3478");
+    }
+
+    /// An empty holder answers, rather than making a caller handle "not yet".
+    #[test]
+    fn a_robot_that_has_fetched_nothing_offers_nothing() {
+        let relays = Relays::empty();
+        assert!(relays.uris().is_empty());
+
+        relays.store(vec!["turn://u:p@relay:3478".to_owned()]);
+        assert_eq!(relays.uris().len(), 1);
+
+        // Replaced whole, so a reader never sees a mixture of two sets.
+        relays.store(vec![
+            "turn://u2:p2@relay:3478".to_owned(),
+            "turns://u2:p2@relay:5349".to_owned(),
+        ]);
+        assert_eq!(relays.uris().len(), 2);
+        assert!(relays.uris().iter().all(|uri| uri.contains("u2")));
+    }
+
+    /// The proxy refusing is not this robot's problem to solve, only to report.
+    #[tokio::test]
+    async fn a_proxy_that_refuses_leaves_the_robot_without_relays() {
+        let app = axum::Router::new().route(
+            "/credentials",
+            axum::routing::get(|| async { axum::http::StatusCode::UNAUTHORIZED }),
+        );
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let endpoint = format!("http://{}/credentials", listener.local_addr().unwrap());
+        tokio::spawn(async move {
+            let _ = axum::serve(listener, app).await;
+        });
+
+        let error = fetch(&endpoint, "hf_abc").await.expect_err("a 401");
+        assert!(error.contains("401"), "{error}");
+    }
+
+    /// And the ordinary path, end to end against a proxy that answers what HF's answers.
+    #[tokio::test]
+    async fn a_refresh_stores_what_the_proxy_offers() {
+        use std::sync::atomic::{AtomicUsize, Ordering};
+
+        let asked = std::sync::Arc::new(AtomicUsize::new(0));
+        let seen = std::sync::Arc::clone(&asked);
+        let app = axum::Router::new().route(
+            "/credentials",
+            axum::routing::get(move |headers: axum::http::HeaderMap| {
+                let seen = std::sync::Arc::clone(&seen);
+                async move {
+                    seen.fetch_add(1, Ordering::SeqCst);
+                    assert_eq!(
+                        headers.get("authorization").unwrap(),
+                        "Bearer hf_abc",
+                        "the robot's own token is what mints these"
+                    );
+                    axum::Json(serde_json::json!({
+                        "iceServers": [{
+                            "urls": ["turn:turn.cloudflare.com:3478?transport=udp"],
+                            "username": "u", "credential": "p",
+                        }],
+                    }))
+                }
+            }),
+        );
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let endpoint = format!("http://{}/credentials", listener.local_addr().unwrap());
+        tokio::spawn(async move {
+            let _ = axum::serve(listener, app).await;
+        });
+
+        let dir = tempfile::tempdir().unwrap();
+        let token_path = dir.path().join("hf-token");
+        std::fs::write(&token_path, r#"{"access_token":"hf_abc"}"#).unwrap();
+
+        let relays = Relays::empty();
+        let task = tokio::spawn(maintain(
+            std::sync::Arc::clone(&relays),
+            token_path,
+            endpoint,
+        ));
+        for _ in 0..100 {
+            if !relays.uris().is_empty() {
+                break;
+            }
+            tokio::time::sleep(Duration::from_millis(20)).await;
+        }
+        task.abort();
+
+        assert_eq!(
+            relays.uris().as_ref(),
+            ["turn://u:p@turn.cloudflare.com:3478?transport=udp".to_owned()]
+        );
+        assert_eq!(asked.load(Ordering::SeqCst), 1, "once, not on a spin");
+    }
+
+    /// A robot with no account asks nobody for credentials.
+    #[tokio::test]
+    async fn no_token_means_no_request() {
+        let dir = tempfile::tempdir().unwrap();
+        let relays = Relays::empty();
+        let task = tokio::spawn(maintain(
+            std::sync::Arc::clone(&relays),
+            dir.path().join("hf-token"),
+            "http://127.0.0.1:1/credentials".to_owned(),
+        ));
+        tokio::time::sleep(Duration::from_millis(200)).await;
+        task.abort();
+        assert!(relays.uris().is_empty());
+    }
+}
diff --git a/mediad/src/upstream.rs b/mediad/src/upstream.rs
index b7eaf4e8..583fb116 100644
--- a/mediad/src/upstream.rs
+++ b/mediad/src/upstream.rs
@@ -103,6 +103,15 @@ impl Pool {
     }
 
     /// Send one line to `service` on `lane`'s connection, connecting first if needed.
+    ///
+    /// A daemon that restarted between two requests is ordinary here: `robotd` is the one an
+    /// update restarts, and `updaterd` restarts itself from a release's postinstall hook. The
+    /// connection from before the restart is still in the pool, its reader has already seen the
+    /// socket close, and the first write into it fails. Those bytes never left, so they are written
+    /// again on a fresh connection rather than reported. Reporting them told the console that a
+    /// daemon listening on a fresh socket was not answering, once per lane, after every restart.
+    /// Once and not in a loop: a daemon that is genuinely gone fails the reconnect, and that is
+    /// the error worth reporting.
     pub async fn send(
         &mut self,
         service: proto::Service,
@@ -110,25 +119,35 @@ impl Pool {
         line: &str,
     ) -> io::Result<()> {
         let key = (service, lane);
+        let mut bytes = line.as_bytes().to_vec();
+        bytes.push(b'\n');
+
         if !self.conns.contains_key(&key) {
             let conn = self.open(service, lane).await?;
             self.conns.insert(key, conn);
         }
-        let conn = self.conns.get_mut(&key).expect("just inserted");
-
-        let mut bytes = line.as_bytes().to_vec();
-        bytes.push(b'\n');
+        match self.write(key, &bytes).await {
+            Err(e) if peer_is_gone(&e) => {
+                let conn = self.open(service, lane).await?;
+                self.conns.insert(key, conn);
+                self.write(key, &bytes).await
+            }
+            done => done,
+        }
+    }
 
+    /// One bounded write on the connection for `key`. Any failure drops that connection, so
+    /// nothing keeps writing into a dead socket. Only this lane's: the others may be perfectly
+    /// alive.
+    async fn write(&mut self, key: (proto::Service, proto::Lane), bytes: &[u8]) -> io::Result<()> {
+        let conn = self.conns.get_mut(&key).expect("connection present");
         let write = async {
-            conn.write.write_all(&bytes).await?;
+            conn.write.write_all(bytes).await?;
             conn.write.flush().await
         };
         match tokio::time::timeout(WRITE_TIMEOUT, write).await {
             Ok(Ok(())) => Ok(()),
             Ok(Err(e)) => {
-                // A broken pipe here is ordinary — the daemon restarted. Drop this lane's
-                // connection so the next call reconnects rather than writing into a dead socket
-                // forever. Only this lane's: the others may be perfectly alive.
                 self.conns.remove(&key);
                 Err(e)
             }
@@ -183,3 +202,100 @@ impl Pool {
         Ok(Conn { write })
     }
 }
+
+/// Whether a write failed because the peer went away, rather than being slow or refusing. Only
+/// these are worth one more try, because only these mean the bytes went to a daemon that is no
+/// longer there. A timeout is a daemon that is there and stuck, and that is not retried.
+fn peer_is_gone(e: &io::Error) -> bool {
+    matches!(
+        e.kind(),
+        io::ErrorKind::BrokenPipe
+            | io::ErrorKind::ConnectionReset
+            | io::ErrorKind::ConnectionAborted
+            | io::ErrorKind::NotConnected
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
+
+    /// A fake daemon that answers one request with `response` and hangs up.
+    fn serve_once(path: &Path, response: proto::Response) -> tokio::task::JoinHandle<String> {
+        let listener = tokio::net::UnixListener::bind(path).unwrap();
+        tokio::spawn(async move {
+            let (stream, _) = listener.accept().await.unwrap();
+            let (read, mut write) = stream.into_split();
+            let request = BufReader::new(read)
+                .lines()
+                .next_line()
+                .await
+                .unwrap()
+                .unwrap();
+            let mut line = serde_json::to_vec(&response).unwrap();
+            line.push(b'\n');
+            write.write_all(&line).await.unwrap();
+            write.flush().await.unwrap();
+            request
+        })
+    }
+
+    /// The daemon restarted between two requests.
+    ///
+    /// The same pool `btd` has, with the same hole it had: the first write after a restart went
+    /// into the socket the old daemon closed, failed, and the console was told the service was
+    /// not answering while it was listening on a fresh socket the whole time.
+    #[tokio::test]
+    async fn a_restarted_daemon_gets_the_next_request_not_the_one_after() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("robotd.sock");
+        let sockets = Sockets {
+            robot: path.clone(),
+            updater: dir.path().join("updaterd.sock"),
+            config: dir.path().join("configd.sock"),
+            pad: dir.path().join("padd.sock"),
+            tof: dir.path().join("tofd.sock"),
+        };
+        let (replies, mut forwarded) = mpsc::channel(8);
+        let mut pool = Pool::new(sockets, replies);
+
+        let before = serve_once(
+            &path,
+            proto::Response::ok(Some(proto::Id::Number(1)), &serde_json::json!({})),
+        );
+        pool.send(
+            proto::Service::Robot,
+            proto::Lane::Prompt,
+            r#"{"jsonrpc":"2.0","id":1,"method":"robot.health"}"#,
+        )
+        .await
+        .unwrap();
+        assert!(
+            forwarded.recv().await.is_some(),
+            "the first answer is forwarded"
+        );
+        // The daemon has answered and hung up: it is restarting.
+        before.await.unwrap();
+
+        // And it is back, listening on a fresh socket at the same path.
+        std::fs::remove_file(&path).unwrap();
+        let after = serve_once(
+            &path,
+            proto::Response::ok(Some(proto::Id::Number(2)), &serde_json::json!({})),
+        );
+        pool.send(
+            proto::Service::Robot,
+            proto::Lane::Prompt,
+            r#"{"jsonrpc":"2.0","id":2,"method":"robot.health"}"#,
+        )
+        .await
+        .expect("a daemon that is back must get the request, not a broken pipe");
+        let request = after.await.unwrap();
+        assert!(request.contains(r#""id":2"#), "{request}");
+        assert!(
+            forwarded.recv().await.is_some(),
+            "and its answer is forwarded"
+        );
+    }
+}
diff --git a/mediad/src/web.rs b/mediad/src/web.rs
index 8ab2be1e..2bd649ae 100644
--- a/mediad/src/web.rs
+++ b/mediad/src/web.rs
@@ -1,6 +1,6 @@
 //! The page, served by the daemon it drives.
 //!
-//! One route, one file, no build step. `http://<robot>:8080/` and there is nothing else to run —
+//! An embedded console and an on-demand PNG snapshot, with no frontend build step. `http://<robot>:8080/` and there is nothing else to run —
 //! which is the whole of it, and `webrtc-console.md` §1 is why it is worth a dependency and a
 //! second port.
 //!
@@ -38,6 +38,8 @@
 //! and say nothing about why.
 
 use std::net::SocketAddr;
+use std::path::PathBuf;
+use std::sync::Arc;
 
 use anyhow::{Context, Result};
 use axum::Router;
@@ -72,7 +74,7 @@ pub fn page(signalling_port: u32) -> String {
 /// Returns only on failure — a bind that was refused, or a listener that died. The caller decides
 /// what that costs; in `mediad` it costs the page and not the video, because a robot that streams
 /// and answers control calls with no console is a great deal better than one that does neither.
-pub async fn serve(host: &str, port: u16, page: String) -> Result<()> {
+pub async fn serve(host: &str, port: u16, page: String, frame_socket: PathBuf) -> Result<()> {
     let address: SocketAddr = format!("{host}:{port}")
         .parse()
         .with_context(|| format!("{host}:{port} is not an address to listen on"))?;
@@ -81,20 +83,151 @@ pub async fn serve(host: &str, port: u16, page: String) -> Result<()> {
         .with_context(|| format!("could not listen on {address}"))?;
 
     tracing::info!(%address, "serving the console");
-    axum::serve(listener, router(page))
+    axum::serve(listener, router(page, frame_socket))
         .await
         .context("the console's listener stopped")
 }
 
-/// One route, returning `page`.
-fn router(page: String) -> Router {
-    Router::new().route("/", get(move || std::future::ready(Html(page))))
+/// The console and its bounded, uncached snapshot endpoint.
+fn router(page: String, frame_socket: PathBuf) -> Router {
+    let slots = Arc::new(tokio::sync::Semaphore::new(4));
+    Router::new()
+        .route("/", get(move || std::future::ready(Html(page))))
+        .route(
+            "/frame",
+            get(move || snapshot(frame_socket.clone(), slots.clone())),
+        )
+}
+
+async fn snapshot(socket: PathBuf, slots: Arc<tokio::sync::Semaphore>) -> axum::response::Response {
+    use axum::http::{StatusCode, header};
+    use axum::response::IntoResponse;
+    let result: Result<Vec<u8>> = async {
+        let permit = slots
+            .try_acquire_owned()
+            .context("snapshot capacity reached")?;
+        let (metadata, pixels) = crate::snapshot::fetch(&socket).await?;
+        tokio::task::spawn_blocking(move || {
+            // The permit belongs to the encoder, even if the HTTP client disconnects.
+            let _permit = permit;
+            crate::snapshot::png(metadata, pixels)
+        })
+        .await?
+    }
+    .await;
+    let mut response = match result {
+        Ok(png) => ([(header::CONTENT_TYPE, "image/png")], png).into_response(),
+        Err(error) => {
+            tracing::debug!(%error, "snapshot unavailable");
+            (
+                StatusCode::SERVICE_UNAVAILABLE,
+                "Camera snapshot unavailable; retry when capture is running.\n",
+            )
+                .into_response()
+        }
+    };
+    response
+        .headers_mut()
+        .insert(header::CACHE_CONTROL, "no-store".parse().unwrap());
+    response
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    /// The PNG comes out upright, because a picture is the one reply with nowhere to carry the
+    /// mount angle. A quarter turn swaps the axes and moves the bright pixel; an upright mount
+    /// leaves both alone, and the same route has to do each.
+    #[tokio::test]
+    async fn frame_route_handshakes_and_returns_a_decodable_uncached_upright_png() {
+        for (rotate, size, bright) in [(0, (2, 1), (1, 0)), (90, (1, 2), (0, 1))] {
+            frame_route_returns(rotate, size, bright).await;
+        }
+    }
+
+    async fn frame_route_returns(rotate: u32, size: (u32, u32), bright: (u32, u32)) {
+        use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
+        let dir = tempfile::tempdir().unwrap();
+        let socket = dir.path().join("media.sock");
+        let camera = tokio::net::UnixListener::bind(&socket).unwrap();
+        let producer = tokio::spawn(async move {
+            let (stream, _) = camera.accept().await.unwrap();
+            let (read, mut write) = stream.into_split();
+            let mut reader = BufReader::new(read);
+            let mut line = String::new();
+            reader.read_line(&mut line).await.unwrap();
+            let hello: proto::Request = serde_json::from_str(&line).unwrap();
+            assert_eq!(hello.method, proto::method::HELLO);
+            assert_eq!(hello.params.unwrap()["api_version"], proto::API_VERSION);
+            let response = proto::Response::ok(
+                hello.id,
+                &proto::HelloResult {
+                    api_version: proto::API_VERSION,
+                    daemon_version: None,
+                    revision: None,
+                },
+            );
+            write
+                .write_all(format!("{}\n", serde_json::to_string(&response).unwrap()).as_bytes())
+                .await
+                .unwrap();
+            line.clear();
+            reader.read_line(&mut line).await.unwrap();
+            let request: proto::Request = serde_json::from_str(&line).unwrap();
+            assert_eq!(request.method, proto::method::MEDIA_FRAME);
+            let header = proto::MediaFrameHeader {
+                width: 2,
+                height: 1,
+                format: "UYVY".into(),
+                bytes: 4,
+                captured_at_unix_us: 1,
+                rotate,
+            };
+            let mut reply = serde_json::to_vec(&proto::Response::ok(request.id, &header)).unwrap();
+            reply.push(b'\n');
+            reply.extend([128, 16, 128, 235]);
+            write.write_all(&reply).await.unwrap();
+        });
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let server = tokio::spawn(async move {
+            axum::serve(listener, router(page(8443), socket))
+                .await
+                .unwrap();
+        });
+        let response = reqwest::get(format!("http://{address}/frame"))
+            .await
+            .unwrap();
+        assert_eq!(response.status(), 200);
+        assert_eq!(response.headers()["content-type"], "image/png");
+        assert_eq!(response.headers()["cache-control"], "no-store");
+        let decoded = image::load_from_memory(&response.bytes().await.unwrap())
+            .unwrap()
+            .to_rgb8();
+        assert_eq!(decoded.dimensions(), size);
+        assert!(decoded.get_pixel(bright.0, bright.1)[0] > 250);
+        // The dark pixel is the frame's first either way round: a clockwise turn takes source
+        // (0, 0) to upright (0, 0), so only the bright one has to move for the turn to be real.
+        assert!(decoded.get_pixel(0, 0)[0] < 5);
+        producer.await.unwrap();
+        server.abort();
+    }
+
+    #[tokio::test]
+    async fn unavailable_and_busy_camera_fail_without_caching() {
+        let dir = tempfile::tempdir().unwrap();
+        for slots in [0, 1] {
+            let response = snapshot(
+                dir.path().join("missing.sock"),
+                Arc::new(tokio::sync::Semaphore::new(slots)),
+            )
+            .await;
+            assert_eq!(response.status(), 503);
+            assert_eq!(response.headers()["cache-control"], "no-store");
+        }
+    }
+
     /// The whole of what this module does to the page.
     #[test]
     fn both_tokens_are_filled_in() {
@@ -121,6 +254,27 @@ mod tests {
         );
     }
 
+    /// **The page the robot serves must be in LAN mode, and the page in the repository must not
+    /// be.**
+    ///
+    /// One file serves two hosts: substituting the port is what tells it a robot served it, and
+    /// the copy pushed to the Space keeps the token so the page reaches for the rendezvous
+    /// instead — a browser on an https page cannot open a `ws://` at all, so getting this
+    /// backwards produces a console that connects to nothing and says nothing.
+    /// `scripts/publish-console.sh` asserts the other half of it at deploy time.
+    #[test]
+    fn the_unsubstituted_page_is_the_remote_one() {
+        assert!(
+            PAGE.contains(PORT_TOKEN),
+            "the page in the repository must carry the port token: it is what the Space copy \
+             reads as `no robot served me`"
+        );
+        assert!(
+            !page(8443).contains(PORT_TOKEN),
+            "and the served page must not, or the robot would serve a page that ignores it"
+        );
+    }
+
     /// A non-default `--port` reaches the page, which is the reason the substitution exists at all:
     /// a page carrying a constant would still be dialling 8443.
     #[test]
@@ -140,7 +294,11 @@ mod tests {
             .expect("a loopback port");
         let address = listener.local_addr().expect("the port it took");
         tokio::spawn(async move {
-            let _ = axum::serve(listener, router(page(8443))).await;
+            let _ = axum::serve(
+                listener,
+                router(page(8443), PathBuf::from(proto::socket::MEDIA)),
+            )
+            .await;
         });
 
         let mut stream = tokio::net::TcpStream::connect(address)
diff --git a/mediad/webclient/index.html b/mediad/webclient/index.html
index adb6e6e7..b9d43e21 100644
--- a/mediad/webclient/index.html
+++ b/mediad/webclient/index.html
@@ -1,5 +1,16 @@
 <!doctype html>
+<!--
+  **The `<html>`/`<head>`/`<body>` skeleton is load-bearing, however tempting it is to drop.**
+  This page was a bare doctype plus content for most of its life, which browsers parse into the
+  same tree — and Hugging Face's static hosting injects `window.huggingface.variables` (the OAuth
+  client id a remote sign-in needs) by rewriting `<head>`. With no `<head>` there is nothing to
+  rewrite, no client id, and a console that cannot sign anybody in with nothing anywhere saying
+  why. `docs/design/remote-access-design.md` §5.
+-->
+<html lang="en">
+<head>
 <meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
 <title>duck console</title>
 <!--
   The robot's console. One file, no build step, no dependencies — `mediad` embeds this page and
@@ -120,6 +131,9 @@
         overflow: auto; white-space: pre-wrap; font: 12px/1.45 ui-monospace, monospace; }
 </style>
 
+</head>
+<body>
+
 <header>
   <h1 id="robot">duck console</h1>
   <span id="release" class="pill dim">release unknown</span>
@@ -128,6 +142,8 @@ <h1 id="robot">duck console</h1>
   <span id="state" class="pill">idle</span>
   <span id="dcstate" class="pill dim">no control channel</span>
   <span id="signalling" class="pill dim"></span>
+  <select id="robots" hidden></select>
+  <span id="account" class="pill dim" hidden></span>
   <button id="connect">connect</button>
 </header>
 
@@ -274,6 +290,115 @@ <h2>telemetry</h2>
 const SIGNALLING_PORT = SERVED_BY_ROBOT ? SERVED_PORT : 8443;
 const SIGNALLING_URL = `ws://${location.hostname || "localhost"}:${SIGNALLING_PORT}`;
 
+// ── which transport, and it is forced rather than chosen ──────────────────────
+//
+// One page, two ways in. On a LAN it opens a WebSocket to the robot's own signalling server, which
+// is everything below `ws`. From off the LAN there is no such socket to open — the robot is behind
+// somebody's router — so it goes through the rendezvous service the robot registered with: SSE in,
+// `POST /send` out, the same envelopes. `remote-access-design.md` §5.
+//
+// **A page served over https cannot open `ws://` at all**, so this is not a heuristic: a browser
+// refuses the mixed-content connection, which means an https page that was not served by a robot
+// has exactly one transport available to it. A page opened from a checkout over `file://` keeps
+// the LAN behaviour, which is what it is for. `?mode=lan` and `?mode=remote` override, for testing
+// one from where the other would be picked.
+// Which build of this page is in front of you.
+//
+// Substituted by `scripts/publish-console.sh` at deploy time and logged as the first line, because
+// a static host caches and a browser caches harder: an hour was spent on a fix that was never
+// being loaded, and the only way to know is for the page to say so itself.
+const BUILD = "{{CONSOLE_BUILD}}";
+// The OAuth app of whatever is serving this page, put here by `entrypoint.sh`.
+const SERVER_CLIENT_ID = "{{OAUTH_CLIENT_ID}}";
+const BUILD_LABEL = BUILD.startsWith("{{") ? "unpublished (served by a robot or a checkout)" : BUILD;
+
+const PARAMS = new URLSearchParams(location.search);
+const REMOTE = PARAMS.get("mode")
+  ? PARAMS.get("mode") === "remote"
+  : !SERVED_BY_ROBOT && location.protocol === "https:";
+
+// Where this page mints its own relay credentials, addressed as the Space it is rather than
+// through `turn.fastrtc.org` — that alias is a dangling delegation and answers nothing
+// (`remote-access-design.md` §6). `?turn=` points this at a local copy or a fake.
+const TURN_CREDENTIALS_URL = PARAMS.get("turn")
+  || "https://fastrtc-turn-service.hf.space/credentials";
+const TURN_TTL_SECONDS = 600;
+
+// The Space the robot's relay registers with. `?rendezvous=` points this at a local copy.
+const RENDEZVOUS = (PARAMS.get("rendezvous")
+  || "https://pollen-robotics-reachy-mini-central.hf.space").replace(/\/$/, "");
+
+// What this page will drive. The rendezvous lists every robot an account owns, and the mini's
+// producers are on it too — `meta.kind` is what tells the families apart, and driving a mini from
+// here would send it method names it does not serve. §5.1.
+const KIND = "microduck";
+
+// The sign-in library, pinned to the version a Space that works pins. `@1` resolved to something
+// whose `oauthHandleRedirectIfPresent` returned nothing on a page holding a fresh `?code=`, which
+// turns a sign-in into a redirect loop — and `reachy_mini`'s own app guide warns that mixing
+// versions across the SDK and the shell "causes silent protocol drift". Pinned, therefore, rather
+// than tracking a major.
+const HUB_ESM = "https://cdn.jsdelivr.net/npm/@huggingface/hub@2.11.2/+esm";
+
+// The OAuth app this page signs in with.
+//
+// **Explicit, rather than the client id a Space is documented to inject.** `hf_oauth: true` in a
+// static Space's front matter did not produce a `window.huggingface` on this page however it was
+// loaded, and chasing why is chasing somebody else's platform. An app registered once at
+// `huggingface.co/settings/applications/new` — client ids are public, which is why one can sit in
+// a page — takes that whole question out of the picture, and takes with it the assumption that
+// this page is served by a Space at all: the same id works from anywhere its redirect URI names.
+//
+// `?client_id=` overrides, which is how a new one is tried before it is written down here. An
+// injected one is still preferred if a Space ever provides it, because that one cannot go stale.
+/// The client id, read **when it is needed** rather than when this file is parsed.
+///
+/// **That distinction was the whole bug.** Hugging Face injects `window.huggingface.variables`
+/// into a static Space with a script tag of its own, and this page's script is inline in the body
+/// — so anything read at parse time is read before the platform's script has run. A bundled app
+/// (`reachy_mini_website`, the SDK's host shell) never notices, because a module bundle executes
+/// after the document. Read late and it is there; read early and a Space with a perfectly good
+/// OAuth app looks like a Space with none, which is exactly what this page reported for a day.
+function oauthClientId() {
+  // Substituted by the Space's `entrypoint.sh` from its `OAUTH_CLIENT_ID` environment variable.
+  // Left as a literal token on the robot's copy and in a checkout, where signing in to a
+  // rendezvous is not a thing anybody is doing.
+  const served = SERVER_CLIENT_ID.startsWith("{{") ? "" : SERVER_CLIENT_ID;
+  // Static Spaces are documented to inject this. This one never did — see the Space's README —
+  // but it is read first anyway, because an id from the platform cannot go stale the way a
+  // baked-in one can.
+  const injected = (window.huggingface && window.huggingface.variables) || {};
+  return PARAMS.get("client_id") || injected.OAUTH_CLIENT_ID || served;
+}
+
+// Where Hugging Face sends the browser back to. This page, without its query string — and it has
+// to match the app's registered redirect URI exactly, trailing slash included.
+const OAUTH_REDIRECT = location.origin + location.pathname;
+
+// Where the sign-in is remembered. `localStorage`, not `sessionStorage`: the OAuth redirect can
+// land in a new tab, and a session store is per-tab.
+const OAUTH_KEY = "duck-console-oauth-v2";
+
+// How long any step of the sign-in gets before the page says so and moves on.
+//
+// **A promise that never settles is the worst failure this page can have**, because every line it
+// would have logged is after the `await`. A spent `?code=` left in the address bar by an earlier
+// attempt produces exactly that: the library takes the code, tries to exchange it, and the page
+// goes quiet with "asking Hugging Face who you are…" as its last word. So every await here races
+// a timer, and the timer's message names the code in the URL as the thing to get rid of.
+const SIGN_IN_TIMEOUT = 10000;
+
+/// `promise`, or an error naming `what` if it takes longer than [`SIGN_IN_TIMEOUT`].
+function within(what, promise) {
+  return Promise.race([
+    promise,
+    new Promise((_, reject) => setTimeout(
+      () => reject(new Error(`${what} did not answer within ${SIGN_IN_TIMEOUT / 1000}s`)),
+      SIGN_IN_TIMEOUT,
+    )),
+  ]);
+}
+
 // Full deflection, matching `padd`'s defaults rather than inventing a second set of numbers:
 // 0.3 m/s and 1.5 rad/s. The robot clamps what it must; these are what a stick at the stop means.
 const MAX_LINEAR = 0.3;
@@ -303,19 +428,335 @@ <h2>telemetry</h2>
 
 function banner(html) { $("banner").innerHTML = html; $("banner").hidden = false; }
 
+log("dim", "console build", BUILD_LABEL);
+
 // ── signalling ─────────────────────────────────────────────────────────────────
 
 let ws = null, pc = null, sessionId = null, control = null;
+// The rendezvous half: the account token, a handle on the open event stream, and which robot of
+// the account's this page is driving.
+let token = null, stream = null, chosen = null;
+// The relay servers this page holds for itself, in the `{urls, username, credential}` shape
+// `RTCPeerConnection` takes. Empty until `refreshRelays` has run, and empty forever on a LAN.
+let relays = [];
+// Whether a session is wanted. Set by a person — the connect button, or picking another robot —
+// and cleared when the robot ends one.
+//
+// **This is what stops a refusal loop.** The rendezvous pushes a `peerStatusChanged` whenever a
+// producer's state changes, which this page answers with a fresh `list` so the picker cannot go
+// stale — and a robot ending a session *is* such a change. Without a flag, that listing walks
+// straight back into `startSession`, gets refused, and the refusal produces the next listing.
+let wanted = false;
+// Whether a `startSession` is already out. The service answers a `list` twice over — once as a
+// push after the welcome, once as the reply to our own — so without this the second listing opens
+// a second session against a robot that is about to accept the first.
+let starting = false;
 
 function send(msg) {
   log("out", "→", JSON.stringify(msg));
+  if (REMOTE) {
+    // **The reply to a `POST /send` can be a message, and dropping it costs the session.**
+    // On a WebSocket every answer comes back on the socket; here `startSession` is answered in
+    // the HTTP response body — `{"type":"sessionStarted","sessionId":…}` — and so is `list`,
+    // while everything else arrives on the event stream. A page that treated this as
+    // fire-and-forget got the robot's offer for a session it had never been told the id of, and
+    // failed on a null peer connection. So the body goes through the same handler as the stream.
+    fetch(`${RENDEZVOUS}/send`, {
+      method: "POST",
+      headers: { "authorization": `Bearer ${token}`, "content-type": "application/json" },
+      body: JSON.stringify(msg),
+    }).then(async (response) => {
+      if (!response.ok) {
+        log("bad", `!! POST /send: HTTP ${response.status}`);
+        return;
+      }
+      const answer = await response.json().catch(() => null);
+      // `{"status":"ok"}` is the answer to everything the service handles on the stream.
+      if (answer && answer.type) {
+        await onSignalling(JSON.stringify(answer));
+      }
+    }).catch((e) => log("bad", "!! POST /send:", e.message));
+    return;
+  }
   ws.send(JSON.stringify(msg));
 }
 
-$("signalling").textContent = SIGNALLING_URL;
+$("signalling").textContent = REMOTE ? RENDEZVOUS.replace(/^https:\/\//, "") : SIGNALLING_URL;
+
+// ── the rendezvous transport ──────────────────────────────────────────────────
+//
+// **`fetch`, not `EventSource`.** The stream needs an `Authorization` header and `EventSource`
+// cannot set one. The service does accept `?token=` as a transitional fallback and is removing it,
+// which is right — a bearer token in a query string is a bearer token in the Space's access log
+// and in every proxy between. So the framing is a few lines here: split on a blank line, keep the
+// `data:` payloads, ignore the comment-only pings the service sends to hold the connection open
+// through its own proxy.
+async function openRendezvous(onMessage, onClosed) {
+  const response = await fetch(`${RENDEZVOUS}/events`, {
+    headers: { "authorization": `Bearer ${token}`, "accept": "text/event-stream" },
+  });
+  if (response.status === 401) throw new Error("Hugging Face refused this sign-in");
+  if (!response.ok) throw new Error(`the rendezvous answered HTTP ${response.status}`);
+
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  let chunks = 0;
+  (async () => {
+    try {
+      for (;;) {
+        const { value, done } = await reader.read();
+        if (done) break;
+        // **CRLF, because the framing is not ours.** SSE permits `\r\n` line endings and a
+        // proxy is free to rewrite them; splitting on `\n\n` alone then matches nothing and
+        // every message is swallowed in silence — a stream that looks connected and says
+        // nothing, which is the worst shape a bug can take here. Normalised once, on arrival.
+        buffer += decoder.decode(value, { stream: true }).replace(/\r\n/g, "\n");
+        if (chunks++ === 0) {
+          // The first thing off the wire, verbatim and bounded. If the frames are not what this
+          // parser expects, this line is what says so instead of a silent stream.
+          log("dim", "first bytes from the stream:", JSON.stringify(buffer.slice(0, 200)));
+        }
+        // Events are separated by a blank line; a single event may carry several `data:` lines.
+        let split;
+        while ((split = buffer.indexOf("\n\n")) !== -1) {
+          const frame = buffer.slice(0, split);
+          buffer = buffer.slice(split + 2);
+          const data = frame
+            .split("\n")
+            .filter((line) => line.startsWith("data:"))
+            .map((line) => line.slice(5).trim())
+            .join("");
+          if (data) onMessage(data);
+        }
+      }
+    } catch (e) {
+      log("bad", "!! the event stream failed:", e.message);
+    }
+    log("dim", "the event stream ended");
+    onClosed();
+  })();
+  return reader;
+}
+
+/// Consume an OAuth redirect the moment the page loads, before anything else can.
+///
+/// **This is what a sign-in loop is made of.** Hugging Face sends the browser back here with a
+/// `?code=` in the URL, and that code has to be exchanged by whatever loads next. Doing it only
+/// when somebody clicks connect means the code is never spent: the click builds a *fresh* login
+/// URL, Hugging Face — already signed in — bounces straight back, and the page returns to idle
+/// having logged two lines that the reload then wiped. Handled here, the page comes back signed
+/// in and says so.
+async function resumeSignIn() {
+  if (!REMOTE) return;
+  log("dim", `remote mode: rendezvous ${RENDEZVOUS}`);
+
+  const returning = PARAMS.has("code") || location.hash.includes("code=");
+  const stored = localStorage.getItem(OAUTH_KEY);
+  const clientId = oauthClientId();
+  if (!clientId) {
+    log("bad", "!! no OAuth client id. On a Space this arrives as",
+               "`window.huggingface.variables.OAUTH_CLIENT_ID` from `hf_oauth: true` in the",
+               "README — if that is set and this still fires, the platform's script had not run",
+               "yet. Otherwise register an app with", OAUTH_REDIRECT, "as its redirect URI, or",
+               "pass `?client_id=` to try one.");
+    setState("no sign-in", "bad");
+    return;
+  }
+  log("dim", `oauth client ${clientId.slice(0, 8)}…, redirect ${OAUTH_REDIRECT}`);
+  if (!returning && !stored) {
+    log("dim", "not signed in. `connect` signs in with Hugging Face.");
+    return;
+  }
+
+  try {
+    if (returning) log("dim", "Hugging Face sent this page back with a sign-in code; spending it…");
+    const hub = await within("the sign-in library", import(HUB_ESM));
+    let result = returning
+      ? await within("the sign-in code exchange", hub.oauthHandleRedirectIfPresent())
+      : null;
+    if (returning && !result) {
+      log("bad", "!! Hugging Face sent this page a sign-in code and the library would not take",
+                 "it. That is a redirect loop waiting to happen, so the code is being dropped;",
+                 "click connect to start again.");
+      // Out of the URL either way: a spent or unusable code that stays in the address bar is
+      // re-read on every reload.
+      history.replaceState(null, "", location.pathname);
+      return;
+    }
+    if (result) {
+      localStorage.setItem(OAUTH_KEY, JSON.stringify(result));
+      history.replaceState(null, "", location.pathname);
+    } else {
+      result = JSON.parse(stored);
+    }
+    token = result.accessToken;
+    const who = result.userInfo && (result.userInfo.preferred_username || result.userInfo.name);
+    $("account").textContent = who || "signed in";
+    $("account").hidden = false;
+    log("dim", `signed in as ${who || "somebody"}; \`connect\` opens the session`);
+    setState("signed in");
+  } catch (e) {
+    log("bad", "!! the sign-in did not complete:", e.message || String(e));
+    if (returning) {
+      log("dim", "dropping the code from the address bar; `connect` starts a fresh sign-in");
+      history.replaceState(null, "", location.pathname);
+    }
+    localStorage.removeItem(OAUTH_KEY);
+    setState("no sign-in", "bad");
+  }
+}
+
+// **After the document, not during it.** Everything above is safe to define at parse time; only
+// this reads what the platform injected, and that script is not guaranteed to have run until the
+// page has loaded.
+if (document.readyState === "complete") {
+  resumeSignIn();
+} else {
+  window.addEventListener("load", () => resumeSignIn());
+}
+
+/// Sign in, and remember who with. `openid profile` only — this token's whole job is proving an
+/// identity to the rendezvous, and the argument for keeping it that narrow is §2.4's.
+///
+/// **Every step says what it was doing.** This is the one part of the page nothing on the robot can
+/// test, and the failures it has are all somebody else's configuration: a CDN a Space's policy
+/// will not load, OAuth metadata that has not taken effect yet, a token that has expired. A red
+/// pill and an empty log would send whoever hits one of those reading this source, so each step
+/// logs before it runs and names itself when it throws.
+async function signIn() {
+  log("dim", "loading the Hugging Face sign-in library…");
+  let hub;
+  try {
+    hub = await within("the sign-in library", import(HUB_ESM));
+  } catch (e) {
+    throw new Error(`could not load @huggingface/hub from cdn.jsdelivr.net (${e.message || e}). `
+      + `A Content-Security-Policy on this host would do that, and the fix is to vendor the `
+      + `library into this page rather than import it.`);
+  }
+
+  if (!oauthClientId()) {
+    throw new Error("this page has no OAuth client id, so it cannot sign anybody in. Register an "
+      + "app at huggingface.co/settings/applications/new with this page's URL as its redirect "
+      + `URI (${OAUTH_REDIRECT}) and the scopes \`openid profile\`, then put its client id in `
+      + "this page — or pass it as `?client_id=` to try one.");
+  }
+
+  const stored = localStorage.getItem(OAUTH_KEY);
+  log("dim", "asking Hugging Face who you are…");
+  let result;
+  try {
+    result = (await within("the sign-in code exchange", hub.oauthHandleRedirectIfPresent()))
+      || (stored ? JSON.parse(stored) : null);
+  } catch (e) {
+    localStorage.removeItem(OAUTH_KEY);
+    throw new Error(`the sign-in did not complete (${e.message || e})`);
+  }
+
+  if (!result) {
+    log("dim", "not signed in yet; going to Hugging Face");
+    let url;
+    try {
+      url = await hub.oauthLoginUrl({
+        clientId: oauthClientId(),
+        redirectUrl: OAUTH_REDIRECT,
+        scopes: "openid profile",
+      });
+    } catch (e) {
+      throw new Error(`this page cannot build a sign-in URL (${e.message || e}). The client id it `
+        + `used is ${oauthClientId().slice(0, 8)}… and the redirect it asks for is `
+        + `${OAUTH_REDIRECT}; an app whose registered redirect URI is not exactly that is the `
+        + `usual cause.`);
+    }
+    window.location.href = url;
+    return null;
+  }
+  localStorage.setItem(OAUTH_KEY, JSON.stringify(result));
+  return result;
+}
+
+$("robots").onchange = () => {
+  if (!stream) return;
+  chosen = $("robots").value;
+  wanted = true;
+  if (sessionId) {
+    send({ type: "endSession", sessionId });
+    sessionId = null;
+    if (pc) { pc.close(); pc = null; }
+    setDc("no control channel");
+    stopTelemetry();
+  }
+  send({ type: "list" });
+};
+
+/// Everything that has to be forgotten when a link goes away, whichever link it was.
+function teardown() {
+  setState("closed", "bad"); setDc("no control channel");
+  $("connect").textContent = "connect";
+  ws = null; stream = null; sessionId = null; control = null;
+  wanted = false; starting = false;
+  stopTelemetry();
+  if (pc) { pc.close(); pc = null; }
+}
+
+$("connect").onclick = async () => {
+  if (ws || stream) {
+    if (ws) ws.close();
+    // Cancelling the read closes the connection, which is what takes the *consumer* off the
+    // rendezvous. The robot's own producer registration is not ours to end.
+    if (stream) { stream.cancel().catch(() => {}); teardown(); }
+    return;
+  }
+
+  if (REMOTE) {
+    wanted = true;
+    try {
+      if (!token) {
+        setState("signing in…");
+        const oauth = await signIn();
+        if (!oauth) return; // redirected to Hugging Face; this page is about to be replaced
+        token = oauth.accessToken;
+        const who = oauth.userInfo && (oauth.userInfo.preferred_username || oauth.userInfo.name);
+        $("account").textContent = who || "signed in";
+        $("account").hidden = false;
+      }
+      setState("connecting…");
+      // Before the session rather than during it: `newPeerConnection` runs in a message handler
+      // that cannot wait, and credentials are short-lived enough that minting them per connect
+      // is simpler than keeping a fresh set around.
+      await refreshRelays();
+      log("dim", "opening the rendezvous event stream…");
+      let spoke = false;
+      stream = await openRendezvous((data) => {
+        spoke = true;
+        onSignalling(data).catch((e) => log("bad", "!!", e.message));
+      }, teardown);
+      setState("signalling");
+      $("connect").textContent = "disconnect";
+      // The welcome is the first thing on a healthy stream and it arrives at once. A stream that
+      // is open and mute for this long is a parser or a proxy, not a slow server, and saying so
+      // beats a page that sits on "signalling" forever.
+      setTimeout(() => {
+        if (!spoke && stream) {
+          log("bad", "!! the stream is open and has said nothing for 10s.",
+                     "The welcome should arrive immediately — so this is the framing being read",
+                     "wrongly, or something between here and the Space buffering it.");
+        }
+      }, 10000);
+    } catch (e) {
+      // `e.message` alone can be empty — a rejected dynamic import in some browsers is one — and
+      // a red pill with an empty log is the worst thing this page can do to somebody.
+      log("bad", "!!", e.message || String(e) || e.name || "no reason given");
+      if (e.stack) log("dim", e.stack.split("\n")[0]);
+      setState(token ? "no rendezvous" : "no sign-in", "bad");
+      // A refused token is a stale sign-in far more often than a revoked one, and the fix is the
+      // same either way: forget it so the next click signs in again rather than failing again.
+      localStorage.removeItem(OAUTH_KEY);
+    }
+    return;
+  }
 
-$("connect").onclick = () => {
-  if (ws) { ws.close(); return; }
+  wanted = true;
   ws = new WebSocket(SIGNALLING_URL);
   setState("connecting…");
 
@@ -330,18 +771,22 @@ <h2>telemetry</h2>
     : `!! no answer from ${SIGNALLING_URL} — wrong host, or mediad is not running. This page was `
       + `opened from a file rather than served by a robot; \`duckctl open\` serves it from the `
       + `robot instead.`);
-  ws.onclose = () => {
-    setState("closed", "bad"); setDc("no control channel");
-    $("connect").textContent = "connect";
-    ws = null; sessionId = null; control = null;
-    stopTelemetry();
-    if (pc) { pc.close(); pc = null; }
+  ws.onclose = teardown;
+
+  ws.onmessage = (event) => {
+    onSignalling(event.data).catch((e) => log("bad", "!!", e.message));
   };
+};
 
-  ws.onmessage = async (event) => {
-    const msg = JSON.parse(event.data);
+// ── one protocol, whichever transport carried it ───────────────────────────────
+//
+// The envelopes are the same on both sides — that is the whole reason the bridge in `mediad` is a
+// translator with an opaque payload rather than a parser (§3.2). So this switch is shared, and the
+// two cases below it that only the rendezvous ever sends are the exceptions worth naming.
+async function onSignalling(raw) {
+    const msg = JSON.parse(raw);
     // Skip the noisy ones so the log stays readable.
-    if (msg.type !== "peerStatusChanged") log("in", "←", event.data.slice(0, 400));
+    if (msg.type !== "peerStatusChanged") log("in", "←", raw.slice(0, 400));
 
     switch (msg.type) {
       case "welcome":
@@ -350,13 +795,45 @@ <h2>telemetry</h2>
         break;
 
       case "list": {
-        const producer = msg.producers && msg.producers[0];
-        if (!producer) {
-          log("bad", "!! no producers. mediad registers as one when its pipeline reaches PLAYING —",
-                     "check its journal for a pipeline that would not start.");
+        // The rendezvous lists every robot the signed-in account owns, and the mini's producers
+        // are on the same service — so this filters on `meta.kind`. On a LAN there is exactly one
+        // producer and it is this robot, whose local `meta` carries no `kind` at all, so the
+        // filter would remove the only candidate. §5.1.
+        let producers = msg.producers || [];
+        if (REMOTE) producers = producers.filter((p) => (p.meta || {}).kind === KIND);
+
+        if (!producers.length) {
+          log("bad", REMOTE
+            ? "!! no duck is registered with this account. A robot appears here about thirty "
+              + "seconds after `robotctl account login`, and only while it has a network."
+            : "!! no producers. mediad registers as one when its pipeline reaches PLAYING — "
+              + "check its journal for a pipeline that would not start.");
           setState("no producer", "bad");
           return;
         }
+
+        // More than one duck is the ordinary case for an account that owns two, so the picker
+        // appears rather than the first one silently winning.
+        if (REMOTE && producers.length > 1) {
+          const picker = $("robots");
+          picker.innerHTML = "";
+          for (const candidate of producers) {
+            const option = document.createElement("option");
+            option.value = candidate.id;
+            option.textContent = (candidate.meta || {}).name || candidate.id.slice(0, 8);
+            picker.append(option);
+          }
+          if (chosen && producers.some((p) => p.id === chosen)) picker.value = chosen;
+          picker.hidden = false;
+        }
+
+        // A session already exists, or nobody asked for one: this listing is a robot appearing
+        // or going away, not an invitation to open a session. Two consumers on one robot is
+        // `remote-webrtc.md` §9's interleaving bug, and the service refuses it anyway.
+        if (sessionId || starting || !wanted) break;
+
+        chosen = (REMOTE && producers.length > 1 && $("robots").value) || producers[0].id;
+        const producer = producers.find((p) => p.id === chosen) || producers[0];
         // The producer's `meta` names the robot before a session exists — `mediad/src/producer.rs`
         // is what puts it there. Shown straight away, so the header is filled in before the
         // datachannel opens and re-filled from `system.info` and `hello` when it does.
@@ -367,11 +844,13 @@ <h2>telemetry</h2>
         if (meta.api_version) $("api").textContent = `api v${meta.api_version}`;
         // No `offer`, so the producer offers and we answer. That is the direction webrtcsink
         // wants: it knows what it is sending.
+        starting = true;
         send({ type: "startSession", peerId: producer.id });
         break;
       }
 
       case "sessionStarted":
+        starting = false;
         sessionId = msg.sessionId;
         setState("negotiating");
         newPeerConnection();
@@ -383,6 +862,12 @@ <h2>telemetry</h2>
       // one mistake that produces silence rather than an error, so they are read off
       // net/webrtc/protocol rather than guessed.
       case "peer":
+        if (!pc) {
+          log("bad", "!! a peer message arrived before this page had a session to put it in",
+                     `(sessionId ${msg.sessionId}).`,
+                     "That is `sessionStarted` having been missed, not the robot misbehaving.");
+          break;
+        }
         if (msg.sdp) {
           await pc.setRemoteDescription(msg.sdp);
           const answer = await pc.createAnswer();
@@ -397,24 +882,100 @@ <h2>telemetry</h2>
         break;
 
       case "endSession":
-        log("dim", "session ended by the robot");
+        log("dim", "session ended by the robot", msg.reason ? `— ${msg.reason}` : "");
+        // Both, and both matter: a stale `sessionId` would be sent on the next `peer` message,
+        // and leaving `wanted` set turns the next listing into another request the robot has
+        // just declined.
+        sessionId = null;
+        wanted = false;
+        starting = false;
         if (pc) { pc.close(); pc = null; }
         setState("signalling"); setDc("no control channel");
         stopTelemetry();
         break;
 
+      // Only the rendezvous sends these two. The robot's own signalling server has no notion of
+      // another consumer holding the robot, and no producer to refuse on behalf of.
+      case "sessionRejected":
+        log("bad", `!! the robot refused a session (${msg.reason || "no reason given"})`,
+                   msg.activeApp ? `— ${msg.activeApp} is driving it` : "");
+        setState(msg.reason === "robot_busy" ? "robot busy" : "refused", "bad");
+        break;
+
+      case "peerStatusChanged":
+        // A robot appearing or going away while this page is open. Cheap to redraw, and the
+        // alternative is a listing that goes stale the moment somebody unplugs a duck. Only
+        // remotely: on a LAN the one producer is the robot serving this page.
+        if (REMOTE) send({ type: "list" });
+        break;
+
       case "error":
         log("bad", "!! server error:", msg.details);
         break;
     }
-  };
-};
+}
+
+/// Mint relay credentials for **this visitor**, so the page can offer a relay of its own.
+///
+/// §6 of `remote-access-design.md` argued only the robot needs to offer one: a connection needs
+/// one relay candidate and not two, and `aiortc`'s TURN client does not work, so a Python
+/// consumer could never be the side that relays. Both halves are still true, and the conclusion
+/// was still wrong for a browser — because it assumed the two ends can address each other at all.
+///
+/// **An iPhone on a mobile network has no IPv4 socket.** It reaches a *hostname* through
+/// DNS64/NAT64 and the STUN server reports an IPv4 reflexive address back, so it looks like it
+/// has IPv4 and gathers a candidate saying so. But an ICE candidate is a bare literal, and the
+/// robot's relay candidate is a bare IPv4 literal, which that phone cannot send a packet to.
+/// Six sessions negotiated perfectly and carried nothing, which is the same symptom a missing
+/// relay gives and a different cause.
+///
+/// Its own allocation is what bridges the two, and only its own can: `turn.cloudflare.com` is a
+/// name, so it resolves over IPv6, and the relayed address Cloudflare hands back is IPv4 — which
+/// the robot can reach. One relay candidate is still enough. It just has to be this end's.
+///
+/// Metered against the visitor's account rather than the robot owner's, which is the right way
+/// round: a robot's allowance should go on being watched, not on watching.
+async function refreshRelays() {
+  relays = [];
+  if (!REMOTE || !token) return;
+  try {
+    const response = await fetch(`${TURN_CREDENTIALS_URL}?ttl=${TURN_TTL_SECONDS}`, {
+      headers: { authorization: `Bearer ${token}` },
+    });
+    if (!response.ok) throw new Error(`HTTP ${response.status}`);
+    const offered = (await response.json()).iceServers || [];
+    // A `stun:` entry has no credentials and is not a relay; the STUN server is set below.
+    relays = offered.filter((server) => server.username && server.credential);
+    log("dim", `relay credentials: ${relays.length} server(s)`);
+  } catch (e) {
+    // Best effort, always. Without a relay this page still reaches every robot it could reach
+    // before, which is most of them — so this is a line in the log and not a failed connect.
+    log("bad", "!! no relay credentials:", e.message || String(e),
+               "— a session from a mobile network may negotiate and carry nothing");
+  }
+}
 
 function newPeerConnection() {
-  // No ICE servers: this is a LAN client talking to a robot on the same network, which is the
-  // case §3 exists for. Reaching a robot elsewhere goes through the bridge (§7) and would need
-  // STUN, which is that design's problem rather than this page's.
-  pc = new RTCPeerConnection();
+  // **STUN only when it is needed, which is when this page is not on the robot's network.**
+  //
+  // On a LAN both ends offer host candidates and they pair immediately; asking a public STUN
+  // server about a robot two metres away would add a round trip to somebody else's service for a
+  // candidate nothing will use. Remotely there are no host candidates in common, so the browser
+  // has to learn its own reflexive address — and until it did, this page offered only
+  // `192.168.…` to a robot on another network and the session negotiated perfectly and carried
+  // nothing.
+  //
+  // `stun.l.google.com` is what `webrtcsink` already defaults to on the robot side, so the two
+  // ends use one server rather than two.
+  //
+  // **And this page's own relay servers, when `refreshRelays` got any.** Reading them here rather
+  // than fetching is the same rule the robot follows in its `consumer-added` handler: this runs
+  // inside a signalling message handler, and an HTTP request in it would delay the answer to
+  // every session, including the LAN ones that will never use a relay. `relays` is filled on the
+  // connect path, which is already asynchronous and already says "connecting…".
+  pc = new RTCPeerConnection(REMOTE
+    ? { iceServers: [{ urls: "stun:stun.l.google.com:19302" }, ...relays] }
+    : undefined);
 
   pc.ontrack = (event) => {
     log("dim", "track:", event.track.kind);
@@ -567,7 +1128,7 @@ <h2>telemetry</h2>
       banner(`This page speaks API v${SERVED_API} and the robot speaks v${hello.api_version}. `
         + `Everything still works; a call this robot does not know will say so. `
         + `<code>duckctl open</code> serves the page from the robot itself, which cannot differ.`);
-    } else if (!SERVED_BY_ROBOT) {
+    } else if (!SERVED_BY_ROBOT && !REMOTE) {
       banner(`This page was opened from a checkout rather than served by the robot, so it cannot `
         + `say whether the two agree about the API. <code>duckctl open</code> serves it from the `
         + `robot.`);
@@ -996,3 +1557,6 @@ <h2>telemetry</h2>
   control.send(line);
 };
 </script>
+
+</body>
+</html>
diff --git a/mediad/webclient/space/Dockerfile b/mediad/webclient/space/Dockerfile
new file mode 100644
index 00000000..ca281f46
--- /dev/null
+++ b/mediad/webclient/space/Dockerfile
@@ -0,0 +1,23 @@
+# The console, served by a Space that can read its own OAuth client id.
+#
+# **Why a server for a page that needs none.** A static Space is documented to inject
+# `window.huggingface.variables.OAUTH_CLIENT_ID` into the page, and for this Space it never did —
+# through a rebuild, a privacy flip, a recreation, and a page given a real `<head>` to be injected
+# into. A Docker Space takes the other documented path instead: `hf_oauth: true` puts the client id
+# in the environment, and eight lines of `sh` put it in the page. That is the mechanism the
+# `grabette-*` Spaces use, and it depends on nothing that can silently stop happening.
+#
+# `docs/design/remote-access-design.md` §5.
+FROM python:3.13-slim
+
+# `python -m http.server` is the whole server: one file, GET only, no upload path, no config. The
+# alternative was nginx, which is a package, a config file and a user to get wrong for a page.
+WORKDIR /app
+COPY index.html /app/index.html
+COPY entrypoint.sh /app/entrypoint.sh
+RUN chmod +x /app/entrypoint.sh
+
+# HF's default for a Docker Space, and `app_port` in the README says the same number.
+EXPOSE 7860
+
+ENTRYPOINT ["/app/entrypoint.sh"]
diff --git a/mediad/webclient/space/README.md b/mediad/webclient/space/README.md
new file mode 100644
index 00000000..12933857
--- /dev/null
+++ b/mediad/webclient/space/README.md
@@ -0,0 +1,47 @@
+---
+title: microduck console
+emoji: 🦆
+colorFrom: yellow
+colorTo: gray
+sdk: docker
+app_port: 7860
+pinned: false
+hf_oauth: true
+hf_oauth_expiration_minutes: 1440
+short_description: Drive a duck that is not on your network.
+tags:
+ - microduck
+ - webrtc
+---
+
+# microduck console
+
+Drives a duck that is not on your network. Sign in with Hugging Face, and the robots your account
+owns appear — the same console page the robot serves on its own LAN, reaching it through the
+rendezvous service instead of a WebSocket.
+
+**`hf_oauth: true` is load-bearing**: it is what creates the OAuth app whose client id this Space
+receives as `OAUTH_CLIENT_ID` in its environment, and `entrypoint.sh` substitutes into the page as
+it serves it. Without it the console cannot sign anybody in, and says so.
+
+**Docker rather than static, and that is a scar.** A static Space is documented to inject
+`window.huggingface.variables.OAUTH_CLIENT_ID` into the page — and for this Space it never did,
+through a metadata change, a privacy flip, a delete-and-recreate, and a page given a real `<head>`
+for the injector to work on. `sdk: docker` uses the other documented path, the same one the
+`grabette-*` Spaces use: the id arrives as an environment variable, which nothing can quietly stop
+doing. A page that needs no server got one for exactly that reason.
+
+`openid profile` is all this asks for — always included, never listed. The token's whole job is
+proving an identity to the rendezvous service, which resolves it through `whoami-v2` and reads the
+username out of the answer. Asking a browser for repository scopes would be the mistake
+`remote-access-design.md` §2.4 is about fixing on the robot.
+
+**Do not edit this Space directly.** The page is
+[`mediad/webclient/index.html`](https://github.com/pollen-robotics/microduck/blob/main/mediad/webclient/index.html)
+in `pollen-robotics/microduck`, and `scripts/publish-console.sh` is what puts it here. It has to
+live there because it tracks two things that do: the signalling protocol and the robot's own method
+names. `remote-access-design.md` §5.
+
+One page, two transports. Served by a robot, it opens `ws://<robot>:8443`. Served from here — over
+https, where a browser will not open a `ws://` at all — it reads the rendezvous service's event
+stream and posts back to it, carrying the same envelopes with per-hop ids.
diff --git a/mediad/webclient/space/entrypoint.sh b/mediad/webclient/space/entrypoint.sh
new file mode 100755
index 00000000..731301c6
--- /dev/null
+++ b/mediad/webclient/space/entrypoint.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+#
+# Put the Space's OAuth client id in the page, then serve it.
+#
+# `OAUTH_CLIENT_ID` is what `hf_oauth: true` in the README puts in this container's environment.
+# It is public — it identifies the app, it does not authorise anything — which is why it can be
+# baked into a page that anybody can read. `OAUTH_CLIENT_SECRET` is also in this environment and
+# must never go anywhere near the page: the browser flow is PKCE and needs no secret.
+set -eu
+
+if [ -z "${OAUTH_CLIENT_ID:-}" ]; then
+    # Not fatal: the page says so itself, and a console that serves and explains beats one that
+    # will not start. The likeliest cause is `hf_oauth: true` missing from the README.
+    echo "no OAUTH_CLIENT_ID in the environment; the page will not be able to sign anybody in" >&2
+fi
+
+mkdir -p /srv
+sed "s|{{OAUTH_CLIENT_ID}}|${OAUTH_CLIENT_ID:-}|g" /app/index.html > /srv/index.html
+
+echo "serving the console on 7860 (oauth client ${OAUTH_CLIENT_ID:-none})"
+exec python3 -m http.server 7860 --directory /srv
diff --git a/odometry/src/anchors.rs b/odometry/src/anchors.rs
new file mode 100644
index 00000000..f834be6b
--- /dev/null
+++ b/odometry/src/anchors.rs
@@ -0,0 +1,95 @@
+//! Sole anchor points for the contact odometry, in each foot's site frame
+//! (X front/back, Y left/right, Z up), metres.
+//!
+//! GENERATED by microduck_rl/scripts/odom_anchor_points.py — do not edit:
+//!   odom_anchor_points.py --rust /home/antoine/Pollen/microduck/odometry/src/anchors.rs
+//! from src/mjlab_microduck/robot/microduck/scene.xml.
+
+/// A named set of candidate contact points, one list per foot.
+pub struct AnchorSet {
+    pub name: &'static str,
+    pub left: &'static [[f64; 3]],
+    pub right: &'static [[f64; 3]],
+}
+
+impl AnchorSet {
+    /// Points for foot 0 (left) or 1 (right).
+    pub fn foot(&self, foot: usize) -> &'static [[f64; 3]] {
+        if foot == 0 { self.left } else { self.right }
+    }
+}
+
+/// Legacy: the v1.5 sole bbox on the site's Z = 0 plane, both feet alike.
+pub const V15: AnchorSet = AnchorSet {
+    name: "v15",
+    left: &[
+        [0.027000, 0.020600, 0.000000],
+        [0.027000, -0.020600, 0.000000],
+        [-0.027000, -0.020600, 0.000000],
+        [-0.027000, 0.020600, 0.000000],
+    ],
+    right: &[
+        [0.027000, 0.020600, 0.000000],
+        [0.027000, -0.020600, 0.000000],
+        [-0.027000, -0.020600, 0.000000],
+        [-0.027000, 0.020600, 0.000000],
+    ],
+};
+
+/// The four corners of the alpha sole's flat contact patch, on the mesh.
+pub const ALPHA4: AnchorSet = AnchorSet {
+    name: "alpha4",
+    left: &[
+        [0.024844, 0.012452, 0.001414],
+        [0.024029, -0.012395, -0.000680],
+        [-0.011047, -0.013121, -0.000751],
+        [-0.011862, 0.013177, 0.001515],
+    ],
+    right: &[
+        [0.024029, 0.012395, -0.000680],
+        [0.024844, -0.012452, 0.001415],
+        [-0.011862, -0.013177, 0.001516],
+        [-0.011047, 0.013121, -0.000751],
+    ],
+};
+
+/// A 4x4 grid over the whole alpha footprint (bevels included), on the mesh.
+pub const ALPHA16: AnchorSet = AnchorSet {
+    name: "alpha16",
+    left: &[
+        [-0.018300, -0.019510, 0.005894],
+        [-0.001500, -0.019659, 0.001516],
+        [0.015500, -0.019659, 0.002082],
+        [0.031699, -0.019061, 0.005531],
+        [-0.018500, -0.006960, 0.002891],
+        [-0.001500, -0.006960, -0.000607],
+        [0.015500, -0.006960, -0.000573],
+        [0.032500, -0.006960, 0.002863],
+        [-0.018500, 0.005740, 0.003709],
+        [-0.001500, 0.005740, 0.000500],
+        [0.015500, 0.005740, 0.000474],
+        [0.032500, 0.005740, 0.003683],
+        [-0.018300, 0.018290, 0.007998],
+        [-0.001500, 0.018439, 0.003859],
+        [0.015500, 0.018439, 0.004318],
+        [0.031699, 0.017841, 0.007574],
+    ],
+    right: &[
+        [-0.018300, -0.018290, 0.007998],
+        [-0.001500, -0.018439, 0.003859],
+        [0.015500, -0.018439, 0.004320],
+        [0.031699, -0.017841, 0.007574],
+        [-0.018500, -0.005740, 0.003712],
+        [-0.001500, -0.005740, 0.000500],
+        [0.015500, -0.005740, 0.000474],
+        [0.032500, -0.005740, 0.003681],
+        [-0.018500, 0.006960, 0.002893],
+        [-0.001500, 0.006960, -0.000607],
+        [0.015500, 0.006960, -0.000573],
+        [0.032500, 0.006960, 0.002863],
+        [-0.018300, 0.019510, 0.005894],
+        [-0.001500, 0.019659, 0.001516],
+        [0.015500, 0.019659, 0.002080],
+        [0.031699, 0.019061, 0.005531],
+    ],
+};
diff --git a/odometry/src/lib.rs b/odometry/src/lib.rs
index a3742b5c..2b94eaa9 100644
--- a/odometry/src/lib.rs
+++ b/odometry/src/lib.rs
@@ -21,16 +21,21 @@
 //! boot", which is all a relative-motion consumer needs.
 //!
 //! Alpha only, like the daemon: v1/v1.5 geometry stayed in the prototype.
+//!
+//! The candidate contact points — the "sole corners" — are an [`AnchorSet`],
+//! sampled on the sole mesh by `microduck_rl/scripts/odom_anchor_points.py`
+//! (see [`anchors`]). [`Odometry::alpha`] uses [`ALPHA16`], a 4x4 grid over
+//! the whole sole on the mesh: in the MuJoCo twin over a 3.2 m walk it drifted
+//! 9 mm where the legacy v1.5 bbox ([`V15`]) drifted 17 mm and the flat
+//! patch's four corners ([`ALPHA4`]) 16 mm, and it stands at the true height
+//! (V15 sat 3.7 mm high). The scan costs about half a microsecond more.
+
+mod anchors;
 
+pub use anchors::{ALPHA4, ALPHA16, AnchorSet, V15};
 use duck_ipc_proto::JOINT_NAMES;
 use kinematics::{Model, Pose, Quat, SiteId};
 
-/// Sole half-extents along the foot-site frame X (front/back) and Y
-/// (left/right). Placeholder carried over from the prototype: the v1.5 sole
-/// bbox values, until alpha's `sole_left.stl` is measured.
-const SOLE_HALF_LEN: f64 = 0.0270;
-const SOLE_HALF_WIDTH: f64 = 0.0206;
-
 /// A candidate corner must sit below world Z = `-SWITCH_MARGIN` to bid for the
 /// anchor. The anchor itself sits at Z = 0, so the margin is slack for FK and
 /// IMU noise, not a physical depth.
@@ -47,6 +52,8 @@ const RIGHT: usize = 1;
 pub struct Odometry {
     model: &'static Model,
     feet: [SiteId; 2],
+    /// The candidate contact points on each sole.
+    anchors: &'static AnchorSet,
     /// `JOINT_NAMES` position → model joint index. `None` for the mouth, which
     /// moves no leg.
     joint_map: [Option<usize>; JOINT_NAMES.len()],
@@ -69,7 +76,7 @@ pub struct Odometry {
 }
 
 impl Odometry {
-    pub fn new(model: &'static Model) -> Self {
+    pub fn new(model: &'static Model, anchors: &'static AnchorSet) -> Self {
         let feet = [
             model.site("left_foot").expect("model has a left_foot site"),
             model
@@ -78,6 +85,7 @@ impl Odometry {
         ];
         Self {
             feet,
+            anchors,
             joint_map: JOINT_NAMES.map(|name| model.joint_index(name)),
             angles: vec![0.0; model.num_joints()],
             model,
@@ -92,8 +100,19 @@ impl Odometry {
         }
     }
 
+    /// The alpha robot with the [`ALPHA16`] grid — the production estimator.
     pub fn alpha() -> Self {
-        Self::new(Model::alpha())
+        Self::new(Model::alpha(), &ALPHA16)
+    }
+
+    /// The alpha robot with a chosen anchor set.
+    pub fn alpha_with(anchors: &'static AnchorSet) -> Self {
+        Self::new(Model::alpha(), anchors)
+    }
+
+    /// The anchor set this estimator picks its contact point from.
+    pub fn anchors(&self) -> &'static AnchorSet {
+        self.anchors
     }
 
     /// Advance the estimate by one sensor sample.
@@ -193,17 +212,10 @@ impl Odometry {
     /// The lowest sole corner below the switch threshold, if any, with its
     /// current world X/Y.
     fn lowest_corner(&self, rot: Quat, feet: &[Pose; 2]) -> Option<(usize, [f64; 3], [f64; 2])> {
-        const CORNERS: [[f64; 3]; 4] = [
-            [SOLE_HALF_LEN, SOLE_HALF_WIDTH, 0.0],
-            [SOLE_HALF_LEN, -SOLE_HALF_WIDTH, 0.0],
-            [-SOLE_HALF_LEN, SOLE_HALF_WIDTH, 0.0],
-            [-SOLE_HALF_LEN, -SOLE_HALF_WIDTH, 0.0],
-        ];
-
         let mut lowest = -SWITCH_MARGIN;
         let mut best = None;
         for foot in [LEFT, RIGHT] {
-            for corner in CORNERS {
+            for &corner in self.anchors.foot(foot) {
                 let in_world = rot.rotate(feet[foot].transform_point(corner));
                 let world = [
                     self.position[0] + in_world[0],
@@ -232,6 +244,87 @@ mod tests {
         [(roll / 2.0).cos(), (roll / 2.0).sin(), 0.0, 0.0]
     }
 
+    /// The generated alpha sets must be sole points: inside the sole's
+    /// footprint in the site frame and within its thickness, with the right
+    /// foot the mirror image of the left.
+    #[test]
+    fn alpha_anchor_sets_lie_on_the_sole() {
+        for set in [&ALPHA4, &ALPHA16] {
+            assert_eq!(set.left.len(), set.right.len(), "{}", set.name);
+            for p in set.left.iter().chain(set.right) {
+                assert!((-0.021..=0.035).contains(&p[0]), "{} x {p:?}", set.name);
+                assert!((-0.022..=0.022).contains(&p[1]), "{} y {p:?}", set.name);
+                assert!((-0.002..=0.012).contains(&p[2]), "{} z {p:?}", set.name);
+            }
+            // Each foot is sampled on its own mesh, so the order differs; the
+            // right sole is the left one mirrored in Y (to the sampling step).
+            for l in set.left {
+                let twin = set.right.iter().any(|r| {
+                    (l[0] - r[0]).abs() < 3e-4
+                        && (l[1] + r[1]).abs() < 3e-4
+                        && (l[2] - r[2]).abs() < 3e-4
+                });
+                assert!(twin, "{}: no mirror of {l:?} on the right sole", set.name);
+            }
+        }
+        assert_eq!(ALPHA4.left.len(), 4);
+        assert_eq!(ALPHA16.left.len(), 16);
+    }
+
+    /// Reference trajectory for the Python replica in
+    /// `microduck_rl/scripts/infer_policy.py` (`PyOdometry`): the same joint
+    /// and IMU sequence fed to both must give the same positions.
+    /// `cargo test -p odometry -- --ignored --nocapture dump_reference_trajectory`
+    #[test]
+    #[ignore = "reference dump for the Python replica, run by hand"]
+    fn dump_reference_trajectory() {
+        for set in [&V15, &ALPHA4, &ALPHA16] {
+            let mut odo = Odometry::alpha_with(set);
+            let mut joints = [0.0; JOINT_NAMES.len()];
+            for i in 0..400 {
+                let t = i as f64;
+                joints[1] = 0.15 * (0.05 * t).sin(); // left_hip_roll
+                joints[2] = 0.30 * (0.07 * t).sin(); // left_hip_pitch
+                joints[3] = 0.20 * (0.07 * t).cos(); // left_knee
+                joints[12] = 0.30 * (0.07 * t).cos(); // right_hip_pitch
+                joints[13] = 0.20 * (0.07 * t).sin(); // right_knee
+                odo.update(&joints, roll_quat(0.10 * (0.05 * t).sin()));
+                let [x, y, z] = odo.position();
+                println!(
+                    "REF {} {i} {x:.9} {y:.9} {z:.9} {}",
+                    set.name,
+                    odo.anchor_foot()
+                );
+            }
+        }
+    }
+
+    /// Cost of one `update` per anchor set, for sizing the set the robot
+    /// runs. `cargo test -p odometry --release -- --ignored --nocapture`.
+    #[test]
+    #[ignore = "timing, run by hand"]
+    fn update_cost_per_anchor_set() {
+        let mut joints = [0.0; JOINT_NAMES.len()];
+        for set in [&V15, &ALPHA4, &ALPHA16] {
+            let mut odo = Odometry::alpha_with(set);
+            let iters = 200_000;
+            let start = std::time::Instant::now();
+            for i in 0..iters {
+                // Wiggle the legs so the FK and corner scan see real data.
+                let t = i as f64 * 0.02;
+                joints[0] = 0.3 * t.sin();
+                joints[5] = 0.3 * t.cos();
+                odo.update(&joints, roll_quat(0.05 * t.sin()));
+            }
+            let per = start.elapsed().as_nanos() as f64 / iters as f64;
+            println!(
+                "{:>8}: {} points/foot, {per:7.0} ns per update",
+                set.name,
+                set.left.len()
+            );
+        }
+    }
+
     /// A robot standing still is at the origin and stays there — the first
     /// update seeds the anchor so the trunk starts at (0, 0), and constant
     /// inputs must not integrate into drift.
diff --git a/pad-imu/Cargo.toml b/pad-imu/Cargo.toml
new file mode 100644
index 00000000..64463d22
--- /dev/null
+++ b/pad-imu/Cargo.toml
@@ -0,0 +1,14 @@
+# A gamepad's inertial unit, read into an attitude.
+#
+# One filter for two programs: `padd` poses the robot's head from it, `robotctl monitor` draws
+# the pad from it. Its own crate so neither depends on the other, and so the head and the
+# picture cannot disagree about which way the pad is tilted. Depends on the wire types only.
+[package]
+name = "pad-imu"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+
+[dependencies]
+duck-ipc-proto = { path = "../duck-ipc-proto" }
diff --git a/pad-imu/src/lib.rs b/pad-imu/src/lib.rs
new file mode 100644
index 00000000..470f265e
--- /dev/null
+++ b/pad-imu/src/lib.rs
@@ -0,0 +1,602 @@
+//! A gamepad's inertial unit, read into an attitude.
+//!
+//! Some pads carry a six-axis IMU. The "Pro Controller" Switch clones do, and `padd`'s tap hands
+//! its samples out as [`proto::PadReport::Imu`] — raw kernel units at several hundred a second.
+//! This crate turns that stream into an orientation two programs need the same way: `padd`, to
+//! pose the robot's head from the pad in your hands, and `robotctl monitor`, to draw the pad
+//! tilting on screen. One filter, so the head and the picture cannot disagree.
+//!
+//! ## What it computes
+//!
+//! **Orientation**, as a quaternion from the pad's body frame to the world, by integrating the
+//! gyro and pulling the result back toward the accelerometer's gravity — the smallest useful
+//! complementary filter. Gravity fixes pitch and roll; yaw comes from the gyro alone and drifts,
+//! which is honest: nothing on a pad can observe heading. Whoever uses yaw has to re-zero it now
+//! and then, and [`relative`] is how.
+//!
+//! **Gyro bias**, because the clone's gyro is not calibrated. At rest on a table its Z rate reads
+//! about 12 °/s, and integrated as-is the attitude would turn a full circle every thirty seconds
+//! while the pad lay still. So the rate is watched for stillness — a short window in which the
+//! three rates barely move and the accelerometer reads one g — and the mean over such a window is
+//! taken as the bias. Until the first still window the raw rate is used and [`Imu::bias_dps`] says
+//! so.
+//!
+//! ## Axes
+//!
+//! `hid-nintendo` reports the accelerometer on `ABS_X/Y/Z` and the gyro on `ABS_RX/RY/RZ`, with
+//! `+Z` up when the pad lies flat: the clone reads about `+1 g` there at rest. The body frame is
+//! **+X the pad's front** — the edge with the triggers, away from the player — and **+Y the pad's
+//! left**, which follows from a right-handed frame with Z up. Confirmed against the drawn pad on
+//! the robot, 2026-09-09.
+//!
+//! ## What it costs
+//!
+//! A few dozen multiplications per sample. Six hundred a second are a rounding error next to
+//! reading them off the kernel.
+
+use duck_ipc_proto as proto;
+
+/// How hard the accelerometer pulls the orientation back toward gravity, per second.
+///
+/// Two: a tilt error decays with a half-second time constant, which is slow enough that shaking
+/// the pad does not make the attitude flinch and fast enough that it is level a second after being
+/// set down.
+const GRAVITY_GAIN: f32 = 2.0;
+
+/// Accelerometer magnitudes accepted as "this is gravity", in g.
+///
+/// Outside this the pad is being moved, and the accelerometer measures the hand as much as the
+/// earth. The orientation then runs on the gyro alone until the pad settles.
+const GRAVITY_BAND: std::ops::RangeInclusive<f32> = 0.85..=1.15;
+
+/// How long the rates have to hold still before a bias is taken from them, seconds.
+const STILL_WINDOW_S: f64 = 0.5;
+
+/// How far the rates may wander across a still window and still count as still, °/s.
+///
+/// Above the clone's noise (about one °/s peak to peak at rest) and well below the slowest turn a
+/// hand makes on purpose.
+const STILL_SPREAD_DPS: f32 = 3.0;
+
+/// Longest gap between two samples the integrator will bridge, seconds.
+///
+/// Beyond it the pad was silent — a dropped batch, a paused reader — and integrating one stale
+/// rate over the whole gap would throw the attitude. The sample is taken; the interval is not.
+const MAX_DT_S: f32 = 0.05;
+
+/// One pad IMU, as accumulated from the tap.
+pub struct Imu {
+    device: proto::PadImuDevice,
+    samples: u64,
+    socket_dropped: u64,
+    /// The last sample's kernel timestamp, for the interval.
+    last_us: Option<u64>,
+    /// Sample rate, hertz, as an average over the recent intervals.
+    rate_hz: Option<f32>,
+    /// The newest sample in physical units.
+    accel_g: [f32; 3],
+    gyro_dps: [f32; 3],
+    bias: Bias,
+    /// Body → world.
+    q: [f32; 4],
+    /// Has the orientation been seeded from gravity yet?
+    seeded: bool,
+}
+
+/// The gyro's rest offset, and the still window being watched for the next one.
+struct Bias {
+    /// The bias in use, °/s. `None` until the first still window completes.
+    value: Option<[f32; 3]>,
+    /// The window under way: when it opened, what it has seen.
+    since_us: Option<u64>,
+    min: [f32; 3],
+    max: [f32; 3],
+    sum: [f64; 3],
+    count: u32,
+}
+
+impl Bias {
+    fn new() -> Self {
+        Self {
+            value: None,
+            since_us: None,
+            min: [f32::INFINITY; 3],
+            max: [f32::NEG_INFINITY; 3],
+            sum: [0.0; 3],
+            count: 0,
+        }
+    }
+
+    /// Offer one raw rate. Only samples taken while the accelerometer reads gravity count: a pad
+    /// in motion can have a quiet gyro for a moment and still not be at rest.
+    fn observe(&mut self, raw_dps: [f32; 3], gravity_ok: bool, at_us: u64) {
+        if !gravity_ok {
+            self.reset_window();
+            return;
+        }
+        let since = *self.since_us.get_or_insert(at_us);
+        for (axis, rate) in raw_dps.iter().enumerate() {
+            self.min[axis] = self.min[axis].min(*rate);
+            self.max[axis] = self.max[axis].max(*rate);
+            self.sum[axis] += f64::from(*rate);
+        }
+        self.count += 1;
+
+        let spread = (0..3)
+            .map(|axis| self.max[axis] - self.min[axis])
+            .fold(0.0f32, f32::max);
+        if spread > STILL_SPREAD_DPS {
+            // Moved. Start over from here rather than waiting the window out.
+            self.reset_window();
+            return;
+        }
+        if (at_us.saturating_sub(since)) as f64 >= STILL_WINDOW_S * 1e6 && self.count > 0 {
+            let mean = [
+                (self.sum[0] / f64::from(self.count)) as f32,
+                (self.sum[1] / f64::from(self.count)) as f32,
+                (self.sum[2] / f64::from(self.count)) as f32,
+            ];
+            // Blend with what is already known rather than jumping: two still windows a minute
+            // apart disagreeing by a tenth of a degree per second should not make the attitude
+            // twitch each time.
+            self.value = Some(match self.value {
+                Some(old) => [
+                    0.5 * (old[0] + mean[0]),
+                    0.5 * (old[1] + mean[1]),
+                    0.5 * (old[2] + mean[2]),
+                ],
+                None => mean,
+            });
+            self.reset_window();
+        }
+    }
+
+    fn reset_window(&mut self) {
+        self.since_us = None;
+        self.min = [f32::INFINITY; 3];
+        self.max = [f32::NEG_INFINITY; 3];
+        self.sum = [0.0; 3];
+        self.count = 0;
+    }
+}
+
+impl Imu {
+    pub fn new(device: proto::PadImuDevice) -> Self {
+        Self {
+            device,
+            samples: 0,
+            socket_dropped: 0,
+            last_us: None,
+            rate_hz: None,
+            accel_g: [0.0; 3],
+            gyro_dps: [0.0; 3],
+            bias: Bias::new(),
+            q: [1.0, 0.0, 0.0, 0.0],
+            seeded: false,
+        }
+    }
+
+    pub fn device(&self) -> &proto::PadImuDevice {
+        &self.device
+    }
+
+    pub fn samples(&self) -> u64 {
+        self.samples
+    }
+
+    pub fn socket_dropped(&self) -> u64 {
+        self.socket_dropped
+    }
+
+    pub fn rate_hz(&self) -> Option<f32> {
+        self.rate_hz
+    }
+
+    /// The newest acceleration, g.
+    pub fn accel_g(&self) -> [f32; 3] {
+        self.accel_g
+    }
+
+    /// The newest angular rate with the bias removed, °/s.
+    pub fn gyro_dps(&self) -> [f32; 3] {
+        self.gyro_dps
+    }
+
+    /// The gyro bias in use, °/s — `None` while it is still being learned.
+    pub fn bias_dps(&self) -> Option<[f32; 3]> {
+        self.bias.value
+    }
+
+    /// Take one batch, sample by sample and in order.
+    pub fn absorb(&mut self, batch: &proto::PadImuBatch) {
+        self.socket_dropped += batch.socket_dropped;
+        for sample in &batch.samples {
+            self.sample(sample);
+        }
+    }
+
+    fn sample(&mut self, sample: &proto::PadImuSample) {
+        self.samples += 1;
+
+        let accel_scale = scale(self.device.accel_per_g);
+        let gyro_scale = scale(self.device.gyro_per_dps);
+        let accel = [
+            sample.accel[0] as f32 * accel_scale,
+            sample.accel[1] as f32 * accel_scale,
+            sample.accel[2] as f32 * accel_scale,
+        ];
+        let raw_gyro = [
+            sample.gyro[0] as f32 * gyro_scale,
+            sample.gyro[1] as f32 * gyro_scale,
+            sample.gyro[2] as f32 * gyro_scale,
+        ];
+        self.accel_g = accel;
+
+        let magnitude = norm(accel);
+        let gravity_ok = GRAVITY_BAND.contains(&magnitude);
+        self.bias.observe(raw_gyro, gravity_ok, sample.at_us);
+        let bias = self.bias.value.unwrap_or([0.0; 3]);
+        let gyro = [
+            raw_gyro[0] - bias[0],
+            raw_gyro[1] - bias[1],
+            raw_gyro[2] - bias[2],
+        ];
+        self.gyro_dps = gyro;
+
+        // The interval, from the kernel's clock: a gap too long to trust is measured (for the
+        // rate) but not integrated.
+        let dt = match self.last_us {
+            Some(last) if sample.at_us > last => (sample.at_us - last) as f32 * 1e-6,
+            _ => 0.0,
+        };
+        self.last_us = Some(sample.at_us);
+        if dt > 0.0 && dt <= MAX_DT_S {
+            let hz = 1.0 / dt;
+            self.rate_hz = Some(match self.rate_hz {
+                Some(rate) => rate + 0.02 * (hz - rate),
+                None => hz,
+            });
+        }
+
+        if !self.seeded {
+            if gravity_ok {
+                self.q = from_gravity(accel);
+                self.seeded = true;
+            }
+            return;
+        }
+        if dt <= 0.0 || dt > MAX_DT_S {
+            return;
+        }
+
+        // Gyro: rotate the body by ω·dt, in the body frame.
+        let rad = std::f32::consts::PI / 180.0;
+        let step = [gyro[0] * rad * dt, gyro[1] * rad * dt, gyro[2] * rad * dt];
+        self.q = mul(self.q, from_rotvec(step));
+
+        // Gravity: nudge the body so that where it thinks "up" is moves onto where the
+        // accelerometer says it is. With `q ← q ⊗ δ`, the new prediction is `δᵀ·predicted`, so δ
+        // has to carry *measured* onto *predicted* — hence the order of the cross product; the
+        // other way round runs away rather than converging. Applied a fraction at a time, and
+        // skipped while the pad is being moved, when the accelerometer is not measuring gravity.
+        if gravity_ok {
+            let measured = normalized(accel);
+            let predicted = rotate(conj(self.q), [0.0, 0.0, 1.0]);
+            let error = cross(measured, predicted);
+            let k = GRAVITY_GAIN * dt;
+            self.q = mul(
+                self.q,
+                from_rotvec([error[0] * k, error[1] * k, error[2] * k]),
+            );
+        }
+        self.q = normalized4(self.q);
+    }
+
+    /// Pitch, roll and yaw of the body in the world, degrees — [`euler_deg`] of the attitude.
+    /// Yaw is the gyro's word alone and drifts; the other two are held by gravity.
+    pub fn euler_deg(&self) -> [f32; 3] {
+        euler_deg(self.q)
+    }
+
+    /// The attitude itself, body → world, `w` first. `None` until the first sample with a
+    /// believable gravity has seeded it — before that there is no attitude, only a default.
+    pub fn quaternion(&self) -> Option<[f32; 4]> {
+        self.seeded.then_some(self.q)
+    }
+}
+
+// ── quaternion arithmetic, w first ───────────────────────────────────────────────────────
+
+/// The rotation from `reference` to `now`, in the body frame of `reference`: what a pad has done
+/// since the moment `reference` was taken. This is how a consumer of yaw beats the drift — take a
+/// fresh reference when the person says "this is centre", and read everything after it relative.
+pub fn relative(reference: [f32; 4], now: [f32; 4]) -> [f32; 4] {
+    normalized4(mul(conj(reference), now))
+}
+
+/// Pitch, roll and yaw of a body → world rotation, degrees.
+///
+/// Aerospace order — yaw about Z, then pitch about the body's Y (nose up positive), then roll
+/// about its X (left side up positive) — read off the rotation matrix.
+pub fn euler_deg(q: [f32; 4]) -> [f32; 3] {
+    let m = matrix(q);
+    // m carries body axes as columns in world coordinates: m[i][j] = row i, column j.
+    let pitch = (-m[2][0]).clamp(-1.0, 1.0).asin();
+    let roll = m[2][1].atan2(m[2][2]);
+    let yaw = m[1][0].atan2(m[0][0]);
+    let deg = 180.0 / std::f32::consts::PI;
+    [pitch * deg, roll * deg, yaw * deg]
+}
+
+/// The rotation matrix of a unit quaternion, body axes as columns.
+pub fn matrix(q: [f32; 4]) -> [[f32; 3]; 3] {
+    let [w, x, y, z] = q;
+    [
+        [
+            1.0 - 2.0 * (y * y + z * z),
+            2.0 * (x * y - z * w),
+            2.0 * (x * z + y * w),
+        ],
+        [
+            2.0 * (x * y + z * w),
+            1.0 - 2.0 * (x * x + z * z),
+            2.0 * (y * z - x * w),
+        ],
+        [
+            2.0 * (x * z - y * w),
+            2.0 * (y * z + x * w),
+            1.0 - 2.0 * (x * x + y * y),
+        ],
+    ]
+}
+
+/// Euclidean length of a vector.
+pub fn norm(v: [f32; 3]) -> f32 {
+    (v[0] * v[0] + v[1] * v[1] + v[2] * v[2]).sqrt()
+}
+
+/// Units per physical unit → physical units per raw unit. A driver that declared no resolution
+/// leaves the numbers raw, which is at least not wrong.
+fn scale(per_unit: i32) -> f32 {
+    if per_unit > 0 {
+        1.0 / per_unit as f32
+    } else {
+        1.0
+    }
+}
+
+fn normalized(v: [f32; 3]) -> [f32; 3] {
+    let n = norm(v);
+    if n < 1e-9 {
+        return [0.0, 0.0, 1.0];
+    }
+    [v[0] / n, v[1] / n, v[2] / n]
+}
+
+fn normalized4(q: [f32; 4]) -> [f32; 4] {
+    let n = (q[0] * q[0] + q[1] * q[1] + q[2] * q[2] + q[3] * q[3]).sqrt();
+    if n < 1e-9 {
+        return [1.0, 0.0, 0.0, 0.0];
+    }
+    [q[0] / n, q[1] / n, q[2] / n, q[3] / n]
+}
+
+fn cross(a: [f32; 3], b: [f32; 3]) -> [f32; 3] {
+    [
+        a[1] * b[2] - a[2] * b[1],
+        a[2] * b[0] - a[0] * b[2],
+        a[0] * b[1] - a[1] * b[0],
+    ]
+}
+
+fn mul(a: [f32; 4], b: [f32; 4]) -> [f32; 4] {
+    [
+        a[0] * b[0] - a[1] * b[1] - a[2] * b[2] - a[3] * b[3],
+        a[0] * b[1] + a[1] * b[0] + a[2] * b[3] - a[3] * b[2],
+        a[0] * b[2] - a[1] * b[3] + a[2] * b[0] + a[3] * b[1],
+        a[0] * b[3] + a[1] * b[2] - a[2] * b[1] + a[3] * b[0],
+    ]
+}
+
+fn conj(q: [f32; 4]) -> [f32; 4] {
+    [q[0], -q[1], -q[2], -q[3]]
+}
+
+/// The rotation of a small rotation vector (axis × angle, radians).
+fn from_rotvec(r: [f32; 3]) -> [f32; 4] {
+    let angle = norm(r);
+    if angle < 1e-9 {
+        return [1.0, 0.0, 0.0, 0.0];
+    }
+    let (s, c) = (angle / 2.0).sin_cos();
+    [c, r[0] / angle * s, r[1] / angle * s, r[2] / angle * s]
+}
+
+/// Rotate a vector by a quaternion.
+fn rotate(q: [f32; 4], v: [f32; 3]) -> [f32; 3] {
+    let p = mul(mul(q, [0.0, v[0], v[1], v[2]]), conj(q));
+    [p[1], p[2], p[3]]
+}
+
+/// The body → world rotation that carries the measured up (the accelerometer at rest) onto the
+/// world's up, with no yaw. The seed, and what the filter would converge to if the gyro said
+/// nothing.
+fn from_gravity(accel: [f32; 3]) -> [f32; 4] {
+    let up_body = normalized(accel);
+    let up_world = [0.0, 0.0, 1.0];
+    let axis = cross(up_body, up_world);
+    let s = norm(axis);
+    let c = up_body[2];
+    if s < 1e-6 {
+        return if c > 0.0 {
+            [1.0, 0.0, 0.0, 0.0]
+        } else {
+            [0.0, 1.0, 0.0, 0.0] // upside down: any horizontal axis will do
+        };
+    }
+    let angle = s.atan2(c);
+    from_rotvec([
+        axis[0] / s * angle,
+        axis[1] / s * angle,
+        axis[2] / s * angle,
+    ])
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn a_device() -> proto::PadImuDevice {
+        proto::PadImuDevice {
+            name: "Nintendo Switch Pro Controller IMU".to_owned(),
+            node: "/dev/input/event5".to_owned(),
+            accel_per_g: 4096,
+            gyro_per_dps: 14247,
+            accel_max: 32767,
+            gyro_max: 32_767_000,
+        }
+    }
+
+    /// One sample, in physical units, `at_us` on the clock.
+    fn sample(seq: u64, at_us: u64, accel_g: [f32; 3], gyro_dps: [f32; 3]) -> proto::PadImuSample {
+        proto::PadImuSample {
+            seq,
+            at_us,
+            accel: [
+                (accel_g[0] * 4096.0) as i32,
+                (accel_g[1] * 4096.0) as i32,
+                (accel_g[2] * 4096.0) as i32,
+            ],
+            gyro: [
+                (gyro_dps[0] * 14247.0) as i32,
+                (gyro_dps[1] * 14247.0) as i32,
+                (gyro_dps[2] * 14247.0) as i32,
+            ],
+        }
+    }
+
+    fn one(sample: proto::PadImuSample) -> proto::PadImuBatch {
+        proto::PadImuBatch {
+            samples: vec![sample],
+            socket_dropped: 0,
+        }
+    }
+
+    /// Feed `seconds` of a steady reading at 200 Hz.
+    fn steady(imu: &mut Imu, seconds: f32, accel_g: [f32; 3], gyro_dps: [f32; 3]) {
+        let n = (seconds * 200.0) as u64;
+        let start = imu.last_us.unwrap_or(0);
+        for i in 1..=n {
+            imu.absorb(&one(sample(i, start + i * 5_000, accel_g, gyro_dps)));
+        }
+    }
+
+    /// Flat on the table: level, and the clone's 12 °/s of Z bias is learned rather than
+    /// integrated — the attitude must not spin while the real pad lies still.
+    #[test]
+    fn a_pad_at_rest_reads_level_and_learns_its_bias() {
+        let mut imu = Imu::new(a_device());
+        assert!(imu.quaternion().is_none(), "no attitude before a sample");
+        steady(&mut imu, 3.0, [0.0, 0.0, 1.0], [1.8, -0.6, 12.0]);
+
+        let bias = imu.bias_dps().expect("three seconds still is a bias");
+        assert!((bias[2] - 12.0).abs() < 0.1, "{bias:?}");
+        let [pitch, roll, yaw] = imu.euler_deg();
+        assert!(
+            pitch.abs() < 0.5 && roll.abs() < 0.5,
+            "level: {pitch} {roll}"
+        );
+        // Yaw drifted for the half second before the bias was known and not after.
+        assert!(yaw.abs() < 12.0 * 0.6, "yaw stopped drifting: {yaw}");
+        let rate = imu.rate_hz().expect("a rate");
+        assert!((rate - 200.0).abs() < 2.0, "{rate}");
+        assert!(imu.quaternion().is_some());
+    }
+
+    /// Nose up: gravity moves toward −X on the body, and the filter reads that as positive pitch.
+    /// The same rotation seeded from gravity and reached by integrating the gyro must agree.
+    #[test]
+    fn a_tilt_reads_as_pitch_whether_seeded_or_integrated() {
+        let tilt = 30.0f32.to_radians();
+        let tilted = [-tilt.sin(), 0.0, tilt.cos()];
+
+        let mut seeded = Imu::new(a_device());
+        steady(&mut seeded, 0.1, tilted, [0.0; 3]);
+        let [pitch, roll, _] = seeded.euler_deg();
+        assert!((pitch - 30.0).abs() < 1.0, "seeded pitch {pitch}");
+        assert!(roll.abs() < 1.0, "seeded roll {roll}");
+
+        // Level first, learn the (zero) bias, then pitch up at 60 °/s for half a second with the
+        // accelerometer saying "moving" so only the gyro speaks.
+        let mut turned = Imu::new(a_device());
+        steady(&mut turned, 2.0, [0.0, 0.0, 1.0], [0.0; 3]);
+        steady(&mut turned, 0.5, [0.0, 0.0, 1.5], [0.0, 60.0, 0.0]);
+        let [pitch, _, _] = turned.euler_deg();
+        assert!((pitch - 30.0).abs() < 1.5, "integrated pitch {pitch}");
+
+        // And once it is still again, gravity agrees and holds it there.
+        steady(&mut turned, 2.0, tilted, [0.0; 3]);
+        let [pitch, _, _] = turned.euler_deg();
+        assert!((pitch - 30.0).abs() < 1.0, "held pitch {pitch}");
+    }
+
+    /// A pad being waved has an accelerometer full of hand: it must not pull the orientation, and
+    /// it must not be mistaken for stillness by the bias learner.
+    #[test]
+    fn motion_neither_corrects_the_attitude_nor_teaches_a_bias() {
+        let mut imu = Imu::new(a_device());
+        steady(&mut imu, 0.1, [0.0, 0.0, 1.0], [0.0; 3]);
+        assert!(imu.bias_dps().is_none());
+        // Quiet gyro, but two g on the accelerometer: not at rest.
+        steady(&mut imu, 2.0, [0.0, 0.0, 2.0], [5.0, 0.0, 0.0]);
+        assert!(imu.bias_dps().is_none(), "a swinging pad taught a bias");
+        let [pitch, roll, _] = imu.euler_deg();
+        // Integrated 5 °/s of roll for two seconds with nothing to say otherwise.
+        assert!((roll - 10.0).abs() < 1.0, "roll {roll}");
+        assert!(pitch.abs() < 1.0, "pitch {pitch}");
+    }
+
+    /// A gap the integrator will not bridge is measured, not integrated.
+    #[test]
+    fn a_long_gap_is_not_integrated() {
+        let mut imu = Imu::new(a_device());
+        steady(&mut imu, 2.0, [0.0, 0.0, 1.0], [0.0; 3]);
+        let before = imu.euler_deg();
+        let last = imu.last_us.unwrap();
+        imu.absorb(&one(sample(
+            9_999,
+            last + 3_000_000,
+            [0.0, 0.0, 1.0],
+            [90.0, 0.0, 0.0],
+        )));
+        let after = imu.euler_deg();
+        assert!((after[1] - before[1]).abs() < 0.5, "{before:?} → {after:?}");
+    }
+
+    /// Re-zeroing: the attitude relative to a reference taken a moment ago is what the pad did
+    /// since — a yaw the gyro has drifted by is gone the moment a new reference is taken, and a
+    /// turn made after it reads in full.
+    #[test]
+    fn a_relative_attitude_starts_from_zero_and_reads_the_turn_since() {
+        let mut imu = Imu::new(a_device());
+        steady(&mut imu, 2.0, [0.0, 0.0, 1.0], [0.0; 3]);
+        // Drift: 40 °/s of yaw for a second, unlearned because the pad is "moving".
+        steady(&mut imu, 1.0, [0.0, 0.0, 1.4], [0.0, 0.0, 40.0]);
+        let drifted = imu.quaternion().unwrap();
+        assert!(
+            euler_deg(drifted)[2].abs() > 30.0,
+            "{:?}",
+            euler_deg(drifted)
+        );
+
+        let reference = drifted;
+        let zeroed = euler_deg(relative(reference, imu.quaternion().unwrap()));
+        assert!(zeroed.iter().all(|a| a.abs() < 0.01), "{zeroed:?}");
+
+        // Turn left 20° (about +Z) after the reference, and that is all that shows.
+        steady(&mut imu, 0.5, [0.0, 0.0, 1.4], [0.0, 0.0, 40.0]);
+        let since = euler_deg(relative(reference, imu.quaternion().unwrap()));
+        assert!((since[2] - 20.0).abs() < 1.0, "{since:?}");
+        assert!(since[0].abs() < 1.0 && since[1].abs() < 1.0, "{since:?}");
+    }
+}
diff --git a/padd/Cargo.toml b/padd/Cargo.toml
index 4a6ded09..66ab958a 100644
--- a/padd/Cargo.toml
+++ b/padd/Cargo.toml
@@ -24,6 +24,9 @@ duck-ipc-proto = { path = "../duck-ipc-proto" }
 # up. Pure serde and toml, and read once at startup: this daemon still holds no privileged access
 # and still knows nothing about what a skill *is*, only that a button names one.
 robotd-params = { path = "../robotd-params" }
+# The pad's IMU as an attitude — the same filter `robotctl monitor` draws from, so the head goes
+# where the picture says the pad is.
+pad-imu = { path = "../pad-imu" }
 clap = { workspace = true, features = ["derive"] }
 gilrs = "0.11"
 # Only to serialise the tap's own lines; the wire types themselves live in duck-ipc-proto.
@@ -40,3 +43,6 @@ tracing-subscriber = { workspace = true, features = ["env-filter"] }
 evdev = "0.13"
 # `getgrnam`/`chown`, to hand the tap's socket to the `robot` group. Bindings only, no C to build.
 libc = "0.2"
+
+[dev-dependencies]
+tempfile = "3.27.0"
diff --git a/padd/src/main.rs b/padd/src/main.rs
index 15de674e..fa482c3b 100644
--- a/padd/src/main.rs
+++ b/padd/src/main.rs
@@ -32,7 +32,8 @@
 //! LB / RB      left / right kick
 //! DPad-Down    sit ↔ stand
 //! RT / LT      mouth (either trigger; the max wins) · RT quacks · LT rides the wheee
-//! Select, 2 s  sit down, then power off
+//! Select       torque off, on release — the emergency stop
+//! Select, 2 s  sit down, torque off, then power off — the release does nothing more
 //! ```
 //!
 //! Head and body-pose mode both zero the velocity while active, as the prototype does — a
@@ -110,6 +111,16 @@ mod tap {
         pub fn watch(&self, _pad: &gilrs::Gamepad<'_>) {}
 
         pub fn idle(&self) {}
+
+        pub fn imu_control(&self, _on: bool) {}
+
+        pub fn has_imu(&self) -> bool {
+            false
+        }
+
+        pub fn attitude(&self) -> Option<[f32; 4]> {
+            None
+        }
     }
 }
 
@@ -181,6 +192,58 @@ const IDLE_POLL: Duration = Duration::from_millis(500);
 /// Select held this long sits the robot down and powers it off.
 const SHUTDOWN_HOLD: Duration = Duration::from_secs(2);
 
+/// The Select button, which does one of two things depending on how long it was held — and so
+/// has to wait for the release to know which.
+///
+/// A short press is the emergency stop: `robot.relax`, torque off, the robot drops. Held for
+/// [`SHUTDOWN_HOLD`] it is the shutdown sequence instead: sit down, torque off, power off. The two
+/// cannot both fire — a robot that has already gone limp cannot sit — so the stop is sent **on
+/// release**, and only if the hold never reached the shutdown. The cost is that the stop lands
+/// when the thumb comes off rather than when it goes down, which for a button somebody presses
+/// and lets go of is the same instant.
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
+struct SelectButton {
+    /// When the current hold began. `None` between presses.
+    held_since: Option<Instant>,
+    /// The shutdown was sent for this hold, so its release is not a stop.
+    shutdown_sent: bool,
+}
+
+/// What Select asks for this tick.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum SelectAction {
+    Nothing,
+    /// Held long enough: sit, torque off, power off. Once per hold.
+    Shutdown,
+    /// Let go before that: torque off now.
+    Relax,
+}
+
+impl SelectButton {
+    /// One tick: is the button down now, and did it come up since the last tick.
+    ///
+    /// `released` is the edge from the event queue, because a press and release inside one tick
+    /// leaves `pressed` false on both sides and would otherwise be a stop nobody saw.
+    fn tick(&mut self, pressed: bool, released: bool, now: Instant) -> SelectAction {
+        if pressed {
+            let since = *self.held_since.get_or_insert(now);
+            if now.duration_since(since) >= SHUTDOWN_HOLD && !self.shutdown_sent {
+                self.shutdown_sent = true;
+                return SelectAction::Shutdown;
+            }
+            return SelectAction::Nothing;
+        }
+        let was_shutdown = self.shutdown_sent;
+        self.held_since = None;
+        self.shutdown_sent = false;
+        if released && !was_shutdown {
+            return SelectAction::Relax;
+        }
+        // A release after the shutdown, or a tick with nothing to say.
+        SelectAction::Nothing
+    }
+}
+
 /// D-pad up held this long switches drive mode, walk ⇄ roller.
 ///
 /// Three seconds, longer than the shutdown hold, and the prototype's number. D-pad up is a
@@ -213,22 +276,29 @@ enum Mode {
 /// How often to look for a rewritten config. See the loop.
 const BINDINGS_POLL: Duration = Duration::from_secs(1);
 
-/// The button bindings, or the mapping the prototype had.
+/// The button bindings and the IMU head switch, or the defaults.
 ///
 /// A file that will not parse is never a reason to leave somebody without a pad: the defaults
 /// are a working robot, and the reason is logged. That matters more here than elsewhere because
 /// this is re-read while running — a half-saved file caught mid-write must not take the buttons
 /// away, and the next read a second later gets the finished one.
-fn read_bindings(path: &Path) -> robotd_params::PadParams {
+fn read_bindings(
+    path: &Path,
+) -> (
+    robotd_params::PadParams,
+    robotd_params::PadImuHeadControlParams,
+) {
     match robotd_params::Params::load(path, false) {
         Ok(params) => {
             let pad = params.pad;
+            let imu_head = params.pad_imu_head_control;
             tracing::info!(
                 a = %pad.a, x = %pad.x, lb = %pad.lb, rb = %pad.rb,
                 dpad_down = %pad.dpad_down,
+                pad_imu_head_control = imu_head.enabled, pad_imu_head_gain = imu_head.gain,
                 "button bindings"
             );
-            pad
+            (pad, imu_head)
         }
         Err(e) => {
             tracing::warn!(
@@ -236,11 +306,61 @@ fn read_bindings(path: &Path) -> robotd_params::PadParams {
                 path = %path.display(),
                 "cannot read the button bindings; using the default mapping"
             );
-            robotd_params::PadParams::default()
+            (
+                robotd_params::PadParams::default(),
+                robotd_params::PadImuHeadControlParams::default(),
+            )
+        }
+    }
+}
+
+/// Where the pad's IMU stands in relation to the head. See `[pad_imu_head_control]` in `robotd-params`.
+#[derive(Debug, Clone, Copy, PartialEq)]
+enum PadImuHead {
+    /// Y means what it always did.
+    Off,
+    /// The head follows the pad's attitude relative to `reference`, the attitude at the press
+    /// that started this. The sticks keep driving.
+    Following { reference: [f32; 4] },
+    /// The head stays where the last pose left it; nothing is sent for it. The sticks drive.
+    Holding,
+}
+
+impl PadImuHead {
+    /// Y was pressed with an IMU pad and the feature on. Off or holding → follow **from here**,
+    /// which is what beats the gyro's yaw drift: every re-entry makes the pad's current attitude
+    /// the new centre. Following → hold.
+    fn on_y(self, attitude: [f32; 4]) -> Self {
+        match self {
+            Self::Off | Self::Holding => Self::Following {
+                reference: attitude,
+            },
+            Self::Following { .. } => Self::Holding,
         }
     }
 }
 
+/// The head pose for a pad attitude relative to its reference.
+///
+/// `relative` is body → world of the pad now, in the frame of the reference — [`pad_imu::relative`].
+/// Its pitch, roll and yaw become the head's, scaled by `gain` and clamped to `max_head`. The signs
+/// are the ones that made the head copy the pad on the robot (2026-09-09): pad nose-up is a
+/// positive `head_pitch`, pad yaw to the left a positive `head_yaw`, and the pad rolling right
+/// (left side up) a negative `head_roll`. Pitch and roll came out opposite to the stick mapping's
+/// guess, which is worth knowing: the sticks' signs describe "stick up looks up", not the joint
+/// axes, and the pad frame is the joints'. The neck stays at zero: one pitch joint is enough to
+/// follow a wrist.
+fn head_from_pad(relative: [f32; 4], gain: f64, max_head: f64) -> proto::HeadParams {
+    let [pitch, roll, yaw] = pad_imu::euler_deg(relative);
+    let angle = |degrees: f32| (f64::from(degrees).to_radians() * gain).clamp(-max_head, max_head);
+    proto::HeadParams {
+        neck_pitch: 0.0,
+        head_pitch: angle(pitch),
+        head_yaw: angle(yaw),
+        head_roll: -angle(roll),
+    }
+}
+
 /// When the config was last written, for spotting a change. `None` for a file that is not there,
 /// which is a real state and compares equal to itself.
 fn config_mtime(path: &Path) -> Option<std::time::SystemTime> {
@@ -308,16 +428,16 @@ fn main() -> std::process::ExitCode {
         socket = %args.socket.display(),
         hz = args.hz,
         roller,
-        "driving — Start toggles the policy, Y head mode, B body pose, A ground pick, \
-         LB/RB kicks, DPad-Down sit, triggers mouth, DPad-Up (3s) walk/roller, \
-         Select (2s) shutdown"
+        "driving — Start once stands up, Start again toggles the policy, Y head mode, B body pose, \
+         A ground pick, LB/RB kicks, DPad-Down sit, triggers mouth, DPad-Right reboot servos, \
+         DPad-Up (3s) walk/roller, Select (release) torque off, Select (2s) sit and shutdown"
     );
 
     let period = Duration::from_secs_f64(1.0 / args.hz as f64);
     // The button bindings, read once like every other daemon reads its config. A file that will
     // not parse is not a reason to leave somebody without a pad: the mapping the prototype had is
     // the fallback, and the reason is logged.
-    let mut bindings = read_bindings(&args.config);
+    let (mut bindings, mut imu_head_cfg) = read_bindings(&args.config);
     // When the file was last written, so a change is picked up without a restart. `padd` holds
     // no motor control and no session state — the whole of it is this table — so re-reading is a
     // swap between two ticks rather than anything to sequence.
@@ -325,16 +445,22 @@ fn main() -> std::process::ExitCode {
     let mut bindings_checked = Instant::now();
 
     let mut mode = Mode::Drive;
+    // IMU head control, when `[pad_imu_head_control]` is on and the pad has one. Off whenever the pad is
+    // gone: a reference taken against one pad means nothing to the next.
+    let mut imu_head = PadImuHead::Off;
     // Whether a pad was there last tick, so appearing and disappearing are each logged once.
     let mut driving = false;
-    let mut select_held_since: Option<Instant> = None;
+    let mut select = SelectButton::default();
     let mut dpad_up_held_since: Option<Instant> = None;
     let mut mode_switch_sent = false;
-    let mut shutdown_sent = false;
     // Trigger levels last tick, for the sound edges: RT quacks on its rising edge, LT
     // starts the wheee ride. The prototype's threshold.
     let mut prev_rt = 0.0f64;
     let mut prev_lt = 0.0f64;
+    // Does this pad think the robot is up (torque on, at the home pose)? When not, Start sends
+    // `robot.init` (stand up and hold) instead of enabling the policy; the next Start enables it.
+    // Starts false: padd starts with the robot, and a robotd restart restarts padd too.
+    let mut up = false;
     // The continuous intents, and the buffer this tick's are built in. Both live across
     // ticks so a steady state neither allocates nor re-sends — see [`Continuous`].
     let mut continuous = Continuous::default();
@@ -351,20 +477,36 @@ fn main() -> std::process::ExitCode {
             let now = config_mtime(&args.config);
             if now != bindings_at {
                 bindings_at = now;
-                bindings = read_bindings(&args.config);
+                (bindings, imu_head_cfg) = read_bindings(&args.config);
                 tracing::warn!("button bindings reloaded");
             }
         }
 
         // Drain the queue so axis polling below sees present state, and catch button
         // *edges* — a held Start must toggle once, not fifty times a second.
+        //
+        // The driving pad is the first one, and only its events may act: with two pads
+        // connected, a Start or Select from the *other* one would otherwise steer a robot
+        // whose sticks belong to somebody else.
+        let pad_id = gilrs.gamepads().next().map(|(id, _)| id);
         let mut toggle_enable = false;
         let mut toggle_head = false;
         let mut toggle_body = false;
         // Which bindable buttons went down this tick, by their config name. A list rather than
         // a flag apiece, because what each one runs is config now and this loop no longer knows.
         let mut pressed: Vec<&'static str> = Vec::new();
+        let mut relax = false;
+        let mut select_released = false;
+        let mut reboot_motors = false;
         while let Some(event) = gilrs.next_event() {
+            if Some(event.id) != pad_id {
+                continue;
+            }
+            // Select is the one button read on its release: a short press stops, a long hold shuts
+            // down, and which it was is only known when the thumb comes off.
+            if let gilrs::EventType::ButtonReleased(Button::Select, _) = event.event {
+                select_released = true;
+            }
             if let gilrs::EventType::ButtonPressed(button, _) = event.event {
                 match button {
                     Button::Start => toggle_enable = true,
@@ -381,12 +523,20 @@ fn main() -> std::process::ExitCode {
                     Button::LeftTrigger => pressed.push("lb"),
                     Button::RightTrigger => pressed.push("rb"),
                     Button::DPadDown => pressed.push("dpad_down"),
+                    // Select is handled on release — see `SelectButton`.
+                    Button::Select => {}
+                    // Reboot the servos: the way back from a tripped overload without pulling
+                    // the battery.
+                    Button::DPadRight => reboot_motors = true,
                     _ => {}
                 }
             }
         }
 
-        let Some((_, pad)) = gilrs.gamepads().next() else {
+        // Re-read the pad by id after the drain: a `Disconnected` dequeued above may have
+        // taken it, and asking for the first pad again would silently hand the robot the
+        // *other* pad's sticks. One tick of "pad gone" beats that.
+        let Some(pad) = pad_id.and_then(|id| gilrs.connected_gamepad(id)) else {
             // No pad. Send nothing: `robotd`'s deadman stops the robot on its own, which is
             // exactly the wanted behaviour, and inventing a zero command here would mask a
             // disconnected pad as a deliberate stop.
@@ -398,6 +548,7 @@ fn main() -> std::process::ExitCode {
                 tracing::warn!("pad gone — sending nothing; robotd's deadman holds the robot");
                 driving = false;
             }
+            imu_head = PadImuHead::Off;
             if let Some(tap) = tap.as_ref() {
                 tap.idle();
             }
@@ -415,15 +566,60 @@ fn main() -> std::process::ExitCode {
         // enough that a tap following the old one would report the rest of the session as silence.
         if let Some(tap) = tap.as_ref() {
             tap.watch(&pad);
+            // Every tick, like the bindings: switching the feature on in the config has to start
+            // the IMU reader without a restart, and off has to let it go.
+            tap.imu_control(imu_head_cfg.enabled);
+        }
+
+        // The pad's attitude this tick, when the feature is on and the pad has an IMU that has
+        // said something believable. `None` is every other case, and Y then means the sticks.
+        let attitude = if imu_head_cfg.enabled {
+            tap.as_ref().and_then(|tap| tap.attitude())
+        } else {
+            None
+        };
+        if attitude.is_none() && imu_head != PadImuHead::Off {
+            // The feature went off, or the IMU went away under us. Not silent: a head that stops
+            // following mid-turn wants a line in the journal saying why.
+            tracing::info!("IMU head control off — no attitude to follow");
+            imu_head = PadImuHead::Off;
         }
 
         if toggle_head {
-            mode = if mode == Mode::Head {
-                Mode::Drive
-            } else {
-                Mode::Head
-            };
-            tracing::info!(?mode, "mode");
+            match attitude {
+                Some(attitude) => {
+                    // Y is the IMU's. The sticks never pose the head while this is possible: two
+                    // sources for one joint set is a head that shakes.
+                    if mode == Mode::Head {
+                        mode = Mode::Drive;
+                    }
+                    imu_head = imu_head.on_y(attitude);
+                    match imu_head {
+                        PadImuHead::Following { .. } => tracing::info!(
+                            "IMU head control: following the pad from here — sticks keep driving"
+                        ),
+                        PadImuHead::Holding => {
+                            tracing::info!("IMU head control: holding the head where it is")
+                        }
+                        PadImuHead::Off => {}
+                    }
+                }
+                None => {
+                    if imu_head_cfg.enabled && tap.as_ref().is_some_and(|tap| tap.has_imu()) {
+                        // The IMU is there and has not spoken yet — a second after connecting,
+                        // typically. Saying so beats silently doing the other thing.
+                        tracing::warn!(
+                            "the pad's IMU has no attitude yet; Y is stick head mode this once"
+                        );
+                    }
+                    mode = if mode == Mode::Head {
+                        Mode::Drive
+                    } else {
+                        Mode::Head
+                    };
+                    tracing::info!(?mode, "mode");
+                }
+            }
         }
         if toggle_body {
             let leaving = mode == Mode::BodyPose;
@@ -444,7 +640,16 @@ fn main() -> std::process::ExitCode {
             }
         }
 
-        if toggle_enable {
+        if toggle_enable && !up {
+            tracing::warn!("Start — robot.init: standing up. Press Start again to drive");
+            match request(&mut stream, &mut next_id, &proto::Call::RobotInit) {
+                Err(e) => {
+                    tracing::error!(error = %e, "init failed");
+                    return std::process::ExitCode::FAILURE;
+                }
+                Ok(_) => up = true,
+            }
+        } else if toggle_enable {
             // The robot owns the toggle. A local on/off belief here drifts from the
             // robot's the moment anything else moves it — robot.relax, the shutdown
             // sequence, either side restarting — and a stale belief turns Start into a
@@ -517,21 +722,45 @@ fn main() -> std::process::ExitCode {
             return std::process::ExitCode::FAILURE;
         }
 
-        // Select held two seconds: sit down, then power off. Sent once per hold — the
-        // robot owns the sequence from there, and a second request would be a no-op anyway.
-        if pad.is_pressed(Button::Select) {
-            let held = select_held_since.get_or_insert(tick);
-            if tick.duration_since(*held) >= SHUTDOWN_HOLD && !shutdown_sent {
-                shutdown_sent = true;
-                tracing::warn!("Select held — asking the robot to sit and power off");
+        // Select: a short press is the emergency stop, on release; held two seconds it is the
+        // shutdown sequence — sit down, torque off, power off — sent once per hold, and the
+        // release after it does nothing. The robot owns the sequence from there.
+        match select.tick(pad.is_pressed(Button::Select), select_released, tick) {
+            SelectAction::Nothing => {}
+            SelectAction::Relax => relax = true,
+            SelectAction::Shutdown => {
+                up = false;
+                tracing::warn!("Select held — asking the robot to sit, torque off and power off");
                 if let Err(e) = request(&mut stream, &mut next_id, &proto::Call::RobotShutdown) {
                     tracing::error!(error = %e, "shutdown request failed");
                     return std::process::ExitCode::FAILURE;
                 }
             }
-        } else {
-            select_held_since = None;
-            shutdown_sent = false;
+        }
+
+        if relax {
+            tracing::warn!("Select released — robot.relax: torque off");
+            // Torque off leaves the robot limp, so the next Start stands it up again rather
+            // than toggling the policy on a robot that is lying on the floor.
+            up = false;
+            if let Err(e) = request(&mut stream, &mut next_id, &proto::Call::RobotRelax) {
+                tracing::error!(error = %e, "relax request failed");
+                return std::process::ExitCode::FAILURE;
+            }
+        }
+
+        if reboot_motors {
+            tracing::warn!(
+                "DPad-Right — asking the robot to reboot its servos (robot.rebootMotors)"
+            );
+            // The reboot leaves the robot limp, so the next Start has to stand it up again
+            // rather than toggle the policy on a robot that is lying down.
+            up = false;
+            let call = proto::Call::RobotRebootMotors(proto::RebootMotorsParams::default());
+            if let Err(e) = request(&mut stream, &mut next_id, &call) {
+                tracing::error!(error = %e, "reboot request failed");
+                return std::process::ExitCode::FAILURE;
+            }
         }
 
         // D-pad up held three seconds: switch drive mode, which is what somebody who has just
@@ -698,6 +927,19 @@ fn main() -> std::process::ExitCode {
             }
         }
 
+        // IMU head control rides in the same frame as the drive: the pad's tilt and the sticks
+        // describe one instant. Only while driving — body-pose mode owns the whole robot for as
+        // long as it lasts, and stick head mode cannot coexist with this (see the Y handling).
+        if mode == Mode::Drive
+            && let (PadImuHead::Following { reference }, Some(now)) = (imu_head, attitude)
+        {
+            frame.push(proto::Call::RobotHead(head_from_pad(
+                pad_imu::relative(reference, now),
+                imu_head_cfg.gain,
+                args.max_head,
+            )));
+        }
+
         if let Err(e) = continuous.send(&mut stream, &frame, tick) {
             tracing::error!(error = %e, "send failed");
             return std::process::ExitCode::FAILURE;
@@ -1033,4 +1275,115 @@ mod tests {
             "the default still parses"
         );
     }
+
+    /// Y, with an IMU pad: the first press follows from where the pad is, the second holds, the
+    /// third follows again **from where the pad is now** — the new reference is what beats the
+    /// gyro's yaw drift, so a re-entry after a minute of drift starts the head at centre.
+    #[test]
+    fn y_cycles_follow_hold_follow_and_re_centres_each_time() {
+        let level = [1.0, 0.0, 0.0, 0.0];
+        // Yawed 30° by the time of the third press — drift, or a turn; the pad cannot tell.
+        let yawed = [
+            (15.0f32.to_radians()).cos(),
+            0.0,
+            0.0,
+            (15.0f32.to_radians()).sin(),
+        ];
+
+        let following = PadImuHead::Off.on_y(level);
+        assert_eq!(following, PadImuHead::Following { reference: level });
+        let holding = following.on_y(yawed);
+        assert_eq!(
+            holding,
+            PadImuHead::Holding,
+            "the second press holds, whatever the pad did"
+        );
+        let again = holding.on_y(yawed);
+        assert_eq!(
+            again,
+            PadImuHead::Following { reference: yawed },
+            "the third follows from the pad's attitude now, not the first one"
+        );
+        // And that reference reads as centre.
+        let head = head_from_pad(pad_imu::relative(yawed, yawed), 1.0, 2.5);
+        assert!(
+            head.head_yaw.abs() < 1e-4 && head.head_pitch.abs() < 1e-4,
+            "{head:?}"
+        );
+    }
+
+    /// The pad's tilt becomes the head's pose with the signs verified on the robot: nose up is a
+    /// positive head_pitch, yaw left a positive head_yaw, rolled right a negative head_roll. Gain
+    /// scales, the travel limit clamps, the neck stays put.
+    #[test]
+    fn the_head_follows_the_pad_with_the_sticks_signs_gain_and_limit() {
+        let half = 15.0f32.to_radians();
+        // 30° nose up: a rotation about +Y.
+        let nose_up = [half.cos(), 0.0, half.sin(), 0.0];
+        let head = head_from_pad(nose_up, 1.0, 2.5);
+        assert!(
+            (head.head_pitch - 30.0f64.to_radians()).abs() < 0.01,
+            "{head:?}"
+        );
+        assert!(
+            head.head_yaw.abs() < 0.01 && head.head_roll.abs() < 0.01,
+            "{head:?}"
+        );
+        assert_eq!(head.neck_pitch, 0.0);
+
+        // 30° rolled right (left side up): about +X. The head rolls the other sign.
+        let rolled = [half.cos(), half.sin(), 0.0, 0.0];
+        let head = head_from_pad(rolled, 1.0, 2.5);
+        assert!(
+            (head.head_roll - (-30.0f64.to_radians())).abs() < 0.01,
+            "{head:?}"
+        );
+
+        // 30° yaw left: about +Z.
+        let left = [half.cos(), 0.0, 0.0, half.sin()];
+        let head = head_from_pad(left, 1.0, 2.5);
+        assert!(
+            (head.head_yaw - 30.0f64.to_radians()).abs() < 0.01,
+            "{head:?}"
+        );
+
+        // Gain 2 doubles it; a limit of 0.5 rad clamps it.
+        let head = head_from_pad(left, 2.0, 2.5);
+        assert!(
+            (head.head_yaw - 60.0f64.to_radians()).abs() < 0.01,
+            "{head:?}"
+        );
+        let head = head_from_pad(left, 2.0, 0.5);
+        assert!((head.head_yaw - 0.5).abs() < 1e-6, "{head:?}");
+    }
+
+    /// Select is read on release. A short press is the stop, on the release; a hold reaching two
+    /// seconds is the shutdown, once, and the release after it is not a stop as well — the robot
+    /// is sitting down and must not be dropped mid-way.
+    #[test]
+    fn select_stops_on_a_short_release_and_shuts_down_on_a_long_hold() {
+        let t0 = Instant::now();
+        let at = |ms: u64| t0 + Duration::from_millis(ms);
+        let mut select = SelectButton::default();
+
+        // Short press: down for 300 ms, then up.
+        assert_eq!(select.tick(true, false, at(0)), SelectAction::Nothing);
+        assert_eq!(select.tick(true, false, at(300)), SelectAction::Nothing);
+        assert_eq!(select.tick(false, true, at(320)), SelectAction::Relax);
+        assert_eq!(select.tick(false, false, at(340)), SelectAction::Nothing);
+
+        // Press and release inside one tick: the state never read as down, the edge did.
+        assert_eq!(select.tick(false, true, at(1_000)), SelectAction::Relax);
+
+        // Long hold: the shutdown fires at two seconds, once, and the release is silent.
+        assert_eq!(select.tick(true, false, at(2_000)), SelectAction::Nothing);
+        assert_eq!(select.tick(true, false, at(3_990)), SelectAction::Nothing);
+        assert_eq!(select.tick(true, false, at(4_000)), SelectAction::Shutdown);
+        assert_eq!(select.tick(true, false, at(4_020)), SelectAction::Nothing);
+        assert_eq!(select.tick(false, true, at(5_000)), SelectAction::Nothing);
+
+        // And the next short press is a stop again.
+        assert_eq!(select.tick(true, false, at(6_000)), SelectAction::Nothing);
+        assert_eq!(select.tick(false, true, at(6_100)), SelectAction::Relax);
+    }
 }
diff --git a/padd/src/tap.rs b/padd/src/tap.rs
index db7a9219..3c6fbfea 100644
--- a/padd/src/tap.rs
+++ b/padd/src/tap.rs
@@ -34,6 +34,32 @@
 //! first report following the last one leaving — the same bargain `robotd` strikes by only
 //! assembling a `robot.state` frame when someone is subscribed. A pad at rest is silent, so a
 //! parked reader is not a wakeup either.
+//!
+//! ## The pad's IMU, when it has one
+//!
+//! Some pads carry an inertial unit. The "Pro Controller" Switch clones do, and the kernel's
+//! `hid-nintendo` exposes it as a **second** evdev node under the same HID device, flagged
+//! `INPUT_PROP_ACCELEROMETER` and named "... IMU". gilrs never opens it — an accelerometer's `ABS_X`
+//! is not a stick — so `padd` drives from the other node and this tap reads the IMU beside it, on a
+//! reader of its own with the same lifecycle: open while somebody subscribes, closed when nobody
+//! does. It is found by walking sysfs from the node gilrs named to its HID parent and back down to a
+//! sibling with the accelerometer property; a pad without one has no such sibling and nothing here
+//! changes for it.
+//!
+//! Unlike a stick it is never silent: the clone streams several hundred samples a second whether
+//! or not anyone touches it. That is why a sample is six integers rather than an event list, why it
+//! has its own drop counter, and why the IMU is not opened at all unless someone is watching —
+//! or unless `padd` itself is, which is the second reader below.
+//!
+//! ## The IMU as a control, not only a stream
+//!
+//! With `[pad_imu_head_control] enabled`, `padd` poses the robot's head from the pad's tilt. The attitude that
+//! needs comes from the same node the tap streams, so rather than a second reader on the same
+//! device this reader runs a `pad_imu::Imu` filter over every batch it reads and the main loop asks
+//! for the attitude ([`Tap::attitude`]). [`Tap::imu_control`] is the main loop saying "keep the
+//! IMU open for me": the node then stays open with or without a subscriber, and closes again when
+//! the feature goes off. One reader, one filter, and `robotctl monitor` draws the same attitude
+//! `padd` steers by.
 
 use std::io::{BufRead, BufReader, Write};
 use std::os::unix::fs::PermissionsExt;
@@ -93,17 +119,29 @@ struct Shared {
     state: Mutex<State>,
     /// Signalled whenever the reader might have work: a pad appeared, or someone subscribed.
     wake: Condvar,
+    /// The IMU's attitude, kept by the IMU reader for the main loop. `None` while no IMU is
+    /// open. Its own lock, not `state`'s: the main loop reads it fifty times a second and must not
+    /// queue behind a subscriber's send.
+    attitude: Mutex<Option<pad_imu::Imu>>,
 }
 
 struct State {
     /// The node to read, as gilrs named it. `None` when no pad is connected.
     wanted: Option<PathBuf>,
+    /// The pad's IMU node, when the pad has one — see [`imu_sibling`]. Resolved once per pad node
+    /// rather than per tick, because it is a walk through sysfs.
+    wanted_imu: Option<PathBuf>,
+    /// Does `padd` itself want the IMU read, for head control? A second reason to hold the node
+    /// open, beside a subscriber.
+    control: bool,
     subscribers: Vec<Subscriber>,
     /// The `Attached` report for the device currently open.
     ///
     /// Kept so a subscriber arriving mid-stream is told what it is looking at immediately, rather
     /// than having to wait for the pad to be unplugged and put back to find out.
     attached: Option<Arc<proto::PadReport>>,
+    /// The `ImuAttached` report for the IMU currently open, for the same reason.
+    imu_attached: Option<Arc<proto::PadReport>>,
 }
 
 struct Subscriber {
@@ -111,6 +149,9 @@ struct Subscriber {
     /// Frames dropped because this subscriber's queue was full. Its writer stamps them into the
     /// next frame it does send, so a slow client cannot read as a stalled radio.
     dropped: Arc<AtomicU64>,
+    /// IMU samples dropped for the same reason, counted apart: a lost sample says nothing about
+    /// the stick reports, and stamping it onto a `PadFrame` would say it did.
+    dropped_imu: Arc<AtomicU64>,
 }
 
 impl Tap {
@@ -146,10 +187,14 @@ impl Tap {
         let shared = Arc::new(Shared {
             state: Mutex::new(State {
                 wanted: None,
+                wanted_imu: None,
+                control: false,
                 subscribers: Vec::new(),
                 attached: None,
+                imu_attached: None,
             }),
             wake: Condvar::new(),
+            attitude: Mutex::new(None),
         });
 
         let accepting = Arc::clone(&shared);
@@ -162,6 +207,11 @@ impl Tap {
             .name("pad-tap-read".to_owned())
             .spawn(move || read(&reading))?;
 
+        let reading_imu = Arc::clone(&shared);
+        thread::Builder::new()
+            .name("pad-tap-imu".to_owned())
+            .spawn(move || read_imu(&reading_imu))?;
+
         Ok(Self { shared })
     }
 
@@ -173,25 +223,127 @@ impl Tap {
     /// It takes the gamepad rather than a path so the node can only come from gilrs — the one place
     /// that knows which of a pad's several input devices is the one being driven from.
     pub fn watch(&self, pad: &gilrs::Gamepad<'_>) {
-        self.want(Some(pad.devpath().to_path_buf()));
+        let node = pad.devpath().to_path_buf();
+        // The sysfs walk for the IMU happens only when the pad's node changes, which is the
+        // comparison `want` makes anyway — so it is made here first, before the walk.
+        if self.shared.lock().wanted.as_deref() == Some(node.as_path()) {
+            return;
+        }
+        let imu = imu_sibling(Path::new("/sys"), Path::new("/dev"), &node);
+        if let Some(imu) = imu.as_deref() {
+            tracing::info!(node = %node.display(), imu = %imu.display(), "the pad has an IMU");
+        }
+        self.want(Some(node), imu);
     }
 
-    /// No pad. The reader closes the device and says so to whoever is watching.
+    /// No pad. The readers close their devices and say so to whoever is watching.
     pub fn idle(&self) {
-        self.want(None);
+        self.want(None, None);
+    }
+
+    /// Keep the pad's IMU open for `padd`'s own use, or stop. Safe to call every tick.
+    pub fn imu_control(&self, on: bool) {
+        let mut state = self.shared.lock();
+        if state.control == on {
+            return;
+        }
+        state.control = on;
+        drop(state);
+        self.shared.wake.notify_all();
     }
 
-    fn want(&self, node: Option<PathBuf>) {
+    /// Does the connected pad have an IMU at all? True as soon as the node is known, before it is
+    /// open — the question "can Y mean IMU head control on this pad" needs answering on the press.
+    pub fn has_imu(&self) -> bool {
+        self.shared.lock().wanted_imu.is_some()
+    }
+
+    /// The pad's attitude, body → world, `w` first. `None` while no IMU is open or before its
+    /// first believable sample.
+    pub fn attitude(&self) -> Option<[f32; 4]> {
+        self.shared
+            .attitude
+            .lock()
+            .unwrap_or_else(PoisonError::into_inner)
+            .as_ref()
+            .and_then(pad_imu::Imu::quaternion)
+    }
+
+    fn want(&self, node: Option<PathBuf>, imu: Option<PathBuf>) {
         let mut state = self.shared.lock();
-        if state.wanted == node {
+        if state.wanted == node && state.wanted_imu == imu {
             return;
         }
         state.wanted = node;
+        state.wanted_imu = imu;
         drop(state);
         self.shared.wake.notify_all();
     }
 }
 
+/// The IMU node that belongs to the same pad as `node`, if the pad has one.
+///
+/// A pad's several input devices share one HID parent in sysfs, and only the inertial one carries
+/// `INPUT_PROP_ACCELEROMETER` (bit 6 of `properties`). So: from `/sys/class/input/eventN/device`
+/// up one to the HID device, then over every other `eventM` whose HID device is the same one and
+/// whose properties say accelerometer. The first such node is it — a pad has one IMU.
+///
+/// `sysfs` and `dev` are parameters so a test can lay the tree out in a temporary directory;
+/// production passes `/sys` and `/dev`.
+fn imu_sibling(sysfs: &Path, dev: &Path, node: &Path) -> Option<PathBuf> {
+    let event = node.file_name()?.to_owned();
+    let class = sysfs.join("class/input");
+    let hid_parent = |event: &std::ffi::OsStr| {
+        std::fs::canonicalize(class.join(event).join("device/device")).ok()
+    };
+    let parent = hid_parent(&event)?;
+
+    let mut candidates: Vec<PathBuf> = std::fs::read_dir(&class)
+        .ok()?
+        .filter_map(Result::ok)
+        .map(|entry| entry.path())
+        .filter(|path| {
+            path.file_name()
+                .and_then(|name| name.to_str())
+                .is_some_and(|name| name.starts_with("event"))
+        })
+        .collect();
+    // Sorted so "the first" is the same one on every call rather than directory order.
+    candidates.sort();
+
+    for candidate in candidates {
+        let name = candidate.file_name()?.to_owned();
+        if name == event {
+            continue;
+        }
+        if hid_parent(&name).as_deref() != Some(parent.as_path()) {
+            continue;
+        }
+        // A candidate whose properties cannot be read — unplugged between the `read_dir`
+        // and here, so the file is gone — must not end the search: the IMU may sort after it.
+        let Ok(properties) = std::fs::read_to_string(candidate.join("device/properties")) else {
+            continue;
+        };
+        if has_accelerometer_property(&properties) {
+            return Some(dev.join("input").join(name));
+        }
+    }
+    None
+}
+
+/// Does a sysfs `properties` bitmask carry `INPUT_PROP_ACCELEROMETER`?
+///
+/// The file is hex words, most significant first, space separated — `40` for a device with only
+/// that bit, `0` for a pad. Bit 6, from `linux/input.h`.
+fn has_accelerometer_property(properties: &str) -> bool {
+    // The property bits fit one word on every kernel, so the last word is the one that matters
+    // and any earlier ones are zero padding.
+    let Some(low) = properties.split_whitespace().last() else {
+        return false;
+    };
+    u64::from_str_radix(low, 16).is_ok_and(|bits| bits & (1 << 6) != 0)
+}
+
 impl Shared {
     /// The state, whether or not a thread panicked while holding it.
     ///
@@ -231,6 +383,68 @@ impl Shared {
         None
     }
 
+    /// The IMU reader's [`Self::wait_for_work`]: a pad with an IMU, and somebody to read it for —
+    /// a subscriber, or `padd` itself.
+    fn wait_for_imu_work(&self) -> PathBuf {
+        let mut state = self.lock();
+        loop {
+            if let Some(node) = state.wanted_imu.clone()
+                && (!state.subscribers.is_empty() || state.control)
+            {
+                return node;
+            }
+            state = self
+                .wake
+                .wait(state)
+                .unwrap_or_else(PoisonError::into_inner);
+        }
+    }
+
+    /// The IMU reader's [`Self::done_with`].
+    fn done_with_imu(&self, node: &Path) -> Option<&'static str> {
+        let state = self.lock();
+        if state.subscribers.is_empty() && !state.control {
+            return Some("nobody is watching any more");
+        }
+        if state.wanted_imu.as_deref() != Some(node) {
+            return Some("the pad changed");
+        }
+        None
+    }
+
+    fn attach_imu(&self, device: proto::PadImuDevice) {
+        *self.attitude_slot() = Some(pad_imu::Imu::new(device.clone()));
+        let report = Arc::new(proto::PadReport::ImuAttached {
+            device: Box::new(device),
+        });
+        let mut state = self.lock();
+        state.imu_attached = Some(Arc::clone(&report));
+        state.send(&report);
+    }
+
+    fn detach_imu(&self, why: String) {
+        *self.attitude_slot() = None;
+        let mut state = self.lock();
+        state.imu_attached = None;
+        state.send(&Arc::new(proto::PadReport::ImuDetached { why }));
+    }
+
+    /// One batch: into the filter first, then out to whoever is watching.
+    fn samples(&self, samples: Vec<proto::PadImuSample>) {
+        let batch = proto::PadImuBatch {
+            samples,
+            socket_dropped: 0,
+        };
+        if let Some(imu) = self.attitude_slot().as_mut() {
+            imu.absorb(&batch);
+        }
+        self.lock().send(&Arc::new(proto::PadReport::Imu(batch)));
+    }
+
+    fn attitude_slot(&self) -> MutexGuard<'_, Option<pad_imu::Imu>> {
+        self.attitude.lock().unwrap_or_else(PoisonError::into_inner)
+    }
+
     fn attach(&self, device: proto::PadInputDevice) {
         let report = Arc::new(proto::PadReport::Attached {
             device: Box::new(device),
@@ -256,20 +470,28 @@ impl Shared {
         self.lock().send(report);
     }
 
-    /// Add a subscriber, seeded with the device it is about to see frames from.
+    /// Add a subscriber, seeded with the device — and the IMU, if any — it is about to see
+    /// reports from.
     ///
-    /// Hands back the counter of what gets dropped for it, which only its own writer may clear.
-    fn subscribe(&self) -> (Receiver<Arc<proto::PadReport>>, Arc<AtomicU64>) {
+    /// Hands back the counters of what gets dropped for it, which only its own writer may clear.
+    fn subscribe(&self) -> (Receiver<Arc<proto::PadReport>>, Dropped) {
         let (reports, rx) = sync_channel(QUEUE);
         let mut state = self.lock();
         if let Some(attached) = state.attached.clone() {
             // Cannot fail: the queue is empty and this is the first thing in it.
             let _ = reports.try_send(attached);
         }
-        let dropped = Arc::new(AtomicU64::new(0));
+        if let Some(attached) = state.imu_attached.clone() {
+            let _ = reports.try_send(attached);
+        }
+        let dropped = Dropped {
+            frames: Arc::new(AtomicU64::new(0)),
+            samples: Arc::new(AtomicU64::new(0)),
+        };
         state.subscribers.push(Subscriber {
             reports,
-            dropped: Arc::clone(&dropped),
+            dropped: Arc::clone(&dropped.frames),
+            dropped_imu: Arc::clone(&dropped.samples),
         });
         drop(state);
         // A subscriber is the reader's other precondition, so it may have work now.
@@ -278,6 +500,12 @@ impl Shared {
     }
 }
 
+/// One subscriber's drop counters, as its writer holds them.
+struct Dropped {
+    frames: Arc<AtomicU64>,
+    samples: Arc<AtomicU64>,
+}
+
 impl State {
     /// Hand one report to every subscriber, dropping it for any that has fallen behind.
     ///
@@ -285,11 +513,17 @@ impl State {
     /// a subscriber that stalled it would corrupt the measurement it asked for — every frame after
     /// the stall would carry a gap the radio had nothing to do with.
     fn send(&mut self, report: &Arc<proto::PadReport>) {
+        let is_sample = matches!(**report, proto::PadReport::Imu(_));
         self.subscribers.retain(|subscriber| {
             match subscriber.reports.try_send(Arc::clone(report)) {
                 Ok(()) => true,
                 Err(TrySendError::Full(_)) => {
-                    subscriber.dropped.fetch_add(1, Ordering::Relaxed);
+                    let counter = if is_sample {
+                        &subscriber.dropped_imu
+                    } else {
+                        &subscriber.dropped
+                    };
+                    counter.fetch_add(1, Ordering::Relaxed);
                     true
                 }
                 // The writer is gone: the client disconnected.
@@ -382,13 +616,24 @@ fn subscriber(stream: UnixStream, shared: &Arc<Shared>) {
         // Whatever this subscriber missed goes on the next frame it does get, where it belongs:
         // beside the gap it explains. Left on the counter until then, so it cannot be lost to an
         // `Attached` or a `Detached` that carries nowhere to put it.
-        let stamped = match (&*report, dropped.load(Ordering::Relaxed)) {
-            (proto::PadReport::Frame(frame), missed) if missed > 0 => {
-                dropped.store(0, Ordering::Relaxed);
-                Some(proto::PadReport::Frame(proto::PadFrame {
-                    socket_dropped: missed,
-                    ..frame.clone()
-                }))
+        let stamped = match &*report {
+            proto::PadReport::Frame(frame) => {
+                let missed = dropped.frames.swap(0, Ordering::Relaxed);
+                (missed > 0).then(|| {
+                    proto::PadReport::Frame(proto::PadFrame {
+                        socket_dropped: missed,
+                        ..frame.clone()
+                    })
+                })
+            }
+            proto::PadReport::Imu(batch) => {
+                let missed = dropped.samples.swap(0, Ordering::Relaxed);
+                (missed > 0).then(|| {
+                    proto::PadReport::Imu(proto::PadImuBatch {
+                        socket_dropped: missed,
+                        ..batch.clone()
+                    })
+                })
             }
             _ => None,
         };
@@ -500,6 +745,114 @@ fn stream(shared: &Arc<Shared>, node: &Path) -> String {
     }
 }
 
+/// Open the wanted IMU node, stream it, and go back to waiting when it ends. Forever.
+///
+/// [`read`], for the second device. Its own thread because `fetch_events` blocks, and one reader
+/// cannot block on two nodes.
+fn read_imu(shared: &Arc<Shared>) {
+    loop {
+        let node = shared.wait_for_imu_work();
+        let why = stream_imu(shared, &node);
+        tracing::info!(node = %node.display(), why, "pad tap stopped reading the IMU");
+        shared.detach_imu(why);
+        thread::sleep(REOPEN_AFTER);
+    }
+}
+
+/// Read one IMU node until it ends, describing how it ended.
+///
+/// A sample is the six `ABS_*` values as they stand at each `SYN_REPORT`. Axes a report did not
+/// mention keep their last value, which is the kernel's own contract for absolute axes — a driver
+/// that leaves an unchanged axis out of a report has not zeroed it. The samples one read produced
+/// go out together, as one report: that is what keeps this affordable at six hundred a second.
+fn stream_imu(shared: &Arc<Shared>, node: &Path) -> String {
+    let mut device = match RawDevice::open(node) {
+        Ok(device) => device,
+        Err(e) => return format!("cannot open {}: {e}", node.display()),
+    };
+    let (described, mut current) = describe_imu(&device, node);
+    shared.attach_imu(described);
+    tracing::info!(node = %node.display(), "pad tap reading the IMU");
+
+    let mut seq = 0u64;
+    let mut resyncing = false;
+    let mut samples: Vec<proto::PadImuSample> = Vec::new();
+    loop {
+        let batch = match device.fetch_events() {
+            Ok(batch) => batch,
+            Err(e) => return format!("{} ended: {e}", node.display()),
+        };
+        for event in batch {
+            let kind = EventType(event.event_type().0);
+            let code = event.code();
+            if kind == EventType::SYNCHRONIZATION {
+                match SynchronizationCode(code) {
+                    SynchronizationCode::SYN_DROPPED => resyncing = true,
+                    SynchronizationCode::SYN_REPORT => {
+                        if resyncing {
+                            // The half-sample after a drop is discarded, as for the pad; the
+                            // values themselves are still the newest the kernel has, so the next
+                            // complete report is right.
+                            resyncing = false;
+                            continue;
+                        }
+                        seq += 1;
+                        samples.push(proto::PadImuSample {
+                            seq,
+                            at_us: micros(event.timestamp()),
+                            accel: [current[0], current[1], current[2]],
+                            gyro: [current[3], current[4], current[5]],
+                        });
+                    }
+                    _ => {}
+                }
+                continue;
+            }
+            if kind == EventType::ABSOLUTE
+                && let Some(slot) = imu_slot(code)
+            {
+                current[slot] = event.value();
+            }
+        }
+        if !samples.is_empty() {
+            shared.samples(std::mem::take(&mut samples));
+        }
+        if let Some(why) = shared.done_with_imu(node) {
+            return why.to_owned();
+        }
+    }
+}
+
+/// Which of the six sample slots an `ABS_*` code fills: X, Y, Z, RX, RY, RZ.
+fn imu_slot(code: u16) -> Option<usize> {
+    (code <= AbsoluteAxisCode::ABS_RZ.0).then_some(usize::from(code))
+}
+
+/// The IMU as the kernel describes it, and where its axes stand right now.
+fn describe_imu(device: &RawDevice, node: &Path) -> (proto::PadImuDevice, [i32; 6]) {
+    let mut current = [0i32; 6];
+    let mut resolution = [0i32; 6];
+    let mut max = [0i32; 6];
+    if let Ok(axes) = device.get_absinfo() {
+        for (code, info) in axes {
+            if let Some(slot) = imu_slot(code.0) {
+                current[slot] = info.value();
+                resolution[slot] = info.resolution();
+                max[slot] = info.maximum();
+            }
+        }
+    }
+    let described = proto::PadImuDevice {
+        name: device.name().unwrap_or("unnamed IMU").to_owned(),
+        node: node.display().to_string(),
+        accel_per_g: resolution[0],
+        gyro_per_dps: resolution[3],
+        accel_max: max[0],
+        gyro_max: max[3],
+    };
+    (described, current)
+}
+
 /// Everything about the device that a number in a frame has to be read against.
 fn describe(device: &RawDevice, node: &Path) -> proto::PadInputDevice {
     let id = device.input_id();
@@ -646,10 +999,14 @@ mod tests {
         Arc::new(Shared {
             state: Mutex::new(State {
                 wanted: None,
+                wanted_imu: None,
+                control: false,
                 subscribers: Vec::new(),
                 attached: None,
+                imu_attached: None,
             }),
             wake: Condvar::new(),
+            attitude: Mutex::new(None),
         })
     }
 
@@ -681,10 +1038,15 @@ mod tests {
         }
 
         assert_eq!(
-            dropped.load(Ordering::Relaxed),
+            dropped.frames.load(Ordering::Relaxed),
             10,
             "the overflow is counted"
         );
+        assert_eq!(
+            dropped.samples.load(Ordering::Relaxed),
+            0,
+            "and not against the IMU, which sent nothing"
+        );
         assert_eq!(
             shared.lock().subscribers.len(),
             1,
@@ -754,6 +1116,193 @@ mod tests {
         assert!(!unnamed.contains(' '), "no prose on the wire: {unnamed}");
     }
 
+    fn a_sample(seq: u64) -> Arc<proto::PadReport> {
+        Arc::new(proto::PadReport::Imu(proto::PadImuBatch {
+            samples: vec![proto::PadImuSample {
+                seq,
+                at_us: 1_000_000 + seq * 1_667,
+                accel: [-391, -35, 4270],
+                gyro: [25_000, -9_000, 171_000],
+            }],
+            socket_dropped: 0,
+        }))
+    }
+
+    /// IMU samples that overflow a slow subscriber are counted against the IMU, not the pad. The
+    /// clone sends six hundred a second and the sticks a handful; a shared counter would report a
+    /// pad link losing reports it never lost.
+    #[test]
+    fn dropped_samples_are_not_dropped_frames() {
+        let shared = a_shared();
+        let (reports, dropped) = shared.subscribe();
+
+        for seq in 0..(QUEUE as u64 + 25) {
+            shared.frame_report(&a_sample(seq));
+        }
+
+        assert_eq!(dropped.samples.load(Ordering::Relaxed), 25);
+        assert_eq!(dropped.frames.load(Ordering::Relaxed), 0);
+        drop(reports);
+    }
+
+    /// `padd` wanting the attitude is reason enough to hold the IMU open, with nobody subscribed —
+    /// and the attitude it reads is the filter's, fed from the same batches the subscribers get.
+    #[test]
+    fn head_control_holds_the_imu_open_and_reads_the_filter() {
+        let shared = a_shared();
+        let node = Path::new("/dev/input/event5");
+        shared.lock().wanted_imu = Some(node.to_path_buf());
+        assert_eq!(
+            shared.done_with_imu(node),
+            Some("nobody is watching any more"),
+            "no subscriber, no control: let go"
+        );
+
+        shared.lock().control = true;
+        assert_eq!(shared.done_with_imu(node), None, "control alone holds it");
+
+        shared.attach_imu(proto::PadImuDevice {
+            name: "Nintendo Switch Pro Controller IMU".to_owned(),
+            node: node.display().to_string(),
+            accel_per_g: 4096,
+            gyro_per_dps: 14247,
+            accel_max: 32767,
+            gyro_max: 32_767_000,
+        });
+        let read = |shared: &Shared| {
+            shared
+                .attitude_slot()
+                .as_ref()
+                .and_then(pad_imu::Imu::quaternion)
+        };
+        assert!(read(&shared).is_none(), "no sample yet, no attitude");
+        // Flat on the table, one sample: seeded level.
+        shared.samples(vec![proto::PadImuSample {
+            seq: 1,
+            at_us: 1_000_000,
+            accel: [0, 0, 4096],
+            gyro: [0, 0, 0],
+        }]);
+        let q = read(&shared).expect("an attitude after a believable sample");
+        let euler = pad_imu::euler_deg(q);
+        assert!(euler.iter().all(|a| a.abs() < 0.5), "{euler:?}");
+
+        shared.detach_imu("the pad changed".to_owned());
+        assert!(read(&shared).is_none(), "gone with the node");
+    }
+
+    /// A subscriber arriving while an IMU is open is told about it, as it is told about the pad.
+    #[test]
+    fn a_subscriber_arriving_mid_stream_is_told_the_imu_too() {
+        let shared = a_shared();
+        shared.attach(a_device());
+        shared.attach_imu(proto::PadImuDevice {
+            name: "Nintendo Switch Pro Controller IMU".to_owned(),
+            node: "/dev/input/event5".to_owned(),
+            accel_per_g: 4096,
+            gyro_per_dps: 14247,
+            accel_max: 32767,
+            gyro_max: 32_767_000,
+        });
+
+        let (reports, _dropped) = shared.subscribe();
+        assert!(matches!(
+            &*reports.try_recv().unwrap(),
+            proto::PadReport::Attached { .. }
+        ));
+        assert!(matches!(
+            &*reports.try_recv().unwrap(),
+            proto::PadReport::ImuAttached { .. }
+        ));
+    }
+
+    /// The IMU is a sibling node under the pad's HID device with the accelerometer property, and
+    /// nothing else qualifies: not the pad itself, not a node of another device, not a sibling
+    /// without the property. Laid out as sysfs lays it out — `eventN/device` is the input device,
+    /// its `device` the HID one — so the walk here is the walk on a board.
+    #[test]
+    fn the_imu_is_the_accelerometer_sibling_under_the_same_hid_device() {
+        let root = tempfile::tempdir().unwrap();
+        let sysfs = root.path().join("sys");
+        let dev = root.path().join("dev");
+        let hid_pad = sysfs.join("devices/hci0/0005:057E:2009.0001");
+        let hid_other = sysfs.join("devices/hci0/0005:045E:0B13.0002");
+        let class = sysfs.join("class/input");
+        std::fs::create_dir_all(&class).unwrap();
+
+        // (event, hid device, properties)
+        let nodes = [
+            ("event3", &hid_other, "0"),
+            ("event4", &hid_pad, "0"),
+            ("event5", &hid_pad, "40"),
+            ("event6", &hid_other, "40"),
+        ];
+        for (index, (event, hid, props)) in nodes.iter().enumerate() {
+            // As on a board: `<hid>/input/inputN/eventN` is the node's directory, its `device`
+            // is the input device `inputN`, and *that* device's `device` is the HID one.
+            let input = hid.join(format!("input/input{index}"));
+            let node = input.join(event);
+            std::fs::create_dir_all(&node).unwrap();
+            std::fs::write(input.join("properties"), format!("{props}\n")).unwrap();
+            std::os::unix::fs::symlink(&node, class.join(event)).unwrap();
+            std::os::unix::fs::symlink(&input, node.join("device")).unwrap();
+            std::os::unix::fs::symlink(hid, input.join("device")).unwrap();
+        }
+
+        assert_eq!(
+            imu_sibling(&sysfs, &dev, Path::new("/dev/input/event4")),
+            Some(dev.join("input/event5")),
+            "the pad's own accelerometer sibling"
+        );
+        assert_eq!(
+            imu_sibling(&sysfs, &dev, Path::new("/dev/input/event3")),
+            Some(dev.join("input/event6")),
+            "another pad, its own sibling — never the first pad's"
+        );
+        assert_eq!(
+            imu_sibling(&sysfs, &dev, Path::new("/dev/input/event9")),
+            None,
+            "a node sysfs has never heard of"
+        );
+        assert!(has_accelerometer_property("40"));
+        assert!(has_accelerometer_property("0 40"));
+        assert!(!has_accelerometer_property("0"));
+        assert!(!has_accelerometer_property(""));
+    }
+
+    /// A sibling whose properties cannot be read — the device was unplugged between the
+    /// `read_dir` and the read, so the file is gone — must not end the search: the IMU may
+    /// sort after it.
+    #[test]
+    fn an_unreadable_sibling_does_not_end_the_imu_search() {
+        let root = tempfile::tempdir().unwrap();
+        let sysfs = root.path().join("sys");
+        let dev = root.path().join("dev");
+        let hid_pad = sysfs.join("devices/hci0/0005:057E:2009.0001");
+        let class = sysfs.join("class/input");
+        std::fs::create_dir_all(&class).unwrap();
+
+        // event4 is the pad; event5 is a sibling that vanished mid-walk (its `properties`
+        // is a directory, which no read ever survives); event6 is the real IMU, after it.
+        for (index, event) in ["event4", "event5", "event6"].iter().enumerate() {
+            let input = hid_pad.join(format!("input/input{index}"));
+            let node = input.join(event);
+            std::fs::create_dir_all(&node).unwrap();
+            std::os::unix::fs::symlink(&node, class.join(event)).unwrap();
+            std::os::unix::fs::symlink(&input, node.join("device")).unwrap();
+            std::os::unix::fs::symlink(&hid_pad, input.join("device")).unwrap();
+        }
+        std::fs::write(hid_pad.join("input/input0/properties"), "0\n").unwrap();
+        std::fs::create_dir_all(hid_pad.join("input/input1/properties")).unwrap();
+        std::fs::write(hid_pad.join("input/input2/properties"), "40\n").unwrap();
+
+        assert_eq!(
+            imu_sibling(&sysfs, &dev, Path::new("/dev/input/event4")),
+            Some(dev.join("input/event6")),
+            "the vanished sibling is skipped, and the IMU behind it is found"
+        );
+    }
+
     /// The tap's wire types are the protocol's, so a frame it builds is a frame `robotctl` parses.
     /// Cheap to assert here, and the alternative is finding out on a board.
     #[test]
diff --git a/robotctl/Cargo.toml b/robotctl/Cargo.toml
index ceeeee31..26c89a8f 100644
--- a/robotctl/Cargo.toml
+++ b/robotctl/Cargo.toml
@@ -27,6 +27,7 @@ libc = "0.2.189"
 # Pure geometry (the ToF reprojection the monitor overlays) — deliberately NOT the `tof`
 # crate, whose vendored C driver would drag a cross C toolchain into every robotctl build.
 kinematics = { path = "../kinematics" }
+pad-imu = { path = "../pad-imu" }
 # `robotctl configure`'s schema, defaults and validation — the same crate `robotd` parses
 # its config with, which is what makes the editor unable to disagree with the daemon. Pure
 # serde + toml, so the recovery-path rule above still holds.
diff --git a/robotctl/src/configure.rs b/robotctl/src/configure.rs
index 17c3d86b..758b554a 100644
--- a/robotctl/src/configure.rs
+++ b/robotctl/src/configure.rs
@@ -27,13 +27,21 @@
 //! unit a change needs restarted, restarting it, printing a divergence list, and the full-screen
 //! editor.
 //!
-//! ## Restart
+//! ## Making a change take
 //!
-//! The daemons read the file **once at startup** (`robotd-params` docs) — so every change
-//! requires a restart, and the exit flow offers one whenever anything was written. *Which*
-//! daemon is derived from the keys that changed, not assumed: `[media]` is `mediad` reading the
-//! same file, and a "restart robotd" offer over a video setting is an edit that reads as having
-//! done nothing at all. [`unit_for`] is that mapping and [`units_for`] applies it.
+//! Mostly the daemons read the file **once at startup** (`robotd-params` docs), so mostly a
+//! change needs a restart — and *which* daemon is derived from the keys that changed rather than
+//! assumed: `[media]` is `mediad` reading the same file, and a "restart robotd" offer over a
+//! video setting is an edit that reads as having done nothing at all.
+//!
+//! Mostly, not always, and the exceptions are where offering a restart is worst. `padd` re-reads
+//! `[pad]` and `[pad_imu_head_control]` a second after the file changes, so a restart there drops the pad
+//! session — and robotd's deadman with it — to apply what would have applied by itself. `robotd`
+//! re-reads `[policy]` on a call, so a restart there takes motor control away from a standing
+//! robot to change a number it would have taken standing up.
+//!
+//! [`Apply`] is what a key needs, [`apply_for`] is the mapping, and [`Plan`] is that answer for a
+//! set of keys — what to restart, what to reload, and what needs nothing at all.
 //!
 //! The file is root-owned; run as `sudo robotctl configure` to actually write.
 
@@ -44,56 +52,152 @@ use std::path::Path;
 // of `robotctl` reaches for `configure::Model` and should not have to know it moved.
 pub use robotd_params::edit::{Edit, Model, Row, bind_pad, pad_bindings, render, sections};
 
-/// Which daemon reads a section, and so which unit a change to it needs restarted.
+/// What a written key needs before the daemon that reads it is running on it.
 ///
-/// `robotd` parses this file for itself; `[media]` and `[detect]` are `mediad` reading the same
+/// Every variant names that daemon, because every message the exit flow prints names it: an offer
+/// that says "restart" without saying *what* is how `[head_imu]` came to restart `robotd`.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Apply {
+    /// Read once at startup. The unit has to go down and come back, and everything it was doing
+    /// stops for as long as that takes.
+    Restart(&'static str),
+    /// A running daemon will re-read it on a call. Cheaper than a restart in the way that
+    /// matters: the motors stay powered.
+    Reload(&'static str),
+    /// The daemon re-reads the file by itself. Nothing to do but say so.
+    Live(&'static str),
+}
+
+impl Apply {
+    /// The daemon, whatever the answer was.
+    fn unit(self) -> &'static str {
+        match self {
+            Self::Restart(unit) | Self::Reload(unit) | Self::Live(unit) => unit,
+        }
+    }
+}
+
+/// What a change to `section.key` needs, and from which daemon.
+///
+/// `robotd` parses this file for itself; `[media]` and `[duck_detector]` are `mediad` reading the same
 /// file, because a per-board setting belongs in the per-board config rather than on a unit file the
-/// release installer rewrites — and because the camera frames `[detect]` is about are on `mediad`'s
+/// release installer rewrites — and because the camera frames `[duck_detector]` is about are on `mediad`'s
 /// tee. Being wrong here is an edit that appears to do nothing until the next reboot — which is
-/// exactly what the restart offer exists to prevent, so it is derived from the keys that changed
-/// rather than assumed.
-fn unit_for(section: &str) -> &'static str {
-    match section {
-        "media" | "detect" => "mediad",
-        // `padd` reads the bindings, and `robotd` never sees them. Offering a robotd restart for
-        // a button change would drop motor control — putting a standing robot on the floor — to
-        // apply a setting it does not read.
-        "pad" => "padd",
-        _ => "robotd",
+/// exactly what the offer exists to prevent, so it is derived from the keys that changed rather
+/// than assumed.
+///
+/// **Every section is listed, and there is no fallback.** `[head_imu]` shipped reading as `robotd`
+/// because a `_ => "robotd"` arm answered for it: enabling the head IMU restarted the daemon that
+/// does not read the key and left `tofd` on the old value, so the switch did nothing and said
+/// nothing. A section with no arm here now fails `every_registry_key_says_how_it_applies` rather
+/// than picking up whichever daemon the catch-all happened to name.
+///
+/// Keyed by the whole `section.key` rather than the section because `[policy]` is not of one
+/// mind: the daemon re-reads that section on a call, all of it but the two keys below.
+fn apply_for(key: &str) -> Option<Apply> {
+    let (section, name) = key.split_once('.')?;
+    Some(match section {
+        "media" | "duck_detector" => Apply::Restart("mediad"),
+        // `padd` stats the file once a second and re-reads both of its sections when the mtime
+        // moves — `padd/src/main.rs`, where the reload is a line above `tap.imu_control()` and
+        // says why it is on every tick. So there is nothing to offer, and offering a restart
+        // anyway is not free: the pad session goes with it, and robotd's deadman zeroes the
+        // velocity of whatever was walking. `robotctl pad bind` has always said the true thing —
+        // "padd picks this up within a second".
+        //
+        // `pad_imu_head_control` is the *controller's* IMU steering the head. Not `head_imu` below.
+        "pad" | "pad_imu_head_control" => Apply::Live("padd"),
+        // `tofd` reads `[head_imu]` out of robotd's file — see `tof/src/config.rs` for why it
+        // reads that file rather than one of its own — and reads it once, at startup.
+        "head_imu" => Apply::Restart("tofd"),
+        // `[policy]` is the one section a running daemon takes back: `PolicyChange::Reload`
+        // re-reads it whole and rebuilds the controller from it, which is how `robotctl policy
+        // add` lands a skill without a restart. Two keys are not in that promise:
+        //
+        // - `mode` is deliberately kept across a reload, because `robot.setMode` does not write
+        //   config and adopting the file's mode would undo a live switch as a side effect.
+        // - `enabled` is read once into `RobotState`, and the reload call is *refused* while it
+        //   is false — so the one direction anybody cares about, off to on, cannot be a reload.
+        "policy" if name != "mode" && name != "enabled" => Apply::Reload("robotd"),
+        "bus" | "control" | "update_gate" | "policy" | "safety" | "chorale" | "theremin"
+        | "audio" => Apply::Restart("robotd"),
+        _ => return None,
+    })
+}
+
+/// What a set of written keys needs, with each daemon named once.
+///
+/// Three lists rather than one, because the three answers read differently on the way out: a
+/// restart is a question, a reload is a lighter question, and `live` is an answer — the operator
+/// is told it already applies and asked nothing.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct Plan {
+    /// Units to restart, in start order.
+    pub restart: Vec<&'static str>,
+    /// Units to ask for a re-read.
+    pub reload: Vec<&'static str>,
+    /// Units that have it already, or will within a second.
+    pub live: Vec<&'static str>,
+}
+
+impl Plan {
+    /// Is there nothing to ask the operator?
+    ///
+    /// True for no edits at all *and* for edits that are already live — the difference is
+    /// `live`, and the caller says the two things differently.
+    pub fn is_quiet(&self) -> bool {
+        self.restart.is_empty() && self.reload.is_empty()
     }
 }
 
-/// The units a set of `section.key` names requires restarting, in start order, without duplicates.
-fn units_for_keys<'a>(keys: impl Iterator<Item = &'a str>) -> Vec<&'static str> {
-    // `robotd` first, because `mediad.service` is `After=robotd.service`: restarting in the
-    // other order means mediad reconnects to a robotd that is about to go away.
-    let mut units: Vec<&'static str> = Vec::new();
+/// What a set of `section.key` names needs, in the order the exit flow acts on it.
+fn plan_for_keys<'a>(keys: impl Iterator<Item = &'a str>) -> Plan {
+    let mut plan = Plan::default();
     for key in keys {
-        let (section, _) = key.split_once('.').expect("registry keys are section.key");
-        let unit = unit_for(section);
-        if !units.contains(&unit) {
-            units.push(unit);
+        // Unreachable for a registry key: `every_registry_key_says_how_it_applies` keeps
+        // `apply_for` exhaustive. Saying nothing beats naming the wrong daemon — the exit path
+        // then prints the file it wrote instead of restarting something that never reads it.
+        let Some(apply) = apply_for(key) else {
+            continue;
+        };
+        let list = match apply {
+            Apply::Restart(_) => &mut plan.restart,
+            Apply::Reload(_) => &mut plan.reload,
+            Apply::Live(_) => &mut plan.live,
+        };
+        if !list.contains(&apply.unit()) {
+            list.push(apply.unit());
         }
     }
-    units.sort_unstable_by_key(|unit| *unit != "robotd");
-    units
+    // A daemon that is going down anyway reads the whole file coming back up, so the weaker
+    // answers for it are absorbed rather than listed. `[policy] mode` with `[policy] gain` is
+    // exactly that shape: mode needs the restart, gain would have been a reload, and offering
+    // "restart robotd, then reload robotd" would disturb a walking robot a second time to apply
+    // what it already applied.
+    plan.reload.retain(|unit| !plan.restart.contains(unit));
+    plan.live
+        .retain(|unit| !plan.restart.contains(unit) && !plan.reload.contains(unit));
+    // `robotd` first, because `mediad.service` is `After=robotd.service`: restarting in the
+    // other order means mediad reconnects to a robotd that is about to go away.
+    plan.restart.sort_unstable_by_key(|unit| *unit != "robotd");
+    plan
 }
 
-/// The units the pending edits require restarting, in start order, without duplicates.
+/// What the pending edits need.
 ///
-/// Empty is a real answer — no edits, nothing to restart — and the caller must not offer a
-/// restart for it. Read *before* a save, which clears the pending map.
-pub fn units_for(model: &Model) -> Vec<&'static str> {
-    units_for_keys(model.pending.keys().copied())
+/// A quiet plan is a real answer — no edits, or edits nobody has to do anything about — and the
+/// caller must not offer a restart for it. Read *before* a save, which clears the pending map.
+pub fn plan_for(model: &Model) -> Plan {
+    plan_for_keys(model.pending.keys().copied())
 }
 
-/// The daemons that read the keys somebody just changed.
+/// What the keys somebody just changed need.
 ///
-/// The same mapping as [`units_for`], from what a save recorded rather than from what is still
+/// The same mapping as [`plan_for`], from what a save recorded rather than from what is still
 /// pending — which is what the exit flow has to work from, because the save already cleared the
 /// other one.
-pub fn units_to_restart(edited: &[String]) -> Vec<&'static str> {
-    units_for_keys(edited.iter().map(String::as_str))
+pub fn plan_for_written(edited: &[String]) -> Plan {
+    plan_for_keys(edited.iter().map(String::as_str))
 }
 
 /// Restart units, reporting rather than hiding the outcome.
@@ -207,11 +311,11 @@ pub fn list(path: &Path, json: bool) -> Result<(), String> {
 // `monitor`'s conventions (ratatui, `ratatui::init`/`restore`) and deliberately dumber — a
 // config editor should feel like a settings menu, not a dashboard.
 
-use ratatui::crossterm::event::{self, Event, KeyCode, KeyEventKind};
-use ratatui::layout::{Constraint, Layout};
+use ratatui::crossterm::event::{self, Event, KeyCode, KeyEventKind, KeyModifiers};
+use ratatui::layout::{Constraint, Layout, Rect};
 use ratatui::style::{Modifier, Style};
 use ratatui::text::{Line, Span};
-use ratatui::widgets::{Block, Borders, Paragraph};
+use ratatui::widgets::{Block, Borders, Clear, Paragraph};
 
 /// What the list shows at one line: a section header, or a key.
 #[derive(Debug)]
@@ -229,15 +333,28 @@ enum Focus {
         buffer: String,
         error: Option<String>,
     },
+    /// Fuzzy-searching the list from a popup (ctrl+f). The cursor follows the best match as
+    /// the query grows; leaving the popup — ENTER or ESC alike — keeps it wherever it landed.
+    Search {
+        query: String,
+        /// Where the cursor was when the popup opened: an emptied query goes back there.
+        origin: usize,
+        /// Which of the ranked hits the cursor sits on (↑↓ walk them).
+        hit: usize,
+    },
     /// Deciding what to do with the pending edits on the way out.
     Confirm,
-    /// Everything written; offering the restart every change requires — of the daemons that
-    /// actually read what changed, which is not always `robotd`.
-    Restart { units: Vec<&'static str> },
+    /// Everything written; offering what the change actually needs — of the daemons that
+    /// actually read what changed, which is not always `robotd` and is not always a restart.
+    /// Never reached for a [`Plan::is_quiet`] plan: there is nothing to ask.
+    Apply { plan: Plan },
 }
 
 /// Run the editor. Returns once the user has left, with everything saved or discarded.
-pub fn run(path: &Path) -> Result<(), String> {
+///
+/// `robot_socket` is only reached for a `[policy]` change, and only if the operator accepts the
+/// reload — the editor is useful on a board where nothing is running.
+pub fn run(path: &Path, robot_socket: &Path) -> Result<(), String> {
     // An interactive editor and nothing else: piped in or out, there is no sensible
     // behaviour to fall back to, and ratatui would panic trying to open the terminal.
     if !crate::monitor::stdout_is_a_terminal() {
@@ -301,7 +418,7 @@ pub fn run(path: &Path) -> Result<(), String> {
                             }
                             None => {
                                 focus = Focus::Editing {
-                                    buffer: row.effective().to_owned(),
+                                    buffer: shown_value(row).to_owned(),
                                     error: None,
                                 };
                             }
@@ -311,11 +428,18 @@ pub fn run(path: &Path) -> Result<(), String> {
                 KeyCode::Enter => {
                     if let Item::Key(index) = items[cursor] {
                         focus = Focus::Editing {
-                            buffer: rows[index].effective().to_owned(),
+                            buffer: shown_value(&rows[index]).to_owned(),
                             error: None,
                         };
                     }
                 }
+                KeyCode::Char('f') if key.modifiers.contains(KeyModifiers::CONTROL) => {
+                    focus = Focus::Search {
+                        query: String::new(),
+                        origin: cursor,
+                        hit: 0,
+                    };
+                }
                 KeyCode::Char('u') | KeyCode::Char('d') => {
                     if let Item::Key(index) = items[cursor] {
                         model.pending.insert(rows[index].entry.key, Edit::Clear);
@@ -343,15 +467,54 @@ pub fn run(path: &Path) -> Result<(), String> {
                 }
                 _ => {}
             },
+            Focus::Search { query, origin, hit } => {
+                match key.code {
+                    // Both leave the selection where the search put it: the point of the
+                    // search was to get there.
+                    KeyCode::Esc | KeyCode::Enter => {
+                        focus = Focus::List;
+                        continue;
+                    }
+                    KeyCode::Char('f') if key.modifiers.contains(KeyModifiers::CONTROL) => {
+                        focus = Focus::List;
+                        continue;
+                    }
+                    KeyCode::Down | KeyCode::Tab => *hit += 1,
+                    KeyCode::Up | KeyCode::BackTab => *hit = hit.saturating_sub(1),
+                    KeyCode::Backspace => {
+                        query.pop();
+                        *hit = 0;
+                    }
+                    KeyCode::Char(c) if !key.modifiers.contains(KeyModifiers::CONTROL) => {
+                        query.push(c);
+                        *hit = 0;
+                    }
+                    _ => {}
+                }
+                if query.is_empty() {
+                    cursor = *origin;
+                } else {
+                    let hits = search(&items, &rows, query);
+                    if !hits.is_empty() {
+                        *hit = (*hit).min(hits.len() - 1);
+                        cursor = hits[*hit];
+                    }
+                }
+            }
             Focus::Confirm => match key.code {
                 KeyCode::Char('y') | KeyCode::Enter => {
                     // Read before the save, which clears `pending` — after it there is nothing
                     // left to say which daemons were affected.
-                    let units = units_for(&model);
+                    let plan = plan_for(&model);
                     match model.save() {
                         Ok(()) => {
                             saved = true;
-                            focus = Focus::Restart { units };
+                            if plan.is_quiet() {
+                                // `padd` has it, or will within a second. Asking would be
+                                // asking somebody to authorise a pad restart for nothing.
+                                break Ok(true);
+                            }
+                            focus = Focus::Apply { plan };
                         }
                         Err(e) => {
                             status = Some(e);
@@ -363,10 +526,12 @@ pub fn run(path: &Path) -> Result<(), String> {
                 KeyCode::Esc => focus = Focus::List,
                 _ => {}
             },
-            Focus::Restart { .. } => match key.code {
+            Focus::Apply { .. } => match key.code {
                 // The restart itself happens after `ratatui::restore`, outside the alternate
                 // screen, so systemctl's output is visible.
                 KeyCode::Char('y') | KeyCode::Enter => break Ok(true),
+                // Back to `List` so the tail below finds no plan to act on — declining has to
+                // leave the same trace as never having been asked.
                 KeyCode::Char('n') | KeyCode::Esc | KeyCode::Char('q') => {
                     focus = Focus::List;
                     break Ok(saved);
@@ -375,9 +540,10 @@ pub fn run(path: &Path) -> Result<(), String> {
             },
         }
     };
-    let restart_wanted = match &focus {
-        Focus::Restart { units } => units.clone(),
-        _ => Vec::new(),
+    // What the operator agreed to on the way out — nothing, unless they were asked and said yes.
+    let agreed = match &focus {
+        Focus::Apply { plan } => plan.clone(),
+        _ => Plan::default(),
     };
     // What was *written*, not what is pending: the save already happened inside the loop above and
     // cleared the pending map, which is why reading it here restarted nothing at all.
@@ -385,17 +551,62 @@ pub fn run(path: &Path) -> Result<(), String> {
     ratatui::restore();
 
     let saved = outcome?;
-    if !restart_wanted.is_empty() {
-        let names = restart_wanted.join(" and ");
+    if !saved {
+        return Ok(());
+    }
+
+    if !agreed.restart.is_empty() {
+        let names = agreed.restart.join(" and ");
         println!("restarting {names}…");
-        restart_units(&restart_wanted)?;
+        restart_units(&agreed.restart)?;
         println!("{names} restarted");
-    } else if saved {
-        let names = units_to_restart(&edited).join(" and ");
-        println!(
-            "written to {} — changes apply on the next `systemctl restart {names}`",
-            path.display()
-        );
+    }
+    for unit in &agreed.reload {
+        // `robotd` is the only unit that can be here — `[policy]` is the one section a running
+        // daemon takes back, and `reload_policies` is that one call — so the name is read off
+        // the plan for the message and asserted rather than dispatched on.
+        debug_assert_eq!(*unit, "robotd", "robotd owns the only reloadable section");
+        println!("asking {unit} to re-read the config…");
+        match crate::reload_policies(robot_socket) {
+            Ok(true) => println!("{unit} is running on the new values"),
+            Ok(false) => println!(
+                "{unit} declined — policies are off on this robot, which takes a restart:\n  \
+                 sudo systemctl restart {unit}"
+            ),
+            Err(e) => {
+                println!("{unit} did not answer ({e}) — it will read the file at its next start")
+            }
+        }
+    }
+    if agreed.is_quiet() {
+        // Declined, or never asked. Say where the change is and what it is waiting on, since
+        // the two answers are different and only one of them is a thing to do.
+        let plan = plan_for_written(&edited);
+        println!("written to {}", path.display());
+        if !plan.restart.is_empty() {
+            println!(
+                "  applies on:  sudo systemctl restart {}",
+                plan.restart.join(" ")
+            );
+        }
+        if !plan.reload.is_empty() {
+            // No command to name: the reload is a call this editor makes, and `robotctl policy`
+            // makes it as a side effect of its own writes. What is worth saying is that nothing
+            // is running on the new value yet.
+            println!(
+                "  {} has it at its next start — nothing is running on it yet",
+                plan.reload.join(" and ")
+            );
+        }
+        if !plan.live.is_empty() {
+            let names = plan.live.join(" and ");
+            let reads = if plan.live.len() == 1 {
+                "picks"
+            } else {
+                "pick"
+            };
+            println!("  {names} {reads} this up within a second — nothing to restart");
+        }
     }
     Ok(())
 }
@@ -433,6 +644,95 @@ fn layout_items(model: &Model) -> Vec<Item> {
     items
 }
 
+/// The value the list draws for a row — and so the one an edit should start from. An optional
+/// key left unset shows what it *resolves* to, `0.9 (auto)`; opening the editor on the literal
+/// word `unset` instead meant erasing it before every edit.
+fn shown_value(row: &Row) -> &str {
+    match &row.resolved {
+        Some(resolved) if !row.differs() => resolved,
+        _ => row.effective(),
+    }
+}
+
+/// Everything the list shows for one key, joined so a query can hit any of it: section, name,
+/// the value as drawn, the default, and the one-line doc.
+fn searchable(row: &Row) -> String {
+    let (section, name) = row.entry.key.split_once('.').expect("section.key");
+    format!(
+        "{section} {name} {} {} {}",
+        shown_value(row),
+        row.default,
+        row.entry.doc
+    )
+}
+
+/// Item indices of every key matching `query`, best first. Ties keep list order, so a query
+/// that fits several keys equally walks them top to bottom.
+fn search(items: &[Item], rows: &[Row], query: &str) -> Vec<usize> {
+    let mut hits: Vec<(i32, usize)> = items
+        .iter()
+        .enumerate()
+        .filter_map(|(at, item)| match item {
+            Item::Key(index) => Some((row_score(&rows[*index], query)?, at)),
+            Item::Header(_) => None,
+        })
+        .collect();
+    hits.sort_by(|a, b| b.0.cmp(&a.0).then(a.1.cmp(&b.1)));
+    hits.into_iter().map(|(_, at)| at).collect()
+}
+
+/// How well one row answers `query`, or `None`. Every whitespace-separated word must hit; a
+/// word hits when it is *typed into* the key name (subsequence, `actsc` → `action_scale`), or
+/// appears verbatim anywhere else the row shows — section, value, default, doc. Only the name
+/// gets the fuzzy treatment: letters in order across a sentence of doc match nearly every row,
+/// which is what made `tof` land on `theremin.enabled` with forty hits behind it.
+fn row_score(row: &Row, query: &str) -> Option<i32> {
+    let name = row.entry.key.split_once('.').expect("section.key").1;
+    let text = searchable(row).to_lowercase();
+    let mut total = 0;
+    for word in query.split_whitespace() {
+        let lower = word.to_lowercase();
+        total += if let Some(at) = name.to_lowercase().find(&lower) {
+            let word_start = at == 0 || !name.as_bytes()[at - 1].is_ascii_alphanumeric();
+            300 + if word_start { 20 } else { 0 } - at as i32
+        } else if let Some(score) = fuzzy_score(word, name) {
+            100 + score
+        } else {
+            let at = text.find(&lower)?;
+            50 - (at / 10) as i32
+        };
+    }
+    Some(total)
+}
+
+/// Case-insensitive subsequence match, scored: `None` if the letters of `needle` do not occur
+/// in order in `hay`; otherwise higher is better — runs of adjacent matches and matches at word
+/// starts (`_`, space, `.`) score well, gaps cost a little. Only ever run over a key name, which
+/// is short enough for a subsequence to mean something.
+fn fuzzy_score(needle: &str, hay: &str) -> Option<i32> {
+    let needle: Vec<char> = needle.chars().flat_map(char::to_lowercase).collect();
+    let hay: Vec<char> = hay.chars().flat_map(char::to_lowercase).collect();
+    if needle.is_empty() {
+        return Some(0);
+    }
+    let mut score = 0i32;
+    let mut at = 0usize;
+    let mut previous: Option<usize> = None;
+    for &c in &needle {
+        let found = hay[at..].iter().position(|&h| h == c)? + at;
+        let word_start = found == 0 || !hay[found - 1].is_alphanumeric();
+        score += match previous {
+            Some(p) if found == p + 1 => 10,
+            _ if word_start => 8,
+            Some(p) => 2 - ((found - p - 1).min(10) as i32),
+            None => 2,
+        };
+        previous = Some(found);
+        at = found + 1;
+    }
+    Some(score)
+}
+
 /// Move the cursor to the next key in `direction`, skipping headers, stopping at the ends.
 fn step(items: &[Item], cursor: usize, direction: isize) -> usize {
     let mut at = cursor as isize;
@@ -557,16 +857,38 @@ fn draw(
                 Line::from("y save · n discard · ESC back"),
             ]
         }
-        // Which daemons, by name: `[media]` is read by `mediad`, and "restart it" over a
-        // change that needs the *other* daemon is how an edit reads as having done nothing.
-        Focus::Restart { units } => {
-            let names = units.join(" and ");
-            let reads = if units.len() == 1 { "reads" } else { "read" };
+        // Which daemons, by name, and what they actually need: `[media]` is read by `mediad`,
+        // and "restart it" over a change that needs the *other* daemon is how an edit reads as
+        // having done nothing. A reload is offered where one exists, because it keeps the motors
+        // powered — it can still ramp a walking robot home, which is why it says so.
+        Focus::Apply { plan } => {
+            let mut what: Vec<String> = Vec::new();
+            if !plan.restart.is_empty() {
+                what.push(format!("restart {}", plan.restart.join(" and ")));
+            }
+            if !plan.reload.is_empty() {
+                what.push(format!("reload {}", plan.reload.join(" and ")));
+            }
+            let reason = if plan.restart.is_empty() {
+                "re-reads [policy] without dropping the motors — a walking robot ramps home first"
+            } else if plan.reload.is_empty() {
+                "reads the config once at startup"
+            } else {
+                "reads some of this at startup and the rest on a call"
+            };
+            vec![
+                Line::from(format!("written. {reason} —")),
+                Line::from(format!("{} now? y do it · n later", what.join(", then "))),
+            ]
+        }
+        Focus::Search { .. } => {
+            let doc = match items.get(cursor) {
+                Some(Item::Key(index)) => rows[*index].entry.doc,
+                _ => "",
+            };
             vec![
-                Line::from(format!(
-                    "written. {names} {reads} the config once at startup —"
-                )),
-                Line::from(format!("restart {names} now? y restart · n later")),
+                Line::from(doc),
+                Line::from("type to search · ↑↓ next/prev hit · ENTER/ESC done"),
             ]
         }
         Focus::List => {
@@ -579,7 +901,7 @@ fn draw(
                     Some(s) => Span::styled(s.to_owned(), Style::new().red()),
                     None => Span::raw(doc),
                 }),
-                Line::from("↑↓ move · SPACE toggle · ENTER edit · u default · q quit"),
+                Line::from("↑↓ move · SPACE toggle · ENTER edit · u default · ^f search · q quit"),
             ]
         }
     };
@@ -587,6 +909,44 @@ fn draw(
         Paragraph::new(footer).block(Block::default().borders(Borders::ALL)),
         footer_area,
     );
+
+    // The search popup: a small box floated over the list, the list still visible around it so
+    // the selection can be watched moving as the query grows.
+    if let Focus::Search { query, hit, .. } = focus {
+        let hits = if query.is_empty() {
+            0
+        } else {
+            search(items, rows, query).len()
+        };
+        let title = if query.is_empty() {
+            " search ".to_owned()
+        } else if hits == 0 {
+            " search · no match ".to_owned()
+        } else {
+            format!(" search · {}/{hits} ", (*hit).min(hits - 1) + 1)
+        };
+        let width = 60.min(list_area.width.saturating_sub(4)).max(20);
+        let popup = Rect {
+            x: list_area.x + (list_area.width.saturating_sub(width)) / 2,
+            y: list_area.y + 2,
+            width,
+            height: 3,
+        };
+        frame.render_widget(Clear, popup);
+        frame.render_widget(
+            Paragraph::new(Line::from(format!("{query}▏"))).block(
+                Block::default()
+                    .borders(Borders::ALL)
+                    .title(title)
+                    .border_style(if hits == 0 && !query.is_empty() {
+                        Style::new().red()
+                    } else {
+                        Style::new().cyan()
+                    }),
+            ),
+            popup,
+        );
+    }
 }
 
 #[cfg(test)]
@@ -627,6 +987,86 @@ mod tests {
 
     use super::*;
 
+    /// ctrl+f: letters typed into a name find it, verbatim text finds it anywhere on the row,
+    /// and letters merely scattered through a doc sentence find nothing — `tof` used to land
+    /// on `theremin.enabled` with forty hits behind it.
+    #[test]
+    fn the_search_ranks_the_key_you_meant_first_and_ignores_scattered_letters() {
+        assert!(fuzzy_score("gain", "gain").unwrap() > fuzzy_score("gain", "gait_in_a").unwrap());
+        assert!(fuzzy_score("gan", "gain").is_some());
+        assert_eq!(fuzzy_score("gainz", "gain"), None);
+        assert!(
+            fuzzy_score("LOW", "head_lowpass").is_some(),
+            "case-insensitive"
+        );
+
+        let m = model("");
+        let rows = m.rows();
+        let items = layout_items(&m);
+        let name_of = |at: usize| match items[at] {
+            Item::Key(index) => rows[index].entry.key,
+            Item::Header(_) => unreachable!("headers are never hits"),
+        };
+        let hits = search(&items, &rows, "nominal_volt");
+        assert_eq!(name_of(hits[0]), "policy.nominal_voltage");
+        let hits = search(&items, &rows, "deadman");
+        assert_eq!(name_of(hits[0]), "safety.deadman_ms");
+        // Typed into the name, not spelled out.
+        let hits = search(&items, &rows, "actsc");
+        assert_eq!(name_of(hits[0]), "policy.action_scale");
+        // Section names are part of the text shown, so they match too.
+        let hits = search(&items, &rows, "safety");
+        assert!(name_of(hits[0]).starts_with("safety."));
+        assert!(search(&items, &rows, "zzzzqqq").is_empty());
+
+        // Every `tof` hit has the three letters together somewhere on the row, or typed into
+        // its name — never spread across the doc.
+        let hits = search(&items, &rows, "tof");
+        assert!(!hits.is_empty());
+        for at in hits {
+            let Item::Key(index) = items[at] else {
+                unreachable!()
+            };
+            let row = &rows[index];
+            let name = row.entry.key.split_once('.').unwrap().1;
+            assert!(
+                searchable(row).to_lowercase().contains("tof")
+                    || fuzzy_score("tof", name).is_some(),
+                "{} matched tof without containing it",
+                row.entry.key
+            );
+        }
+        // The doc of `theremin.enabled` says "ToF theremin" — a fair hit, but a doc hit, so
+        // the rows *about* the sensor come first.
+        let hits = search(&items, &rows, "tof");
+        assert_ne!(name_of(hits[0]), "theremin.enabled");
+        assert!(hits.len() < 15, "{} rows hit tof", hits.len());
+        // Several words all have to hit.
+        assert!(
+            search(&items, &rows, "safety limp")
+                .iter()
+                .all(|&at| name_of(at).contains("limp"))
+        );
+    }
+
+    /// An `(auto)` row opens the editor on the value it resolves to, not on the word `unset`.
+    #[test]
+    fn editing_an_auto_key_starts_from_its_resolved_value() {
+        let m = model("");
+        let rows = m.rows();
+        let bitrate = rows
+            .iter()
+            .find(|r| r.entry.key == "media.bitrate")
+            .unwrap();
+        assert_eq!(bitrate.effective(), "unset");
+        assert_eq!(shown_value(bitrate), bitrate.resolved.as_deref().unwrap());
+        let set = rows
+            .iter()
+            .find(|r| r.entry.key == "safety.deadman_ms")
+            .unwrap();
+        assert_eq!(shown_value(set), set.effective());
+    }
+
     fn model(text: &str) -> Model {
         Model::from_text(Path::new("/test/robotd.toml"), text).expect("parses")
     }
@@ -642,21 +1082,196 @@ mod tests {
     fn the_restart_offer_names_the_daemon_that_reads_the_change() {
         let mut m = model("");
         m.edit(entry("media.quality"), "360p30").expect("valid");
-        assert_eq!(units_for(&m), vec!["mediad"]);
+        assert_eq!(plan_for(&m).restart, vec!["mediad"]);
 
         let mut m = model("");
         m.edit(entry("control.hz"), "60").expect("valid");
-        assert_eq!(units_for(&m), vec!["robotd"]);
+        assert_eq!(plan_for(&m).restart, vec!["robotd"]);
 
         // Both, and robotd first: mediad.service is After=robotd.service, so the other order
         // reconnects mediad to a robotd that is about to go away.
         let mut m = model("");
-        m.edit(entry("media.camera"), "false").expect("valid");
+        m.edit(entry("media.source"), "test").expect("valid");
         m.edit(entry("audio.enabled"), "false").expect("valid");
-        assert_eq!(units_for(&m), vec!["robotd", "mediad"]);
+        assert_eq!(plan_for(&m).restart, vec!["robotd", "mediad"]);
+
+        // Nothing pending is nothing to ask about, and the caller must not offer anything.
+        assert!(plan_for(&model("")).is_quiet());
+        assert!(plan_for(&model("")).live.is_empty());
+    }
 
-        // Nothing pending is nothing to restart, and the caller must not offer one.
-        assert!(units_for(&model("")).is_empty());
+    /// `[head_imu]` is `tofd`'s, and it read as `robotd`'s on the board.
+    ///
+    /// Turning the head IMU on through this editor restarted `robotd` — which never looks at the
+    /// key — and left `tofd` running on the value it loaded at boot. The switch was on in the
+    /// file, off in the daemon, and the only sign was a startup line nobody re-reads. Regression
+    /// test rather than an assertion folded into the case above, because the two IMU sections are
+    /// a name apart (and now less so): `pad_imu_head_control` is the controller's, and `padd` re-reads it by itself.
+    #[test]
+    fn the_head_imu_switch_restarts_tofd_and_not_robotd() {
+        let mut m = model("");
+        m.edit(entry("head_imu.enabled"), "true").expect("valid");
+        let plan = plan_for(&m);
+        assert_eq!(plan.restart, vec!["tofd"]);
+        assert!(plan.live.is_empty());
+
+        let mut m = model("");
+        m.edit(entry("pad_imu_head_control.enabled"), "true")
+            .expect("valid");
+        let plan = plan_for(&m);
+        assert_eq!(
+            plan.live,
+            vec!["padd"],
+            "the controller's IMU is padd's, and padd re-reads it"
+        );
+        assert!(plan.restart.is_empty(), "and it needs no restart");
+    }
+
+    /// `[pad]` and `[pad_imu_head_control]` are live: padd re-reads them, so there is nothing to offer.
+    ///
+    /// The inverse of the `[head_imu]` bug and the same mistake — a mapping that does not
+    /// describe the daemon. `padd` stats the file every second and re-reads both sections when
+    /// the mtime moves, which is why `robotctl pad bind` prints "padd picks this up within a
+    /// second" rather than offering anything. Restarting it to apply what applies by itself
+    /// takes the pad session down, and robotd's deadman then zeroes the velocity of whatever was
+    /// walking — a real cost, paid for nothing.
+    #[test]
+    fn the_pad_sections_need_no_restart_at_all() {
+        for key in [
+            "pad.a",
+            "pad.dpad_down",
+            "pad_imu_head_control.enabled",
+            "pad_imu_head_control.gain",
+        ] {
+            let mut m = model("");
+            let value = match key {
+                "pad_imu_head_control.enabled" => "true",
+                "pad_imu_head_control.gain" => "0.5",
+                _ => "walk",
+            };
+            m.edit(entry(key), value).expect("valid");
+            let plan = plan_for(&m);
+            assert!(plan.is_quiet(), "{key} must not ask for anything: {plan:?}");
+            assert_eq!(plan.live, vec!["padd"], "{key}");
+        }
+
+        // Paired with a restart it stays quiet about padd and loud about the other one: the
+        // offer is for the daemon that needs it, and padd is neither restarted nor mentioned in
+        // it.
+        let mut m = model("");
+        m.edit(entry("pad.a"), "walk").expect("valid");
+        m.edit(entry("safety.deadman_ms"), "800").expect("valid");
+        let plan = plan_for(&m);
+        assert_eq!(plan.restart, vec!["robotd"]);
+        assert_eq!(plan.live, vec!["padd"]);
+    }
+
+    /// `[policy]` reloads instead of restarting — except the two keys a reload does not carry.
+    ///
+    /// `PolicyChange::Reload` re-reads that section whole and rebuilds the controller from it,
+    /// which is how `robotctl policy add` lands a skill on a running robot. Restarting robotd
+    /// for `action_scale` takes motor control away from a standing robot to change a number it
+    /// would have taken standing up. `mode` is deliberately kept across a reload and `enabled`
+    /// is read once at startup — with the reload call *refused* while it is false, so off to on
+    /// cannot be one.
+    #[test]
+    fn the_policy_section_reloads_but_its_two_startup_keys_do_not() {
+        let mut m = model("");
+        m.edit(entry("policy.action_scale"), "0.4").expect("valid");
+        let plan = plan_for(&m);
+        assert_eq!(plan.reload, vec!["robotd"]);
+        assert!(plan.restart.is_empty(), "the motors stay powered");
+
+        let mut m = model("");
+        m.edit(entry("policy.enabled"), "true").expect("valid");
+        assert_eq!(
+            plan_for(&m).restart,
+            vec!["robotd"],
+            "a reload is refused while policies are off"
+        );
+
+        let mut m = model("");
+        m.edit(entry("policy.mode"), "roller").expect("valid");
+        assert_eq!(
+            plan_for(&m).restart,
+            vec!["robotd"],
+            "a reload keeps the running mode, so the file's would be ignored"
+        );
+
+        // One section, both answers, and the restart absorbs the reload. "restart robotd, then
+        // reload robotd" would ramp a walking robot home a second time to apply what coming back
+        // up already applied.
+        let mut m = model("");
+        m.edit(entry("policy.mode"), "roller").expect("valid");
+        m.edit(entry("policy.gain"), "300").expect("valid");
+        let plan = plan_for(&m);
+        assert_eq!(plan.restart, vec!["robotd"]);
+        assert!(plan.reload.is_empty(), "the restart is the reload");
+    }
+
+    /// Every key in the registry says how it applies.
+    ///
+    /// What went wrong with `[head_imu]` was not a wrong answer, it was a default one: a
+    /// catch-all arm answered `robotd` for a section nobody had mapped, so adding a section was
+    /// enough to ship a restart offer that restarts the wrong daemon. There is no catch-all now,
+    /// and this fails for the next key added without an arm — at `cargo test`, not on a board,
+    /// and not as a switch that silently does nothing.
+    #[test]
+    fn every_registry_key_says_how_it_applies() {
+        let unmapped: Vec<&str> = robotd_params::registry::REGISTRY
+            .iter()
+            .map(|e| e.key)
+            .filter(|key| apply_for(key).is_none())
+            .collect();
+        assert!(
+            unmapped.is_empty(),
+            "nothing says how {unmapped:?} applies — add an arm to `apply_for`"
+        );
+    }
+
+    /// The offer says which daemon and which of the three answers, in words.
+    ///
+    /// The screen is the whole user interface to this mapping: an operator who reads "restart
+    /// robotd" over a `[media]` change learns the wrong thing about their robot, and one who is
+    /// asked to restart `padd` for a binding pays for nothing. Rendered rather than asserted on
+    /// the `Plan`, because what went wrong on the board was what the screen *said*.
+    #[test]
+    fn the_offer_says_which_daemon_and_what_it_needs() {
+        let screen_for = |focus: &Focus| {
+            let m = model("");
+            let rows = m.rows();
+            let items = layout_items(&m);
+            let mut terminal = ratatui::Terminal::new(ratatui::backend::TestBackend::new(100, 24))
+                .expect("terminal");
+            terminal
+                .draw(|frame| draw(frame, &m, &rows, &items, 1, focus, None))
+                .expect("draws");
+            format!("{:?}", terminal.backend().buffer())
+        };
+
+        let restart = screen_for(&Focus::Apply {
+            plan: plan_for_keys(["head_imu.enabled"].into_iter()),
+        });
+        assert!(restart.contains("restart tofd"), "{restart}");
+        assert!(restart.contains("once at startup"), "{restart}");
+
+        // A reload names itself as one, and says the thing an operator standing over the robot
+        // wants to know: the motors stay powered, and a walking robot ramps home first.
+        let reload = screen_for(&Focus::Apply {
+            plan: plan_for_keys(["policy.gain"].into_iter()),
+        });
+        assert!(reload.contains("reload robotd"), "{reload}");
+        assert!(!reload.contains("restart"), "{reload}");
+        assert!(reload.contains("ramps home"), "{reload}");
+
+        // Both, in the order they are done.
+        let both = screen_for(&Focus::Apply {
+            plan: plan_for_keys(["media.quality", "policy.gain"].into_iter()),
+        });
+        assert!(
+            both.contains("restart mediad, then reload robotd"),
+            "{both}"
+        );
     }
 
     /// The whole first screen renders without panicking, features first — the same
@@ -726,16 +1341,16 @@ mod tests {
         );
     }
 
-    /// A `[detect]` change restarts `mediad`, not `robotd`.
+    /// A `[duck_detector]` change restarts `mediad`, not `robotd`.
     ///
     /// `robotd` owned every key in this file for long enough that the restart was hardcoded, and
-    /// `[detect]` is read by `mediad` because the camera frames are on its tee. Restarting the
+    /// `[duck_detector]` is read by `mediad` because the camera frames are on its tee. Restarting the
     /// A save records what it wrote, because that is what decides the restart.
     ///
     /// The bug this pins: `save` clears `pending`, and the restart decision is made after the
-    /// editor closes — so reading `pending` there found an empty map, `units_to_restart` returned
-    /// nothing, and turning the detector off looked like it had no effect at all. Twice, on a
-    /// robot, before anybody suspected the editor rather than the daemon.
+    /// editor closes — so reading `pending` there found an empty map, the plan came back empty,
+    /// and turning the detector off looked like it had no effect at all. Twice, on a robot,
+    /// before anybody suspected the editor rather than the daemon.
     #[test]
     fn a_save_remembers_what_it_wrote_so_the_right_daemon_restarts() {
         let dir = tempfile::tempdir().unwrap();
@@ -744,40 +1359,47 @@ mod tests {
         let mut m = Model::load(&path).expect("loads");
 
         assert!(m.written().is_empty(), "nothing written yet");
-        m.edit(entry("detect.enabled"), "true").expect("edits");
+        m.edit(entry("duck_detector.enabled"), "true")
+            .expect("edits");
         assert!(!m.pending.is_empty());
         m.save().expect("saves");
 
         assert!(m.pending.is_empty(), "a save clears what is pending");
-        assert_eq!(m.written(), ["detect.enabled".to_owned()]);
-        assert_eq!(units_to_restart(m.written()), vec!["mediad"]);
+        assert_eq!(m.written(), ["duck_detector.enabled".to_owned()]);
+        assert_eq!(plan_for_written(m.written()).restart, vec!["mediad"]);
 
         // A second save adds to the record rather than replacing it: somebody who changes the
         // detector and then the gait wants both daemons restarted.
         m.edit(entry("policy.mode"), "roller").expect("edits");
         m.save().expect("saves");
-        assert_eq!(units_to_restart(m.written()), vec!["robotd", "mediad"]);
+        assert_eq!(
+            plan_for_written(m.written()).restart,
+            vec!["robotd", "mediad"]
+        );
     }
 
     /// wrong daemon is how somebody edits a value three times and swears it does nothing.
     #[test]
     fn the_section_decides_which_daemon_restarts() {
-        let detect = vec!["detect.enabled".to_owned()];
-        assert_eq!(units_to_restart(&detect), vec!["mediad"]);
+        let detect = vec!["duck_detector.enabled".to_owned()];
+        assert_eq!(plan_for_written(&detect).restart, vec!["mediad"]);
 
         let policy = vec!["policy.mode".to_owned()];
-        assert_eq!(units_to_restart(&policy), vec!["robotd"]);
+        assert_eq!(plan_for_written(&policy).restart, vec!["robotd"]);
 
         // Both, in the order they are least disruptive to restart: the control loop first, then the
         // camera — a robot that is standing up should not be waiting on a WebRTC teardown.
-        let both = vec!["detect.hz".to_owned(), "audio.enabled".to_owned()];
-        assert_eq!(units_to_restart(&both), vec!["robotd", "mediad"]);
+        let both = vec!["duck_detector.hz".to_owned(), "audio.enabled".to_owned()];
+        assert_eq!(plan_for_written(&both).restart, vec!["robotd", "mediad"]);
 
-        // A button change restarts the daemon that reads it. Offering `robotd` here would drop
-        // motor control — a standing robot on the floor — to apply a setting it never sees.
+        // A button change restarts nothing: `padd` reads it back off the file by itself, and
+        // offering `robotd` here would drop motor control — a standing robot on the floor — to
+        // apply a setting it never sees.
         let pad = vec!["pad.x".to_owned()];
-        assert_eq!(units_to_restart(&pad), vec!["padd"]);
+        let plan = plan_for_written(&pad);
+        assert!(plan.is_quiet());
+        assert_eq!(plan.live, vec!["padd"]);
 
-        assert!(units_to_restart(&[]).is_empty());
+        assert_eq!(plan_for_written(&[]), Plan::default());
     }
 }
diff --git a/robotctl/src/frame.rs b/robotctl/src/frame.rs
new file mode 100644
index 00000000..9b154553
--- /dev/null
+++ b/robotctl/src/frame.rs
@@ -0,0 +1,157 @@
+//! Local binary snapshots deliberately bypass the JSON-only service router.
+use super::{Client, Failure, exit, proto};
+use std::io::{BufRead, Read};
+use std::path::Path;
+use std::time::Duration;
+
+pub(super) fn run(socket: &Path, output: &Path) -> Result<(), Failure> {
+    let mut client = Client::connect_to("mediad", socket)?;
+    let timeout = Some(Duration::from_secs(3));
+    client
+        .reader
+        .get_ref()
+        .set_read_timeout(timeout)
+        .map_err(failed)?;
+    client.writer.set_write_timeout(timeout).map_err(failed)?;
+    client.hello()?;
+    let id = proto::Id::Number(client.next_id);
+    client.send(&proto::Request {
+        jsonrpc: "2.0".into(),
+        id: Some(id.clone()),
+        method: proto::method::MEDIA_FRAME.into(),
+        params: None,
+    })?;
+    let (header, bytes) = read_frame(&mut client.reader, id).map_err(failed)?;
+    // Never leave a success-looking file behind after an incomplete camera reply.
+    std::fs::write(output, bytes).map_err(failed)?;
+    eprintln!("{}", serde_json::to_string(&header).map_err(failed)?);
+    Ok(())
+}
+
+fn failed(error: impl std::fmt::Display) -> Failure {
+    Failure::new(exit::FAILED, format!("camera snapshot: {error}"))
+}
+
+fn read_frame(
+    reader: &mut impl BufRead,
+    id: proto::Id,
+) -> Result<(proto::MediaFrameHeader, Vec<u8>), Box<dyn std::error::Error>> {
+    let mut line = Vec::new();
+    reader.by_ref().take(4097).read_until(b'\n', &mut line)?;
+    if line.len() > 4096 || !line.ends_with(b"\n") {
+        return Err("invalid snapshot header length".into());
+    }
+    let response: proto::Response = serde_json::from_slice(&line)?;
+    if response.id != Some(id) || response.jsonrpc != "2.0" {
+        return Err("snapshot response does not match request".into());
+    }
+    if let Some(error) = response.error {
+        return Err(format!("{}: {}", error.code, error.message).into());
+    }
+    let header: proto::MediaFrameHeader =
+        serde_json::from_value(response.result.ok_or("missing snapshot result")?)?;
+    if !header.valid_uyvy() {
+        return Err("invalid UYVY geometry or size".into());
+    }
+    let mut bytes = vec![0; header.bytes];
+    // Reuse the header reader: it may already have buffered the beginning of the binary tail.
+    reader.read_exact(&mut bytes)?;
+    Ok((header, bytes))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::{BufReader, Cursor};
+    fn reply(bytes: usize, tail: &[u8]) -> Vec<u8> {
+        let header = proto::MediaFrameHeader {
+            width: 2,
+            height: 1,
+            format: "UYVY".into(),
+            bytes,
+            captured_at_unix_us: 1,
+            rotate: 90,
+        };
+        let mut wire =
+            serde_json::to_vec(&proto::Response::ok(Some(proto::Id::Number(2)), &header)).unwrap();
+        wire.push(b'\n');
+        wire.extend(tail);
+        wire
+    }
+    #[test]
+    fn command_handshakes_and_only_saves_complete_frames() {
+        use std::io::Write;
+        use std::os::unix::net::UnixListener;
+        for complete in [true, false] {
+            let dir = tempfile::tempdir().unwrap();
+            let socket = dir.path().join("media.sock");
+            let output = dir.path().join("frame.uyvy");
+            let listener = UnixListener::bind(&socket).unwrap();
+            let server = std::thread::spawn(move || {
+                let (mut stream, _) = listener.accept().unwrap();
+                let mut reader = BufReader::new(stream.try_clone().unwrap());
+                let mut line = String::new();
+                reader.read_line(&mut line).unwrap();
+                let hello: proto::Request = serde_json::from_str(&line).unwrap();
+                assert_eq!(hello.method, proto::method::HELLO);
+                let hello = proto::Response::ok(
+                    hello.id,
+                    &proto::HelloResult {
+                        api_version: proto::API_VERSION,
+                        daemon_version: None,
+                        revision: None,
+                    },
+                );
+                writeln!(stream, "{}", serde_json::to_string(&hello).unwrap()).unwrap();
+                line.clear();
+                reader.read_line(&mut line).unwrap();
+                let frame: proto::Request = serde_json::from_str(&line).unwrap();
+                assert_eq!(frame.method, proto::method::MEDIA_FRAME);
+                assert_eq!(frame.id, Some(proto::Id::Number(2)));
+                stream
+                    .write_all(&reply(
+                        4,
+                        if complete {
+                            &[128, 16, 128, 235]
+                        } else {
+                            &[128]
+                        },
+                    ))
+                    .unwrap();
+            });
+            let result = run(&socket, &output);
+            server.join().unwrap();
+            assert_eq!(result.is_ok(), complete);
+            assert_eq!(output.exists(), complete);
+            if complete {
+                assert_eq!(std::fs::read(output).unwrap(), [128, 16, 128, 235]);
+            }
+        }
+    }
+
+    #[test]
+    fn coalesced_header_and_binary_are_preserved() {
+        let mut reader = BufReader::new(Cursor::new(reply(4, &[128, 16, 128, 235])));
+        assert_eq!(
+            read_frame(&mut reader, proto::Id::Number(2)).unwrap().1,
+            [128, 16, 128, 235]
+        );
+    }
+    #[test]
+    fn truncated_mismatched_and_oversized_replies_fail() {
+        for (wire, id) in [
+            (reply(4, &[1]), 2),
+            (reply(4, &[1; 4]), 3),
+            (reply(usize::MAX, &[]), 2),
+            (vec![b'x'; 4097], 2),
+        ] {
+            assert!(
+                read_frame(
+                    &mut BufReader::new(Cursor::new(wire)),
+                    proto::Id::Number(id)
+                )
+                .is_err()
+            );
+        }
+    }
+}
diff --git a/robotctl/src/imu_view.rs b/robotctl/src/imu_view.rs
new file mode 100644
index 00000000..4c5aed7a
--- /dev/null
+++ b/robotctl/src/imu_view.rs
@@ -0,0 +1,297 @@
+//! The pad's IMU, drawn: a wireframe pad posed like the real one.
+//!
+//! The attitude comes from the `pad-imu` crate — the same filter `padd` poses the head with — and
+//! this module only draws it. A dozen line segments rasterised into half-block pixels, redrawn at
+//! the monitor's own pace rather than the IMU's: six hundred samples a second is a rate for a
+//! filter, not for a terminal. The wireframe puts a marker on the front edge so a wrong guess
+//! about the body frame is visible the first time the pad tilts.
+
+use pad_imu::Imu;
+use ratatui::buffer::Buffer;
+use ratatui::layout::Rect;
+use ratatui::style::Color;
+
+/// Camera yaw, radians: a three-quarter view, so both the front edge and a grip are visible.
+const CAMERA_AZIMUTH: f32 = -0.55;
+/// Camera elevation above the pad's plane, radians.
+const CAMERA_ELEVATION: f32 = 0.55;
+
+/// Draw the pad's attitude into `area`, two pixels per cell.
+///
+/// A wireframe of a pad — a flat slab, two grips toward the player, the two sticks, a marker on
+/// the front edge — posed by the orientation and seen from a fixed three-quarter camera. Cheap on
+/// purpose: a dozen segments, no depth sorting. The eye resolves a wireframe pad without it.
+pub fn draw(imu: &Imu, area: Rect, buf: &mut Buffer) {
+    let (w, h) = (usize::from(area.width), usize::from(area.height) * 2);
+    if w < 6 || h < 6 {
+        return;
+    }
+    let mut canvas = Canvas::new(w, h);
+    let rotation = pad_imu::matrix(imu.quaternion().unwrap_or([1.0, 0.0, 0.0, 0.0]));
+
+    // World → screen: yaw the camera for a three-quarter view, then look down at it. The result
+    // is in body millimetres until it is scaled below.
+    let (az_sin, az_cos) = CAMERA_AZIMUTH.sin_cos();
+    let (el_sin, el_cos) = CAMERA_ELEVATION.sin_cos();
+    let project = |p: [f32; 3]| -> (f32, f32) {
+        let world = rotate_matrix(rotation, p);
+        let x = world[0] * az_cos - world[1] * az_sin;
+        let y = world[0] * az_sin + world[1] * az_cos;
+        let up = world[2] * el_cos + y * el_sin;
+        (x, -up)
+    };
+
+    // One zoom for every attitude: the pad's bounding sphere is what has to fit, so a pad on its
+    // edge and a pad lying flat are drawn at the same scale and tilting reads as tilting, not as
+    // the picture breathing. The body origin sits at the canvas centre. Framed at 80% of the
+    // sphere rather than all of it: only a grip tip pointing straight at the camera's edge ever
+    // reaches the last 20%, and framing for that moment shrinks every other one.
+    let radius = PAD_WIREFRAME
+        .iter()
+        .flat_map(|s| [s.from, s.to])
+        .map(pad_imu::norm)
+        .fold(1.0f32, f32::max)
+        * 0.8;
+    let scale = ((w as f32 - 2.0) / (2.0 * radius)).min((h as f32 - 2.0) / (2.0 * radius));
+    let (cx, cy) = (w as f32 / 2.0, h as f32 / 2.0);
+    let place = |p: (f32, f32)| (p.0 * scale + cx, p.1 * scale + cy);
+
+    for segment in PAD_WIREFRAME {
+        canvas.line(
+            place(project(segment.from)),
+            place(project(segment.to)),
+            segment.colour(),
+        );
+    }
+    canvas.blit(area, buf);
+}
+
+/// One segment of the drawn pad, in the body frame: millimetres, +X front, +Y left, +Z up.
+struct Segment {
+    from: [f32; 3],
+    to: [f32; 3],
+    part: Part,
+}
+
+#[derive(Clone, Copy)]
+enum Part {
+    Body,
+    Grip,
+    Stick,
+    Front,
+}
+
+impl Segment {
+    const fn new(from: [f32; 3], to: [f32; 3], part: Part) -> Self {
+        Self { from, to, part }
+    }
+
+    fn colour(&self) -> Color {
+        match self.part {
+            Part::Body => Color::Cyan,
+            Part::Grip => Color::Rgb(0, 140, 160),
+            Part::Stick => Color::White,
+            Part::Front => Color::Yellow,
+        }
+    }
+}
+
+/// The pad, in as few lines as still read as a pad: the top face of a slab 50 mm deep by 150
+/// wide, its front edge given thickness, two grips reaching back toward the player, the two
+/// sticks standing proud, and a bar along the front edge so that "which way is it facing" never
+/// has to be inferred from the grips alone. Every line dropped from a fuller model — the bottom
+/// face, the grips' far edges — was one that turned the picture into hatching at terminal
+/// resolution without adding a degree of freedom the eye could read.
+const PAD_WIREFRAME: &[Segment] = &{
+    const B: Part = Part::Body;
+    const G: Part = Part::Grip;
+    const S: Part = Part::Stick;
+    const F: Part = Part::Front;
+    [
+        // Top face.
+        Segment::new([25.0, 75.0, 10.0], [25.0, -75.0, 10.0], B),
+        Segment::new([25.0, -75.0, 10.0], [-25.0, -75.0, 10.0], B),
+        Segment::new([-25.0, -75.0, 10.0], [-25.0, 75.0, 10.0], B),
+        Segment::new([-25.0, 75.0, 10.0], [25.0, 75.0, 10.0], B),
+        // Thickness, on the front edge only.
+        Segment::new([25.0, 75.0, 10.0], [25.0, 75.0, -10.0], B),
+        Segment::new([25.0, -75.0, 10.0], [25.0, -75.0, -10.0], B),
+        Segment::new([25.0, 75.0, -10.0], [25.0, -75.0, -10.0], B),
+        // Grips: the outer edge of each, back and down from the rear corners, closed at the end.
+        Segment::new([-25.0, 70.0, 10.0], [-70.0, 55.0, -20.0], G),
+        Segment::new([-25.0, 40.0, 10.0], [-70.0, 35.0, -20.0], G),
+        Segment::new([-70.0, 55.0, -20.0], [-70.0, 35.0, -20.0], G),
+        Segment::new([-25.0, -70.0, 10.0], [-70.0, -55.0, -20.0], G),
+        Segment::new([-25.0, -40.0, 10.0], [-70.0, -35.0, -20.0], G),
+        Segment::new([-70.0, -55.0, -20.0], [-70.0, -35.0, -20.0], G),
+        // Sticks: the Pro Controller's left stick sits forward-left, the right one back-right.
+        Segment::new([8.0, 45.0, 10.0], [8.0, 45.0, 26.0], S),
+        Segment::new([-10.0, -30.0, 10.0], [-10.0, -30.0, 26.0], S),
+        // Front bar, along the top of the front edge, with a nose at its middle.
+        Segment::new([25.0, 60.0, 14.0], [25.0, -60.0, 14.0], F),
+        Segment::new([25.0, 0.0, 14.0], [45.0, 0.0, 14.0], F),
+    ]
+};
+
+/// A half-block pixel canvas: one colour per pixel, two pixels per terminal row.
+struct Canvas {
+    w: usize,
+    h: usize,
+    pixels: Vec<Option<Color>>,
+}
+
+impl Canvas {
+    fn new(w: usize, h: usize) -> Self {
+        Self {
+            w,
+            h,
+            pixels: vec![None; w * h],
+        }
+    }
+
+    fn set(&mut self, x: i32, y: i32, colour: Color) {
+        if x < 0 || y < 0 {
+            return;
+        }
+        let (x, y) = (x as usize, y as usize);
+        if x < self.w && y < self.h {
+            self.pixels[y * self.w + x] = Some(colour);
+        }
+    }
+
+    /// Bresenham, on rounded endpoints. Clipped per pixel: a segment that leaves the canvas is
+    /// drawn as far as it goes rather than dropped.
+    fn line(&mut self, a: (f32, f32), b: (f32, f32), colour: Color) {
+        let (mut x0, mut y0) = (a.0.round() as i32, a.1.round() as i32);
+        let (x1, y1) = (b.0.round() as i32, b.1.round() as i32);
+        let dx = (x1 - x0).abs();
+        let dy = -(y1 - y0).abs();
+        let sx = if x0 < x1 { 1 } else { -1 };
+        let sy = if y0 < y1 { 1 } else { -1 };
+        let mut err = dx + dy;
+        loop {
+            self.set(x0, y0, colour);
+            if x0 == x1 && y0 == y1 {
+                break;
+            }
+            let e2 = 2 * err;
+            if e2 >= dy {
+                err += dy;
+                x0 += sx;
+            }
+            if e2 <= dx {
+                err += dx;
+                y0 += sy;
+            }
+        }
+    }
+
+    fn blit(&self, area: Rect, buf: &mut Buffer) {
+        for row in 0..usize::from(area.height) {
+            for col in 0..self.w {
+                let top = self.pixels[(row * 2) * self.w + col];
+                let bottom = self
+                    .pixels
+                    .get((row * 2 + 1) * self.w + col)
+                    .copied()
+                    .flatten();
+                let Some(cell) = buf.cell_mut((area.x + col as u16, area.y + row as u16)) else {
+                    continue;
+                };
+                match (top, bottom) {
+                    (Some(t), Some(b)) => {
+                        cell.set_symbol("▀").set_fg(t).set_bg(b);
+                    }
+                    (Some(t), None) => {
+                        cell.set_symbol("▀").set_fg(t);
+                    }
+                    (None, Some(b)) => {
+                        cell.set_symbol("▄").set_fg(b);
+                    }
+                    (None, None) => {}
+                }
+            }
+        }
+    }
+}
+
+fn rotate_matrix(m: [[f32; 3]; 3], v: [f32; 3]) -> [f32; 3] {
+    [
+        m[0][0] * v[0] + m[0][1] * v[1] + m[0][2] * v[2],
+        m[1][0] * v[0] + m[1][1] * v[1] + m[1][2] * v[2],
+        m[2][0] * v[0] + m[2][1] * v[1] + m[2][2] * v[2],
+    ]
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use duck_ipc_proto as proto;
+
+    fn an_imu(accel_g: [f32; 3]) -> Imu {
+        let mut imu = Imu::new(proto::PadImuDevice {
+            name: String::new(),
+            node: String::new(),
+            accel_per_g: 4096,
+            gyro_per_dps: 14247,
+            accel_max: 32767,
+            gyro_max: 32_767_000,
+        });
+        imu.absorb(&proto::PadImuBatch {
+            samples: vec![proto::PadImuSample {
+                seq: 1,
+                at_us: 1_000_000,
+                accel: [
+                    (accel_g[0] * 4096.0) as i32,
+                    (accel_g[1] * 4096.0) as i32,
+                    (accel_g[2] * 4096.0) as i32,
+                ],
+                gyro: [0; 3],
+            }],
+            socket_dropped: 0,
+        });
+        imu
+    }
+
+    fn picture(imu: &Imu, w: u16, h: u16) -> Vec<String> {
+        let area = Rect::new(0, 0, w, h);
+        let mut buf = Buffer::empty(area);
+        draw(imu, area, &mut buf);
+        (0..h)
+            .map(|y| (0..w).map(|x| buf[(x, y)].symbol()).collect())
+            .collect()
+    }
+
+    /// The wireframe lands on the canvas: something is drawn, and a level pad and a rolled pad
+    /// are different pictures.
+    #[test]
+    fn the_pad_is_drawn_and_moves_with_the_attitude() {
+        let flat = picture(&an_imu([0.0, 0.0, 1.0]), 40, 10);
+        let inked = flat
+            .iter()
+            .flat_map(|r| r.chars())
+            .filter(|c| *c != ' ')
+            .count();
+        assert!(inked > 30, "a wireframe is more than a few pixels: {inked}");
+        assert_ne!(flat, picture(&an_imu([0.0, 0.7, 0.7]), 40, 10));
+    }
+
+    /// Print the wireframe for a few attitudes. Not an assertion — a way to look at the picture
+    /// without a pad in hand: `cargo test -p robotctl imu_view -- --ignored --nocapture`.
+    #[test]
+    #[ignore = "visual probe, run manually with --ignored --nocapture"]
+    fn show_me_the_pad() {
+        for (name, accel) in [
+            ("flat", [0.0, 0.0, 1.0]),
+            ("nose up 30°", [-0.5, 0.0, 0.866]),
+            ("rolled left 45°", [0.0, -0.707, 0.707]),
+            ("on its front edge", [1.0, 0.0, 0.0]),
+        ] {
+            let imu = an_imu(accel);
+            println!("── {name} · euler {:?}", imu.euler_deg());
+            for row in picture(&imu, 44, 10) {
+                println!("│{row}│");
+            }
+        }
+    }
+}
diff --git a/robotctl/src/main.rs b/robotctl/src/main.rs
index 80867e25..29f9f568 100644
--- a/robotctl/src/main.rs
+++ b/robotctl/src/main.rs
@@ -42,6 +42,8 @@ use robotd_params::Slot;
 
 mod configure;
 mod duck;
+mod frame;
+mod imu_view;
 mod monitor;
 mod path_map;
 mod show;
@@ -106,6 +108,10 @@ struct Cli {
     #[arg(long, global = true, default_value = proto::socket::TOF)]
     tof_socket: PathBuf,
 
+    /// Local camera snapshot socket.
+    #[arg(long, global = true, default_value = proto::socket::MEDIA)]
+    media_socket: PathBuf,
+
     #[command(subcommand)]
     namespace: Namespace,
 }
@@ -114,6 +120,11 @@ struct Cli {
 /// `robotctl motors` later is additive rather than a restructure.
 #[derive(Subcommand, Debug)]
 enum Namespace {
+    /// Save one fresh raw UYVY frame; geometry is printed to stderr.
+    Frame {
+        #[arg(long, default_value = "frame.uyvy")]
+        output: PathBuf,
+    },
     /// Wifi. Served by `configd`, which drives NetworkManager.
     #[command(subcommand_required = true, arg_required_else_help = true)]
     Net {
@@ -265,6 +276,19 @@ enum Namespace {
         file: PathBuf,
     },
 
+    /// The duck detector — which model `mediad` looks for other ducks with.
+    ///
+    /// The model is trained in `pollen-robotics/duck_detector` and published on the Hub as
+    /// `pollen-robotics/microduck-duck-detector`; a robot installs it from there the way it
+    /// installs the official policy set, into `/opt/robot/detector/current`, so a retrain is a
+    /// tag rather than a daemon release. `[duck_detector]` in the config says whether the detector runs
+    /// at all (`robotctl configure`); this is about which model it runs.
+    #[command(subcommand_required = true, arg_required_else_help = true)]
+    DuckDetector {
+        #[command(subcommand)]
+        command: DuckDetectorCommand,
+    },
+
     /// Watch what the robot is doing, live.
     ///
     /// This is the one window into the control loop. It shows what a client asked for
@@ -421,6 +445,28 @@ enum RobotCommand {
         json: bool,
     },
 
+    /// Hand the robot to its policy, or take it back.
+    ///
+    /// **This is the gamepad's Start button**, and the difference from `init` is the whole point:
+    /// `init` powers the joints and position-ramps to the home pose with nothing balancing, while
+    /// this gives the robot to the policy, which then holds it up. A biped cannot stand by being
+    /// commanded to a pose — in simulation, where nobody is steadying it, `init` puts the robot on
+    /// the floor and `enable` stands it up from sitting.
+    ///
+    /// The console has had this button since it existed; the CLI did not, which is a gap nobody
+    /// noticed until a robot with no hands to hold it needed one.
+    Enable {
+        /// Take it back: the policy stops driving and the robot holds its pose.
+        #[arg(long)]
+        off: bool,
+        /// Flip whichever state it is in — what Start does, and what a client cannot get right by
+        /// remembering, because the robot's state moves without asking it.
+        #[arg(long, conflicts_with = "off")]
+        toggle: bool,
+        #[arg(long)]
+        json: bool,
+    },
+
     /// Cut power to the joints.
     ///
     /// **The robot collapses** if nothing is holding it. This is what you want before picking it up
@@ -436,6 +482,19 @@ enum RobotCommand {
         json: bool,
     },
 
+    /// Reboot servos: every one of them, or only the ids given.
+    ///
+    /// The way back from a servo in hardware error (overload, overheating) without pulling the
+    /// battery. Torque goes off on every joint first, so hold the robot or have it down; the
+    /// rebooted servos come back with torque off and their gains restored on the next write.
+    /// Then `robot init` or Start.
+    RebootMotors {
+        /// Servo ids, space separated. None means all.
+        ids: Vec<u8>,
+        #[arg(long)]
+        json: bool,
+    },
+
     /// Run a one-shot skill by name — `roulade`, `kick_left`, `ground_pick`, `sit_toggle`, or
     /// whatever else this robot has.
     ///
@@ -788,7 +847,8 @@ enum PadCommand {
     /// the Xbox button, then press the small **Sync** button on the top edge, next to the USB-C
     /// port, until the Xbox light flashes quickly. Do NOT hold the Xbox button itself — that
     /// switches the controller off. On a DualSense: hold Create and PS together until the light bar
-    /// flashes.
+    /// flashes. On a Pro Controller (the Switch-style pads): hold the small Sync button on the top
+    /// edge until the player lights sweep.
     ///
     /// Then run this. No MAC address needed: the robot looks for a gamepad in pairing mode and
     /// takes the one it finds.
@@ -859,6 +919,33 @@ enum AccountCommand {
     },
 }
 
+/// `robotctl duck-detector …`
+#[derive(Subcommand, Debug)]
+enum DuckDetectorCommand {
+    /// Is there a newer duck detector than the one installed?
+    ///
+    /// Asks the Hub what revisions the detector's own repo offers, against the one on the
+    /// board. Changes nothing, and an unreachable Hub is reported rather than treated as a
+    /// failure.
+    Check {
+        #[arg(long)]
+        json: bool,
+    },
+
+    /// Install a duck detector from the Hub and run it.
+    ///
+    /// The newest revision unless `--version` names one, which is also how to go back. `mediad`
+    /// is restarted onto it — the model is loaded once, at its start — which drops the console's
+    /// video for a moment; `[duck_detector] enabled` decides whether the detector then runs at all.
+    Update {
+        /// A revision in the detector repo — a tag like `v2`. Omit for the newest.
+        #[arg(long)]
+        version: Option<String>,
+        #[arg(long)]
+        json: bool,
+    },
+}
+
 /// `robotctl policy …`
 #[derive(Subcommand, Debug)]
 enum PolicyCommand {
@@ -2601,6 +2688,17 @@ fn run_robot(socket: &Path, command: RobotCommand) -> Result<(), Failure> {
     let (call, json) = match &command {
         RobotCommand::Init { json } => (proto::Call::RobotInit, *json),
         RobotCommand::Relax { json, .. } => (proto::Call::RobotRelax, *json),
+        RobotCommand::Enable { off, toggle, json } => (
+            proto::Call::RobotEnable(proto::EnableParams {
+                on: !*off,
+                toggle: *toggle,
+            }),
+            *json,
+        ),
+        RobotCommand::RebootMotors { ids, json } => (
+            proto::Call::RobotRebootMotors(proto::RebootMotorsParams { ids: ids.clone() }),
+            *json,
+        ),
         RobotCommand::Do { skill, json } => (
             proto::Call::RobotDo(proto::DoParams {
                 skill: skill.clone(),
@@ -2668,6 +2766,21 @@ fn run_robot(socket: &Path, command: RobotCommand) -> Result<(), Failure> {
     match command {
         RobotCommand::Init { .. } => println!("standing up — about two seconds to the home pose"),
         RobotCommand::Relax { .. } => println!("torque off"),
+        // The daemon's own `reason` names the state it ended in, which is the only trustworthy
+        // answer for a toggle — the client cannot know which way it went.
+        RobotCommand::Enable { .. } => println!(
+            "{}",
+            outcome
+                .reason
+                .as_deref()
+                .unwrap_or("the policy has the robot")
+        ),
+        RobotCommand::RebootMotors { ids, .. } if ids.is_empty() => {
+            println!("rebooting every servo, torque off — then `robot init` or Start")
+        }
+        RobotCommand::RebootMotors { ids, .. } => {
+            println!("rebooting servos {ids:?}, torque off — then `robot init` or Start")
+        }
         RobotCommand::Do { skill, .. } => println!("{skill:?} queued"),
         RobotCommand::Mode { .. } | RobotCommand::Look { .. } => unreachable!("answered above"),
     }
@@ -2974,9 +3087,11 @@ fn run_policy(
     // `check` and `update` are `updaterd`'s: they need a network stack, which this binary
     // deliberately does not link and `robotd` deliberately does not have.
     match &command {
-        PolicyCommand::Check { json } => return run_policy_check(updater_socket, *json),
+        PolicyCommand::Check { json } => {
+            return run_set_check(updater_socket, Set::Policies, *json);
+        }
         PolicyCommand::Update { version, json } => {
-            return run_policy_update(updater_socket, version.as_deref(), *json);
+            return run_set_update(updater_socket, Set::Policies, version.as_deref(), *json);
         }
         PolicyCommand::Search { query, json } => {
             return run_policy_search(updater_socket, query, *json);
@@ -3412,6 +3527,24 @@ fn skill_encoding_refusal(name: &str, encoding: Option<&str>) -> Option<String>
     }
 }
 
+/// Ask `robotd` to re-read `[policy]`, and say whether it took it.
+///
+/// `false` is a running daemon that declined — policies are off on this robot, which is the one
+/// thing in that section a reload cannot change — and an `Err` is one that could not be reached
+/// at all. Neither is a failure worth an exit code: the config is written either way, and the
+/// next start picks it up. Shared with `configure`, which offers this instead of a restart for
+/// the same keys.
+pub(crate) fn reload_policies(robot_socket: &Path) -> Result<bool, String> {
+    (|| -> Result<bool, Failure> {
+        let mut client = Client::connect_to("robotd", robot_socket)?;
+        client.hello()?;
+        let result: proto::IntentResult =
+            decode(&result_of(client.call(&proto::Call::RobotReloadPolicies)?)?)?;
+        Ok(result.accepted)
+    })()
+    .map_err(|e| e.message)
+}
+
 /// Tell `robotd` to re-read its skills, and say whether it did.
 ///
 /// A skill written into config is not one the robot has until the loop resolves it again, and
@@ -3419,14 +3552,7 @@ fn skill_encoding_refusal(name: &str, encoding: Option<&str>) -> Option<String>
 /// the whole point of the command is that trying one is cheap. An unreachable robot is not a
 /// failure here: the config is written either way, and the next start picks it up.
 fn report_reload(robot_socket: &Path) {
-    let reloaded = (|| -> Result<bool, Failure> {
-        let mut client = Client::connect_to("robotd", robot_socket)?;
-        client.hello()?;
-        let result: proto::IntentResult =
-            decode(&result_of(client.call(&proto::Call::RobotReloadPolicies)?)?)?;
-        Ok(result.accepted)
-    })();
-    match reloaded {
+    match reload_policies(robot_socket) {
         Ok(true) => println!("  the robot is re-reading its skills"),
         Ok(false) | Err(_) => {
             println!("  robotd did not pick it up — it will at the next start");
@@ -3503,10 +3629,62 @@ fn run_policy_search(updater_socket: &Path, query: &str, json: bool) -> Result<(
 }
 
 /// `robotctl policy check` — what is installed against what the repo offers.
-fn run_policy_check(updater_socket: &Path, json: bool) -> Result<(), Failure> {
+/// The two Hub-installed sets `updaterd` manages the same way: the official policy set and the
+/// duck detector. Same layout on disk, same provenance record, same two questions — what differs
+/// is which daemon runs the result and what to tell a person when it did not pick it up.
+#[derive(Clone, Copy)]
+enum Set {
+    Policies,
+    Detector,
+}
+
+impl Set {
+    fn check_call(self) -> proto::Call {
+        match self {
+            Set::Policies => proto::Call::PolicyCheck,
+            Set::Detector => proto::Call::DetectorCheck,
+        }
+    }
+
+    fn install_call(self, version: Option<&str>) -> proto::Call {
+        let params = proto::PolicyInstallParams {
+            version: version.map(str::to_owned),
+        };
+        match self {
+            Set::Policies => proto::Call::PolicyInstall(params),
+            Set::Detector => proto::Call::DetectorInstall(params),
+        }
+    }
+
+    /// The `robotctl` namespace, for the hint that names the install command.
+    fn namespace(self) -> &'static str {
+        match self {
+            Set::Policies => "policy",
+            Set::Detector => "duck-detector",
+        }
+    }
+
+    fn what(self) -> &'static str {
+        match self {
+            Set::Policies => "the official set",
+            Set::Detector => "the duck detector",
+        }
+    }
+
+    /// What tells a person whether the thing that runs it is running it.
+    fn where_it_shows(self) -> &'static str {
+        match self {
+            Set::Policies => "`robotctl health` says if a slot could not be loaded.",
+            Set::Detector => "`journalctl -u mediad` says if it could not be loaded.",
+        }
+    }
+}
+
+/// `robotctl policy check` and `robotctl duck-detector check` — what is installed, against the Hub.
+fn run_set_check(updater_socket: &Path, set: Set, json: bool) -> Result<(), Failure> {
     let mut client = Client::connect_to("updaterd", updater_socket)?;
     client.hello()?;
-    let result = result_of(client.call(&proto::Call::PolicyCheck)?)?;
+    let result = result_of(client.call(&set.check_call())?)?;
     if json {
         println!("{}", compact(&result));
         return Ok(());
@@ -3518,8 +3696,11 @@ fn run_policy_check(updater_socket: &Path, json: bool) -> Result<(), Failure> {
         // ask about, and the fix is the same — the daemon's post-install hook installs the set,
         // so the interesting question is why it did not.
         println!("installed  nothing this daemon can identify");
-        println!("           the release's postinstall hook installs the official set;");
-        println!("           `robotctl health` says if a slot could not be loaded.");
+        println!(
+            "           the release's postinstall hook installs {};",
+            set.what()
+        );
+        println!("           {}", set.where_it_shows());
         return Ok(());
     };
     println!("installed  {installed}  (from {repo})");
@@ -3534,7 +3715,7 @@ fn run_policy_check(updater_socket: &Path, json: bool) -> Result<(), Failure> {
         }
         (Some(available), _) => {
             println!("newest     {available}");
-            println!("\n`sudo robotctl policy update` installs it.");
+            println!("\n`sudo robotctl {} update` installs it.", set.namespace());
         }
         (None, _) => println!("newest     the repo has no tagged revisions"),
     }
@@ -3544,19 +3725,16 @@ fn run_policy_check(updater_socket: &Path, json: bool) -> Result<(), Failure> {
     Ok(())
 }
 
-/// `robotctl policy update` — fetch a set and run it.
-fn run_policy_update(
+/// `robotctl policy update` and `robotctl duck-detector update` — fetch a set and run it.
+fn run_set_update(
     updater_socket: &Path,
+    set: Set,
     version: Option<&str>,
     json: bool,
 ) -> Result<(), Failure> {
     let mut client = Client::connect_to("updaterd", updater_socket)?;
     client.hello()?;
-    let result = result_of(client.call(&proto::Call::PolicyInstall(
-        proto::PolicyInstallParams {
-            version: version.map(str::to_owned),
-        },
-    ))?)?;
+    let result = result_of(client.call(&set.install_call(version))?)?;
     if json {
         println!("{}", compact(&result));
         return Ok(());
@@ -3569,13 +3747,19 @@ fn run_policy_update(
             println!("installed {} (was {previous})", installed.installed);
             // Worth its own line rather than silence: the files are right and the robot is not
             // running them, which looks from the outside exactly like an update that did nothing.
-            if installed.reloaded {
-                println!("the robot is running it now");
-            } else {
-                println!(
+            match (set, installed.reloaded) {
+                (Set::Policies, true) => println!("the robot is running it now"),
+                (Set::Policies, false) => println!(
                     "the robot did not pick it up — it is still running the old set. \n\
                      `sudo systemctl restart robotd`, or check `robotctl health`."
-                );
+                ),
+                (Set::Detector, true) => println!(
+                    "mediad restarted onto it — if [duck_detector] enabled is on, it is looking with it now"
+                ),
+                (Set::Detector, false) => println!(
+                    "mediad did not restart — it is still running the old model. \n\
+                     `sudo systemctl restart mediad`, or check `journalctl -u mediad`."
+                ),
             }
         }
     }
@@ -3952,7 +4136,8 @@ fn run_pad(socket: &Path, command: PadCommand) -> Result<(), Failure> {
         // someone who ran this needs to know *now* that they should be holding the button.
         eprintln!(
             "looking for a gamepad in pairing mode — on an Xbox pad, press the small Sync \
-             button on the top edge (not the Xbox button, which switches it off)"
+             button on the top edge (not the Xbox button, which switches it off); on a Pro \
+             Controller, hold its Sync button until the player lights sweep"
         );
     }
 
@@ -4338,6 +4523,7 @@ fn resolve_from_dir(dir: &std::path::Path) -> Result<String, Failure> {
 
 fn run(cli: Cli) -> Result<(), Failure> {
     let command = match cli.namespace {
+        Namespace::Frame { output } => return frame::run(&cli.media_socket, &output),
         Namespace::Health { json } => {
             return run_health(&cli.socket, &cli.robot_socket, &cli.config_socket, json);
         }
@@ -4386,6 +4572,16 @@ fn run(cli: Cli) -> Result<(), Failure> {
         Namespace::Policy { command, file } => {
             return run_policy(&cli.robot_socket, &cli.socket, &file, command);
         }
+        Namespace::DuckDetector { command } => {
+            return match command {
+                DuckDetectorCommand::Check { json } => {
+                    run_set_check(&cli.socket, Set::Detector, json)
+                }
+                DuckDetectorCommand::Update { version, json } => {
+                    run_set_update(&cli.socket, Set::Detector, version.as_deref(), json)
+                }
+            };
+        }
         Namespace::Robot { command } => {
             return run_robot(&cli.robot_socket, command);
         }
@@ -4402,7 +4598,7 @@ fn run(cli: Cli) -> Result<(), Failure> {
             let result = if list {
                 configure::list(&file, json)
             } else {
-                configure::run(&file)
+                configure::run(&file, &cli.robot_socket)
             };
             return result.map_err(|e| Failure::new(exit::FAILED, e));
         }
diff --git a/robotctl/src/monitor.rs b/robotctl/src/monitor.rs
index 186df70b..3ba0a6af 100644
--- a/robotctl/src/monitor.rs
+++ b/robotctl/src/monitor.rs
@@ -31,7 +31,7 @@ use ratatui::widgets::{
     Block, Cell, Paragraph, RenderDirection, Row, Sparkline, Table, TableState,
 };
 
-use crate::{Client, Failure, duck, exit, path_map};
+use crate::{Client, Failure, duck, exit, imu_view, path_map};
 
 /// Tracking error at the edge of a deviation bar, radians.
 ///
@@ -72,6 +72,21 @@ const SUBSCRIBE_ID: u64 = 1;
 /// deliberate act, and everything below moving then is what the reader asked for.
 const PAD_HEIGHT: u16 = 8;
 
+/// Rows the pad block grows by while the pad has an IMU: two borders and ten rows of a
+/// wireframe pad tilting with the real one, beside the numbers. Ten because the picture is drawn
+/// two pixels a row and a pad needs about twenty to read as one.
+///
+/// Only while one is attached. An Xbox pad has none and its block is exactly what it was; the
+/// Pro Controller clones have one and the block opens up the moment `padd` finds it — which is the
+/// right moment for the reader to learn the pad can do that at all.
+const IMU_HEIGHT: u16 = 12;
+
+/// How often IMU samples alone may repaint the frame.
+///
+/// The clone sends six hundred a second, and a terminal redrawn at that rate is a terminal doing
+/// nothing else. Thirty a second is smooth to the eye and leaves the CPU for the filter.
+const IMU_REPAINT: Duration = Duration::from_millis(33);
+
 /// Rows the ToF block occupies while it is open: two borders and the eight rows
 /// of an 8×8 frame.
 ///
@@ -964,9 +979,26 @@ struct PadView {
     /// Times the robot's realtime clock stepped backwards between two reports. Expected exactly
     /// once on a board with no RTC, when its first NTP reply lands.
     clock_steps: u64,
+    /// The pad's inertial unit, while `padd` has one open. Its own lifecycle: a pad without one
+    /// never sets this, and a pad that drops takes it away through `ImuDetached`, not `Detached`.
+    imu: Option<pad_imu::Imu>,
+    /// When a sample last earned a repaint — see [`IMU_REPAINT`].
+    imu_painted: Option<Instant>,
 }
 
 impl PadView {
+    /// Has enough time passed since the last IMU-driven repaint for another one?
+    fn imu_repaint_due(&mut self) -> bool {
+        let now = Instant::now();
+        match self.imu_painted {
+            Some(at) if now.duration_since(at) < IMU_REPAINT => false,
+            _ => {
+                self.imu_painted = Some(now);
+                true
+            }
+        }
+    }
+
     /// Take one report.
     fn absorb(&mut self, report: proto::PadReport) {
         match report {
@@ -1002,6 +1034,15 @@ impl PadView {
                 self.trouble = Some(why);
             }
             proto::PadReport::Frame(frame) => self.frame(frame),
+            proto::PadReport::ImuAttached { device } => {
+                self.imu = Some(pad_imu::Imu::new(*device));
+            }
+            proto::PadReport::Imu(batch) => {
+                if let Some(imu) = self.imu.as_mut() {
+                    imu.absorb(&batch);
+                }
+            }
+            proto::PadReport::ImuDetached { .. } => self.imu = None,
         }
     }
 
@@ -1089,6 +1130,109 @@ impl PadView {
     }
 }
 
+/// The pad's inertial unit: a wireframe pad posed like the real one, and the numbers beside it.
+///
+/// Left, the picture; right, the words. The picture is what a person reads — a pad tilting on
+/// screen as it tilts in the hand is understood in the time it takes to see it — and the numbers
+/// are for when the picture is wrong: they say which axis, by how much, and whether the gyro bias
+/// the picture depends on has been learned yet.
+fn render_imu(imu: &pad_imu::Imu, frame: &mut ratatui::Frame, area: ratatui::layout::Rect) {
+    let device = imu.device();
+    let mut title = vec![
+        Span::raw(" imu "),
+        Span::styled(
+            device.name.clone(),
+            Style::new().fg(Color::Magenta).add_modifier(Modifier::BOLD),
+        ),
+    ];
+    match imu.rate_hz() {
+        Some(hz) => title.push(Span::raw(format!(" · {hz:.0} Hz ")).dim()),
+        None => title.push(Span::raw(" · waiting for samples ").dim()),
+    }
+    let block = Block::bordered()
+        .border_style(Style::new().fg(Color::Magenta))
+        .title(Line::from(title))
+        .title_bottom(
+            Line::from(format!(
+                " {} samples · {} · yellow bar = front edge ",
+                imu.samples(),
+                device.node
+            ))
+            .dim(),
+        );
+    let inner = block.inner(area);
+    frame.render_widget(block, area);
+
+    // The picture gets the left half of the width, capped where a wider one stops adding detail;
+    // the words take the rest. The picture is the one that earns its place, so it is sized first.
+    let picture_width = (inner.width / 2).clamp(12, 48);
+    let [picture, words] =
+        Layout::horizontal([Constraint::Length(picture_width), Constraint::Min(0)])
+            .areas::<2>(inner);
+    imu_view::draw(imu, picture, frame.buffer_mut());
+
+    let [pitch, roll, yaw] = imu.euler_deg();
+    let a = imu.accel_g();
+    let g = imu.gyro_dps();
+    let magnitude = (a[0] * a[0] + a[1] * a[1] + a[2] * a[2]).sqrt();
+    let signed = |v: f32| format!("{v:+7.2}");
+    let bias = match imu.bias_dps() {
+        Some(b) => Line::from(vec![
+            Span::raw(" bias  "),
+            Span::raw(format!(
+                "{} {} {} °/s ",
+                signed(b[0]),
+                signed(b[1]),
+                signed(b[2])
+            )),
+            Span::styled("settled", Style::new().fg(Color::Green)),
+            Span::raw(" — removed from the rates above").dim(),
+        ]),
+        None => Line::from(vec![
+            Span::raw(" bias  "),
+            Span::styled(
+                "learning — hold the pad still for half a second",
+                Style::new().fg(Color::Yellow),
+            ),
+        ]),
+    };
+    let mut lines = vec![
+        Line::from(vec![
+            Span::raw(" tilt  "),
+            Span::styled(
+                format!("pitch {pitch:+6.1}°  roll {roll:+6.1}°"),
+                Style::new().add_modifier(Modifier::BOLD),
+            ),
+            Span::raw(format!("  yaw {yaw:+6.1}°")),
+            Span::raw(" (gyro only, drifts)").dim(),
+        ]),
+        Line::from(format!(
+            " accel {} {} {} g   |a| {magnitude:.2} g",
+            signed(a[0]),
+            signed(a[1]),
+            signed(a[2])
+        )),
+        Line::from(format!(
+            " gyro  {} {} {} °/s",
+            signed(g[0]),
+            signed(g[1]),
+            signed(g[2])
+        )),
+        bias,
+        Line::from(" axes  +X front · +Y left · +Z up · at rest Z reads +1 g").dim(),
+    ];
+    if imu.socket_dropped() > 0 {
+        lines.push(Line::from(vec![Span::styled(
+            format!(
+                " {} samples dropped reaching this view",
+                imu.socket_dropped()
+            ),
+            Style::new().fg(Color::Magenta),
+        )]));
+    }
+    frame.render_widget(Paragraph::new(lines), words);
+}
+
 /// What the time since the last report means.
 ///
 /// The distinction between the last two is the whole difficulty of measuring a pad link, and
@@ -1250,10 +1394,15 @@ impl View {
                 Ok(true)
             }
             Update::Pad(report) => {
+                let sample = matches!(*report, proto::PadReport::Imu(_));
                 self.pad.absorb(*report);
                 // A repaint even while the block is closed would be a redraw per report, at up to
-                // 125 a second, for something nobody is looking at.
-                Ok(self.show_pad)
+                // 125 a second, for something nobody is looking at — and an IMU sample, at six
+                // hundred a second, earns one only every [`IMU_REPAINT`] even when it is.
+                if !self.show_pad {
+                    return Ok(false);
+                }
+                Ok(!sample || self.pad.imu_repaint_due())
             }
             Update::Tof(frame) => {
                 self.tof = Some(*frame);
@@ -1329,7 +1478,7 @@ impl View {
             // connect to. Either way the pad block is still drawn when it is open: it reads a
             // different daemon over a different socket, and a robot is not a precondition for
             // watching the sticks.
-            let pad_height = if self.show_pad { PAD_HEIGHT } else { 0 };
+            let pad_height = self.pad_height();
             let tof_height = if self.show_tof { TOF_HEIGHT } else { 0 };
             let [pad, tof, rest] = Layout::vertical([
                 Constraint::Length(pad_height),
@@ -1386,7 +1535,7 @@ impl View {
         // The pad block, when open, sits directly under the header rather than at the bottom: it is
         // the *source* of the command the header reports, and the frame then reads top to bottom in
         // the order the robot does — sticks, command, joints, loop rate.
-        let pad_height = if self.show_pad { PAD_HEIGHT } else { 0 };
+        let pad_height = self.pad_height();
         let tof_height = if self.show_tof { TOF_HEIGHT } else { 0 };
         let trace_height = area
             .height
@@ -1428,6 +1577,20 @@ impl View {
         }
     }
 
+    /// Rows the pad block takes: none while closed, [`PAD_HEIGHT`] open, and [`IMU_HEIGHT`] more
+    /// while the pad has an inertial unit to show.
+    fn pad_height(&self) -> u16 {
+        if !self.show_pad {
+            return 0;
+        }
+        PAD_HEIGHT
+            + if self.pad.imu.is_some() {
+                IMU_HEIGHT
+            } else {
+                0
+            }
+    }
+
     /// Carve the robot view's column off the right, when it is wanted and fits.
     fn duck_split(
         &self,
@@ -2319,14 +2482,23 @@ impl View {
         };
 
         // Fixed rows, in the order the questions arrive: is it arriving, has it been arriving, and
-        // what is it saying.
-        let [cadence, gaps, axes, held] = Layout::vertical([
+        // what it is saying — and, when the pad has one, where the pad is in space.
+        let imu_height = if self.pad.imu.is_some() {
+            IMU_HEIGHT
+        } else {
+            0
+        };
+        let [cadence, gaps, axes, held, imu] = Layout::vertical([
             Constraint::Length(1),
             Constraint::Length(1),
             Constraint::Length(AXIS_ROWS as u16),
             Constraint::Length(1),
+            Constraint::Length(imu_height),
         ])
-        .areas::<4>(inner);
+        .areas::<5>(inner);
+        if let Some(unit) = self.pad.imu.as_ref() {
+            render_imu(unit, frame, imu);
+        }
 
         frame.render_widget(self.pad_cadence(), cadence);
         // A label beside the trace rather than a title above it: a bordered block for one row of
@@ -2365,6 +2537,13 @@ impl View {
                 Style::new().fg(Color::Yellow),
             ));
         }
+        if self.pad.imu.is_some() {
+            // Loud on purpose: a pad with an IMU is news, and the block below has just grown.
+            title.push(Span::styled(
+                "· IMU ",
+                Style::new().fg(Color::Magenta).add_modifier(Modifier::BOLD),
+            ));
+        }
         title
     }
 
@@ -3644,6 +3823,112 @@ mod tests {
         view
     }
 
+    fn an_imu() -> proto::PadImuDevice {
+        proto::PadImuDevice {
+            name: "Nintendo Switch Pro Controller IMU".to_owned(),
+            node: "/dev/input/event6".to_owned(),
+            accel_per_g: 4096,
+            gyro_per_dps: 14247,
+            accel_max: 32767,
+            gyro_max: 32_767_000,
+        }
+    }
+
+    /// The pad block is what it always was for a pad without an IMU, and grows — with the
+    /// picture, the numbers and a loud tag in the title — the moment `padd` opens one. An Xbox
+    /// pad's owner must see no change; a Pro Controller's must not be able to miss it.
+    #[test]
+    fn the_pad_block_grows_an_imu_panel_only_when_the_pad_has_one() {
+        let mut view = watching_a_pad();
+        let without = render_to(&mut view, 100, 40);
+        assert!(
+            !without.contains("front edge"),
+            "no IMU, no panel:\n{without}"
+        );
+        assert!(!without.contains("· IMU"), "{without}");
+
+        feed(
+            &mut view,
+            Update::Pad(Box::new(proto::PadReport::ImuAttached {
+                device: Box::new(an_imu()),
+            })),
+        );
+        // Two hundred samples of a pad lying flat, a second's worth: level, bias learned.
+        for i in 1..=200u64 {
+            feed(
+                &mut view,
+                Update::Pad(Box::new(proto::PadReport::Imu(proto::PadImuBatch {
+                    samples: vec![proto::PadImuSample {
+                        seq: i,
+                        at_us: 1_000_000 + i * 5_000,
+                        accel: [-391, -35, 4270],
+                        gyro: [25_000, -9_000, 171_000],
+                    }],
+                    socket_dropped: 0,
+                }))),
+            );
+        }
+        let with = render_to(&mut view, 100, 40);
+        assert!(with.contains("· IMU"), "the title says so:\n{with}");
+        assert!(
+            with.contains("Nintendo Switch Pro Controller IMU"),
+            "the panel names the unit:\n{with}"
+        );
+        assert!(with.contains("pitch"), "and reads its attitude:\n{with}");
+        assert!(
+            with.contains("settled"),
+            "a second still learns the bias:\n{with}"
+        );
+        assert!(
+            with.contains('▀') || with.contains('▄'),
+            "and draws the pad:\n{with}"
+        );
+
+        feed(
+            &mut view,
+            Update::Pad(Box::new(proto::PadReport::ImuDetached {
+                why: "the pad changed".to_owned(),
+            })),
+        );
+        let gone = render_to(&mut view, 100, 40);
+        assert!(
+            !gone.contains("· IMU"),
+            "and it goes when the IMU does:\n{gone}"
+        );
+    }
+
+    /// Six hundred samples a second must not become six hundred repaints a second.
+    #[test]
+    fn imu_samples_repaint_at_most_thirty_times_a_second() {
+        let mut view = watching_a_pad();
+        feed(
+            &mut view,
+            Update::Pad(Box::new(proto::PadReport::ImuAttached {
+                device: Box::new(an_imu()),
+            })),
+        );
+        let repaints = (1..=100u64)
+            .filter(|i| {
+                view.absorb(Update::Pad(Box::new(proto::PadReport::Imu(
+                    proto::PadImuBatch {
+                        samples: vec![proto::PadImuSample {
+                            seq: *i,
+                            at_us: 1_000_000 + i * 1_667,
+                            accel: [0, 0, 4096],
+                            gyro: [0, 0, 0],
+                        }],
+                        socket_dropped: 0,
+                    },
+                ))))
+                .unwrap_or_else(|_| panic!("an update is not a failure"))
+            })
+            .count();
+        assert!(
+            repaints <= 2,
+            "a burst of samples earned {repaints} repaints"
+        );
+    }
+
     /// Stopping `tofd` must be an ordinary thing to do. The subscribe reports why
     /// it failed and the caller retries — nothing here may panic or give up, or
     /// `systemctl stop tofd` would take the monitor's other two streams with it.
@@ -3741,6 +4026,7 @@ mod tests {
         proto::TofFrame {
             seq: 7,
             at_us: 1_000_000,
+            t_ns: 0,
             rows: 8,
             cols: 8,
             distance_mm,
@@ -4209,6 +4495,10 @@ mod tests {
             odom: proto::OdomState::default(),
             theremin: None,
             chorale: None,
+            t_ns: 0,
+            imu: None,
+            frames: None,
+            skeleton: Vec::new(),
         }
     }
 }
diff --git a/robotd-params/src/edit.rs b/robotd-params/src/edit.rs
index adf21ef0..e3471f59 100644
--- a/robotd-params/src/edit.rs
+++ b/robotd-params/src/edit.rs
@@ -32,7 +32,7 @@ use std::io::Write as _;
 use std::path::{Path, PathBuf};
 
 use crate::Params;
-use crate::registry::{Entry, Kind, REGISTRY};
+use crate::registry::{Entry, Kind, REGISTRY, RENAMED_SECTIONS};
 use toml_edit::DocumentMut;
 
 /// One key's place in the world: what the file says, what the default is.
@@ -84,7 +84,7 @@ pub struct Model {
     ///
     /// Kept because `pending` is *cleared* by a save, and what wants restarting is decided after
     /// the editor has closed — reading `pending` there found nothing every time, so nothing was
-    /// ever restarted and a `[detect]` change looked like a no-op.
+    /// ever restarted and a `[duck_detector]` change looked like a no-op.
     written: Vec<String>,
 }
 
@@ -112,9 +112,10 @@ impl Model {
         // The daemon's own parse first: a file robotd would refuse is not a file to edit
         // blind, and the error names the line.
         toml::from_str::<Params>(text).map_err(|e| format!("{}: {e}", path.display()))?;
-        let doc: DocumentMut = text
+        let mut doc: DocumentMut = text
             .parse()
             .map_err(|e| format!("{}: {e}", path.display()))?;
+        Self::migrate_renamed_sections(&mut doc);
         Ok(Self {
             path: path.to_path_buf(),
             doc,
@@ -124,6 +125,29 @@ impl Model {
         })
     }
 
+    /// Sections that changed name, carried to the new one in the document itself.
+    ///
+    /// The loader accepts the old name through a serde alias, so a file written before the rename
+    /// keeps working untouched. This is the other half: an *editor* that then set a key under the new
+    /// name would leave the file with both sections, which the loader refuses as a duplicate — so the
+    /// old header is renamed here, once, and the next save writes the file under the new name only.
+    /// Nothing is written until something else is saved; a read-only browse changes no file.
+    ///
+    /// Called from [`Model::from_text`] and again in [`Model::save`], which re-reads the file
+    /// from disk before rendering and would otherwise write the old header straight back.
+    fn migrate_renamed_sections(doc: &mut DocumentMut) {
+        for (old, new) in RENAMED_SECTIONS {
+            if doc.contains_key(new) {
+                // Both present: the loader's duplicate-field error already named it. Not ours to
+                // guess which wins.
+                continue;
+            }
+            if let Some(item) = doc.remove(old) {
+                doc.insert(new, item);
+            }
+        }
+    }
+
     /// Every key the daemon knows, in registry order, with pending edits shown as if applied.
     pub fn rows(&self) -> Vec<Row> {
         REGISTRY
@@ -246,6 +270,15 @@ impl Model {
             Kind::Table => {
                 return Err("edit the one-shot skills with `robotctl policy`".to_owned());
             }
+            // Six numbers from a calibration, where a typo is a plausible wrong answer rather
+            // than an error. Written by whatever measured them, not typed into an editor.
+            Kind::Record(_) => {
+                return Err(
+                    "camera intrinsics come from a calibration; write them into robotd.toml \
+                     directly, or leave them absent to publish the module's design figures"
+                        .to_owned(),
+                );
+            }
             Kind::IntegerList => {
                 let mut array = toml_edit::Array::new();
                 for word in input.split(',') {
@@ -432,8 +465,9 @@ impl Model {
     pub fn save(&mut self) -> Result<(), String> {
         let lock = lock(&self.path)?;
         if let Ok(fresh) = std::fs::read_to_string(&self.path)
-            && let Ok(doc) = fresh.parse::<DocumentMut>()
+            && let Ok(mut doc) = fresh.parse::<DocumentMut>()
         {
+            Self::migrate_renamed_sections(&mut doc);
             self.doc = doc;
         }
         let text = self.rendered();
@@ -683,7 +717,8 @@ mod tests {
         let find = |key: &str| rows.iter().find(|r| r.entry.key == key).expect("known");
         assert_eq!(find("control.hz").effective(), "50");
         assert_eq!(find("policy.mode").effective(), "walk");
-        assert_eq!(find("safety.limp_fall").effective(), "true");
+        assert_eq!(find("safety.limp_fall").effective(), "false");
+        assert_eq!(find("policy.voltage_adapt").effective(), "true");
         assert_eq!(find("audio.pet_detect").effective(), "unset");
     }
 
@@ -920,7 +955,7 @@ mod tests {
                 .clone()
         };
         let walk = hint(&m, "policy.walk").expect("resolves");
-        assert!(walk.contains("alpha_walking"), "{walk}");
+        assert!(walk.contains("velstand"), "{walk}");
         assert_eq!(hint(&m, "policy.legs_lowpass").as_deref(), Some("0.7"));
         assert_eq!(
             hint(&m, "audio.pet_detect").as_deref(),
@@ -1035,18 +1070,60 @@ mod tests {
                 "update_gate",
                 "policy",
                 "safety",
-                "detect",
+                "duck_detector",
                 "chorale",
                 "theremin",
+                "head_imu",
                 "audio",
                 "media",
                 // Last, and the editor shows sections in this order: the pad is what a robot's
                 // buttons do, which is the thing somebody browses for rather than tunes.
-                "pad"
+                "pad",
+                "pad_imu_head_control"
             ]
         );
     }
 
+    /// A file written before `[imu_head]` became `[pad_imu_head_control]` loads (the alias), and
+    /// the editor carries the section to its new name so a save under the new key cannot leave two
+    /// sections the loader would refuse as duplicates. The value set under the old name is what the
+    /// new key reports.
+    #[test]
+    fn a_renamed_section_is_carried_to_its_new_name() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let config = dir.path().join("robotd.toml");
+        std::fs::write(&config, "[imu_head]\nenabled = true\ngain = 0.5\n").expect("write");
+
+        let mut m = Model::load(&config).expect("loads through the alias");
+        let row = m
+            .rows()
+            .into_iter()
+            .find(|r| r.entry.key == "pad_imu_head_control.gain")
+            .expect("registry key");
+        assert_eq!(
+            row.set.as_deref(),
+            Some("0.5"),
+            "the old section's value shows under the new key"
+        );
+
+        m.edit(entry("pad_imu_head_control.enabled"), "false")
+            .expect("valid");
+        m.save().expect("saves");
+        let text = std::fs::read_to_string(&config).expect("read");
+        assert!(!text.contains("[imu_head]"), "old header gone:\n{text}");
+        assert!(
+            text.contains("[pad_imu_head_control]"),
+            "new header present:\n{text}"
+        );
+        assert!(
+            text.contains("gain = 0.5"),
+            "untouched key carried over:\n{text}"
+        );
+        let params: Params = toml::from_str(&text).expect("the daemon loads the result");
+        assert!(!params.pad_imu_head_control.enabled);
+        assert_eq!(params.pad_imu_head_control.gain, 0.5);
+    }
+
     /// **Four processes write this file**, and two staging into the same `robotd.toml.new` at
     /// once is one writer's half renamed into place by the other. Every writer takes the lock
     /// for its whole read-modify-write, so concurrent adds compose instead of racing.
diff --git a/robotd-params/src/lib.rs b/robotd-params/src/lib.rs
index 54246663..1253a9f4 100644
--- a/robotd-params/src/lib.rs
+++ b/robotd-params/src/lib.rs
@@ -39,6 +39,16 @@ pub const RELEASE_DIR: &str = "/opt/robot/daemon/current";
 /// atomically. See `docs/design/policy-channel-design.md` §9.
 pub const POLICY_DIR: &str = "/opt/robot/policies/current";
 
+/// Where the duck detector lives — outside the release, the way [`POLICY_DIR`] is, and for the
+/// same reason: the model is trained and published elsewhere (`pollen-robotics/duck_detector`,
+/// on the Hub as `pollen-robotics/microduck-duck-detector`), a retrain is a tag rather than a
+/// daemon release, and a daemon fix should not re-ship fourteen megabytes of unchanged weights.
+///
+/// Seeded by the release's own `scripts/seed-detector.sh`, moved past with
+/// `robotctl duck-detector update`; `current` is a symlink beside a `releases/` directory, the layout
+/// the policies use and the updater swaps atomically.
+pub const DETECTOR_DIR: &str = "/opt/robot/detector/current";
+
 /// Where policies fetched from the Hub one at a time live — `robotctl policy load <slot> <repo>`.
 ///
 /// Outside every release directory, per `updater-design.md` §5.7: a policy somebody chose has to
@@ -60,11 +70,55 @@ pub struct Params {
     pub safety: SafetyParams,
     pub audio: AudioParams,
     pub theremin: ThereminParams,
+    pub head_imu: HeadImuParams,
     pub chorale: ChoraleParams,
     pub media: MediaParams,
-    pub detect: DetectParams,
+    ///
+    /// `[detect]` until 2026-09: in `robotctl configure` that read as "detect what?", one line
+    /// from `chorale.accept`. Named for what it detects. The alias keeps a file written under the
+    /// old name loading; the editor renames the section the next time it saves that file.
+    #[serde(alias = "detect")]
+    pub duck_detector: DuckDetectorParams,
     /// Which pad button runs which skill. `padd` reads this, not `robotd`.
     pub pad: PadParams,
+    /// Posing the head from the pad's own IMU. `padd` reads this too.
+    ///
+    /// Named for what it is, in full, because `[head_imu]` is two sections up and is the IMU *in*
+    /// the robot's head: the two were `imu_head` and `head_imu` for a while, and that is a name
+    /// apart, not a difference. The alias keeps a file written under the old name loading; the
+    /// editor renames the section the next time it saves that file.
+    #[serde(alias = "imu_head")]
+    pub pad_imu_head_control: PadImuHeadControlParams,
+}
+
+/// Controller-IMU head control: pose the head by tilting the pad.
+///
+/// Some pads carry an inertial unit — the "Pro Controller" Switch clones do; an Xbox pad does not.
+/// With this on and such a pad connected, **Y** stops meaning "the sticks pose the head" and
+/// means "the pad's tilt poses the head": the sticks keep driving, and turning the pad in your
+/// hands turns the robot's head. Press Y again and the head holds where it is, still driving.
+/// Press it a third time and the pad drives the head again **from where the pad is now** — the
+/// pad's yaw comes from a gyro and drifts, and re-centring on every re-entry is how a person
+/// beats the drift without a magnetometer.
+///
+/// Off, or on a pad with no IMU, Y is what it always was. Nothing else about the pad changes.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields, default)]
+pub struct PadImuHeadControlParams {
+    /// Whether Y engages IMU head control on a pad that has an IMU.
+    pub enabled: bool,
+    /// Head radians per pad radian. One is "the head turns as far as the pad did"; more makes a
+    /// small wrist movement a large head movement. The head's own travel limit still applies.
+    pub gain: f64,
+}
+
+impl Default for PadImuHeadControlParams {
+    fn default() -> Self {
+        Self {
+            enabled: false,
+            gain: 1.0,
+        }
+    }
 }
 
 /// Which pad button runs which skill.
@@ -296,6 +350,61 @@ impl CongestionControl {
     }
 }
 
+/// Where `mediad`'s video comes from.
+///
+/// **This was `camera: bool`, and the boolean was the problem.** `camera = false` does not mean
+/// "no video" — the WebRTC control channel rides the video track, so a pipeline that never starts
+/// costs a robot its control surface along with its picture (`remote-webrtc.md`). What it means is
+/// "a test pattern instead", and nothing in the key said so: a board set up with no camera streamed
+/// 720p30 of synthetic video, which is how the pattern came to cost five times what the camera it
+/// stands in for does. A name that says what you get is the fix for the next person reading it.
+///
+/// `--sim-camera` is not a value here. It carries an address, so it is a flag, and it overrides
+/// this the way it always has.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum MediaSource {
+    /// The head camera, at [`Quality`]. What every robot with a camera wants, and the default.
+    #[default]
+    Camera,
+    /// A test pattern at [`TEST_PATTERN_GEOMETRY`], for a board with no camera: the session
+    /// exists, so signalling, negotiation, the datachannel and the control API are all reachable.
+    Test,
+}
+
+/// Every source, in the order an editor cycles them — and the strings the file uses.
+///
+/// One list, for [`QUALITY_LABELS`]'s reason; [`tests::every_media_source_label_round_trips`]
+/// pins it to the enum in both directions.
+pub const MEDIA_SOURCE_LABELS: &[&str] = &["camera", "test"];
+
+impl MediaSource {
+    /// The sources, in [`MEDIA_SOURCE_LABELS`] order.
+    pub const ALL: [MediaSource; 2] = [MediaSource::Camera, MediaSource::Test];
+
+    /// The name this source has in the file.
+    pub fn label(self) -> &'static str {
+        match self {
+            MediaSource::Camera => "camera",
+            MediaSource::Test => "test",
+        }
+    }
+}
+
+/// What a test pattern runs at, whatever `[media] quality` says — width, height, frames a second.
+///
+/// **A test pattern is not video anybody watches.** It exists so a board with no camera still has
+/// a whole session — signalling, negotiation, the datachannel, the control API — and none of that
+/// needs the rung a camera streams at. Running it at the configured rung instead is what an idle
+/// radxa-zero3 was measured doing: **29.4% of a core against the real camera's 6.1%** on the same
+/// board, with nothing connected. A camera's frames arrive off the ISP in hardware, while a test
+/// pattern is drawn by the CPU — at 720p30, 1.84 MB of packed UYVY thirty times a second, every
+/// frame discarded unread. This is 73 KB five times a second: 0.7% of that pixel rate.
+///
+/// 16:9 with both axes a multiple of 8, for [`Quality::size`]'s reason. Five frames a second is
+/// still a live stream — enough to prove the path end to end, which is all it is for.
+pub const TEST_PATTERN_GEOMETRY: (u32, u32, u32) = (256, 144, 5);
+
 /// `[media]` — what `mediad` streams.
 ///
 /// **These were command-line flags in `mediad.service`, and that is why this section exists.**
@@ -315,9 +424,9 @@ impl CongestionControl {
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(deny_unknown_fields, default)]
 pub struct MediaParams {
-    /// Stream the head camera. `false` streams a test pattern instead, which is what a board
-    /// with no camera wants: the pipeline starts, so the WebRTC control channel exists.
-    pub camera: bool,
+    /// Where the video comes from: the head camera, or a test pattern for a board without one.
+    /// [`MediaSource`] says why this is a name rather than a boolean.
+    pub source: MediaSource,
     /// Frame size and rate, as one name. [`Quality`] says why it is one key and not four.
     pub quality: Quality,
     /// Starting video bitrate, bits per second. Unset follows the quality —
@@ -329,16 +438,90 @@ pub struct MediaParams {
     /// Whether the send rate adapts to the link, and by what. [`CongestionControl`] has the
     /// trade — it is the largest single CPU consumer in this process.
     pub congestion_control: CongestionControl,
+    /// This robot's own measured camera geometry, when somebody has written a `[media.intrinsics]`
+    /// table for it — and only then.
+    ///
+    /// Absent is the common case and not a gap: `mediad` falls back to the hardware family's
+    /// calibration ([`CameraIntrinsics::alpha`] — the camera and lens are one part across a
+    /// revision, so it is a real solve of the same optics) and publishes it tagged `source:
+    /// "family"`, with the module's design figures (`source: "nominal"`) below that for a camera
+    /// nobody has solved at all. So this stays `Some` only for a per-robot solve, which is exactly
+    /// what lets `media.video` distinguish *this* robot's calibration from the family's. See
+    /// [`CameraIntrinsics`].
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub intrinsics: Option<CameraIntrinsics>,
+}
+
+/// A camera calibration, as OpenCV's `calibrateCamera` produces one.
+///
+/// **The resolution it was measured at is part of the record**, because intrinsics are in pixels:
+/// the same camera calibrated at 1280×720 and at 640×360 yields numbers that differ by a factor of
+/// two and describe the same optics. `mediad` scales them to whatever is being streamed, and
+/// refuses to when the aspect ratio differs — a frame of another shape is not a resize of this
+/// one, and which part was cropped is not recoverable from its size.
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct CameraIntrinsics {
+    /// The frame size these were measured at, in pixels.
+    pub width: u32,
+    pub height: u32,
+    /// Focal length in pixels, per axis. Equal for square pixels, which these are.
+    pub fx: f64,
+    pub fy: f64,
+    /// Where the optical axis crosses the image, in pixels from the top-left of the **delivered,
+    /// unrotated** frame. A few pixels off centre on a real module.
+    pub cx: f64,
+    pub cy: f64,
+    /// `k1 k2 p1 p2 k3`, OpenCV's order. Empty for a calibration that did not model distortion.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub distortion: Vec<f64>,
 }
 
+impl CameraIntrinsics {
+    /// The alpha family's camera calibration: the head camera module and M12 lens every alpha unit
+    /// carries — one part across the family, so one solve is every unit's calibration.
+    ///
+    /// Solved on unit *graphite*, 2026-09-08 — ChArUco board on a screen (caliper-measured), 80
+    /// views, 0.79 px RMS, on the 1280×720 frame as `mediad` sends it (unrotated). This is the
+    /// **~62° full field of view** of the production `1920×1080@30` sensor mode: on this board's
+    /// IMX219 driver that mode is a scaled full-frame readout, not the native 1920×1080 crop the
+    /// datasheet describes — validated on hardware, the solved HFOV is 62°, not 39°. (`SensorMode`
+    /// and [`super`]'s nominal model still assume the crop; they are only the fallback this
+    /// overrides, but they are wrong for this hardware and should be corrected when touched.)
+    /// Re-solve with `duckslam calib intrinsics`; `duckslam calib export-toml` prints this shape.
+    pub fn alpha() -> Self {
+        Self {
+            width: 1280,
+            height: 720,
+            fx: 1061.8060025020175,
+            fy: 1062.193713957031,
+            cx: 596.7776848217006,
+            cy: 474.52348043048636,
+            distortion: vec![
+                -0.34695388691888,
+                0.14615866153945595,
+                -0.0007449157712424215,
+                -0.0022167170528743837,
+                -0.016437266141048814,
+            ],
+        }
+    }
+}
+
+// Derivable since `camera: bool` became `source: MediaSource`, and still written out: every line
+// of it is a decision with a reason beside it, and `#[derive(Default)]` would delete the reasons
+// while keeping the values. The next field added here should have to say what its default is for.
+#[allow(clippy::derivable_impls)]
 impl Default for MediaParams {
     fn default() -> Self {
         Self {
-            // On, because a robot with a camera is the case, and a board without one shows a
-            // test pattern rather than nothing only if somebody turns this off.
-            camera: true,
+            // The camera, because a robot with a camera is the case. A board without one shows a
+            // test pattern instead, and only if somebody names it.
+            source: MediaSource::Camera,
             quality: Quality::default(),
             bitrate: None,
+            // Only a per-robot solve goes here; the family calibration is `mediad`'s fallback.
+            intrinsics: None,
             // `webrtcsink`'s own default, named rather than inherited: what the element defaults
             // to is a fact about a plugin we ship from a pinned release, and the day it changes
             // should not be the day every robot's send rate changes with it.
@@ -347,7 +530,7 @@ impl Default for MediaParams {
     }
 }
 
-/// `[detect]` — finding other ducks in the camera.
+/// `[duck_detector]` — finding other ducks in the camera.
 ///
 /// **Read by `mediad`, not by `robotd`**, which is a first for this file: the frames are on
 /// `mediad`'s tee and perception belongs next to the sensor. It lives here anyway, because this is
@@ -356,12 +539,13 @@ impl Default for MediaParams {
 /// find.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(deny_unknown_fields, default)]
-pub struct DetectParams {
-    /// Off by default. The detector costs a model in the release, ~50 ms of CPU per frame and some
-    /// heat; a robot that nothing asks to look for ducks should not be paying for it.
+pub struct DuckDetectorParams {
+    /// Off by default. The detector costs ~50 ms of CPU per frame and some heat; a robot that
+    /// nothing asks to look for ducks should not be paying for it.
     pub enabled: bool,
     /// Where to look, and therefore *what runs it*: a `.rknn` goes to the NPU, an `.onnx` runs on
-    /// the CPU. Absent means the release's own model, NPU first — see [`DetectParams::model`].
+    /// the CPU. Absent means the installed set under [`DETECTOR_DIR`], NPU first — see
+    /// [`DuckDetectorParams::models`].
     pub model: Option<PathBuf>,
     /// Frames per second to run the detector at.
     ///
@@ -377,7 +561,7 @@ pub struct DetectParams {
     pub threshold: f32,
 }
 
-impl Default for DetectParams {
+impl Default for DuckDetectorParams {
     fn default() -> Self {
         Self {
             enabled: false,
@@ -394,9 +578,25 @@ impl MediaParams {
         self.bitrate
             .unwrap_or_else(|| self.quality.default_bitrate())
     }
+
+    /// Frame size and rate the pipeline will actually run at — width, height, frames a second.
+    ///
+    /// [`Quality`], except for the test pattern, which gets [`TEST_PATTERN_GEOMETRY`] instead.
+    /// A simulated camera is a camera: `--sim-camera` renders the configured rung, and `mediad`
+    /// applies that precedence where it picks the source.
+    pub fn geometry(&self) -> (u32, u32, u32) {
+        match self.source {
+            MediaSource::Camera => (
+                self.quality.width(),
+                self.quality.height(),
+                self.quality.fps(),
+            ),
+            MediaSource::Test => TEST_PATTERN_GEOMETRY,
+        }
+    }
 }
 
-impl DetectParams {
+impl DuckDetectorParams {
     /// The models to try, best first. Empty when the detector is off.
     ///
     /// **A list, not a choice**, because whether the NPU works is not something this file can know.
@@ -406,6 +606,11 @@ impl DetectParams {
     /// board still sees, on the CPU, instead of logging one warning and doing nothing for ever.
     ///
     /// An explicit `model` is the operator being specific, so it is tried alone.
+    ///
+    /// **Not filtered on existence.** A board whose set was never seeded — first install with no
+    /// network — has neither file, and an empty list here would read as "detector off" in
+    /// `mediad`'s journal when the truth is "detector on, model missing". Letting the loader fail
+    /// on the path names the directory and what fills it.
     pub fn models(&self) -> Vec<PathBuf> {
         if !self.enabled {
             return Vec::new();
@@ -416,17 +621,16 @@ impl DetectParams {
             }
             return vec![path.clone()];
         }
-        let release = PathBuf::from(RELEASE_DIR).join("models");
-        [
-            release.join("duck_detect.rknn"),
-            release.join("duck_detect.onnx"),
-        ]
-        .into_iter()
-        .filter(|path| path.exists())
-        .collect()
+        let set = PathBuf::from(DETECTOR_DIR);
+        DETECTOR_FILES.iter().map(|name| set.join(name)).collect()
     }
 }
 
+/// The two files a detector set holds, NPU first. `scripts/seed-detector.sh` and
+/// `updater::policy::DETECTOR_FILES` download exactly this list, and a test in each place holds
+/// them together.
+pub const DETECTOR_FILES: [&str; 2] = ["duck_detect.rknn", "duck_detect.onnx"];
+
 /// `[chorale]` — several ducks singing one piece.
 ///
 /// `accept` is **false by default, and that is the whole section.** A chorale is not only a sound:
@@ -454,9 +658,10 @@ pub struct ChoraleParams {
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(deny_unknown_fields, default)]
 pub struct ThereminParams {
-    /// Master switch. On by default: the instrument still has to be picked up with
-    /// `robot.theremin`, so what this turns off is the *ability* to, on a duck where the
-    /// feature is unwanted or the sensor is known bad.
+    /// Master switch. **Off by default**: the theremin is a party trick, and a duck that
+    /// nobody asked to play one should not be reaching for the depth stream at all. Turning
+    /// it on grants the *ability* to pick the instrument up — that still takes
+    /// `robot.theremin` — on a duck where somebody wants it and the ToF is known good.
     pub enabled: bool,
     /// `tofd`'s depth stream.
     pub socket: PathBuf,
@@ -478,7 +683,7 @@ impl Default for ThereminParams {
     fn default() -> Self {
         let hand = kinematics::hand::Config::default();
         Self {
-            enabled: true,
+            enabled: false,
             socket: PathBuf::from(duck_ipc_proto::socket::TOF),
             near_m: hand.near_m,
             far_m: hand.far_m,
@@ -502,6 +707,27 @@ impl ThereminParams {
     }
 }
 
+/// `[head_imu]` — the BMI088 on the head module, read by `tofd` and served as
+/// `head_imu.stream`.
+///
+/// **One switch, and it is off.** Reading this chip at 100 Hz costs ~3.5–4.5% of a core on an
+/// RK3566, and a bench that isolates the parts says none of it is fixable in the loop: being
+/// woken a hundred times a second is 0.7 points of it, the Madgwick fusion 0.3, and the rest is
+/// the two I²C transactions a sample takes. Fewer bytes is not on offer — a gyro and an
+/// accelerometer sample *is* twelve bytes — so what is left is not reading it, which is this
+/// key, or reading it less often, which is `tofd --imu-hz`.
+///
+/// It stays off until something subscribes to the stream, because for now nothing does: it was
+/// added for the mapping work, and a duck that is not mapping was paying for it from boot.
+/// `docs/project/tof-on-demand.md` is the measurement and the reasoning.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(deny_unknown_fields, default)]
+pub struct HeadImuParams {
+    /// Read the head IMU at all. `false` — and derived rather than written out, so the default
+    /// cannot be changed by editing one word. `tofd --imu` overrides it for a session.
+    pub enabled: bool,
+}
+
 /// `[audio]` — the voice and the microphone. All optional equipment: a robot without a
 /// codec (or a bank) walks identically and stays quiet, so nothing here reaches a health
 /// verdict.
@@ -663,7 +889,7 @@ pub struct PolicyParams {
     pub skills: Vec<SkillDef>,
     /// Scale actions with battery voltage: effective scale × (nominal / measured). The
     /// servos' effective kP tracks their supply, so this holds the robot's response steady
-    /// as the pack sags. Off by default, as in the prototype.
+    /// as the pack sags. On by default since 2026-09-14 (the prototype ran without it).
     pub voltage_adapt: bool,
     /// Reference voltage for `voltage_adapt` — the supply the gains were identified at.
     pub nominal_voltage: f64,
@@ -1350,9 +1576,13 @@ impl PolicyParams {
         };
 
         let (walk_default, stand, sitstand, ground_pick) = match self.mode {
+            // The velstand gait (set v5) walks on a twist and stands still at zero command,
+            // so no standing network is loaded by default: with `stand` unset the walking
+            // policy runs at every velocity. `alpha_walking.onnx` + `alpha_stand.onnx` stay
+            // in the set for a board that loads them back by hand.
             Mode::Walk => (
-                "alpha_walking.onnx",
-                Some("alpha_stand.onnx"),
+                "velstand.onnx",
+                None,
                 Some("alpha_sitstand.onnx"),
                 Some("alpha_ground_pick.onnx"),
             ),
@@ -1461,9 +1691,9 @@ pub struct SafetyParams {
     pub battery_empty_shutdown: bool,
 
     /// Go limp *while falling*, to land soft instead of fighting the floor all the way
-    /// down. **On by default** since it was validated on a robot — the whole point is that
-    /// the fleet lands soft, and a mode every board has to opt into individually is a mode
-    /// most boards do not have.
+    /// down. **Off by default** since the velstand gait became the default walk (set v5):
+    /// the hand-back it ends with is to the standing network, which the default configuration
+    /// no longer loads. Turn it on with a robot that runs a standing policy.
     ///
     /// The only thing the daemon does about a fall. Drop to `gain_limp`, let the robot
     /// collapse, pose it back to standing once it has landed, then hand it to the standing
@@ -1524,7 +1754,7 @@ impl Default for PolicyParams {
             ground_pick_action_scale: None,
             ground_pick_gain_ratio: 1.0,
             skills: Vec::new(),
-            voltage_adapt: false,
+            voltage_adapt: true,
             nominal_voltage: 7.4,
         }
     }
@@ -1538,7 +1768,7 @@ impl Default for SafetyParams {
             deadman_ms: 500,
             gain_limp: 50,
             battery_empty_shutdown: true,
-            limp_fall: true,
+            limp_fall: false,
             limp_fall_tilt_z: -0.90,
             limp_fall_predict_z: -0.5,
             limp_fall_lookahead_ms: 300,
@@ -2543,7 +2773,7 @@ mod tests {
         params.set_slot(Slot::Walk, None);
         assert_eq!(
             params.resolved().walk,
-            std::path::Path::new(super::POLICY_DIR).join("alpha_walking.onnx"),
+            std::path::Path::new(super::POLICY_DIR).join("velstand.onnx"),
             "reset must restore the default, not empty the slot"
         );
     }
@@ -2606,6 +2836,35 @@ mod tests {
     /// [`QUALITY_LABELS`] is what the registry offers and what the file may contain, and
     /// [`Quality::ALL`] is what the daemon can do — a rung in one and not the other is either a
     /// choice the editor writes and `mediad` cannot read, or a mode nobody can select.
+    /// **An absent `[media.intrinsics]` stays `None`.** Only a per-robot solve goes in the config;
+    /// the family calibration is `mediad`'s fallback, so that `Some` here means, unambiguously,
+    /// that this robot was measured — which is what lets `media.video` tag `source: "robot"` versus
+    /// `"family"`. `CameraIntrinsics::alpha` is still the family solve `mediad` reads.
+    #[test]
+    fn an_absent_intrinsics_table_is_none_not_the_family() {
+        assert_eq!(MediaParams::default().intrinsics, None);
+
+        let parsed: Params = toml::from_str("[media]\nbitrate = 2000\n").expect("parses");
+        assert_eq!(parsed.media.intrinsics, None, "absent key");
+        let parsed: Params = toml::from_str("").expect("parses");
+        assert_eq!(parsed.media.intrinsics, None, "absent table");
+
+        // The family solve is a real calibration, just not stored here.
+        assert_eq!(CameraIntrinsics::alpha().width, 1280);
+
+        let parsed: Params = toml::from_str(
+            "[media.intrinsics]\nwidth = 640\nheight = 360\nfx = 500.0\nfy = 501.0\ncx = 320.0\ncy = 180.0\n",
+        )
+        .expect("parses");
+        let own = parsed.media.intrinsics.expect("this robot's own");
+        assert_eq!(
+            (own.width, own.fx),
+            (640, 500.0),
+            "a written table is this robot's own solve"
+        );
+        assert!(own.distortion.is_empty());
+    }
+
     #[test]
     fn every_quality_label_round_trips() {
         assert_eq!(QUALITY_LABELS.len(), Quality::ALL.len());
@@ -2617,6 +2876,42 @@ mod tests {
         }
     }
 
+    /// [`MEDIA_SOURCE_LABELS`] is what the registry offers and what the file may contain, and
+    /// [`MediaSource::ALL`] is what `mediad` can build. A name in one and not the other is either
+    /// a choice the editor writes and `mediad` cannot read, or a source nobody can select.
+    #[test]
+    fn every_media_source_label_round_trips() {
+        assert_eq!(MEDIA_SOURCE_LABELS.len(), MediaSource::ALL.len());
+        for (label, source) in MEDIA_SOURCE_LABELS.iter().zip(MediaSource::ALL) {
+            assert_eq!(*label, source.label());
+            let parsed: Params =
+                toml::from_str(&format!("[media]\nsource = \"{label}\"\n")).expect("parses");
+            assert_eq!(parsed.media.source, source);
+        }
+    }
+
+    /// **The key that was replaced must not come back as a silent default.** A robot carrying the
+    /// old `camera = false` gets the unknown-key warning and this build's default — the camera —
+    /// which is a board that starts using a camera it may not have. Better than refusing to boot
+    /// over an inert key (the `[chorale]` rule), and only defensible if the warning names it, so
+    /// this pins that the key is *ignored* rather than parsed into something.
+    #[test]
+    fn the_retired_camera_boolean_is_ignored_and_named() {
+        let (_, ignored) = without_unknown_keys("[media]\ncamera = false\n").unwrap();
+        assert_eq!(ignored, ["media.camera"]);
+
+        let dir = tempfile::tempdir().unwrap();
+        let path = write(dir.path(), "[media]\ncamera = false\n");
+        let media = Params::load(&path, true)
+            .expect("an inert key must not stop the robot")
+            .media;
+        assert_eq!(
+            media.source,
+            MediaSource::Camera,
+            "the retired key must not still be steering the source"
+        );
+    }
+
     /// The labels are `webrtcsink`'s own property nicknames — the strings that get set on the
     /// element. `gcc`, not `googcc`: a nickname this file spelled its own way would be a config
     /// key that parses, validates, saves, and then silently leaves the element on its default.
@@ -2651,6 +2946,57 @@ mod tests {
         assert_eq!(media.bitrate_resolved(), 3_000_000);
     }
 
+    /// **A camera runs at the configured rung and a test pattern does not**, which is the whole
+    /// of [`MediaParams::geometry`]. Every rung, so a `quality` edit cannot start reaching the
+    /// pattern by accident.
+    #[test]
+    fn only_a_camera_runs_at_the_configured_quality() {
+        let mut media = MediaParams::default();
+        for quality in Quality::ALL {
+            media.quality = quality;
+
+            media.source = MediaSource::Camera;
+            assert_eq!(
+                media.geometry(),
+                (quality.width(), quality.height(), quality.fps()),
+                "a camera streams {}",
+                quality.label()
+            );
+
+            media.source = MediaSource::Test;
+            assert_eq!(
+                media.geometry(),
+                TEST_PATTERN_GEOMETRY,
+                "a test pattern ignores {}",
+                quality.label()
+            );
+        }
+    }
+
+    /// The pattern's geometry has to satisfy the same two constraints every [`Quality`] rung does
+    /// — 16:9, and both axes a multiple of 8 for the encoder's macroblocks — because it goes
+    /// through the same capsfilter and the same encoder. A rate of zero would be a still image.
+    #[test]
+    fn the_test_pattern_is_16_9_and_encodable() {
+        let (width, height, fps) = TEST_PATTERN_GEOMETRY;
+        assert_eq!(width % 8, 0, "width {width} is not a multiple of 8");
+        assert_eq!(height % 8, 0, "height {height} is not a multiple of 8");
+        assert_eq!(width * 9, height * 16, "{width}x{height} is not 16:9");
+        assert!(fps > 0, "a test pattern with no frame rate is a photograph");
+
+        // And it is worth having: a pattern as expensive as the rung it replaces would be this
+        // constant written the long way.
+        let (w, h, f) = MediaParams {
+            source: MediaSource::Camera,
+            ..MediaParams::default()
+        }
+        .geometry();
+        assert!(
+            width * height * fps * 4 < w * h * f,
+            "{width}x{height}@{fps} is not materially cheaper than the default {w}x{h}@{f}"
+        );
+    }
+
     /// A bitrate in the wrong unit is the mistake this band exists to catch: `2000` is somebody
     /// who meant kilobits, and it would produce a stream with no picture in it.
     #[test]
@@ -2671,7 +3017,11 @@ mod tests {
     #[test]
     fn the_defaults_are_what_mediad_streamed_before_the_section_existed() {
         let media = Params::default().media;
-        assert!(media.camera, "mediad.service carried --camera");
+        assert_eq!(
+            media.source,
+            MediaSource::Camera,
+            "mediad.service carried --camera"
+        );
         assert_eq!(media.quality.size(), (1280, 720));
         assert_eq!(media.quality.fps(), 30);
         assert_eq!(media.bitrate_resolved(), 2_000_000);
@@ -2708,7 +3058,7 @@ mod tests {
             from_file.update_gate.max_consecutive_errors,
             built_in.update_gate.max_consecutive_errors
         );
-        assert_eq!(from_file.media.camera, built_in.media.camera);
+        assert_eq!(from_file.media.source, built_in.media.source);
         assert_eq!(from_file.media.quality, built_in.media.quality);
         assert_eq!(
             from_file.media.bitrate_resolved(),
@@ -2761,7 +3111,7 @@ mod tests {
         );
         assert!(skill("roulade").chain, "holding the button chains rolls");
         assert!(!skill("kick_left").chain);
-        assert!(!p.voltage_adapt, "off by default in the prototype");
+        assert!(p.voltage_adapt, "on by default since 2026-09-14");
         assert_eq!(p.nominal_voltage, 7.4);
 
         let name = |p: &Option<std::path::PathBuf>| {
@@ -2769,8 +3119,11 @@ mod tests {
                 .and_then(|p| p.file_name())
                 .map(|n| n.to_string_lossy().into_owned())
         };
-        assert_eq!(p.walk, PathBuf::from(POLICY_DIR).join("alpha_walking.onnx"));
-        assert_eq!(name(&p.stand).as_deref(), Some("alpha_stand.onnx"));
+        assert_eq!(p.walk, PathBuf::from(POLICY_DIR).join("velstand.onnx"));
+        assert!(
+            p.stand.is_none(),
+            "velstand stands on its own; no standing network by default"
+        );
         assert_eq!(name(&p.sitstand).as_deref(), Some("alpha_sitstand.onnx"));
         assert_eq!(
             name(&p.ground_pick).as_deref(),
diff --git a/robotd-params/src/registry.rs b/robotd-params/src/registry.rs
index 6ba6cd28..abdf9e0e 100644
--- a/robotd-params/src/registry.rs
+++ b/robotd-params/src/registry.rs
@@ -53,6 +53,18 @@ pub enum Kind {
     /// this editor cannot edit is still a section it must know exists, or the next repeating
     /// table added to `Params` goes unnoticed.
     Table,
+    /// A **nested table of related values** — `[media.intrinsics]` — written by a tool rather
+    /// than typed.
+    ///
+    /// Distinct from [`Kind::Table`], which is a repeating one, and distinct from every scalar
+    /// kind for the same reason as that: it has no single cursor position. It is also not a thing
+    /// anybody should type — six numbers from a calibration, where a typo produces a plausible
+    /// wrong answer rather than an error — so the editor lists it and says what writes it.
+    ///
+    /// The string is a TOML body for the table, and it earns its place in the type rather than in
+    /// a comment: the completeness test uses it to prove the key parses, so a record whose fields
+    /// are renamed under it fails here instead of at a robot's next boot.
+    Record(&'static str),
 }
 
 /// One key of `robotd.toml`.
@@ -289,24 +301,24 @@ pub const REGISTRY: &[Entry] = &[
         Kind::Integer,
         "Gain for that ramp — softened standing, not limp",
     ),
-    // ── [detect] ─────────────────────────────────────────────────────────────
+    // ── [duck_detector] ──────────────────────────────────────────────────────
     feature(
-        "detect.enabled",
+        "duck_detector.enabled",
         Kind::Bool,
         "Look for other ducks in the camera (mediad runs it; needs a restart)",
     ),
     entry(
-        "detect.model",
+        "duck_detector.model",
         Kind::OptionalPath,
         "Model to run; unset = the release's, .rknn on the NPU before .onnx on the CPU",
     ),
     entry(
-        "detect.hz",
+        "duck_detector.hz",
         Kind::Float,
         "Looks per second. 2 is a thermal limit, not a preference — flat out cooks the board",
     ),
     entry(
-        "detect.threshold",
+        "duck_detector.threshold",
         Kind::Float,
         "Confidence a detection needs, on this model's own scale (int8 scores are not 0..1)",
     ),
@@ -320,7 +332,7 @@ pub const REGISTRY: &[Entry] = &[
     feature(
         "theremin.enabled",
         Kind::Bool,
-        "The ToF theremin may be picked up at all (robot.theremin still starts it)",
+        "The ToF theremin may be picked up at all — off by default (robot.theremin starts it)",
     ),
     entry("theremin.socket", Kind::Text, "tofd's depth stream"),
     entry(
@@ -348,6 +360,12 @@ pub const REGISTRY: &[Entry] = &[
         Kind::Integer,
         "How long a note rides over a sensor dropout, milliseconds",
     ),
+    // ── [head_imu] ───────────────────────────────────────────────────────────
+    feature(
+        "head_imu.enabled",
+        Kind::Bool,
+        "Read the head IMU (BMI088) at all — off by default; ~4% of a core when on",
+    ),
     // ── [audio] ──────────────────────────────────────────────────────────────
     feature(
         "audio.enabled",
@@ -383,9 +401,9 @@ pub const REGISTRY: &[Entry] = &[
     ),
     // ── [media] ──────────────────────────────────────────────────────────────
     feature(
-        "media.camera",
-        Kind::Bool,
-        "Stream the head camera — off is a test pattern, for a board with no camera",
+        "media.source",
+        Kind::Choice(crate::MEDIA_SOURCE_LABELS),
+        "Where video comes from: the head camera, or a cheap test pattern for a board without one",
     ),
     feature(
         "media.quality",
@@ -397,6 +415,13 @@ pub const REGISTRY: &[Entry] = &[
         Kind::OptionalInteger,
         "Starting video bitrate, bits/s — unset follows the quality",
     ),
+    entry(
+        "media.intrinsics",
+        Kind::Record(
+            "width = 1280\nheight = 720\nfx = 1809.5\nfy = 1809.5\ncx = 640.0\ncy = 360.0",
+        ),
+        "This robot's own camera calibration — a per-robot solve writes it; absent, mediad publishes the family's",
+    ),
     entry(
         "media.congestion_control",
         Kind::Choice(crate::CONGESTION_LABELS),
@@ -416,6 +441,35 @@ pub const REGISTRY: &[Entry] = &[
     feature("pad.lb", Kind::Text, "Skill on the left bumper"),
     feature("pad.rb", Kind::Text, "Skill on the right bumper"),
     feature("pad.dpad_down", Kind::Text, "Skill on D-pad down"),
+    // ── [pad_imu_head_control] ───────────────────────────────────────────────
+    //
+    // Controller-IMU head control. Read by `padd`, like `[pad]`. Not `[head_imu]`, which is
+    // the IMU in the robot's head.
+    feature(
+        "pad_imu_head_control.enabled",
+        Kind::Bool,
+        "Y poses the head from the pad's own IMU (Pro Controller) — sticks keep driving; Y again holds, again re-centres",
+    ),
+    entry(
+        "pad_imu_head_control.gain",
+        Kind::Float,
+        "Head radians per pad radian — 1 follows the pad exactly, more amplifies the wrist",
+    ),
+];
+
+/// Sections that changed name: `(old, new)`.
+///
+/// The loader takes the old name through a `#[serde(alias)]` on the field, so a file written
+/// before the rename keeps loading; the editor (`edit.rs`) carries the section to its new name so
+/// its next save cannot leave both in one file, which the loader refuses as a duplicate. Listed
+/// here, beside the registry, because the coverage test below has to know an alias is not a
+/// section of its own — serde names aliases in its "unknown field" message like any other field.
+pub const RENAMED_SECTIONS: &[(&str, &str)] = &[
+    // The pad's IMU steering the head, a letter-swap away from `head_imu` — the IMU *in* the
+    // head. Renamed 2026-09 for that reason alone.
+    ("imu_head", "pad_imu_head_control"),
+    // "detect" read as "detect what?" in the editor. Renamed 2026-09 for the thing it detects.
+    ("detect", "duck_detector"),
 ];
 
 /// The registry entry for a key, if it is one.
@@ -480,6 +534,8 @@ mod tests {
             .skip(1)
             .step_by(2)
             .filter(|name| *name != "__no_such_section__")
+            // An old name is an alias for a section already in this list, not a section.
+            .filter(|name| !RENAMED_SECTIONS.iter().any(|(old, _)| old == name))
             .map(str::to_owned)
             .collect();
         // A sanity anchor so a serde message change cannot pass vacuously: the sections this
@@ -534,6 +590,9 @@ mod tests {
                 Kind::Table => {
                     format!("[[{section}.{key}]]\nname = \"probe\"\nduration = 1.0\n")
                 }
+                // A record carries its own body, so this proves the *fields* still parse and not
+                // merely that something table-shaped is accepted.
+                Kind::Record(body) => format!("[{section}.{key}]\n{body}\n"),
             };
             let parsed: Result<Params, _> = toml::from_str(&probe);
             assert!(
@@ -593,13 +652,14 @@ mod tests {
                 "policy.voltage_adapt",
                 "safety.battery_empty_shutdown",
                 "safety.limp_fall",
-                "detect.enabled",
+                "duck_detector.enabled",
                 "chorale.accept",
                 "theremin.enabled",
+                "head_imu.enabled",
                 "audio.enabled",
                 "audio.greet",
                 "audio.pet_detect",
-                "media.camera",
+                "media.source",
                 "media.quality",
                 // The five one-shot buttons. Front-page keys because "what does this button do"
                 // is a question somebody asks holding the pad, not while reading tuning docs.
@@ -608,6 +668,7 @@ mod tests {
                 "pad.lb",
                 "pad.rb",
                 "pad.dpad_down",
+                "pad_imu_head_control.enabled",
             ]
         );
     }
diff --git a/robotd/src/control.rs b/robotd/src/control.rs
index f0a81784..a02ec53e 100644
--- a/robotd/src/control.rs
+++ b/robotd/src/control.rs
@@ -279,6 +279,7 @@ impl Controller {
     /// exception is a seated robot, which carries across whatever changed: the seat is a static
     /// pose on a constant flag, and any sitstand network asked to hold it holds it.
     pub fn carry_over(&mut self, from: &Controller) {
+        self.policy.carry_over(&from.policy);
         self.last_action = from.last_action;
         self.previous = from.previous;
         self.ground_pick = from.ground_pick;
@@ -291,8 +292,9 @@ impl Controller {
     ///
     /// Called when the policy is re-enabled, so a robot that sat disabled for a minute does
     /// not resume with a stale action in its observation and a filter anchored to wherever
-    /// it was before.
+    /// it was before. Recurrent networks also discard their episode memory.
     pub fn reset(&mut self) {
+        self.policy.reset();
         self.last_action = [0.0; ACTION_LEN];
         self.previous = None;
     }
@@ -456,6 +458,10 @@ impl Controller {
                     let chains = active.phase == SkillPhase::Holding
                         && def.is_some_and(|d| d.chain)
                         && active.chain > 0.0;
+                    if chains {
+                        // A chained replay is a new episode even though Net is unchanged.
+                        self.policy.reset();
+                    }
                     chains.then(|| ActiveSkill {
                         phase: SkillPhase::Holding,
                         remaining: def.map_or(0.0, |d| d.duration),
@@ -649,6 +655,41 @@ impl Controller {
 mod tests {
     use super::*;
 
+    #[test]
+    #[ignore = "requires ONNX Runtime >= 1.23"]
+    fn recurrent_memory_resets_with_controller_feedback() {
+        let path = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+            .join("../duck-control/tests/fixtures/lstm.onnx");
+        let policy = Policy::load(
+            &duck_control::policy::PolicyPaths {
+                walk: path,
+                ..Default::default()
+            },
+            0.05,
+        )
+        .unwrap();
+        let mut controller = Controller::new(policy, Tuning::default(), SkillTuning::default());
+        let sensors = duck_control::Sensors::default();
+        let command = Command::default();
+        let first = controller
+            .step(&sensors, &command, false, 0.02, 1.0)
+            .unwrap()
+            .targets;
+        let next = controller
+            .step(&sensors, &command, false, 0.02, 1.0)
+            .unwrap()
+            .targets;
+        assert_ne!(first, next);
+        controller.reset();
+        assert_eq!(
+            first,
+            controller
+                .step(&sensors, &command, false, 0.02, 1.0)
+                .unwrap()
+                .targets
+        );
+    }
+
     /// The prototype's **current alpha configuration** — its built-in defaults, which the
     /// installer deliberately passes no flags to override. The filters are ON at the values
     /// the policies are trained with; changing any of these silently changes how the robot
diff --git a/robotd/src/intents.rs b/robotd/src/intents.rs
index b487338a..b3f515f8 100644
--- a/robotd/src/intents.rs
+++ b/robotd/src/intents.rs
@@ -12,8 +12,8 @@
 //! Every slot is stamped, because the loop's real question is never "what is the value" but
 //! "how old is it". That is what the deadman reads.
 
-use std::sync::Arc;
 use std::sync::atomic::{AtomicBool, AtomicU8, Ordering};
+use std::sync::{Arc, Mutex};
 
 /// "No mode switch pending" in [`Intents::mode_switch`].
 ///
@@ -198,6 +198,9 @@ pub struct Intents {
     /// The wheee hold, as a stamped level: `padd` re-notifies while the trigger is down,
     /// and the loop reads value + age so a dead client's ride decays instead of looping.
     wheee: ArcSwap<Stamped<bool>>,
+    /// `robot.rebootMotors`, pending: the ids to reboot (empty = all). A mutex rather than an
+    /// atomic because it carries a list; the loop takes it with `try_lock`, so it can never wait.
+    reboot_motors: Mutex<Option<Vec<u8>>>,
 }
 
 /// A pending policy change, as [`Intents::request_policy_change`] took it.
@@ -282,6 +285,7 @@ impl Intents {
             mode_switch: AtomicU8::new(MODE_NONE),
             policy_change: ArcSwapOption::empty(),
             sounds: std::sync::atomic::AtomicU32::new(0),
+            reboot_motors: Mutex::new(None),
             wheee: ArcSwap::from_pointee(Stamped {
                 value: false,
                 at_us: 0,
@@ -465,6 +469,24 @@ impl Intents {
     /// Ask the loop to cut power to the joints.
     ///
     /// Also clears `enabled`: a robot that has been asked to go limp is not one the policy should
+    /// Ask the loop to reboot these servos (empty = all). Clears `enabled` for the same reason
+    /// [`Self::request_relax`] does: the robot comes back up when someone asks, not mid-reboot.
+    pub fn request_reboot_motors(&self, ids: Vec<u8>) {
+        self.enabled.store(false, Ordering::Relaxed);
+        if let Ok(mut slot) = self.reboot_motors.lock() {
+            *slot = Some(ids);
+        }
+    }
+
+    /// Take the pending reboot request, if any. Never blocks: a contended lock reads as "nothing
+    /// yet" and the request is picked up on the next tick.
+    pub fn take_reboot_motors(&self) -> Option<Vec<u8>> {
+        self.reboot_motors
+            .try_lock()
+            .ok()
+            .and_then(|mut slot| slot.take())
+    }
+
     /// keep driving, and leaving that flag set would have the next tick bring it straight back up.
     pub fn request_relax(&self) {
         self.enabled.store(false, Ordering::Relaxed);
diff --git a/robotd/src/main.rs b/robotd/src/main.rs
index 7f57252f..ec164489 100644
--- a/robotd/src/main.rs
+++ b/robotd/src/main.rs
@@ -26,7 +26,7 @@ mod soc;
 mod sound;
 mod theremin;
 
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 use std::process::ExitCode;
 use std::sync::Arc;
 use std::sync::atomic::{AtomicBool, AtomicU8, AtomicU32, AtomicU64, Ordering};
@@ -54,7 +54,8 @@ type PowerOff = Arc<dyn Fn() + Send + Sync>;
 
 /// Model API version this build implements (`updater-design.md` §5.5). Bump when the
 /// sensor-input / actuator-output contract a model sees changes.
-const MODEL_API: u32 = 1;
+// API 2 adds explicit recurrent state; API 1 feed-forward models remain supported.
+const MODEL_API: u32 = 2;
 
 /// Socket mode. Same reasoning as `updaterd`'s: the group decides who may ask.
 const SOCKET_MODE: u32 = 0o660;
@@ -67,6 +68,22 @@ const MAX_LINE: usize = 64 * 1024;
 /// journal size cap it is what *evicts* the logs support needs.
 const LOOP_SUMMARY_INTERVAL: Duration = Duration::from_secs(300);
 
+/// How often an *isolated* dropped bus transaction is worth a line.
+///
+/// One drop is ordinary on a serial bus and a run of them is a fault, so the loop logs the first
+/// of a run and every tenth after it. That rule reads `consecutive_errors`, which resets on the
+/// next good read — so it never fired on the case a board actually produces: one drop, one good
+/// read, one drop, at about a hertz, forever `consecutive=1`. Every one of them was logged.
+///
+/// Which is the failure [`LOOP_SUMMARY_INTERVAL`] exists to prevent, arriving by another door: a
+/// journal under a size cap, filled with the most ordinary event the robot has, evicting the
+/// history somebody will need — and, since `duckctl logs` reads that journal over a radio, forty
+/// lines of it saying nothing else.
+///
+/// So an isolated drop gets one line a minute, carrying how many it stands for. A *run* is not
+/// rate-limited: that is the spasm, and it stays as loud as it was.
+const BUS_DROP_QUIET: Duration = Duration::from_secs(60);
+
 /// How fast the beak follows the vowel being sung, as a time constant.
 ///
 /// A vowel is a step — `ah` opens the mouth to 0.90 and `mm` to 0.02 — and a servo asked to jump
@@ -219,11 +236,23 @@ struct Args {
     #[arg(long)]
     port: Option<String>,
 
-    /// Run against a robot made of nothing. For laptop development and tests — there is no
-    /// simulator yet, and this is what stands in for one.
+    /// Run against a robot made of nothing. For laptop development and tests, and for the cases
+    /// `--sim` does not cover: no physics, no falling over, positions that echo back perfectly.
     #[arg(long)]
     fake: bool,
 
+    /// Run against a robot in MuJoCo, at `host:port`.
+    ///
+    /// **The same daemon, a simulated body.** Everything above `duck_control::io::RobotIo` — the
+    /// loop, the policy, safety, fall detection, odometry, kinematics, every IPC call — is the code
+    /// that runs on a robot, unchanged and unable to tell. `duck_control::sim` has the protocol and
+    /// the reasons for its shape; `docs/design/simulation.md` has what it is and is not a twin of.
+    ///
+    /// Nothing is connected until the first tick, and a simulator that goes away is retried on
+    /// every tick after — restarting MuJoCo must not mean restarting the duck.
+    #[arg(long, conflicts_with = "fake")]
+    sim: Option<String>,
+
     /// Do not load a policy: run the loop and hold the startup pose.
     ///
     /// Distinct from a policy that failed to load, which is unhealthy. This is the
@@ -599,6 +628,12 @@ struct RobotState {
     /// drops off the I²C bus — and an accepted theremin on a duck with no depth is a
     /// feature that silently does nothing.
     theremin_ready: AtomicBool,
+    /// Whether `[theremin] enabled` allows an instrument at all, and there is a voice to play
+    /// it in. Read once at startup, like the policies — and kept separate from
+    /// [`State::theremin_ready`] so that the refusal can name the switch. Off is the default,
+    /// so "the feature is not turned on" is the answer most of these refusals want, and
+    /// sending that person to look at `tofd` wastes their evening.
+    theremin_allowed: bool,
     /// Whether this robot's config allows it to sing with others. Read once at startup, like the
     /// policies: `[chorale] accept`, false by default.
     chorale_accepted: bool,
@@ -665,6 +700,7 @@ impl RobotState {
             config_path: config_path.to_owned(),
             has_voice: params.audio.enabled && has_any_wav(&params.audio.bank),
             theremin_ready: AtomicBool::new(false),
+            theremin_allowed: params.theremin.enabled && params.audio.enabled,
             chorale_accepted: params.chorale.accept,
             mode: AtomicU8::new(mode_code(params.policy.mode)),
             fallen: AtomicBool::new(false),
@@ -878,8 +914,6 @@ async fn main() -> ExitCode {
         .with_writer(std::io::stderr)
         .init();
 
-    duck_ipc_proto::log_startup_identity!("robotd");
-
     let explicit = args.params.is_some();
     let params_path = args
         .params
@@ -900,9 +934,30 @@ async fn main() -> ExitCode {
     }
 
     if let Some(Command::Init { duration }) = args.command {
+        // init opens the motor bus itself. Keep ownership until the whole ramp returns,
+        // so neither a daemon nor another init can join it partway through.
+        let _instance_lock = match claim_lock(&args.socket) {
+            Ok(lock) => lock,
+            Err(e) => {
+                tracing::error!(path = %args.socket.display(), error = %e, "cannot claim robot IPC socket");
+                return ExitCode::FAILURE;
+            }
+        };
+        duck_ipc_proto::log_startup_identity!("robotd");
         return run_init(&params, duration);
     }
 
+    // Own the endpoint before publishing an identity or starting a thread that can touch
+    // the motors. Keep the lock through control-thread shutdown and socket cleanup.
+    let (_instance_lock, listener) = match claim_socket(&args.socket).await {
+        Ok(owned) => owned,
+        Err(e) => {
+            tracing::error!(path = %args.socket.display(), error = %e, "cannot claim robot IPC socket");
+            return ExitCode::FAILURE;
+        }
+    };
+    duck_ipc_proto::log_startup_identity!("robotd");
+
     let state = Arc::new(RobotState::new(
         &params,
         &params_path,
@@ -947,6 +1002,7 @@ async fn main() -> ExitCode {
     let serving = serve(
         Arc::clone(&state),
         Arc::clone(&intents),
+        listener,
         args.socket.clone(),
     );
     let mut code = ExitCode::SUCCESS;
@@ -971,17 +1027,12 @@ async fn main() -> ExitCode {
 /// Enable torque and ramp to the home pose.
 #[cfg(target_os = "linux")]
 fn run_init(params: &Params, duration: Duration) -> ExitCode {
-    let mut io = match duck_control::bus::DynamixelIo::open(&params.bus.port) {
-        Ok(io) => io,
-        Err(e) => {
-            tracing::error!(error = %e, port = %params.bus.port, "cannot open the bus");
-            return ExitCode::FAILURE;
-        }
-    };
-    if let Err(e) = io.check_registers() {
-        tracing::error!(error = %e, "motor register check failed");
+    // The same open as the daemon's, replacement adoption included: `init` is what someone
+    // reaches for right after a motor swap, and it must not be the one path that refuses the
+    // new servo.
+    let Some(mut io) = open_bus(&params.bus.port, 0) else {
         return ExitCode::FAILURE;
-    }
+    };
     if let Err(e) = io.set_torque(true) {
         tracing::error!(error = %e, "cannot enable torque");
         return ExitCode::FAILURE;
@@ -1028,6 +1079,7 @@ fn spawn_control_thread(
 ) -> std::io::Result<std::thread::JoinHandle<()>> {
     let period = params.period();
     let fake = args.fake;
+    let sim = args.sim.clone();
     let port = params.bus.port.clone();
     let params = params.clone();
     // So a reload can re-read `[policy]` without a restart. The path rather than the loaded
@@ -1065,6 +1117,24 @@ fn spawn_control_thread(
                 return;
             }
 
+            // No `open_bus_waiting` equivalent, deliberately: `RemoteIo` connects lazily and
+            // reconnects on every tick, so a duck started before its simulator simply reports
+            // unhealthy until the simulator answers — which is what a robot with no power on the
+            // bus does too, by a different route.
+            if let Some(addr) = sim {
+                tracing::warn!(%addr, "--sim: the body is in MuJoCo");
+                runtime.block_on(control_loop(
+                    duck_control::sim::RemoteIo::at(addr),
+                    state,
+                    intents,
+                    params,
+                    params_path,
+                    period,
+                    poweroff,
+                ));
+                return;
+            }
+
             // Waiting, not one shot. `open_bus` verifies motor registers, which means it
             // talks to the servos — so on an unpowered board it fails and this used to fall
             // straight off the end of the thread. No control loop was ever created, and
@@ -1131,6 +1201,9 @@ fn open_bus(port: &str, attempt: u32) -> Option<BusIo> {
             return None;
         }
     };
+    if !adopt_missing_servo(&mut io, loud) {
+        return None;
+    }
     match io.check_registers() {
         Ok(0) => tracing::info!("motor registers already correct"),
         Ok(n) => tracing::warn!(corrected = n, "motor registers corrected"),
@@ -1148,6 +1221,67 @@ fn open_bus(port: &str, attempt: u32) -> Option<BusIo> {
     Some(io)
 }
 
+/// The motor-swap path: if exactly one expected servo is silent and a factory-fresh one
+/// answers instead, flash the new one as the missing joint.
+///
+/// A ping census of the fifteen expected IDs is all a complete bus pays for this. The
+/// factory-defaults probe — which reopens the port at 57 600 baud — only runs once a single
+/// servo is known to be missing, so an ordinary boot never scans for anything.
+///
+/// Returns whether the bus is worth checking further. `false` is "keep waiting": every servo
+/// unpowered, a servo missing with nothing fresh to replace it, or two missing at once, which
+/// cannot be told apart and is left to a human.
+#[cfg(target_os = "linux")]
+fn adopt_missing_servo(io: &mut BusIo, loud: bool) -> bool {
+    use duck_control::bus::replacement_target;
+
+    let missing = match io.missing_servos() {
+        Ok(missing) => missing,
+        Err(e) => {
+            if loud {
+                tracing::error!(error = %e, "cannot ping the servos; waiting, is servo power on?");
+            }
+            return false;
+        }
+    };
+    if missing.is_empty() {
+        return true;
+    }
+    if missing.len() == duck_control::NUM_JOINTS {
+        // Not a swap, just no power yet; `check_registers` below says so in the words people
+        // already know.
+        return true;
+    }
+    let Some(id) = replacement_target(&missing) else {
+        if loud {
+            tracing::error!(
+                ?missing,
+                "several servos are missing; a replacement can only be adopted one at a time, waiting"
+            );
+        }
+        return false;
+    };
+    match io.adopt_replacement(id) {
+        Ok(true) => true,
+        Ok(false) => {
+            if loud {
+                tracing::error!(
+                    id,
+                    "servo missing and nothing answers at factory defaults (id 1, 57600 baud); \
+                     is it plugged in? waiting"
+                );
+            }
+            false
+        }
+        Err(e) => {
+            if loud {
+                tracing::error!(error = %e, id, "adopting the replacement servo failed; waiting");
+            }
+            false
+        }
+    }
+}
+
 #[cfg(not(target_os = "linux"))]
 fn open_bus(_port: &str, _attempt: u32) -> Option<BusIo> {
     tracing::error!("no bus on this platform; use --fake");
@@ -1230,6 +1364,19 @@ impl Bringup {
     }
 }
 
+/// One low-pass step toward `target`.
+///
+/// A non-finite target is dropped, not folded in: `ema += α·(inf − ema)` is `inf` on this
+/// tick and on every tick after, because nothing finite can climb back out of it. The wire
+/// can produce one — JSON parses `1e400` as infinity — and the safety layer below refuses
+/// non-finite joint targets rather than clamping them, so a single bad `robot.move` would
+/// otherwise freeze the robot on its hold pose until reboot.
+fn slew(ema: &mut f64, target: f64, alpha: f64) {
+    if target.is_finite() {
+        *ema += alpha * (target - *ema);
+    }
+}
+
 async fn adopt_startup_pose<T: RobotIo>(
     safety: &mut Safety<T>,
     state: &RobotState,
@@ -1643,6 +1790,11 @@ async fn control_loop<T: RobotIo>(
     let mut window_start = Instant::now();
     let mut window_ticks = 0u64;
     let mut last_summary = Instant::now();
+    // Dropped bus reads: when one was last reported, how many have gone unreported since, and how
+    // many happened in this summary window. See [`BUS_DROP_QUIET`].
+    let mut last_bus_drop: Option<Instant> = None;
+    let mut bus_drops_quiet = 0u32;
+    let mut bus_drops_window = 0u32;
     let mut was_driving = false;
     let mut bringup = Bringup::Limp;
     // A mode switch in flight: the mode to end up in, once the robot is home. `None` the rest of
@@ -1733,12 +1885,16 @@ async fn control_loop<T: RobotIo>(
         None
     };
 
-    // The theremin. Its depth reader starts now and parks on `tofd`'s socket whether or not
-    // anyone ever asks for an instrument: one blocked read costs nothing, and connecting
-    // lazily would make the first arming window wait for a connection as well as for
-    // frames — a second of silence that reads as a broken feature. Off entirely when the
-    // params say so, or when audio is off, since a theremin with no voice is a mouth
-    // opening for no reason.
+    // The theremin. `[theremin] enabled` is off by default, so on most ducks this is `None`
+    // and nothing here subscribes to depth at all — `tofd` keeps its own counsel, and
+    // `robotctl monitor` is unaffected either way, since it subscribes to `tofd` itself.
+    //
+    // On a duck that has turned it on, the depth reader starts *now* and parks on `tofd`'s
+    // socket whether or not anyone ever asks for an instrument: one blocked read costs
+    // nothing, and connecting lazily would make the first arming window wait for a
+    // connection as well as for frames — a second of silence that reads as a broken feature.
+    // Also off when audio is off, since a theremin with no voice is a mouth opening for no
+    // reason.
     let mut theremin = (params.theremin.enabled && params.audio.enabled)
         .then(|| theremin::Theremin::spawn(params.theremin.socket.clone(), params.theremin.hand()));
     // How far the beak is open for the chorale, slewed across ticks — see where it is written.
@@ -1782,22 +1938,47 @@ async fn control_loop<T: RobotIo>(
         voice.play("greet", false);
     }
 
+    // When the joints in `sensors` were actually read, `CLOCK_MONOTONIC` ns — the clock
+    // `tof.frame` and a mapper share. Stamped at the read, not at publish, because
+    // `controller.step()` (an ONNX forward pass) sits between the two and would bias every
+    // `robot.state` timestamp by one inference otherwise. It rides the coast: a coasted tick
+    // republishes the last fresh sample, so it must republish that sample's read time too.
+    let mut sensors_read_ns = 0u64;
     while !state.shutdown.load(Ordering::Relaxed) {
         ticker.tick().await;
         let tick_start = Instant::now();
 
+        let read_at = proto::clock::monotonic_ns();
         let fresh = match safety.read() {
             Ok(sensors) => {
                 state.consecutive_errors.store(0, Ordering::Relaxed);
+                sensors_read_ns = read_at;
                 Some(sensors)
             }
             Err(e) => {
                 let n = state.consecutive_errors.fetch_add(1, Ordering::Relaxed) + 1;
-                // One dropped transaction is ordinary on a serial bus; a run of them is not.
-                // Log the first and then every tenth, so a persistent fault is visible
-                // without a wall of identical lines.
-                if n == 1 || n.is_multiple_of(10) {
-                    tracing::warn!(error = %e, consecutive = n, "bus read failed");
+                bus_drops_window += 1;
+
+                // A run of them is a fault, and stays as loud as it was: every tenth, at once.
+                // An isolated drop is ordinary, and `consecutive` resets on the next good read —
+                // so `n == 1` was true of every drop on a bus that recovers each time, and
+                // logging on it filled the journal. One line per [`BUS_DROP_QUIET`], saying how
+                // many it stands for.
+                let a_run = n.is_multiple_of(10);
+                let due = last_bus_drop.is_none_or(|at| at.elapsed() >= BUS_DROP_QUIET);
+                if a_run || due {
+                    tracing::warn!(
+                        error = %e,
+                        consecutive = n,
+                        // Zero on a run, and on the first drop after a quiet spell. Non-zero is
+                        // the rate: that many more happened and were not worth their own lines.
+                        also = bus_drops_quiet,
+                        "bus read failed"
+                    );
+                    last_bus_drop = Some(Instant::now());
+                    bus_drops_quiet = 0;
+                } else {
+                    bus_drops_quiet += 1;
                 }
                 None
             }
@@ -1894,6 +2075,33 @@ async fn control_loop<T: RobotIo>(
             None => {}
         }
 
+        // `robot.rebootMotors`: torque off everywhere, then REBOOT the named servos (every servo
+        // when none are named). The rebooted servos are off the bus for a few hundred milliseconds
+        // — the reads fail and the loop coasts through it — and come back with torque off and
+        // EEPROM gains; the forgotten gain cache makes the next write restore the gains, and the
+        // robot is back at limp, so the next `init` or Start brings it up like a fresh boot. Torque
+        // off first on purpose: a tripped servo is usually a leg, and a robot standing on the other
+        // leg while one reboots is not a robot to leave standing.
+        if let Some(ids) = intents.take_reboot_motors() {
+            let ids: Vec<u8> = if ids.is_empty() {
+                duck_control::model::JOINT_IDS.to_vec()
+            } else {
+                ids
+            };
+            if let Err(e) = safety.set_torque(false) {
+                tracing::warn!(error = %e, "robot.rebootMotors: torque off failed on a servo; rebooting anyway");
+            }
+            match safety.reboot_motors(&ids) {
+                Ok(()) => tracing::warn!(
+                    ?ids,
+                    "robot.rebootMotors: rebooted; init or Start brings the robot up"
+                ),
+                Err(e) => tracing::warn!(error = %e, ?ids, "robot.rebootMotors: failed part-way"),
+            }
+            bringup = Bringup::Limp;
+            was_driving = false;
+        }
+
         // One-shot skill requests, taken once per tick like the power request. They need a
         // driving robot — the prototype's buttons likewise did nothing until the policy ran.
         let requests = intents.take_skills();
@@ -2289,14 +2497,14 @@ async fn control_loop<T: RobotIo>(
             twist_ema = [0.0; 3];
         }
         for (ema, target) in twist_ema.iter_mut().zip(twist_target) {
-            *ema += cmd_alpha * (target - *ema);
+            slew(ema, target, cmd_alpha);
         }
         for (ema, target) in head_ema.iter_mut().zip(gated.head) {
-            *ema += head_alpha * (target - *ema);
+            slew(ema, target, head_alpha);
         }
         if snapshot.pose.active {
             for (ema, target) in body_ema.iter_mut().zip(snapshot.pose.body) {
-                *ema += cmd_alpha * (target - *ema);
+                slew(ema, target, cmd_alpha);
             }
         } else {
             body_ema = [0.0; 3];
@@ -2559,6 +2767,11 @@ async fn control_loop<T: RobotIo>(
         if was_driving && !driving {
             stopped_driving_at = Some(tick_start);
             if !snapshot.enabled {
+                // Even a brief explicit disable ends the recurrent episode. The resume
+                // grace period below is for dropped sensor reads, not a user's stop.
+                if let Some(controller) = controller.as_mut() {
+                    controller.reset();
+                }
                 // A deliberate stop returns to the home pose — the prototype's Start-off
                 // ("policy DISABLED - returning to default pose"). Commanded directly, no
                 // ramp: the servos do the travel at their own speed, and the robot is
@@ -2872,6 +3085,15 @@ async fn control_loop<T: RobotIo>(
                 },
                 theremin: theremin_state.clone(),
                 chorale: chorale_state.clone(),
+                t_ns: sensors_read_ns,
+                imu: Some(proto::ImuState {
+                    gyro: sensors.imu.gyro,
+                    quat: sensors.imu.quat,
+                }),
+                frames: Some(mapping::frames_at(mapping::head_joints_of(
+                    &sensors.positions,
+                ))),
+                skeleton: mapping::skeleton_at(&sensors.positions),
             });
         }
 
@@ -2899,6 +3121,9 @@ async fn control_loop<T: RobotIo>(
                     total = ticks,
                     hz = format!("{hz:.1}"),
                     missed = state.missed.load(Ordering::Relaxed),
+                    // Every dropped bus read in this window, reported or suppressed. The warnings
+                    // above are rate-limited, so this is where the true rate lives.
+                    bus_drops = bus_drops_window,
                     driving,
                     fallen = safety.fallen(),
                     battery_v = format!(
@@ -2916,6 +3141,7 @@ async fn control_loop<T: RobotIo>(
                     "control loop"
                 );
                 last_summary = Instant::now();
+                bus_drops_window = 0;
             }
         }
     }
@@ -3069,25 +3295,91 @@ fn publish_slow_sensors<T: RobotIo>(io: &mut Safety<T>, state: &RobotState) {
     }
 }
 
+/// Own an endpoint even when no listener exists, as during startup or standalone init.
+fn claim_lock(socket_path: &Path) -> std::io::Result<std::fs::File> {
+    use std::fs::{OpenOptions, TryLockError};
+    use std::io::{Error, ErrorKind};
+
+    if let Some(parent) = socket_path.parent().filter(|p| !p.as_os_str().is_empty()) {
+        std::fs::create_dir_all(parent)?;
+    }
+
+    // Append, rather than replace the extension: distinct --socket paths need distinct
+    // locks. Never unlink this file, even at shutdown — a waiter could already have the
+    // old inode open. The kernel releases the lock on exit, including SIGKILL.
+    let mut lock_path = socket_path.as_os_str().to_os_string();
+    lock_path.push(".lock");
+    let lock = OpenOptions::new()
+        .create(true)
+        .read(true)
+        .write(true)
+        .truncate(false)
+        .open(lock_path)?;
+    match lock.try_lock() {
+        Ok(()) => (),
+        Err(TryLockError::WouldBlock) => {
+            return Err(Error::new(
+                ErrorKind::AddrInUse,
+                "another robotd owns this socket",
+            ));
+        }
+        Err(TryLockError::Error(e)) => return Err(e),
+    }
+    Ok(lock)
+}
+
+/// Claim one daemon endpoint, including the window before there is a listener to probe.
+async fn claim_socket(socket_path: &Path) -> std::io::Result<(std::fs::File, UnixListener)> {
+    use std::io::ErrorKind;
+    use std::os::unix::fs::{FileTypeExt, PermissionsExt};
+
+    let lock = claim_lock(socket_path)?;
+    // Before bind, not after it. A regular file or a symlink at the path is a typo, and it is
+    // refused here on every platform rather than left to the kernel: Linux fails to bind over
+    // either, which is what made this look enforced, but macOS follows a dangling symlink and
+    // creates the socket at its target, so a daemon there came up serving through a path nobody
+    // asked for. That is the one platform `cargo test --workspace` is promised on.
+    match std::fs::symlink_metadata(socket_path) {
+        Ok(existing) if !existing.file_type().is_socket() => {
+            return Err(std::io::Error::new(
+                ErrorKind::AddrInUse,
+                "the socket path exists and is not a socket; refusing to bind over it",
+            ));
+        }
+        Ok(_) => (),
+        Err(e) if e.kind() == ErrorKind::NotFound => (),
+        Err(e) => return Err(e),
+    }
+    let listener = match UnixListener::bind(socket_path) {
+        Ok(listener) => listener,
+        Err(e) if e.kind() == ErrorKind::AddrInUse => {
+            // An older daemon may own the socket without holding our new lock. Only a
+            // real socket that refuses connections is stale; a timeout or a permission error
+            // is not permission to remove somebody else's path.
+            match tokio::time::timeout(Duration::from_secs(1), UnixStream::connect(socket_path))
+                .await
+            {
+                Ok(Err(probe)) if probe.kind() == ErrorKind::ConnectionRefused => {
+                    tracing::warn!(path = %socket_path.display(), "removing stale socket");
+                    std::fs::remove_file(socket_path)?;
+                    UnixListener::bind(socket_path)?
+                }
+                Ok(Err(probe)) => return Err(probe),
+                _ => return Err(e),
+            }
+        }
+        Err(e) => return Err(e),
+    };
+    std::fs::set_permissions(socket_path, std::fs::Permissions::from_mode(SOCKET_MODE))?;
+    Ok((lock, listener))
+}
+
 async fn serve(
     state: Arc<RobotState>,
     intents: Arc<Intents>,
+    listener: UnixListener,
     socket_path: PathBuf,
 ) -> std::io::Result<()> {
-    // A leftover socket from a killed process must not stop us coming up.
-    if socket_path.exists() {
-        tracing::warn!(path = %socket_path.display(), "removing stale socket");
-        let _ = std::fs::remove_file(&socket_path);
-    }
-    if let Some(parent) = socket_path.parent() {
-        let _ = std::fs::create_dir_all(parent);
-    }
-
-    let listener = UnixListener::bind(&socket_path)?;
-
-    use std::os::unix::fs::PermissionsExt;
-    std::fs::set_permissions(&socket_path, std::fs::Permissions::from_mode(SOCKET_MODE))?;
-
     tracing::info!(
         path = %socket_path.display(),
         mode = format!("{SOCKET_MODE:o}"),
@@ -3924,6 +4216,15 @@ fn dispatch(
                     accepted: false,
                     reason: Some("this robot has no voice to play a theremin in".to_owned()),
                 }
+            } else if p.active && !state.theremin_allowed {
+                proto::ThereminResult {
+                    accepted: false,
+                    reason: Some(
+                        "the theremin is off by default — turn `[theremin] enabled` on with \
+                         `robotctl configure`, which offers the robotd restart it needs"
+                            .to_owned(),
+                    ),
+                }
             } else if p.active && !state.theremin_ready.load(Ordering::Relaxed) {
                 proto::ThereminResult {
                     accepted: false,
@@ -3999,6 +4300,10 @@ fn dispatch(
         // What each slot is running, from where, and why it is not running what was asked. Served
         // from the snapshot the control loop publishes, so it answers during startup too rather
         // than racing the first load.
+        // The geometry the mapping fields of `robot.state` are stated in. Constant for the
+        // life of the process, read from the same asset the FK runs on.
+        proto::Call::RobotModel => proto::Response::ok(Some(id), &mapping::model()),
+
         proto::Call::RobotPolicies => proto::Response::ok(
             Some(id),
             &proto::PoliciesResult {
@@ -4206,6 +4511,12 @@ fn dispatch(
             proto::Response::ok(Some(id), &proto::IntentResult::accepted())
         }
 
+        // Never refused: a robot with a tripped servo is exactly the one that needs it.
+        proto::Call::RobotRebootMotors(p) => {
+            intents.request_reboot_motors(p.ids.clone());
+            proto::Response::ok(Some(id), &proto::IntentResult::accepted())
+        }
+
         proto::Call::RobotHealth => proto::Response::ok(Some(id), &state.health()),
         proto::Call::RobotSafeToRestart => proto::Response::ok(Some(id), &state.safe_to_restart()),
         proto::Call::RobotModelApi => proto::Response::ok(
@@ -4271,6 +4582,167 @@ async fn shutdown() {
     }
 }
 
+/// What `robot.state` carries for a mapper, and what `robot.model` answers: sensor poses from
+/// the head FK, and the static geometry they are stated in. One place, the `kinematics` crate,
+/// so a laptop or a server that pairs a picture with a pose asks rather than transcribes.
+mod mapping {
+    use std::sync::LazyLock;
+
+    use duck_ipc_proto as proto;
+
+    static FK: LazyLock<kinematics::head::HeadFk> = LazyLock::new(kinematics::head::HeadFk::alpha);
+    static TOF: LazyLock<kinematics::tof::Reprojector> =
+        LazyLock::new(kinematics::tof::Reprojector::alpha);
+
+    /// The head joints, in [`kinematics::head::HeadFk`]'s order, out of a full joint vector.
+    const HEAD: [&str; 4] = ["neck_pitch", "head_pitch", "head_yaw", "head_roll"];
+
+    pub fn head_joints_of(positions: &[f64]) -> [f64; 4] {
+        let mut out = [0.0; 4];
+        for (slot, name) in out.iter_mut().zip(HEAD) {
+            if let Some(i) = proto::JOINT_NAMES.iter().position(|n| *n == name) {
+                *slot = positions.get(i).copied().unwrap_or(0.0);
+            }
+        }
+        out
+    }
+
+    fn pose(p: kinematics::Pose) -> proto::PoseState {
+        proto::PoseState {
+            pos: p.pos,
+            quat: p.quat.wxyz(),
+        }
+    }
+
+    /// Every body's pose in the trunk frame, in [`Model::body_names`] order, from the full measured
+    /// joint vector — the whole skeleton for a viewer. The model's joint order is the MJCF's, not
+    /// the wire's, so the angles are gathered by name from [`proto::JOINT_NAMES`]-ordered positions.
+    pub fn skeleton_at(positions: &[f64]) -> Vec<proto::PoseState> {
+        let model = kinematics::Model::alpha();
+        let angles: Vec<f64> = model
+            .joint_names()
+            .map(|n| {
+                proto::JOINT_NAMES
+                    .iter()
+                    .position(|w| *w == n)
+                    .and_then(|i| positions.get(i).copied())
+                    .unwrap_or(0.0)
+            })
+            .collect();
+        model.body_poses(&angles).into_iter().map(pose).collect()
+    }
+
+    fn skeleton_links() -> Vec<proto::SkeletonLink> {
+        let model = kinematics::Model::alpha();
+        let parents = model.body_parents();
+        model
+            .body_names()
+            .enumerate()
+            .map(|(i, name)| proto::SkeletonLink {
+                name: name.to_owned(),
+                parent: parents[i],
+            })
+            .collect()
+    }
+
+    pub fn frames_at(head: [f64; 4]) -> proto::FramesState {
+        proto::FramesState {
+            camera: pose(FK.camera_in_trunk_cv2(head)),
+            tof: pose(FK.tof_in_trunk(head)),
+            head_imu: FK.head_imu_in_trunk(head).map(pose),
+        }
+    }
+
+    pub fn model() -> proto::ModelResult {
+        let model = kinematics::Model::alpha();
+        proto::ModelResult {
+            asset: "alpha".to_owned(),
+            trunk_height_m: model.trunk_height_m(),
+            joint_names: proto::JOINT_NAMES.iter().map(|s| (*s).to_owned()).collect(),
+            head_joints: HEAD.iter().map(|s| (*s).to_owned()).collect(),
+            tof_beams: TOF.beams().to_vec(),
+            tof_fov_deg: kinematics::tof::FOV_DEG,
+            frames_at_zero: frames_at([0.0; 4]),
+            skeleton: skeleton_links(),
+        }
+    }
+
+    #[cfg(test)]
+    mod tests {
+        use super::*;
+
+        #[test]
+        fn head_joints_come_out_of_the_wire_order() {
+            let mut joints = [0.0; 15];
+            joints[5] = 0.1;
+            joints[6] = 0.2;
+            joints[7] = 0.3;
+            joints[8] = 0.4;
+            assert_eq!(head_joints_of(&joints), [0.1, 0.2, 0.3, 0.4]);
+        }
+
+        #[test]
+        fn the_model_says_what_the_frames_are_stated_in() {
+            let m = model();
+            assert_eq!(m.tof_beams.len(), 64);
+            assert_eq!(m.joint_names.len(), 15);
+            assert!(m.trunk_height_m > 0.05 && m.trunk_height_m < 0.3);
+            // Camera and ToF are parallel, a couple of centimetres apart.
+            let f = m.frames_at_zero;
+            let d: f64 = (0..3)
+                .map(|i| (f.camera.pos[i] - f.tof.pos[i]).powi(2))
+                .sum::<f64>()
+                .sqrt();
+            assert!(d > 0.01 && d < 0.05, "camera-tof distance {d}");
+        }
+
+        #[test]
+        fn the_skeleton_topology_and_poses_line_up() {
+            let links = model().skeleton;
+            assert!(!links.is_empty(), "a skeleton is served");
+            assert_eq!(links[0].parent, None, "the root has no parent");
+            assert!(
+                links[1..].iter().all(|l| l.parent.is_some()),
+                "every other link has a parent"
+            );
+            // A pose per link, in the same order, and every parent precedes its child.
+            let poses = skeleton_at(&[0.0; 15]);
+            assert_eq!(poses.len(), links.len(), "one pose per link");
+            assert!(
+                links
+                    .iter()
+                    .enumerate()
+                    .all(|(i, l)| l.parent.is_none_or(|p| p < i))
+            );
+        }
+
+        #[test]
+        fn the_skeleton_moves_with_a_leg_joint() {
+            let mut bent = [0.0; 15];
+            let knee = proto::JOINT_NAMES
+                .iter()
+                .position(|n| n.contains("knee"))
+                .expect("a knee joint");
+            bent[knee] = 0.8;
+            // Bending a knee moves some body, but never the root (trunk_base sits at identity).
+            let rest = skeleton_at(&[0.0; 15]);
+            let moved = skeleton_at(&bent);
+            assert_eq!(rest[0].pos, moved[0].pos, "the root does not move");
+            assert!(
+                rest.iter().zip(&moved).any(|(a, b)| a.pos != b.pos),
+                "a leg body moved"
+            );
+        }
+
+        #[test]
+        fn frames_move_with_the_head() {
+            let a = frames_at([0.0; 4]).camera.pos;
+            let b = frames_at([0.0, 0.0, 1.0, 0.0]).camera.pos;
+            assert!(a != b);
+        }
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -4678,15 +5150,19 @@ mod tests {
         );
     }
 
-    /// Limp-fall ships ON, and it must refuse a fallen robot nothing.
+    /// Limp-fall ships OFF (the default gait has no standing network to hand back to), and
+    /// switched on it must refuse a fallen robot nothing.
     ///
     /// This is the contract that answers "I booted it face-down and pressed Start": enable
-    /// and init are never refused for gravity, whatever the mode is set to. It matters more
-    /// now the mode is a default than it did when it was opt-in — every robot has it.
+    /// and init are never refused for gravity, whatever the mode is set to.
     #[test]
-    fn limp_fall_ships_on_and_refuses_nothing() {
-        let params = Params::default();
-        assert!(params.safety.limp_fall, "on by default, fleet-wide");
+    fn limp_fall_ships_off_and_refuses_nothing() {
+        let mut params = Params::default();
+        assert!(
+            !params.safety.limp_fall,
+            "off by default: velstand loads no standing policy"
+        );
+        params.safety.limp_fall = true;
 
         let s = RobotState::new(
             &params,
@@ -4721,6 +5197,51 @@ mod tests {
         assert!(init.accepted, "nor may init refuse for gravity");
     }
 
+    /// The theremin ships **off**, and the refusal has to name the switch.
+    ///
+    /// The switch and a silent depth stream are different problems with the same symptom, and
+    /// they used to share one message. Now that off is the default, that message would send
+    /// every first-time player to inspect a `tofd` that is running perfectly.
+    #[test]
+    fn a_switched_off_theremin_names_the_switch_and_not_tofd() {
+        let ask = |params: &Params| -> proto::ThereminResult {
+            let mut s = RobotState::new(
+                params,
+                std::path::Path::new("/test/robotd.toml"),
+                false,
+                false,
+            );
+            // A voice, which `RobotState::new` decides by looking for wavs on disk: a test
+            // machine has no bank, and without this every answer here is "no voice to play in".
+            s.has_voice = true;
+            dispatch(
+                &s,
+                &Arc::new(Intents::new()),
+                proto::Id::Number(1),
+                &proto::Call::RobotTheremin(proto::ThereminParams { active: true }),
+            )
+            .result_as()
+            .expect("a theremin answer")
+        };
+
+        let params = Params::default();
+        assert!(!params.theremin.enabled, "the theremin ships off");
+        let refused = ask(&params);
+        assert!(!refused.accepted);
+        let reason = refused.reason.expect("a refusal says why");
+        assert!(reason.contains("[theremin] enabled"), "{reason}");
+        assert!(!reason.contains("tofd"), "not tofd's fault: {reason}");
+
+        // Switched on, and the honest complaint becomes the one about depth — `theremin_ready`
+        // is published by the loop, which is not running under a dispatch test.
+        let mut on = Params::default();
+        on.theremin.enabled = true;
+        let refused = ask(&on);
+        assert!(!refused.accepted);
+        let reason = refused.reason.expect("a refusal says why");
+        assert!(reason.contains("tofd"), "{reason}");
+    }
+
     fn state() -> RobotState {
         RobotState::new(
             &Params::default(),
@@ -4851,8 +5372,10 @@ mod tests {
     /// crouch that roller mode does have.
     #[test]
     fn the_published_policy_names_are_one_modes_answer() {
-        let walk = PolicyNames::of(&Params::default().policy.resolved());
-        assert!(walk.stand.is_some(), "walking has a standing network");
+        let mut walking = Params::default();
+        walking.policy.stand = Some(PathBuf::from("/srv/alpha_stand.onnx"));
+        let walk = PolicyNames::of(&walking.policy.resolved());
+        assert!(walk.stand.is_some(), "walking can carry a standing network");
 
         let mut rolling = Params::default();
         rolling.policy.mode = Mode::Roller;
@@ -5407,6 +5930,9 @@ mod tests {
         fn set_torque(&mut self, on: bool) -> duck_control::io::Result<()> {
             self.0.set_torque(on)
         }
+        fn reboot(&mut self, id: u8) -> duck_control::io::Result<()> {
+            self.0.reboot(id)
+        }
         fn slow_sensors(&mut self) -> duck_control::io::Result<duck_control::SlowSensors> {
             self.0.slow_sensors()
         }
@@ -6341,7 +6867,7 @@ mod tests {
         assert!(policy.slot(Slot::Walk).is_none(), "the override is dropped");
         assert_eq!(
             policy.resolved().walk,
-            PathBuf::from(params::POLICY_DIR).join("alpha_walking.onnx"),
+            PathBuf::from(params::POLICY_DIR).join("velstand.onnx"),
             "and the slot resolves to this robot's own policy"
         );
         let reason = errors.get(Slot::Walk).expect("the reason is kept");
@@ -7106,9 +7632,12 @@ mod tests {
         assert!(result.enabled);
         assert_eq!(result.slots.len(), Slot::ALL.len());
         for slot in &result.slots {
+            // `stand` is the empty row by default — velstand stands on its own — and an
+            // empty slot has no file to have come from anywhere.
+            let expected = (slot.slot != "stand").then_some("official");
             assert_eq!(
                 slot.origin.as_deref(),
-                Some("official"),
+                expected,
                 "a default robot runs the release's own set: {slot:?}"
             );
             assert!(!slot.overridden, "{slot:?}");
@@ -7293,6 +7822,9 @@ mod tests {
             fn set_torque(&mut self, on: bool) -> duck_control::io::Result<()> {
                 self.0.set_torque(on)
             }
+            fn reboot(&mut self, id: u8) -> duck_control::io::Result<()> {
+                self.0.reboot(id)
+            }
             fn slow_sensors(&mut self) -> duck_control::io::Result<duck_control::SlowSensors> {
                 self.0.slow_sensors()
             }
@@ -7487,6 +8019,63 @@ mod tests {
         );
     }
 
+    /// **`robot.rebootMotors` cuts torque, reboots the named servos and returns to limp.**
+    #[tokio::test]
+    async fn robot_reboot_motors_reboots_the_named_servos_and_returns_to_limp() {
+        let io = FakeIo::at(DEFAULT_POSITION).frozen();
+        let mut params = Params::default();
+        params.policy.enabled = false;
+        let s = Arc::new(RobotState::new(
+            &params,
+            std::path::Path::new("/test/robotd.toml"),
+            false,
+            false,
+        ));
+        let intents = Arc::new(Intents::new());
+        intents.request_init();
+
+        let (tx, rx) = std::sync::mpsc::channel();
+        let loop_state = Arc::clone(&s);
+        let loop_intents = Arc::clone(&intents);
+        let handle = tokio::spawn(async move {
+            let mut io = io;
+            control_loop_probe_with(&mut io, loop_state, loop_intents, Duration::from_millis(2))
+                .await;
+            tx.send((io.torque, io.reboots.clone(), io.last_gain))
+                .unwrap();
+        });
+        while s.ticks.load(Ordering::Relaxed) < 3 {
+            tokio::time::sleep(Duration::from_millis(2)).await;
+        }
+        let at = s.ticks.load(Ordering::Relaxed);
+        intents.request_reboot_motors(vec![7]);
+        while s.ticks.load(Ordering::Relaxed) < at + 4 {
+            tokio::time::sleep(Duration::from_millis(2)).await;
+        }
+        s.shutdown.store(true, Ordering::Relaxed);
+        handle.await.unwrap();
+        let (torque, reboots, last_gain) = rx.recv().unwrap();
+        assert_eq!(
+            torque,
+            Some(false),
+            "the joints must be unpowered after a reboot"
+        );
+        assert_eq!(reboots, vec![7], "only the named servo is rebooted");
+        assert_eq!(
+            last_gain,
+            Some(params.policy.gain),
+            "the gain is written again after the reboot"
+        );
+        assert!(
+            !s.homed.load(Ordering::Relaxed),
+            "still reporting homed after a reboot"
+        );
+        assert!(
+            !intents.snapshot().enabled,
+            "a reboot must stop the policy asking to drive"
+        );
+    }
+
     /// Relaxing clears `enabled` too. Otherwise the very next tick sees a robot that was asked to
     /// drive, brings it back up, and the robot someone just let go of stands up again.
     #[test]
@@ -7558,4 +8147,20 @@ mod tests {
         assert!(Bringup::Limp.homing_target(since).is_none());
         assert!(Bringup::Ready.homing_target(since).is_none());
     }
+
+    /// `1e400` on the wire parses as infinity. Folded into the EMA it is permanent — nothing
+    /// finite climbs back out — and with the safety layer refusing non-finite targets, one bad
+    /// `robot.move` would freeze the robot on its hold pose until reboot. Dropped instead.
+    #[test]
+    fn a_non_finite_command_does_not_poison_the_filter() {
+        let mut ema = 0.5;
+        slew(&mut ema, f64::INFINITY, 0.3);
+        slew(&mut ema, f64::NEG_INFINITY, 0.3);
+        slew(&mut ema, f64::NAN, 0.3);
+        assert_eq!(ema, 0.5, "non-finite targets are dropped, not folded in");
+
+        // And the filter still works afterwards: the next real command slews as always.
+        slew(&mut ema, 1.0, 0.3);
+        assert!((ema - 0.65).abs() < 1e-12, "{}", ema);
+    }
 }
diff --git a/robotd/tests/single_instance.rs b/robotd/tests/single_instance.rs
new file mode 100644
index 00000000..2e624418
--- /dev/null
+++ b/robotd/tests/single_instance.rs
@@ -0,0 +1,337 @@
+//! Startup ownership against the actual binary, with fake I/O and private sockets.
+use std::io::Read;
+use std::os::unix::fs::MetadataExt;
+use std::os::unix::net::{UnixListener, UnixStream};
+use std::path::Path;
+use std::process::{Child, Command, ExitStatus, Stdio};
+use std::time::{Duration, Instant};
+
+use updater::robot::{Health, RobotClient, SocketRobotClient};
+
+struct Robotd(Child);
+
+impl Robotd {
+    fn spawn(socket: &Path, extra: &[&str]) -> Self {
+        // An explicit empty config keeps host /etc/robot settings out of the test.
+        let params = socket.parent().unwrap().join("params.toml");
+        std::fs::write(&params, "").unwrap();
+        Self(
+            Command::new(env!("CARGO_BIN_EXE_robotd"))
+                .arg("--socket")
+                .arg(socket)
+                .arg("--params")
+                .arg(params)
+                .args(["--fake", "--no-policy"])
+                .args(extra)
+                .env("RUST_LOG", "warn")
+                .stdout(Stdio::null())
+                .stderr(Stdio::piped())
+                .spawn()
+                .expect("spawn robotd"),
+        )
+    }
+
+    async fn wait_for_exit(&mut self) -> (ExitStatus, String) {
+        let deadline = Instant::now() + Duration::from_secs(10);
+        loop {
+            if let Some(status) = self.0.try_wait().unwrap() {
+                let mut log = String::new();
+                self.0
+                    .stderr
+                    .take()
+                    .unwrap()
+                    .read_to_string(&mut log)
+                    .unwrap();
+                return (status, log);
+            }
+            assert!(Instant::now() < deadline, "robotd did not exit");
+            tokio::time::sleep(Duration::from_millis(25)).await;
+        }
+    }
+
+    async fn assert_refused(&mut self) {
+        let (status, log) = self.wait_for_exit().await;
+        assert_eq!(status.code(), Some(1), "{status}: {log}");
+        assert!(log.contains("cannot claim robot IPC socket"), "{log}");
+        assert!(
+            !log.contains("starting service="),
+            "a refused startup must not publish the loser's identity: {log}"
+        );
+        assert!(
+            !log.contains("--fake: no bus, no robot"),
+            "a refused startup must not start the control loop: {log}"
+        );
+        assert!(
+            !log.contains("cannot open the bus"),
+            "a refused init must not try to open the bus: {log}"
+        );
+    }
+
+    fn kill(&mut self) {
+        self.0.kill().unwrap();
+        self.0.wait().unwrap();
+    }
+}
+
+impl Drop for Robotd {
+    fn drop(&mut self) {
+        // A failed assertion must not leave a daemon behind, either.
+        let _ = self.0.kill();
+        let _ = self.0.wait();
+    }
+}
+
+async fn wait_until_healthy(socket: &Path) {
+    let client = SocketRobotClient::new(socket.to_owned());
+    let deadline = Instant::now() + Duration::from_secs(10);
+    loop {
+        let health = client.health(Duration::from_millis(500)).await;
+        if matches!(health, Health::Healthy) {
+            return;
+        }
+        assert!(
+            Instant::now() < deadline,
+            "robotd never became healthy: {health:?}"
+        );
+        tokio::time::sleep(Duration::from_millis(25)).await;
+    }
+}
+
+/// The second process used to unlink the first one's listener and take all new clients,
+/// while both control loops kept running. Its forced unhealthy response identifies a takeover.
+#[tokio::test]
+async fn a_second_daemon_cannot_replace_the_running_service() {
+    let dir = tempfile::tempdir().unwrap();
+    let socket = dir.path().join("robotd.sock");
+    let mut first = Robotd::spawn(&socket, &[]);
+    wait_until_healthy(&socket).await;
+    let inode = std::fs::metadata(&socket).unwrap().ino();
+
+    let mut second = Robotd::spawn(&socket, &["--unhealthy"]);
+    second.assert_refused().await;
+
+    assert!(first.0.try_wait().unwrap().is_none());
+    assert_eq!(std::fs::metadata(&socket).unwrap().ino(), inode);
+    wait_until_healthy(&socket).await;
+}
+
+/// `init` used to bypass the daemon's lock and open the motor bus itself. A missing,
+/// private port makes reaching run_init observable without ever opening real hardware.
+#[tokio::test]
+async fn init_cannot_open_the_bus_while_a_daemon_is_running() {
+    let dir = tempfile::tempdir().unwrap();
+    let socket = dir.path().join("robotd.sock");
+    let port = dir.path().join("missing-bus");
+    let mut daemon = Robotd::spawn(&socket, &[]);
+    wait_until_healthy(&socket).await;
+    let inode = std::fs::metadata(&socket).unwrap().ino();
+
+    let mut init = Robotd::spawn(&socket, &["--port", port.to_str().unwrap(), "init"]);
+    init.assert_refused().await;
+
+    assert!(daemon.0.try_wait().unwrap().is_none());
+    assert_eq!(std::fs::metadata(&socket).unwrap().ino(), inode);
+    wait_until_healthy(&socket).await;
+}
+
+/// A failed init must release ownership just like a successful ramp: the operator may
+/// need to start the daemon to diagnose the bus. It must not create an IPC listener.
+#[tokio::test]
+async fn a_failed_init_releases_the_lock_without_creating_a_socket() {
+    let dir = tempfile::tempdir().unwrap();
+    let socket = dir.path().join("robotd.sock");
+    let port = dir.path().join("missing-bus");
+    let lock_path = dir.path().join("robotd.sock.lock");
+    let mut init = Robotd::spawn(&socket, &["--port", port.to_str().unwrap(), "init"]);
+    let (status, log) = init.wait_for_exit().await;
+    assert_eq!(status.code(), Some(1), "{status}: {log}");
+    #[cfg(target_os = "linux")]
+    assert!(log.contains("cannot open the bus"), "{log}");
+    #[cfg(not(target_os = "linux"))]
+    assert!(log.contains("init needs a real bus"), "{log}");
+    assert!(!socket.exists(), "init must not bind a listener");
+    let inode = std::fs::metadata(&lock_path).unwrap().ino();
+
+    let _daemon = Robotd::spawn(&socket, &[]);
+    wait_until_healthy(&socket).await;
+    assert_eq!(std::fs::metadata(&lock_path).unwrap().ino(), inode);
+}
+
+/// Both launches start together, before either has answered a client. Repeating the race
+/// exercises both possible winners; waiting for the first daemon to be ready would miss it.
+#[tokio::test]
+async fn simultaneous_starts_leave_exactly_one_daemon_running() {
+    for _ in 0..10 {
+        let dir = tempfile::tempdir().unwrap();
+        let socket = dir.path().join("robotd.sock");
+        let gate = std::sync::Barrier::new(2);
+        let (mut first, mut second) = std::thread::scope(|scope| {
+            let start = || {
+                gate.wait();
+                Robotd::spawn(&socket, &[])
+            };
+            let first = scope.spawn(start);
+            let second = scope.spawn(start);
+            (first.join().unwrap(), second.join().unwrap())
+        });
+
+        let deadline = Instant::now() + Duration::from_secs(10);
+        let winner = loop {
+            match (first.0.try_wait().unwrap(), second.0.try_wait().unwrap()) {
+                (Some(_), None) => {
+                    first.assert_refused().await;
+                    break &mut second;
+                }
+                (None, Some(_)) => {
+                    second.assert_refused().await;
+                    break &mut first;
+                }
+                (Some(a), Some(b)) => panic!("both daemons exited: {a}, {b}"),
+                (None, None) => (),
+            }
+            assert!(Instant::now() < deadline, "both daemons kept running");
+            tokio::time::sleep(Duration::from_millis(25)).await;
+        };
+        wait_until_healthy(&socket).await;
+        assert!(winner.0.try_wait().unwrap().is_none());
+    }
+}
+
+/// A PID file or an unconditionally exclusive create would survive SIGKILL and prevent
+/// recovery. The kernel lock must release, and the abandoned socket must be replaceable.
+#[tokio::test]
+async fn a_killed_daemon_can_restart_using_the_same_lock_file() {
+    let dir = tempfile::tempdir().unwrap();
+    let socket = dir.path().join("robotd.sock");
+    let lock_path = dir.path().join("robotd.sock.lock");
+    let mut first = Robotd::spawn(&socket, &[]);
+    wait_until_healthy(&socket).await;
+    let lock_inode = std::fs::metadata(&lock_path).unwrap().ino();
+    first.kill();
+    assert!(socket.exists(), "SIGKILL leaves a stale socket");
+
+    let _restarted = Robotd::spawn(&socket, &[]);
+    wait_until_healthy(&socket).await;
+    assert_eq!(std::fs::metadata(lock_path).unwrap().ino(), lock_inode);
+    let mut duplicate = Robotd::spawn(&socket, &["--unhealthy"]);
+    duplicate.assert_refused().await;
+    wait_until_healthy(&socket).await;
+}
+
+/// Graceful shutdown must remove the socket but keep the lock inode reusable, so a
+/// normal service restart cannot split contenders across two different lock files.
+#[tokio::test]
+async fn a_clean_shutdown_can_restart_using_the_same_lock_file() {
+    let dir = tempfile::tempdir().unwrap();
+    let socket = dir.path().join("robotd.sock");
+    let lock_path = dir.path().join("robotd.sock.lock");
+    let mut first = Robotd::spawn(&socket, &[]);
+    wait_until_healthy(&socket).await;
+    let inode = std::fs::metadata(&lock_path).unwrap().ino();
+    assert_eq!(unsafe { libc::kill(first.0.id() as i32, libc::SIGTERM) }, 0);
+    let (status, log) = first.wait_for_exit().await;
+    assert!(status.success(), "{status}: {log}");
+    assert!(!socket.exists());
+
+    let _restarted = Robotd::spawn(&socket, &[]);
+    wait_until_healthy(&socket).await;
+    assert_eq!(std::fs::metadata(lock_path).unwrap().ino(), inode);
+}
+
+/// An older robotd does not hold our new lock. A listening socket is still owned and
+/// must not be mistaken for the file a killed process left behind.
+#[tokio::test]
+async fn a_live_listener_without_a_lock_is_preserved() {
+    let dir = tempfile::tempdir().unwrap();
+    let socket = dir.path().join("robotd.sock");
+    let _listener = UnixListener::bind(&socket).unwrap();
+    let inode = std::fs::metadata(&socket).unwrap().ino();
+
+    let mut daemon = Robotd::spawn(&socket, &[]);
+    daemon.assert_refused().await;
+    assert_eq!(std::fs::metadata(&socket).unwrap().ino(), inode);
+    UnixStream::connect(&socket).expect("original listener remains reachable");
+}
+
+/// Linux AF_UNIX can refuse a connection with EAGAIN when the accept queue is full.
+/// A busy listener must be preserved just like one that answers the liveness probe.
+#[cfg(target_os = "linux")]
+#[tokio::test]
+async fn a_live_listener_with_a_full_accept_queue_is_preserved() {
+    use std::io::ErrorKind;
+    use std::os::fd::AsRawFd;
+
+    let dir = tempfile::tempdir().unwrap();
+    let socket = dir.path().join("robotd.sock");
+    let listener = UnixListener::bind(&socket).unwrap();
+    // Shrink the queue on this live listener so the test needs only a few connections.
+    assert_eq!(unsafe { libc::listen(listener.as_raw_fd(), 1) }, 0);
+    let inode = std::fs::metadata(&socket).unwrap().ino();
+    let mut queued = Vec::new();
+    let mut full = false;
+    for _ in 0..8 {
+        match tokio::time::timeout(
+            Duration::from_secs(1),
+            tokio::net::UnixStream::connect(&socket),
+        )
+        .await
+        {
+            Ok(Ok(stream)) => queued.push(stream),
+            Ok(Err(e)) if e.kind() == ErrorKind::WouldBlock => {
+                full = true;
+                break;
+            }
+            Err(_) => {
+                full = true;
+                break;
+            }
+            Ok(Err(e)) => panic!("cannot fill the accept queue: {e}"),
+        }
+    }
+    assert!(full && !queued.is_empty(), "accept queue was not saturated");
+
+    let mut daemon = Robotd::spawn(&socket, &[]);
+    daemon.assert_refused().await;
+    assert_eq!(std::fs::metadata(&socket).unwrap().ino(), inode);
+    listener.set_nonblocking(true).unwrap();
+    while let Ok((stream, _)) = listener.accept() {
+        drop(stream);
+    }
+    UnixStream::connect(&socket).expect("original listener still accepts new connections");
+}
+
+/// The lock must exclude a second launch even before the first has bound its socket.
+/// Checking only whether a listener answers leaves that startup window unprotected.
+#[tokio::test]
+async fn a_held_lock_refuses_startup_before_a_socket_exists() {
+    let dir = tempfile::tempdir().unwrap();
+    let socket = dir.path().join("robotd.sock");
+    let lock = std::fs::File::create(dir.path().join("robotd.sock.lock")).unwrap();
+    lock.try_lock().unwrap();
+
+    let port = dir.path().join("missing-bus");
+    // `init` has no listener at all, so both entry points must respect the lock alone.
+    for command in [vec![], vec!["--port", port.to_str().unwrap(), "init"]] {
+        let mut process = Robotd::spawn(&socket, &command);
+        process.assert_refused().await;
+    }
+    assert!(!socket.exists());
+}
+
+/// A path typo is not permission to delete a regular file or a dangling symlink.
+#[tokio::test]
+async fn non_socket_paths_are_not_removed() {
+    let dir = tempfile::tempdir().unwrap();
+    let socket = dir.path().join("robotd.sock");
+    std::fs::write(&socket, "keep this file").unwrap();
+    let mut daemon = Robotd::spawn(&socket, &[]);
+    daemon.assert_refused().await;
+    assert_eq!(std::fs::read_to_string(&socket).unwrap(), "keep this file");
+
+    std::fs::remove_file(&socket).unwrap();
+    let target = dir.path().join("missing");
+    std::os::unix::fs::symlink(&target, &socket).unwrap();
+    let mut daemon = Robotd::spawn(&socket, &[]);
+    daemon.assert_refused().await;
+    assert_eq!(std::fs::read_link(&socket).unwrap(), target);
+}
diff --git a/robotd/tests/updater_gate.rs b/robotd/tests/updater_gate.rs
index e35957c8..4fa27514 100644
--- a/robotd/tests/updater_gate.rs
+++ b/robotd/tests/updater_gate.rs
@@ -277,7 +277,7 @@ async fn real_robotd_answers_every_method_the_engine_calls() {
     );
     assert_eq!(
         client.model_api(t).await,
-        Some(1),
+        Some(2),
         "modelApi must parse; None here means the field name drifted"
     );
     assert!(
diff --git a/scripts/board-test.sh b/scripts/board-test.sh
index a6dad0cf..99a16865 100755
--- a/scripts/board-test.sh
+++ b/scripts/board-test.sh
@@ -771,6 +771,16 @@ sed "s|\"ORG/duck-daemon\"|\"pollen-robotics/microduck\"|" \
     /bin/deploy/updater.toml > /etc/robot/updater.toml
 cp /bin/deploy/robotd.toml /etc/robot/robotd.toml
 
+# What Armbian ships in /etc/cron.d: a simulated `apt-get upgrade` at every boot, whose only
+# reader is the login banner and which holds one core for seconds while robotd is starting.
+# setup-quiet-boot.sh is meant to empty it, and the assertion below is on what the file contains, not
+# on its absence — the package that owns it would recreate a deleted one.
+mkdir -p /etc/cron.d
+cat > /etc/cron.d/armbian-updates <<"CRON"
+@reboot root /usr/lib/armbian/armbian-apt-updates
+@daily root /usr/lib/armbian/armbian-apt-updates
+CRON
+
 # ── install.sh, the provisioning path ──
 #
 # The bootstrap download self-skips because a release is already live, which is the branch a
@@ -847,6 +857,22 @@ echo "    [ok] the login banner is installed and reports a rolled-back update"
 # updated had it.
 test -f /etc/profile.d/robot-name-prompt.sh \
     || { echo "    [FAIL] the prompt snippet was not installed"; exit 1; }
+
+# Apt off the boot path. The cron file must still exist, hold no live job, and both stock apt
+# timers must be masked — masked, not disabled, because an upgrade of apt itself re-enables a disabled
+# timer and leaves a mask alone.
+test -f /etc/cron.d/armbian-updates \
+    || { echo "    [FAIL] setup-quiet-boot deleted the Armbian cron file instead of emptying it"; exit 1; }
+if grep -Eq "^[[:space:]]*[^#[:space:]]" /etc/cron.d/armbian-updates; then
+    echo "    [FAIL] /etc/cron.d/armbian-updates still runs armbian-apt-updates at boot"
+    cat /etc/cron.d/armbian-updates
+    exit 1
+fi
+for unit in apt-daily.timer apt-daily-upgrade.timer; do
+    grep -q "^mask ${unit}$" /stub/systemctl.log \
+        || { echo "    [FAIL] install.sh did not mask ${unit}"; exit 1; }
+done
+echo "    [ok] install.sh takes the Armbian update count and the apt-daily timers off the boot path"
 test -f /etc/bash_completion.d/robotctl \
     || { echo "    [FAIL] the robotctl completions were not installed"; exit 1; }
 
@@ -1010,6 +1036,12 @@ rm -f /etc/systemd/journald.conf.d/10-robot.conf /usr/local/bin/robotctl
 # And the login-shell files, for the opposite reason: the hook is supposed to put these back, and
 # leaving the ones install.sh wrote in place would make that assertion vacuous.
 rm -f /etc/profile.d/robot-name-prompt.sh /etc/bash_completion.d/robotctl /etc/update-motd.d/40-robot
+# And the Armbian boot-time apt job put back, for the same reason: a board in the field has it, and
+# the hook is the only thing that reaches that board.
+cat > /etc/cron.d/armbian-updates <<"CRON"
+@reboot root /usr/lib/armbian/armbian-apt-updates
+@daily root /usr/lib/armbian/armbian-apt-updates
+CRON
 ( cd "$REL" && PATH="/stub:$PATH" sh "$REL"/hooks/postinstall > /tmp/hook.log 2>&1 ) || {
     echo "    [FAIL] hooks/postinstall exited non-zero, which fails an update"
     cat /tmp/hook.log
@@ -1068,6 +1100,17 @@ for f in /etc/profile.d/robot-name-prompt.sh /etc/bash_completion.d/robotctl /et
 done
 echo "    [ok] postinstall alone installs the login-shell files"
 
+# Apt off the boot path, from the hook alone: the whole fleet was provisioned with the Armbian
+# `@reboot` simulated upgrade running, and an update is the only path that fixes those boards.
+if grep -Eq "^[[:space:]]*[^#[:space:]]" /etc/cron.d/armbian-updates; then
+    echo "    [FAIL] postinstall alone left armbian-apt-updates running at boot"; exit 1
+fi
+for unit in apt-daily.timer apt-daily-upgrade.timer; do
+    grep -q "^mask ${unit}$" /stub/systemctl.log \
+        || { echo "    [FAIL] postinstall alone did not mask ${unit}"; exit 1; }
+done
+echo "    [ok] postinstall alone takes apt off the boot path"
+
 # What the hook does NOT place, which is now a short list and worth naming exactly: the journald
 # drop-in and the robotctl symlink. Both were deleted above and the hook restored neither, so a
 # release that changed either delivers it to no board that only updates — only install.sh does
diff --git a/scripts/dev-push.sh b/scripts/dev-push.sh
index 737592ed..009bad31 100755
--- a/scripts/dev-push.sh
+++ b/scripts/dev-push.sh
@@ -372,14 +372,14 @@ cargo run -p xtask -- package \
     --include "robotd/systemd/robotd.service=systemd/robotd.service" \
     --include "hooks/postinstall=hooks/postinstall" \
     --include "scripts/setup-gstreamer.sh=scripts/setup-gstreamer.sh" \
-    --include "duck-detect/models/duck_detect.rknn=models/duck_detect.rknn" \
-    --include "duck-detect/models/duck_detect.onnx=models/duck_detect.onnx" \
     --include "scripts/setup-npu.sh=scripts/setup-npu.sh" \
     --include "deploy/overlays/rk3568-npu-enable.dts=deploy/overlays/rk3568-npu-enable.dts" \
     --include "scripts/setup-rkaiq.sh=scripts/setup-rkaiq.sh" \
     --include "scripts/rkaiq-modinfo-shim.c=scripts/rkaiq-modinfo-shim.c" \
     --include "scripts/setup-login.sh=scripts/setup-login.sh" \
+    --include "scripts/setup-quiet-boot.sh=scripts/setup-quiet-boot.sh" \
     --include "scripts/seed-policies.sh=scripts/seed-policies.sh" \
+    --include "scripts/seed-detector.sh=scripts/seed-detector.sh" \
     --include "scripts/robot-rescue=scripts/robot-rescue" \
     --include "scripts/robot-boot-check=scripts/robot-boot-check" \
     --include "updater/systemd/robot-boot-check.service=systemd/robot-boot-check.service" \
diff --git a/scripts/duck-sim b/scripts/duck-sim
new file mode 100755
index 00000000..fea9ab68
--- /dev/null
+++ b/scripts/duck-sim
@@ -0,0 +1,893 @@
+#!/bin/sh
+# A duck in MuJoCo, driven by the real daemon, in one command.
+#
+#   scripts/duck-sim              # a window opens, the duck stands up, and it is yours
+#   scripts/duck-sim drive        # walk it forward for a few seconds
+#   scripts/duck-sim ctl health   # anything robotctl does
+#   scripts/duck-sim down
+#
+# And the same duck, as a machine you log into:
+#
+#   scripts/duck-sim boot         # the daemons under real systemd, in a container
+#   scripts/duck-sim shell        # you are on the duck
+#   duck-a # robotctl health
+#
+# `boot` needs sudo, because `systemd-nspawn` does. What it buys over the plain form is the part
+# that is not fakeable: the real unit files, with their real User=, groups, RuntimeDirectory= and
+# hardening, under a real init — which is what makes `robotctl update apply` and the health gate
+# behave here the way they behave on a robot.
+#
+# What is running afterwards is `robotd` — the same binary a robot runs, with the same policies, the
+# same 50 Hz loop and the same IPC — with `duck_control::sim::RemoteIo` in place of the servo bus.
+# `docs/design/simulation.md` says what that is and is not a twin of.
+#
+# The three things this exists to stop anyone typing by hand, because none of them is guessable:
+#
+#   * policies live at /opt/robot/daemon/current on a robot and in this repo on a laptop, so every
+#     one has to be named in a params file;
+#   * `ort` dlopens libonnxruntime and a laptop has no system one — the RL repo's venv does;
+#   * a unix socket path is capped at ~108 bytes, so the state directory has to be short.
+set -eu
+
+STATE="${DUCK_SIM_STATE:-$HOME/.cache/duck-sim}"
+RL="${DUCK_SIM_RL:-$HOME/Pollen/microduck_rl}"
+PORT="${DUCK_SIM_PORT:-7801}"
+
+# `setsid` is util-linux: Linux has it, a Mac does not. What it buys is a daemon in its own session,
+# so closing this terminal does not take the duck with it — and on a machine without it `nohup`
+# alone covers the hangup, which is the part that matters. Nothing here kills by process group any
+# more (see `stop_one`), so a session was the only thing ever wanted from it.
+SETSID="$(command -v setsid 2>/dev/null || true)"
+DUCKS="${DUCK_SIM_DUCKS:-1}"
+
+# Which world. A bare name is one of the simulator's own scenes; anything with a slash is a path.
+#
+#   DUCK_SIM_SCENE=apartment scripts/duck-sim boot 2
+#
+# `apartment` is six rooms in 7x6 m with 50 cm walls and doorways deliberately off centre — that
+# asymmetry is what lets a pose be disambiguated from a 45-degree forward field of view, which is
+# exactly what the duck has. The default is a bare floor, where there is nothing to see.
+SCENE="${DUCK_SIM_SCENE:-}"
+
+# Which ducks have an eye. `a`, `a,c`, or `all`; empty for none, which is the default because a
+# rendered frame costs 12 ms against 0.3 ms to step four ducks' physics — one camera is a third of a
+# core and four is most of one. Each duck with a camera also gets a `mediad`, and its console is at
+# 8080 + its index.
+CAMERAS="${DUCK_SIM_CAMERAS:-}"
+FRAME_PORT="${DUCK_SIM_FRAME_PORT:-7901}"
+SOCK="$STATE/duck.sock"
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+
+say()  { printf '\033[36m==\033[0m %s\n' "$*"; }
+die()  { printf 'error: %s\n' "$*" >&2; exit 1; }
+
+# Which duck `ctl` talks to. `DUCK_SIM_DUCK=duck-b scripts/duck-sim ctl monitor` for another.
+WHO="${DUCK_SIM_DUCK:-}"
+
+# **Every socket, not just robotd's.** `monitor` draws the depth frame from `tofd` and the sticks
+# from `padd`, and it looks for them under /run — which on a board is where they are and here is
+# not. A monitor with no ToF points looked like a sensor that was not wired, and was a client
+# pointed at the wrong path.
+ctl() {
+    name="${WHO:-$(duck_name 0)}"
+    "$REPO/target/debug/robotctl" \
+        --robot-socket "$STATE/$name.sock" \
+        --tof-socket "$STATE/$name-tof.sock" \
+        "$@"
+}
+
+# ── stopping ──────────────────────────────────────────────────────────────────
+# By pidfile, never by name. `pkill -f robotd` also matches the shell that is about to start one,
+# which is a good way to kill your own terminal — three times in one afternoon, in this case.
+# Stop one thing this script started, identified by name and by what it must still be running.
+#
+# **A pid is not an identity.** This function used to kill the process *group* named by a pidfile,
+# with a `sudo` fallback — and pidfiles go stale, pids are recycled, and a `boot` leaves behind the
+# pidfiles an `up` wrote. The result was `kill -TERM -<recycled pid>` as root, which took out an
+# unrelated process group: it killed a login session, and the machine had to be rebooted to get it
+# back. Nothing here may act on a pid without first confirming, through /proc, that the process is
+# still the one it was written for.
+#
+# No group kill at all any more. Every process this starts is a single process that exits on TERM,
+# and the group form bought nothing but the reach to do damage.
+# How a pid says what it is. /proc is Linux and a Mac has none, so `ps` answers there — and the
+# question is the same either way, which is the point: nothing above may signal a pid without it.
+#
+# A dead pid must not fall through to the other branch and get a second opinion. On Linux an
+# unreadable `cmdline` *is* the answer (the process is gone), so this returns empty rather than
+# asking `ps`; only a machine with no /proc at all reaches it.
+cmdline_of() {
+    if [ -d /proc ]; then
+        tr '\0' ' ' < "/proc/$1/cmdline" 2>/dev/null
+    else
+        ps -p "$1" -o command= 2>/dev/null
+    fi
+}
+
+stop_one() {
+    file="$STATE/$1.pid"
+    expect="$2"
+    [ -f "$file" ] || return 0
+    pid="$(tr -dc '0-9' < "$file")"
+    # Removed before anything is signalled, so a stale file cannot be acted on twice.
+    rm -f "$file"
+
+    [ -n "$pid" ] || return 0
+    [ "$pid" -gt 1 ] 2>/dev/null || return 0
+    cmdline_of "$pid" | grep -q -- "$expect" || {
+        say "not stopping pid $pid: it is no longer $1"
+        return 0
+    }
+
+    kill -TERM "$pid" 2>/dev/null || sudo -n kill -TERM "$pid" 2>/dev/null || true
+    # `waited`, not `i`: there are no locals in POSIX sh, and `down` walks its ducks with `i`.
+    # This loop used to leave it wherever the wait ended, so stopping a `robotd` that took a moment
+    # to go moved the caller's counter forward and the `tofd` beside it was never signalled at all.
+    waited=0
+    while [ $waited -lt 25 ] && kill -0 "$pid" 2>/dev/null; do
+        waited=$((waited + 1))
+        sleep 0.2
+    done
+    kill -0 "$pid" 2>/dev/null || return 0
+    kill -KILL "$pid" 2>/dev/null || sudo -n kill -KILL "$pid" 2>/dev/null || true
+}
+
+down() {
+    stop_one robotd robotd
+    stop_one ether duck-ether
+    stop_one body body_server
+    i=0
+    while [ "$i" -lt 16 ]; do
+        stop_one "$(duck_name "$i")" robotd
+        stop_one "$(duck_name "$i")-tof" tofd
+        stop_one "$(duck_name "$i")-media" mediad
+        i=$((i + 1))
+    done
+    # The container-mode radio is a unit, not a pidfile — see `boot`.
+    sudo -n systemctl stop duck-ether 2>/dev/null || true
+    rm -f "$SOCK"
+    # Verified, not assumed: `down` reporting success while a MuJoCo window is still open is worse
+    # than saying nothing, and is exactly what the subshell bug above produced.
+    if python3 -c "import socket,sys;s=socket.socket();s.settimeout(.3);sys.exit(0 if s.connect_ex(('127.0.0.1',$PORT))==0 else 1)" 2>/dev/null; then
+        say "something is still listening on $PORT — not started by this script?"
+        say "  pkill -f 'body_serve[r]'   # brackets: do not match your own command line"
+        return 1
+    fi
+    say "down"
+}
+
+# ── starting ──────────────────────────────────────────────────────────────────
+
+# Always build, never "unless the binary exists". `target/debug` is shared by every branch checked
+# out in this tree, so a robotd that is present is not a robotd that was built from here: one built
+# on another branch that afternoon installed cleanly, connected to the body, and had no idea what a
+# simulated body was — its `--sim` was the older robot-made-of-nothing — and every duck "would not
+# enable". cargo returns in a moment when nothing changed, which is the only case the guard saved.
+build_daemons() {
+    say "building the daemons from $(git -C "$REPO" rev-parse --abbrev-ref HEAD)"
+    (cd "$REPO" && cargo build --quiet -p robotd -p robotctl -p tof -p sounds)
+}
+
+# **A checkout has no policies.** They live on the Hub and reach a robot through
+# `scripts/seed-policies.sh` at install time, deliberately outside the release — so a fresh clone
+# has nothing to name here, and a duck started against seven missing files comes up *degraded* and
+# never stands. Same script, same set, a root under the state directory.
+#
+# A `policies/` beside the repo wins if it has one: that is somebody's own set, and fetching over
+# it would silently swap the gait they are working on.
+policies() {
+    if [ -f "$REPO/policies/alpha_stand.onnx" ]; then
+        POLICIES="$REPO/policies"
+        return 0
+    fi
+    POLICIES="$STATE/policies/current"
+    [ -f "$POLICIES/alpha_stand.onnx" ] || {
+        say "no policy set here — fetching the official one"
+        sh "$REPO/scripts/seed-policies.sh" "$STATE/policies" || true
+    }
+    [ -f "$POLICIES/alpha_stand.onnx" ] ||
+        die "no policy set in $STATE/policies. It needs the network once, or your own .onnx files in $REPO/policies."
+}
+
+up() {
+    [ -d "$RL" ] || die "no simulator at $RL. It is the microduck_rl repo — set DUCK_SIM_RL."
+    [ -x "$RL/.venv/bin/python" ] || die "$RL has no .venv. Run \`uv sync\` there first."
+    # `.so.<version>` on Linux, `.<version>.dylib` on macOS — the wheel names it after the platform
+    # and `ort` dlopens whatever this points at, so both spellings are looked for rather than one.
+    ORT="$(ls "$RL"/.venv/lib/python*/site-packages/onnxruntime/capi/libonnxruntime.so.* \
+            "$RL"/.venv/lib/python*/site-packages/onnxruntime/capi/libonnxruntime*.dylib \
+            2>/dev/null | head -1)"
+    [ -n "$ORT" ] || die "no onnxruntime in $RL/.venv — the policies cannot load without it."
+
+    down
+    mkdir -p "$STATE"
+
+    build_daemons
+    policies
+
+    # Every policy named explicitly: `RELEASE_DIR` is /opt/robot/daemon/current, which exists on a
+    # robot and not here, and `PolicyParams::resolved` uses a named path verbatim when it has one.
+    cat > "$STATE/robotd.toml" <<TOML
+[policy]
+enabled = true
+walk = "$POLICIES/alpha_walking.onnx"
+stand = "$POLICIES/alpha_stand.onnx"
+sitstand = "$POLICIES/alpha_sitstand.onnx"
+ground_pick = "$POLICIES/alpha_ground_pick.onnx"
+kick_left = "$POLICIES/ball_kick_left.onnx"
+kick_right = "$POLICIES/ball_kick_right.onnx"
+roulade = "$POLICIES/roulade.onnx"
+
+# Singing is opt-in, and a room full of ducks that will not sing together is a poor demonstration
+# of a room full of ducks. On a real robot this is a decision someone makes; here it is the point.
+[chorale]
+accept = true
+
+[audio]
+bank = "$STATE/sounds/DUCK"
+# plughw:aic3104 is the board's codec, and robotd passes it to aplay with -D, so on anything that is
+# not a robot every sound fails before ALSA's default is ever consulted. That failure is logged and
+# skipped by design, which is why a silent duck looks like a sound bug. No backticks in this comment:
+# the heredoc is unquoted so that $REPO expands, which means backticks run as commands — these three
+# words were being executed, and "plughw:aic3104: not found" is a confusing thing to read.
+device = "default"
+
+# Its own depth sensor. On a board this is /run/tofd/tof.sock and needs no saying; here every duck
+# has one and they must not share.
+[theremin]
+socket = "$STATE/DUCK-tof.sock"
+TOML
+
+    # **A voice each, and it is not decoration.** `robotctl chorale` refuses without one — but more
+    # than that, `robotd` takes its chorale id from the seed recorded in the bank it plays from, and
+    # that id is how a duck recognises its own beacon reflected back. Ducks sharing a bank share an
+    # id, drop each other as their own reflection, and sit there hearing nobody. So: one bank per
+    # duck, seeded from its name.
+    [ -x "$REPO/target/debug/sounds" ] || (cd "$REPO" && cargo build --quiet -p sounds)
+    i=0
+    while [ "$i" -lt "$DUCKS" ]; do
+        name="$(duck_name "$i")"
+        sed -e "s|/sounds/DUCK|/sounds/$name|" -e "s|/DUCK-tof.sock|/$name-tof.sock|" \
+            "$STATE/robotd.toml" > "$STATE/robotd-$name.toml"
+        if [ ! -d "$STATE/sounds/$name" ]; then
+            say "rendering $name a voice"
+            DUCK_IDENTITY="$name" "$REPO/target/debug/sounds" ensure-bank \
+                --dir "$STATE/sounds/$name" >/dev/null 2>&1 || say "$name has no voice"
+        fi
+        i=$((i + 1))
+    done
+
+    start_body
+
+    # Depth, before the daemon that reads it. `tofd --sim` asks the simulator for an 8x8 frame at
+    # the sensor's own 15 Hz — the same rays a real VL53L5CX would cast, from the model's `tof` site,
+    # so a head that turns takes the sensor with it.
+    say "starting tofd"
+    [ -x "$REPO/target/debug/tofd" ] || (cd "$REPO" && cargo build --quiet -p tof)
+    i=0
+    while [ "$i" -lt "$DUCKS" ]; do
+        name="$(duck_name "$i")"
+        DUCK_RUNTIME_DIR="$STATE" $SETSID nohup "$REPO/target/debug/tofd" \
+            --sim "127.0.0.1:$(duck_port "$i")" --socket "$STATE/$name-tof.sock" \
+            > "$STATE/$name-tof.log" 2>&1 &
+        echo $! > "$STATE/$name-tof.pid"
+        i=$((i + 1))
+    done
+
+    say "starting robotd"
+    i=0
+    while [ "$i" -lt "$DUCKS" ]; do
+        name="$(duck_name "$i")"
+        # Its own identity, or every duck on this laptop has the same one — and a chorale id is
+        # how a duck recognises its own beacon reflected back, so identical ducks drop each
+        # other's beacons and never hear anybody. A container gets this from its own machine-id.
+        DUCK_IDENTITY="$name" \
+        DUCK_RUNTIME_DIR="$STATE" ORT_DYLIB_PATH="$ORT" RUST_LOG="${RUST_LOG:-info}" \
+            $SETSID nohup "$REPO/target/debug/robotd" --sim "127.0.0.1:$(duck_port "$i")" \
+            --params "$STATE/robotd-$name.toml" --socket "$STATE/$name.sock" \
+            > "$STATE/$name.log" 2>&1 &
+        echo $! > "$STATE/$name.pid"
+        i=$((i + 1))
+    done
+    # `duck.sock` is whichever duck `ctl` and `drive` talk to — the first one, unless asked.
+    ln -sf "$STATE/$(duck_name 0).sock" "$SOCK"
+    ln -sf "$STATE/$(duck_name 0).log" "$STATE/robotd.log"
+    wait_for_socket || die "robotd did not come up. $STATE/$(duck_name 0).log has why."
+
+    # A `mediad` for every duck with an eye. On the host rather than in a container even in
+    # container mode: `webrtcsink` here is a local build at /opt/gst-plugins-rs, and a Debian
+    # container has no packaged one — so the console is served from the host, pointed at the
+    # simulator's frame port. `360p30` is exactly the 640x360 the renderer produces.
+    i=0
+    while [ "$i" -lt "$DUCKS" ]; do
+        if has_camera "$i"; then
+            name="$(duck_name "$i")"
+            [ -x "$REPO/target/debug/mediad" ] || (cd "$REPO" && cargo build --quiet -p mediad)
+            printf '[media]\nquality = "360p30"\n' > "$STATE/mediad-$name.toml"
+            DUCK_RUNTIME_DIR="$STATE" RUST_LOG="${RUST_LOG:-info}" \
+                $SETSID nohup "$REPO/target/debug/mediad" \
+                --sim-camera "127.0.0.1:$((FRAME_PORT + i))" \
+                --config "$STATE/mediad-$name.toml" \
+                --robot-socket "$STATE/$name.sock" --tof-socket "$STATE/$name-tof.sock" \
+                --port $((8443 + i)) --web-port $((8080 + i)) \
+                > "$STATE/$name-media.log" 2>&1 &
+            echo $! > "$STATE/$name-media.pid"
+            say "$name can see — console at http://127.0.0.1:$((8080 + i))"
+        fi
+        i=$((i + 1))
+    done
+
+    # The radio, once there is more than one duck to hear. It is a client of each `robotd` exactly
+    # as `btd` is, so nothing above the socket knows the difference.
+    if [ "$DUCKS" -gt 1 ]; then
+        [ -x "$REPO/target/debug/duck-ether" ] || (cd "$REPO" && cargo build --quiet -p duck-ether)
+        args=""
+        i=0
+        while [ "$i" -lt "$DUCKS" ]; do
+            args="$args --duck $(duck_name "$i")=$STATE/$(duck_name "$i").sock@$(duck_port "$i")"
+            i=$((i + 1))
+        done
+        # shellcheck disable=SC2086
+        $SETSID nohup "$REPO/target/debug/duck-ether" $args > "$STATE/ether.log" 2>&1 &
+        echo $! > "$STATE/ether.pid"
+        say "the ether is open — $DUCKS ducks can hear each other"
+    fi
+
+    say "standing up"
+    i=0
+    while [ "$i" -lt "$DUCKS" ]; do
+        SOCK_I="$STATE/$(duck_name "$i").sock" stand_at "$STATE/$(duck_name "$i").sock" || \
+            say "$(duck_name "$i") would not enable"
+        i=$((i + 1))
+    done
+    sleep 6
+    ctl health | head -3
+    i=0
+    while [ "$i" -lt "$DUCKS" ]; do
+        upright_at "$(duck_port "$i")" "$(duck_name "$i")" || true
+        i=$((i + 1))
+    done
+
+    cat <<'NEXT'
+
+  Your duck is up. From here:
+
+    scripts/duck-sim drive        walk it forward, then stop
+    scripts/duck-sim ctl health   or anything else robotctl does
+    scripts/duck-sim ctl robot do roulade
+    scripts/duck-sim log          what the daemon is saying
+    scripts/duck-sim down
+
+NEXT
+}
+
+# **`robot.enable`, not `robot init`.** `init` enables torque and then position-ramps to the home
+# pose over two seconds with nothing balancing — and this duck cannot hold any pose without a policy
+# driving it, at any timestep, from any placement. So the ramp tipped it flat every time: gravity in
+# the trunk frame went from -1.000 to +0.016 inside those two seconds, and it lay there. `enable`
+# hands the robot to the policy directly, and from a seated start it stands itself up: trunk 0.063
+# to 0.116 m, upright and steady.
+#
+# There is no `robotctl` subcommand for it — the console has the button — so this is the call.
+stand() { stand_at "$SOCK"; }
+
+stand_at() {
+    python3 - "$1" <<'PY'
+import json, socket, sys
+s = socket.socket(socket.AF_UNIX); s.settimeout(5); s.connect(sys.argv[1])
+f = s.makefile("rw")
+f.write(json.dumps({"jsonrpc": "2.0", "id": 1, "method": "robot.enable",
+                    "params": {"on": True}}) + "\n"); f.flush()
+answer = json.loads(f.readline())
+sys.exit(0 if answer.get("result", {}).get("accepted") else 1)
+PY
+}
+
+# Did it actually stand? Two numbers, because one of them is not enough.
+#
+# **Trunk height is the one that answers it.** An earlier version asked only for gravity in the
+# trunk frame and called -0.978 upright — but a duck sitting on its bottom with a vertical trunk has
+# gravity [0, 0, -1] as surely as a standing one does, so it reported a seated duck as standing
+# while the window showed it sitting. `STAND` is 0.12 and `SIT` is 0.07; halfway is the line.
+# Orientation still matters, for the duck that stood up and then fell over.
+upright() { upright_at "$PORT" "the duck"; }
+
+upright_at() {
+    read_z="$(python3 - "$1" <<'PY'
+import json, socket, sys
+s = socket.socket(); s.settimeout(2); s.connect(("127.0.0.1", int(sys.argv[1])))
+f = s.makefile("rw")
+f.write(json.dumps({"op": "hello", "protocol": 1, "joints": 15}) + "\n"); f.flush(); f.readline()
+f.write('{"op":"read"}\n'); f.flush()
+r = json.loads(f.readline())
+print("%.3f %.3f" % (r.get("trunk_z", -1.0), r["imu"]["gravity"][2]))
+PY
+)" || return 0
+    trunk="${read_z% *}"
+    z="${read_z#* }"
+    standing="$(python3 -c "print(1 if $trunk > 0.095 else 0)" 2>/dev/null || echo 0)"
+    if [ "$standing" = 1 ]; then
+        case "$z" in
+            -0.9*|-1*) say "$2: standing (trunk $trunk m, gravity z $z)"; return 0 ;;
+        esac
+    fi
+
+    printf '\n'
+    say "$2 did not stand up (trunk ${trunk}m, standing is about 0.12; gravity z $z)"
+    if grep -q "behind real time" "$STATE/body.log" 2>/dev/null; then
+        cat <<'WHY'
+  The simulator could not keep real time, and that is almost certainly why. The daemon's loop is
+  wall-clock: if MuJoCo runs at half speed the policy is effectively driving a robot that moves half
+  as fast as it expects, and it cannot balance one. The viewer is the usual cause.
+
+    scripts/duck-sim down && DUCK_SIM_VIEWER=0 scripts/duck-sim
+WHY
+    else
+        cat <<'WHY'
+  The simulator kept up, so this is the policy rather than the pacing. Worth a look:
+
+    scripts/duck-sim log                 what the daemon decided
+    scripts/duck-sim stand               try again
+WHY
+    fi
+    return 1
+}
+
+# Does this duck have an eye? `all`, or its letter in the list.
+has_camera() {
+    case "$CAMERAS" in
+        "")   return 1 ;;
+        all)  return 0 ;;
+        *)    case ",$CAMERAS," in *",$(printf %s "$LETTERS" | cut -c$(($1 + 1))),"*) return 0 ;; esac
+              return 1 ;;
+    esac
+}
+
+# The body, on the host in both modes: MuJoCo is not going in a container, and the container shares
+# the host's network namespace so localhost is the same localhost either way.
+start_body() {
+    [ -d "$RL" ] || die "no simulator at $RL. It is the microduck_rl repo — set DUCK_SIM_RL."
+    [ -x "$RL/.venv/bin/python" ] || die "$RL has no .venv. Run \`uv sync\` there first."
+    mkdir -p "$STATE"
+    say "starting the body — a MuJoCo window should open"
+    # `DUCK_SIM_VIEWER=0` for a window-less run: watching costs frames, and the daemon's loop is
+    # wall-clock, so a simulator that cannot keep up is a robot that cannot balance.
+    [ "${DUCK_SIM_VIEWER:-1}" = 0 ] && HEADLESS=--headless || HEADLESS=
+    # **The viewer needs `mjpython` on macOS.** MuJoCo's passive viewer has to own the main thread
+    # and the Cocoa event loop, so `launch_passive` refuses under a plain interpreter — the body
+    # server catches that and runs headless, which is a window that never opens and no error to
+    # explain it. `mjpython` is the launcher the wheel ships for exactly this. Linux has no such
+    # rule, and asking for headless has nothing to launch either way.
+    PY_BIN="$RL/.venv/bin/python"
+    if [ -z "$HEADLESS" ] && [ "$(uname -s)" = Darwin ] && [ -x "$RL/.venv/bin/mjpython" ]; then
+        PY_BIN="$RL/.venv/bin/mjpython"
+    fi
+    # **Backgrounded directly, and in its own session.** `( cd X && nohup cmd & echo $! )` records
+    # the *subshell's* pid, because `A && B & C` parses as `(A && B) & C` — so `down` killed a
+    # wrapper and left MuJoCo running as an orphan. `setsid` puts the simulator in its own process
+    # group, which is what makes stopping it one signal rather than a hunt.
+    case "$SCENE" in
+        "")   scene_arg="" ;;
+        */*)  scene_arg="--scene $SCENE" ;;
+        *)    scene_arg="--scene $RL/src/mjlab_microduck/robot/microduck/scene_$SCENE.xml" ;;
+    esac
+    # **The camera flags go with the cameras.** Rendering is newer than the body server, and a
+    # build without it has no `--cameras`/`--frame-port` — argparse then refuses the whole
+    # invocation over two arguments nobody asked to use, and the duck never starts. Passed only
+    # when a camera was actually requested, so asking for one against such a build still fails,
+    # loudly and about the thing that is missing.
+    cam_args=""
+    if [ -n "$CAMERAS" ]; then
+        cam_args="--cameras $CAMERAS --frame-port $FRAME_PORT"
+    fi
+    # shellcheck disable=SC2086
+    $SETSID nohup "$PY_BIN" -m mjlab_microduck.sim.body_server \
+        --port "$PORT" --ducks "$DUCKS" --keyframe "${DUCK_SIM_KEYFRAME:-SIT}" $HEADLESS $scene_arg \
+        $cam_args \
+        > "$STATE/body.log" 2>&1 &
+    echo $! > "$STATE/body.pid"
+    wait_for_port || die "the simulator did not come up. $STATE/body.log has why."
+}
+
+wait_for_port() {
+    i=0
+    while [ $i -lt 100 ]; do
+        # Not /dev/tcp: that is a bash builtin and this is #!/bin/sh, which is dash on Debian
+        # and Ubuntu. python3 is already required by `drive`, so it is the portable knock.
+        if python3 -c "import socket,sys;s=socket.socket();s.settimeout(.3);sys.exit(s.connect_ex(('127.0.0.1',$PORT)))" 2>/dev/null; then
+            return 0
+        fi
+        i=$((i + 1)); sleep 0.2
+    done
+    return 1
+}
+
+wait_for_socket() {
+    i=0
+    while [ $i -lt 150 ]; do
+        [ -S "$SOCK" ] && ctl health >/dev/null 2>&1 && return 0
+        i=$((i + 1)); sleep 0.2
+    done
+    return 1
+}
+
+# Walking has no robotctl subcommand — intents come from a pad or the console — so this is the
+# smallest client that sends one. Resent at 10 Hz because `robotd` expires an intent 500 ms after
+# they stop arriving, which is what makes a dropped connection stop the robot rather than run it
+# into a wall.
+drive() {
+    [ -S "$SOCK" ] || die "no duck. \`scripts/duck-sim\` first."
+    say "walking forward for 8 s"
+    python3 - "$SOCK" "${1:-0.15}" "${2:-0.0}" <<'PY'
+import json, socket, sys, time
+sock, vx, vyaw = sys.argv[1], float(sys.argv[2]), float(sys.argv[3])
+s = socket.socket(socket.AF_UNIX); s.connect(sock)
+f = s.makefile("w")
+for _ in range(80):
+    f.write(json.dumps({"jsonrpc": "2.0", "method": "robot.move",
+                        "params": {"vx": vx, "vy": 0.0, "vyaw": vyaw}}) + "\n")
+    f.flush()
+    time.sleep(0.1)
+PY
+    say "stopped — the intent expires on its own"
+}
+
+# How fast the world is actually running. The daemons' loops are wall-clock, so a simulator below
+# real time is not merely slow to watch — the policies are driving robots that move less than they
+# expect, and they cannot balance one. Reported rather than left to be felt.
+realtime() {
+    factor="$(python3 - "$PORT" <<'PY'
+import json, socket, sys, time
+s = socket.socket(); s.settimeout(5); s.connect(("127.0.0.1", int(sys.argv[1])))
+f = s.makefile("rw")
+f.write(json.dumps({"op": "hello", "protocol": 1, "joints": 15}) + "\n"); f.flush(); f.readline()
+def now():
+    f.write('{"op":"read"}\n'); f.flush(); return json.loads(f.readline())["sim_time"]
+a, w = now(), time.perf_counter()
+time.sleep(3.0)
+print("%.2f" % ((now() - a) / (time.perf_counter() - w)))
+PY
+)" || return 0
+    case "$factor" in
+        1.0*|0.9[5-9]) say "the world is running at ${factor}x real time" ;;
+        *) say "the world is at ${factor}x real time — below 1.0 the policies cannot balance. \
+Try DUCK_SIM_VIEWER=0, or fewer ducks." ;;
+    esac
+}
+
+# ── the container ─────────────────────────────────────────────────────────────
+
+# Every duck this script could have started, stopped and unmounted. By name from the same list that
+# starts them, so a duck left behind by an interrupted boot is still cleaned up.
+down_containers() {
+    # Called by every `down`, including the plain one. A machine with no systemd has no containers
+    # to stop, and sixteen `sudo systemctl` that cannot resolve would ask for a password first.
+    command -v systemctl >/dev/null 2>&1 || return 0
+    i=0
+    while [ "$i" -lt 16 ]; do
+        name="$(duck_name "$i")"
+        if sudo systemctl is-active --quiet "$name" 2>/dev/null; then
+            sudo systemctl stop "$name" 2>/dev/null || true
+        fi
+        merged="$STATE/ducks/$name/merged"
+        mountpoint -q "$merged" 2>/dev/null && sudo umount "$merged" 2>/dev/null || true
+        i=$((i + 1))
+    done
+}
+
+
+ROOTFS="$STATE/rootfs"
+
+# duck-a, duck-b, … — one container each, one body port each, all in one world.
+LETTERS=abcdefghijklmnop
+duck_name() { echo "duck-$(printf %s "$LETTERS" | cut -c$(($1 + 1)))"; }
+duck_port() { echo $((PORT + $1)); }
+
+# Debian 13 Trixie, the board's own userland, built unprivileged. Two things an Ubuntu host needs
+# and does not have: Debian's archive keyring, and apt not dropping to a `_apt` uid that the user
+# namespace cannot map — which leaves files nobody can delete.
+# What the container needs beyond a minimal Debian. `alsa-utils` is `aplay`, which `robotd` forks to
+# make a sound — without it the ducks sing silently, and by design that failure is logged and skipped.
+# `libasound2-plugins` is the ALSA-to-PulseAudio bridge, which is what lets several ducks be audible
+# at once rather than the first one holding the device.
+PACKAGES=systemd-sysv,dbus,libssl3,ca-certificates,alsa-utils,libasound2-plugins
+
+rootfs() {
+    containers_or_die
+    # The list is recorded, so changing it rebuilds rather than silently not taking effect — which is
+    # otherwise a round trip spent wondering why a pull changed nothing.
+    if [ -d "$ROOTFS" ] && [ "$(cat "$STATE/rootfs.packages" 2>/dev/null)" = "$PACKAGES" ]; then
+        say "rootfs already at $ROOTFS (delete it to rebuild)"
+        return 0
+    fi
+    if [ -d "$ROOTFS" ]; then
+        say "the package list changed — rebuilding the rootfs"
+        sudo rm -rf "$ROOTFS"
+    fi
+    command -v mmdebstrap >/dev/null || die "mmdebstrap is missing: sudo apt install mmdebstrap"
+    mkdir -p "$STATE/keyring"
+    if [ ! -f "$STATE/keyring/usr/share/keyrings/debian-archive-keyring.gpg" ]; then
+        say "fetching Debian's archive keyring (this host is not Debian)"
+        deb="$(curl -s http://deb.debian.org/debian/pool/main/d/debian-archive-keyring/ \
+            | grep -o 'debian-archive-keyring_[0-9.]*_all\.deb' | sort -u | tail -1)"
+        [ -n "$deb" ] || die "could not find the keyring package on deb.debian.org"
+        curl -sSL -o "$STATE/keyring.deb" "http://deb.debian.org/debian/pool/main/d/debian-archive-keyring/$deb"
+        dpkg-deb -x "$STATE/keyring.deb" "$STATE/keyring"
+    fi
+    # The keyring has to be readable by the uid apt drops to *inside* the user namespace, and a
+    # keyring under a 0700 `~/.cache` is not — apt then reports the repository as unsigned, which
+    # reads like a mirror problem and is a permissions one. So it is staged somewhere traversable
+    # for the length of the build.
+    KEYDIR="$(mktemp -d)"
+    chmod 755 "$KEYDIR"
+    cp "$STATE"/keyring/usr/share/keyrings/*.gpg "$KEYDIR/"
+    chmod 644 "$KEYDIR"/*.gpg
+    trap 'rm -rf "$KEYDIR"' EXIT
+
+    say "building a Debian 13 rootfs — about three minutes, once"
+    # **A tarball, then unpack it as root.** Building the tree directly needs every parent directory
+    # traversable by the subuids mmdebstrap maps into, and `~/.cache` is 0700 — which is the user's
+    # business, not this script's. A tar is one file in a directory we own, and unpacking it with
+    # the sudo `boot` already needs is what gets the ownership right.
+    mmdebstrap --variant=important \
+        --keyring="$KEYDIR" \
+        --aptopt='APT::Sandbox::User "root"' \
+        --include="$PACKAGES" \
+        --format=tar \
+        trixie "$STATE/rootfs.tar" http://deb.debian.org/debian
+    say "unpacking it (sudo, for the ownership)"
+    sudo mkdir -p "$ROOTFS"
+    sudo tar -xpf "$STATE/rootfs.tar" -C "$ROOTFS"
+    rm -f "$STATE/rootfs.tar"
+    printf '%s' "$PACKAGES" > "$STATE/rootfs.packages"
+    say "rootfs ready ($(sudo du -sh "$ROOTFS" | cut -f1))"
+}
+
+# Everything a release puts on a board, put here by hand — this is not `robotctl update apply`, it
+# is what a board looks like *after* one, so that the units and the daemons are the real thing.
+stage() {
+    ORT="$(ls "$RL"/.venv/lib/python*/site-packages/onnxruntime/capi/libonnxruntime.so.* 2>/dev/null | head -1)"
+    [ -n "$ORT" ] || die "no onnxruntime in $RL/.venv"
+    say "installing the release into the container"
+    # **Every daemon's users, not just robotd's.** A unit whose `User=` does not exist fails with
+    # 217/USER and says nothing about a missing user — which is how `tofd` looked like a sensor that
+    # was never wired when it was only unable to start. The release's own postinstall installs every
+    # sysusers file it ships, so this does too, plus the `i2c` group `tofd.service` asks for and that
+    # a board gets from provisioning rather than from a release. mediad, btd and padd would each
+    # have arrived at the same wall in turn.
+    # **No apostrophes below this line.** The whole block is one single-quoted argument, so an
+    # apostrophe in a comment ends it — the rest becomes unquoted shell, and it swallowed the brace
+    # that closes this function along with the next one. `sh -n` sees nothing wrong, because the
+    # quotes balance; the symptom is `boot: not found` from a script that clearly defines boot.
+    #
+    # Which body a duck drives is therefore not written here. It goes into that duck-s own overlay
+    # in `boot`, because the environment does not survive the trip: `systemd-nspawn --setenv` sets
+    # a variable for the container PID 1, and systemd does not pass its own environment to the
+    # services it starts.
+    sudo sh -eu -c '
+        ROOTFS="$1"; REPO="$2"; ORT="$3"; PORT="$4"
+        REL="$ROOTFS/opt/robot/daemon/releases/sim"
+        mkdir -p "$REL/bin" "$REL/policies" "$ROOTFS/etc/systemd/system/robotd.service.d"
+        install -m755 "$REPO/target/debug/robotd" "$REPO/target/debug/robotctl" "$REL/bin/"
+        cp "$REPO"/policies/*.onnx "$REL/policies/"
+        ln -sfn /opt/robot/daemon/releases/sim "$ROOTFS/opt/robot/daemon/current"
+        # On PATH, because the first thing anybody types after logging into a duck is `robotctl`
+        # and `command not found` is a poor greeting. A symlink rather than a profile.d line: it
+        # works for `machinectl shell duck-a robotctl …` too, which does not read a profile.
+        ln -sfn /opt/robot/daemon/current/bin/robotctl "$ROOTFS/usr/local/bin/robotctl"
+        cp "$ORT" "$ROOTFS/usr/lib/"
+        ln -sfn "/usr/lib/$(basename "$ORT")" "$ROOTFS/usr/lib/libonnxruntime.so"
+        cp "$REPO"/robotd/systemd/robotd.service "$ROOTFS/etc/systemd/system/"
+        cp "$REPO"/tof/systemd/tofd.service "$ROOTFS/etc/systemd/system/" 2>/dev/null || true
+        install -m755 "$REPO/target/debug/tofd" "$REL/bin/" 2>/dev/null || true
+        mkdir -p "$ROOTFS/usr/lib/sysusers.d"
+        cp "$REPO"/btd/systemd/sysusers.d/btd.conf "$ROOTFS/usr/lib/sysusers.d/" 2>/dev/null || true
+        cp "$REPO"/mediad/systemd/sysusers.d/mediad.conf "$ROOTFS/usr/lib/sysusers.d/" 2>/dev/null || true
+        cp "$REPO"/padd/systemd/sysusers.d/padd.conf "$ROOTFS/usr/lib/sysusers.d/" 2>/dev/null || true
+        cp "$REPO"/tof/systemd/sysusers.d/tofd.conf "$ROOTFS/usr/lib/sysusers.d/" 2>/dev/null || true
+        cp "$REPO"/updater/systemd/sysusers.d/robot.conf "$ROOTFS/usr/lib/sysusers.d/" 2>/dev/null || true
+        printf "g i2c -\n" > "$ROOTFS/usr/lib/sysusers.d/duck-sim-groups.conf"
+        # ALSA pointed at the host, so `aplay` reaches the machine speakers rather than a sound card
+        # the container does not have. Through the host audio server rather than /dev/snd, because
+        # that is what lets four ducks be audible at once.
+        printf "pcm.!default { type pulse }\nctl.!default { type pulse }\n" > "$ROOTFS/etc/asound.conf"
+        # **Run now, not left to the container.** `systemd-sysusers.service` carries
+        # `ConditionNeedsUpdate=/etc`, and staging writes /etc after /usr — so /etc looks newer, the
+        # condition is not met, and the unit is skipped. The users then do not exist, `tofd.service`
+        # dies with 217/USER, and from the monitor that looks like a sensor nobody wired. The
+        # release postinstall runs this directly for the same reason.
+        chroot "$ROOTFS" /usr/bin/systemd-sysusers >/dev/null 2>&1 || true
+        # Verified here rather than discovered three layers down.
+        for who in tofd robot mediad btd padd; do
+            grep -q "^$who:" "$ROOTFS/etc/passwd" "$ROOTFS/etc/group" 2>/dev/null \
+                || echo "  WARNING: no $who user or group — the unit that needs it will not start"
+        done
+        # The body is on the host, and this container shares the host network namespace, so
+        # localhost is the same localhost.
+        rm -f "$ROOTFS/etc/systemd/system/robotd.service.d/sim.conf"
+        # No params file at all: inside the container `RELEASE_DIR` is real, so every policy
+        # resolves the way it does on a robot. That is the whole point of booting one.
+        rm -f "$ROOTFS/etc/robot/robotd.toml"
+        printf "root:x:0:\n" >/dev/null
+        chroot "$ROOTFS" /usr/bin/passwd -d root >/dev/null 2>&1 || true
+        chroot "$ROOTFS" /usr/bin/systemctl enable robotd.service tofd.service >/dev/null 2>&1 || true
+    ' _ "$ROOTFS" "$REPO" "$ORT" "$PORT"
+}
+
+# `boot`, `shell` and `rootfs` are systemd, and a machine without it cannot run any of them. Said
+# here, before anything reaches for `sudo` — a password prompt followed by `machinectl: command not
+# found` is a worse way to learn it.
+containers_or_die() {
+    command -v systemd-nspawn >/dev/null 2>&1 && return 0
+    die "this needs systemd-nspawn, which is Linux only. \`scripts/duck-sim\` with no argument runs the same body and the same daemons as plain processes."
+}
+
+boot() {
+    containers_or_die
+    # Always, not only when the directory is missing: deciding whether the rootfs is still the right
+    # one is `rootfs`'s job, and guarding the call on the directory existing is what stopped a
+    # changed package list from ever being noticed. It returns in a moment when nothing has changed.
+    rootfs
+    build_daemons
+    stage
+    start_body
+
+    # The host's audio server, if there is one. A duck with no speaker is not an error — on a board
+    # `robotd` logs a failed `aplay` and carries on — so this is offered rather than required.
+    AUDIO_BIND=""
+    if [ -S "${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/pulse/native" ]; then
+        AUDIO_BIND="--bind=${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/pulse/native:/run/pulse-host"
+    else
+        say "no host audio server — the ducks will sing silently"
+    fi
+
+    # **One rootfs, one overlay per duck.** The base is read-only and each duck gets its own upper,
+    # so duck four costs megabytes rather than 213 of them — and `robotctl configure` on one duck
+    # does not edit another's config.
+    i=0
+    while [ "$i" -lt "$DUCKS" ]; do
+        name="$(duck_name "$i")"
+        upper="$STATE/ducks/$name"
+        sudo mkdir -p "$upper/upper" "$upper/work" "$upper/merged"
+        sudo mount -t overlay overlay \
+            -o "lowerdir=$ROOTFS,upperdir=$upper/upper,workdir=$upper/work" "$upper/merged"
+        # Its own name. `--hostname` below sets the kernel one, and then systemd inside reads
+        # /etc/hostname — which mmdebstrap filled in with the name of the machine that built the
+        # rootfs — and sets it back. A duck should not think it is a laptop.
+        printf '%s\n' "$name" | sudo tee "$upper/merged/etc/hostname" >/dev/null
+        # This duck's own body, in this duck's own filesystem — which is what the overlay is for.
+        #
+        # **And its socket somewhere the ether can reach.** A container's `/run` is its own, so
+        # `/run/robotd.sock` inside it is invisible from here — and the radio has to hold one
+        # connection per duck, from outside all of them. So a host directory is bound in at
+        # `/run/duck`, robotd is told to listen there, and a symlink puts it back at the path every
+        # client in the container expects. The socket is then the same object on both sides.
+        sudo mkdir -p "$upper/merged/etc/systemd/system/robotd.service.d" "$upper/run"
+        sudo tee "$upper/merged/etc/systemd/system/robotd.service.d/sim.conf" >/dev/null <<CONF
+[Service]
+ExecStart=
+ExecStart=/opt/robot/daemon/current/bin/robotd --sim 127.0.0.1:$(duck_port "$i") --socket /run/duck/robotd.sock
+ExecStartPost=/bin/ln -sf /run/duck/robotd.sock /run/robotd.sock
+Environment=PULSE_SERVER=unix:/run/pulse-host
+CONF
+        sudo mkdir -p "$upper/merged/etc/systemd/system/tofd.service.d"
+        # `RestrictAddressFamilies=AF_UNIX` in the unit, because on a robot `tofd` talks to a bus
+        # and a socket and has no business with TCP. Here its sensor is across a TCP connection, and
+        # the sandbox refuses it with EAFNOSUPPORT — "Address family not supported by protocol",
+        # which reads like a broken network rather than a policy. Reset and re-stated rather than
+        # appended: these merge as a union, and being explicit is what makes the drop-in readable.
+        sudo tee "$upper/merged/etc/systemd/system/tofd.service.d/sim.conf" >/dev/null <<CONF
+[Service]
+ExecStart=
+ExecStart=/opt/robot/daemon/current/bin/tofd --sim 127.0.0.1:$(duck_port "$i")
+RestrictAddressFamilies=
+RestrictAddressFamilies=AF_UNIX AF_INET
+CONF
+        # Singing is opt-in. Only this key: everything else resolves from the release, which is
+        # the reason to boot a container in the first place.
+        sudo mkdir -p "$upper/merged/etc/robot"
+        printf '[chorale]\naccept = true\n\n[audio]\ndevice = "default"\n' \
+            | sudo tee "$upper/merged/etc/robot/robotd.toml" >/dev/null
+        # A voice of its own — the chorale id comes from the bank seed, so ducks sharing a bank
+        # share an id and drop each other as their own reflection.
+        if [ ! -d "$upper/merged/var/lib/robot/sounds" ]; then
+            say "rendering $name a voice"
+            sudo env DUCK_IDENTITY="$name" "$REPO/target/debug/sounds" ensure-bank \
+                --dir "$upper/merged/var/lib/robot/sounds" >/dev/null 2>&1 || say "$name has no voice"
+        fi
+        say "booting $name (body on port $(duck_port "$i"))"
+        sudo systemd-run --collect --unit="$name" --quiet \
+            systemd-nspawn -D "$upper/merged" --machine="$name" --boot \
+            --hostname="$name" --resolv-conf=copy-host \
+            --bind="$upper/run:/run/duck" $AUDIO_BIND
+        i=$((i + 1))
+    done
+
+    i=0
+    while [ "$i" -lt "$DUCKS" ]; do
+        name="$(duck_name "$i")"
+        j=0
+        while [ $j -lt 60 ]; do
+            sudo machinectl show "$name" >/dev/null 2>&1 && break
+            j=$((j + 1)); sleep 0.5
+        done
+        i=$((i + 1))
+    done
+    sleep 5
+
+    # Hand each to its policy, from inside — the socket lives in that container's own /run, which is
+    # the point. `enable` rather than `init`: see `robotctl robot enable`.
+    say "standing them up"
+    i=0
+    while [ "$i" -lt "$DUCKS" ]; do
+        name="$(duck_name "$i")"
+        # `systemd-run --machine`, not `machinectl shell`: the latter allocates a PTY and is
+        # unhappy with its output redirected, which is how three ducks out of four were quietly
+        # never enabled. This runs the command in the container and waits for its exit status.
+        if ! sudo systemd-run --machine="$name" --pipe --wait --quiet \
+            /usr/local/bin/robotctl robot enable >/dev/null 2>&1; then
+            say "$name would not enable — shell in and try \`robotctl robot enable\`"
+        fi
+        i=$((i + 1))
+    done
+    sleep 5
+    i=0
+    while [ "$i" -lt "$DUCKS" ]; do
+        PORT_I="$(duck_port "$i")" upright_at "$(duck_port "$i")" "$(duck_name "$i")" || true
+        i=$((i + 1))
+    done
+
+    # The radio, reaching each duck through the socket bound out of its container.
+    if [ "$DUCKS" -gt 1 ]; then
+        [ -x "$REPO/target/debug/duck-ether" ] || (cd "$REPO" && cargo build --quiet -p duck-ether)
+        args=""
+        i=0
+        while [ "$i" -lt "$DUCKS" ]; do
+            name="$(duck_name "$i")"
+            args="$args --duck $name=$STATE/ducks/$name/run/robotd.sock@$(duck_port "$i")"
+            i=$((i + 1))
+        done
+        # A unit, not a background process with a pidfile. It has to run as root — robotd creates
+        # its socket 0660 root:robot, and the host group would not help since the container has its
+        # own — and a root process stopped by pid is exactly the shape that killed a login session.
+        # `systemctl stop duck-ether` needs no pid and cannot be wrong about which process it is.
+        # shellcheck disable=SC2086
+        sudo systemd-run --collect --unit=duck-ether --quiet \
+            "$REPO/target/debug/duck-ether" $args
+        say "the ether is open — $DUCKS ducks can hear each other"
+    fi
+
+    realtime
+
+    cat <<NEXT
+
+  scripts/duck-sim shell           you are on $(duck_name 0)
+  scripts/duck-sim shell duck-b    or any other
+  duck-a # robotctl health
+
+  scripts/duck-sim down
+
+NEXT
+}
+
+shell() {
+    containers_or_die
+    sudo machinectl shell "${1:-$(duck_name 0)}"
+}
+
+case "${1:-up}" in
+    up|"")   up ;;
+    rootfs)  rootfs ;;
+    boot)    shift; DUCKS="${1:-$DUCKS}"; boot ;;
+    shell)   shift; shell "$@" ;;
+    down)    down_containers; down ;;
+    drive)   shift; drive "$@" ;;
+    ctl)     shift; ctl "$@" ;;
+    stand)   stand && sleep 6 && upright ;;
+    status)  ctl health | head -4; upright ;;
+    monitor) shift; ctl monitor "$@" ;;
+    log)     tail -f "$STATE/robotd.log" ;;
+    simlog)  tail -f "$STATE/body.log" ;;
+    realtime) realtime ;;
+    *)       die "unknown command '$1'. Try: up, boot, shell, down, stand, drive, monitor, ctl, log, simlog, status, realtime" ;;
+esac
diff --git a/scripts/install.sh b/scripts/install.sh
index ca7fe2ac..2daa1e3a 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -738,6 +738,18 @@ install_units() {
   robot. The next update installs it."
     fi
 
+    # Apt off the boot path: Armbian's `@reboot` update count and the stock apt-daily timers, which
+    # together pin a core for seconds while robotd is starting and produce nothing a robot reads.
+    # Same shape as setup-login.sh above, for the same §9.1 reason: the hook runs it too.
+    setup_quiet_boot="${INSTALL_DIR}/current/scripts/setup-quiet-boot.sh"
+    if [ -f "$setup_quiet_boot" ]; then
+        sh "$setup_quiet_boot" || warn "could not take apt off the boot path; boot is slower and
+  noisier than it needs to be, and the robot is unaffected."
+    else
+        warn "the release carries no scripts/setup-quiet-boot.sh; Armbian keeps running a simulated
+  apt upgrade at every boot. The next update installs it."
+    fi
+
     systemctl daemon-reload
     enable_unit updaterd.service
     enable_unit robotd.service
diff --git a/scripts/publish-console.sh b/scripts/publish-console.sh
new file mode 100755
index 00000000..7a04daae
--- /dev/null
+++ b/scripts/publish-console.sh
@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+#
+# Publish the console page to the Hugging Face Space that serves it remotely.
+#
+# The page in this repository is the source (`remote-access-design.md` §5): it tracks the
+# signalling protocol and the robot's method names, and a copy living in the Space would drift
+# from both. This is the deploy — by hand while there is one Space, by CI when that stops being
+# true.
+#
+# What it substitutes, and what it deliberately does not:
+#
+#   {{API_VERSION}}     the version this checkout speaks, read from `duck-ipc-proto`, so the page
+#                       can tell a person that it and the robot disagree.
+#   {{SIGNALLING_PORT}} left alone. The page reads an unsubstituted port as "no robot served me",
+#                       which is exactly true here and is what selects the rendezvous transport.
+#                       Substituting it would make the page try to open a WebSocket to the Space.
+#
+# Usage: scripts/publish-console.sh [--space <org/name>] [--dry-run]
+#
+# Pushing needs a Hugging Face token with write access to the Space. `hf auth login` stores one,
+# and git will ask for it otherwise; the token is never read by this script.
+
+set -euo pipefail
+
+SPACE="pollen-robotics/microduck-console"
+DRY_RUN=
+
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --space) SPACE="$2"; shift 2 ;;
+        --dry-run) DRY_RUN=1; shift ;;
+        -h|--help) sed -n '2,22p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+        *) echo "unknown argument: $1" >&2; exit 2 ;;
+    esac
+done
+
+REPO_ROOT=$(cd "$(dirname "$0")/.." && pwd)
+PAGE="$REPO_ROOT/mediad/webclient/index.html"
+SPACE_DIR="$REPO_ROOT/mediad/webclient/space"
+CARD="$SPACE_DIR/README.md"
+
+for file in "$PAGE" "$CARD" "$SPACE_DIR/Dockerfile" "$SPACE_DIR/entrypoint.sh"; do
+    [ -f "$file" ] || { echo "missing: $file" >&2; exit 1; }
+done
+
+# One source of truth for the wire version: the constant every daemon compiles against.
+API_VERSION=$(sed -n 's/^pub const API_VERSION: u32 = \([0-9]*\);.*/\1/p' \
+    "$REPO_ROOT/duck-ipc-proto/src/lib.rs")
+[ -n "$API_VERSION" ] || { echo "could not read API_VERSION" >&2; exit 1; }
+
+STAGE=$(mktemp -d)
+trap 'rm -rf "$STAGE"' EXIT
+
+# Which build this is, logged by the page as its first line. A static host caches and a browser
+# caches harder, so "is the fix even loaded" has to be answerable without guessing.
+# The revision *and* a hash of the page itself. The revision alone is not enough: a page edited
+# but not yet committed publishes under its parent's revision, so two different pages can carry
+# the same stamp — which is exactly the confusion this stamp exists to end.
+REVISION=$(cd "$REPO_ROOT" && git rev-parse --short HEAD)
+PAGE_HASH=$(shasum "$PAGE" | cut -c1-8)
+STAMP=$(date -u +%Y-%m-%dT%H:%MZ)
+sed -e "s/{{API_VERSION}}/$API_VERSION/g" \
+    -e "s|{{CONSOLE_BUILD}}|$REVISION/$PAGE_HASH $STAMP|g" "$PAGE" > "$STAGE/index.html"
+cp "$CARD" "$STAGE/README.md"
+# The Space is a Docker Space: it serves the page and substitutes its own OAuth client id into it.
+cp "$SPACE_DIR/Dockerfile" "$SPACE_DIR/entrypoint.sh" "$STAGE/"
+
+# The client id is substituted by the container at start, not here, so the token must survive
+# this staging — and the secret that comes with it must never appear in the page at all.
+grep -q '{{OAUTH_CLIENT_ID}}' "$STAGE/index.html" || {
+    echo "the OAuth token is gone from the page; the Space could not fill in its client id" >&2
+    exit 1
+}
+
+grep -q '{{SIGNALLING_PORT}}' "$STAGE/index.html" || {
+    echo "the port token is gone from the page; the Space copy would try to open a WebSocket" >&2
+    exit 1
+}
+
+echo "page:  $(wc -c < "$STAGE/index.html") bytes, api v$API_VERSION"
+echo "space: https://huggingface.co/spaces/$SPACE"
+
+if [ -n "$DRY_RUN" ]; then
+    echo "--dry-run: staged in $STAGE, nothing pushed"
+    trap - EXIT
+    exit 0
+fi
+
+CLONE="$STAGE/space"
+git clone --depth 1 "https://huggingface.co/spaces/$SPACE" "$CLONE"
+cp "$STAGE/index.html" "$STAGE/README.md" "$STAGE/Dockerfile" "$STAGE/entrypoint.sh" "$CLONE/"
+
+cd "$CLONE"
+if git diff --quiet; then
+    echo "the Space already serves this page"
+    exit 0
+fi
+
+git add index.html README.md Dockerfile entrypoint.sh
+git commit -q -m "Console from microduck $REVISION (api v$API_VERSION)"
+git push
+echo "pushed. The Space rebuilds in a few seconds."
diff --git a/scripts/publish-space.sh b/scripts/publish-space.sh
new file mode 100755
index 00000000..9c6ec9ee
--- /dev/null
+++ b/scripts/publish-space.sh
@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+#
+# Publish one of `spaces/` to the Hugging Face Space that serves it.
+#
+# The source lives in this repository for the reason `remote-access-design.md` §5 gives about the
+# console: a Space consuming a duck tracks things that live here — the rendezvous protocol, the
+# robot's own method names, the camera's geometry — and a copy in a Space repo drifts from all of
+# them. This is the deploy, by hand while there are two of them.
+#
+# Usage:
+#   scripts/publish-space.sh vision-demo
+#   scripts/publish-space.sh vision-demo --space pollen-robotics/other-name --dry-run
+#
+# Pushing needs a Hugging Face token with write access. `hf auth login` stores one and git will
+# ask otherwise; this script never reads it.
+
+set -euo pipefail
+
+NAME="${1:-}"
+[ -n "$NAME" ] || { echo "usage: $0 <directory under spaces/> [--space id] [--dry-run]" >&2; exit 2; }
+shift
+
+SPACE="pollen-robotics/microduck-$NAME"
+DRY_RUN=
+
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --space) SPACE="$2"; shift 2 ;;
+        --dry-run) DRY_RUN=1; shift ;;
+        *) echo "unknown argument: $1" >&2; exit 2 ;;
+    esac
+done
+
+REPO_ROOT=$(cd "$(dirname "$0")/.." && pwd)
+SOURCE="$REPO_ROOT/spaces/$NAME"
+[ -d "$SOURCE" ] || { echo "no such space source: $SOURCE" >&2; exit 1; }
+[ -f "$SOURCE/README.md" ] || { echo "$NAME has no README.md, which is its Space card" >&2; exit 1; }
+
+STAGE=$(mktemp -d)
+trap 'rm -rf "$STAGE"' EXIT
+
+echo "space:  https://huggingface.co/spaces/$SPACE"
+echo "files:  $(find "$SOURCE" -maxdepth 1 \( -type f -o -type l \) -exec basename {} \; | sort | tr '\n' ' ')"
+
+if [ -n "$DRY_RUN" ]; then
+    echo "--dry-run: nothing pushed"
+    exit 0
+fi
+
+CLONE="$STAGE/space"
+git clone --depth 1 "https://huggingface.co/spaces/$SPACE" "$CLONE"
+
+# Copied rather than synced: a file deleted here stays in the Space until somebody removes it
+# there. Deliberate — a `--delete` that ran against the wrong Space id would remove somebody's
+# work, and these are hand-run.
+#
+# Files only, and `find` rather than a glob for one reason: running a Space locally leaves a
+# `__pycache__` beside its source (gitignored, so it stays there), and `cp` without `-r` fails on
+# a directory instead of skipping it — which under `set -e` aborts the publish after the clone,
+# for a reason that has nothing to do with the Space.
+#
+# **Symlinks are followed and flattened, which is how two Spaces share a client.** `spaces/shared`
+# holds the modules that speak this project's protocols — the control lane, the rendezvous
+# listing — and each Space links to the ones it uses. A Space repo cannot have a parent directory,
+# so `-type l` and `cp -L` turn the link into the file at publish time. Duplicating those modules
+# per Space instead is the drift `remote-access-design.md` §5 keeps their source in this
+# repository to avoid, and two copies in one repository would drift just as happily.
+find "$SOURCE" -maxdepth 1 \( -type f -o -type l \) -exec cp -L {} "$CLONE/" \;
+
+cd "$CLONE"
+if git diff --quiet; then
+    echo "the Space already serves this"
+    exit 0
+fi
+
+REVISION=$(cd "$REPO_ROOT" && git rev-parse --short HEAD)
+git add -A
+git commit -q -m "$NAME from microduck $REVISION"
+git push
+echo "pushed. The Space rebuilds in a minute or two — Gradio Spaces install their requirements."
diff --git a/scripts/seed-detector.sh b/scripts/seed-detector.sh
new file mode 100755
index 00000000..cab86aa9
--- /dev/null
+++ b/scripts/seed-detector.sh
@@ -0,0 +1,126 @@
+#!/bin/sh
+# Install the duck detector, downloading it from the Hugging Face Hub.
+#
+# `mediad` reads the detector from /opt/robot/detector/current, deliberately outside the release,
+# for the reason `robotd` reads its policies from /opt/robot/policies/current: a retrain should not
+# need a daemon release, and a daemon fix should not re-ship fourteen megabytes of unchanged
+# weights. The model is trained and published by pollen-robotics/duck_detector; this is what puts
+# it on a board, and it is `seed-policies.sh` with a fixed file list — read that script for the
+# reasoning behind every rule here, which is the same.
+#
+# Run by `hooks/postinstall` on every update and so by `scripts/install.sh` on a fresh board.
+#
+# THE RULE THAT MATTERS: never touch a set this script did not install. `current` pointing at
+# anything but a `seed-*` directory means something else put a detector there, and replacing that
+# would silently undo it on the next unrelated daemon update.
+#
+# Nothing here is signed, as with the policies: the model is data, `mediad` refuses one whose input
+# is not a square RGB tensor, and a truncated download fails to load rather than running. And it
+# is never fatal — the detector is off by default, and a robot asked to look for ducks with no model
+# says so in `mediad`'s journal rather than failing an update.
+#
+# **The model repo shares its name with the dataset repo.** The robot only ever addresses the
+# model: `huggingface.co/<repo>/resolve/<rev>/<file>` is the model's URL, and the dataset's carries
+# a `datasets/` prefix this script never writes. Nothing here can fetch a frame by accident.
+#
+# Usage: seed-detector.sh [DETECTOR_ROOT]
+# Defaults to what a robot uses; the argument exists so this can be tested off a board.
+set -eu
+
+DETECTOR_ROOT="${1:-/opt/robot/detector}"
+
+# The pin. An xtask test asserts these literals match `[workspace.metadata.detector]` in
+# Cargo.toml — this script runs from inside a release and cannot read the manifest.
+#
+# A floor, not a ceiling: what a board installs when it has *nothing*. A board moves past it with
+# `robotctl duck-detector update`, which needs no daemon release; bump this when fresh boards should get
+# a newer model, not to push one to boards that already have one.
+DETECTOR_REPO="${DETECTOR_REPO:-pollen-robotics/microduck-duck-detector}"
+DETECTOR_VERSION="${DETECTOR_VERSION:-duck-v1}"
+DETECTOR_BASE_URL="${DETECTOR_BASE_URL:-https://huggingface.co/${DETECTOR_REPO}/resolve/${DETECTOR_VERSION}}"
+
+# Both, always. The `.rknn` is what the detector is for; the `.onnx` is the CPU fallback for a
+# board whose NPU is switched off in its device tree, which is how Armbian ships the Radxa Zero 3
+# (`robotd_params::DuckDetectorParams::models`). A revision missing either is one not ready for robots,
+# and `updater::policy::DETECTOR_FILES` is the same list for `robotctl duck-detector update`.
+DETECTOR_FILES="duck_detect.rknn duck_detect.onnx"
+
+# Per-file, and generous: the ONNX is ten megabytes, and `hooks/postinstall` runs inside an
+# update under a 120-second hook timeout that the policies' seeder already spends up to 72 s of.
+# Two files at twenty seconds is 40, which keeps the whole hook under its budget. A link that
+# cannot move 10 MB in twenty seconds is one the fallback below is for, and the next update tries
+# again.
+CURL_OPTS="--fail --location --silent --show-error --connect-timeout 5 --max-time 20"
+
+# Where a set came from, written beside it — the record `robotctl duck-detector check` reads to know which
+# repo to ask, in the format `seed-policies.sh` writes and `updater::policy::Source` parses.
+write_source() {
+    [ ! -f "$1/.source" ] || return 0
+    {
+        echo "repo=${DETECTOR_REPO}"
+        echo "version=${2}"
+        echo "fetched=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+    } > "$1/.source" || echo "seed-detector: cannot record where this detector came from" >&2
+}
+
+target="releases/seed-${DETECTOR_VERSION}"
+live="$(readlink "${DETECTOR_ROOT}/current" 2>/dev/null || true)"
+
+# **A set that is already installed is never replaced.** Two states: something is installed, or
+# nothing is. Anything installed — whoever installed it — is left alone, with its provenance
+# record back-filled if missing.
+if [ -n "$live" ]; then
+    case "$live" in
+        releases/*)
+            write_source "${DETECTOR_ROOT}/${live}" "${live#releases/seed-}" ;;
+        *)
+            echo "seed-detector: ${DETECTOR_ROOT}/current is not ours; leaving it alone" >&2 ;;
+    esac
+    exit 0
+fi
+
+staging="${DETECTOR_ROOT}/releases/.staging"
+rm -rf "$staging"
+mkdir -p "$staging" || { echo "seed-detector: cannot create ${staging}" >&2; exit 0; }
+
+# Everything into staging first, so a partial download is never what `current` points at.
+ok=yes
+for name in $DETECTOR_FILES; do
+    # shellcheck disable=SC2086  # CURL_OPTS is a deliberate word list
+    if ! curl $CURL_OPTS -o "${staging}/${name}" "${DETECTOR_BASE_URL}/${name}"; then
+        echo "seed-detector: could not fetch ${name} from ${DETECTOR_BASE_URL}" >&2
+        ok=no
+        break
+    fi
+done
+
+if [ "$ok" = no ]; then
+    # Nothing partial ever goes live. A board that cannot reach the Hub ends up with no detector,
+    # and the pin is retried at the next update.
+    rm -rf "$staging"
+    echo "seed-detector: leaving the board without a detector for now" >&2
+    exit 0
+fi
+
+chmod 644 "$staging"/duck_detect.* 2>/dev/null || true
+
+write_source "$staging" "${DETECTOR_VERSION}"
+
+rm -rf "${DETECTOR_ROOT:?}/${target}"
+mv "$staging" "${DETECTOR_ROOT}/${target}" \
+    || { echo "seed-detector: cannot install into ${target}" >&2; exit 0; }
+
+# `current -> releases/<something>`, relative, swapped rather than rewritten — the policies
+# seeder explains each of those; this is the same code.
+ln -sfn "$target" "${DETECTOR_ROOT}/current.new" || {
+    echo "seed-detector: cannot stage ${DETECTOR_ROOT}/current" >&2
+    exit 0
+}
+if ! mv -T "${DETECTOR_ROOT}/current.new" "${DETECTOR_ROOT}/current" 2>/dev/null; then
+    if ! { rm -f "${DETECTOR_ROOT}/current" \
+        && mv "${DETECTOR_ROOT}/current.new" "${DETECTOR_ROOT}/current"; }; then
+        echo "seed-detector: cannot point ${DETECTOR_ROOT}/current at ${target}" >&2
+        exit 0
+    fi
+fi
+echo "seed-detector: installed ${DETECTOR_REPO}@${DETECTOR_VERSION}" >&2
diff --git a/scripts/seed-policies.sh b/scripts/seed-policies.sh
index 9f841d4f..a44a8aae 100755
--- a/scripts/seed-policies.sh
+++ b/scripts/seed-policies.sh
@@ -11,10 +11,12 @@
 # Run by `hooks/postinstall` on every update and by `scripts/install.sh` on a fresh board, which
 # between them are every way policies reach a robot.
 #
-# THE RULE THAT MATTERS: never touch a set this script did not install. `current` pointing at
-# anything but a `seed-*` directory means something else put policies there — `robotctl policy`,
-# or whatever ends up publishing bundles — and replacing that would silently undo it on the next
-# unrelated daemon update. The handover needs no flag and no config.
+# THE RULE THAT MATTERS: never touch a set that is not ours, and never move ours backwards. A
+# set carries a `.source` record; one from another repo, or without a record, was put there by
+# something else and replacing it would silently undo that on the next unrelated daemon update.
+# One from our repo is moved up to the pin when it is *below* it — the daemon's defaults name
+# files a newer set carries, and a board that updates the daemon but keeps an old set would
+# otherwise fail to load its gait and roll the update back — and left alone otherwise.
 #
 # Nothing here is signed and that is deliberate: a policy is not a binary. `robotd` holds the only
 # write handle to the bus behind joint clamps, a fall reflex and an intent deadman, and refuses
@@ -40,28 +42,29 @@ POLICY_ROOT="${1:-/opt/robot/policies}"
 # Cargo.toml — this script runs from inside a release and cannot read the manifest, which is the
 # same reason `setup-gstreamer.sh` carries its plugin version as a literal.
 #
-# A floor, not a ceiling: it decides what a board installs when it has *nothing*, and nothing
-# else. A board moves past it with `robotctl policy update`, which needs no daemon release;
-# bumping this does, since it ships inside one — so bump it when a new set should be what fresh
-# boards get, not to push one to boards that already have a set.
+# A minimum, not a ceiling: it decides what a board installs when it has *nothing*, and the
+# oldest official set this daemon runs with. A board below it is moved up to it on update; a
+# board past it — `robotctl policy update`, which needs no daemon release — is left where it is.
+# Bumping this ships inside a release, so bump it when the daemon's defaults need the new set
+# (a slot defaulting to a file only the new set carries), and tag the set first.
 POLICY_REPO="${POLICY_REPO:-pollen-robotics/microduck-policies}"
-POLICY_VERSION="${POLICY_VERSION:-v1}"
+POLICY_VERSION="${POLICY_VERSION:-v5}"
 POLICY_BASE_URL="${POLICY_BASE_URL:-https://huggingface.co/${POLICY_REPO}/resolve/${POLICY_VERSION}}"
 
 # The set says what is in it. `manifest.json` lists every policy, and that list is what gets
 # downloaded — so adding a tenth policy to the set is a tag on the Hub rather than an edit here
 # and a daemon release to carry it.
 #
-# The fallback below is the nine that exist today, for a revision tagged before the manifest did.
-# It goes when every tagged set carries one.
+# The fallback below is what robotd's own defaults name (both modes), for a revision tagged
+# before the manifest did. It goes when every tagged set carries one.
 #
 # The grep is over a file we generate, so its shape is ours: one `"file": "name.onnx"` per policy.
 # A JSON parser is not available here — this runs from a release on a board with curl and a
 # POSIX shell — and an xtask test asserts the pattern matches what the manifest actually says.
-FALLBACK_FILES="alpha_walking.onnx alpha_stand.onnx alpha_sitstand.onnx alpha_ground_pick.onnx ball_kick_left.onnx ball_kick_right.onnx roller.onnx roller_crouch.onnx roulade.onnx"
+FALLBACK_FILES="velstand.onnx alpha_sitstand.onnx alpha_ground_pick.onnx ball_kick_left.onnx ball_kick_right.onnx roller.onnx roller_crouch.onnx roulade.onnx"
 
 # Per-file, because `hooks/postinstall` runs inside an update under a 120-second hook timeout and
-# a hook that times out fails the update and rolls it back. Nine files at eight seconds is 72,
+# a hook that times out fails the update and rolls it back. Ten files at eight seconds is 80,
 # which leaves the rest of the hook room; a link that cannot move 800 KB in eight seconds is one
 # the fallback below is for, and the next update tries again.
 CURL_OPTS="--fail --location --silent --show-error --connect-timeout 5 --max-time 8"
@@ -86,28 +89,48 @@ write_source() {
 target="releases/seed-${POLICY_VERSION}"
 live="$(readlink "${POLICY_ROOT}/current" 2>/dev/null || true)"
 
-# **A set that is already installed is never replaced.** The pin is a floor — what a board with
-# nothing gets — and not a ceiling, which is the distinction that makes `robotctl policy update`
-# possible at all.
+# **An installed set is never moved backwards, and only ours is moved at all.** The pin is a
+# minimum — what a board with nothing gets, and the oldest set this daemon's defaults load —
+# and not a ceiling, which is the distinction that makes `robotctl policy update` possible.
 #
-# This used to replace an older `seed-*` on the reasoning that a daemon update was still how a
-# retrained gait reached a board. `policy update` is now how, and the old rule became a trap: a
-# board moved forward to v2 by hand had `current -> releases/seed-v2`, which matches `seed-*`,
-# so the next unrelated daemon update would have read it as an older set of ours and quietly put
-# v1 back. Silently reverting the gait somebody chose, as a side effect of a binary update.
+# This used to replace any older `seed-*` on the reasoning that a daemon update was still how a
+# retrained gait reached a board. `policy update` became how, and that rule was a trap: a board
+# moved forward to v2 by hand had `current -> releases/seed-v2`, and the next unrelated daemon
+# update quietly put v1 back. Then it never replaced anything, and that was the opposite trap:
+# when the daemon's default gait became a file only v5 carries, a board on v4 updating the
+# daemon could not load its walk, reported unhealthy, and rolled the release back.
 #
-# So there are two states now: something is installed, or nothing is. Anything installed —
-# whoever installed it — is left alone but has its provenance record back-filled if it is
-# missing, because a board seeded before that record existed takes this branch forever and
-# `policy check` cannot ask about a set that will not say where it came from.
+# So the version decides. The record beside the set says what it is; a set from our repo whose
+# version is a lower number than the pin is replaced by the pin (below), and everything else is
+# left alone: a newer set, a set from another repo, a set that says nothing about itself, or one
+# whose version is not a plain number. A board seeded before the record existed has it
+# back-filled from the directory name, because `policy check` cannot ask about a set that will
+# not say where it came from — and so that this comparison can read it next time.
+number_of() {
+    # "v5" -> 5; anything that is not a plain vN is "" and never compares.
+    case "$1" in
+        v[0-9]|v[0-9][0-9]|v[0-9][0-9][0-9]) echo "${1#v}" ;;
+        *) echo "" ;;
+    esac
+}
 if [ -n "$live" ]; then
     case "$live" in
         releases/*)
             write_source "${POLICY_ROOT}/${live}" "${live#releases/seed-}" ;;
         *)
-            echo "seed-policies: ${POLICY_ROOT}/current is not ours; leaving it alone" >&2 ;;
+            echo "seed-policies: ${POLICY_ROOT}/current is not ours; leaving it alone" >&2
+            exit 0 ;;
     esac
-    exit 0
+    record="${POLICY_ROOT}/${live}/.source"
+    have_repo="$(sed -n 's/^repo=//p' "$record" 2>/dev/null | head -n 1)"
+    have_version="$(sed -n 's/^version=//p' "$record" 2>/dev/null | head -n 1)"
+    have="$(number_of "$have_version")"
+    want="$(number_of "$POLICY_VERSION")"
+    if [ "$have_repo" != "$POLICY_REPO" ] || [ -z "$have" ] || [ -z "$want" ] \
+        || [ "$have" -ge "$want" ]; then
+        exit 0
+    fi
+    echo "seed-policies: ${have_version} is below the ${POLICY_VERSION} this daemon needs; moving up" >&2
 fi
 
 staging="${POLICY_ROOT}/releases/.staging"
@@ -153,7 +176,10 @@ done
 if [ "$ok" = no ]; then
     # Nothing partial ever goes live, and nothing already installed is disturbed. A half-published
     # revision or a link that was down leaves the board exactly as it was — on the previous set if
-    # it has one, with none if it does not — and the pin is retried at the next update.
+    # it has one, with none if it does not — and the pin is retried at the next update. A board
+    # below the minimum that stays there is one whose daemon cannot load its default gait; robotd
+    # then reports unhealthy and the update rolls back, which is the honest outcome and the
+    # message above is the reason.
     rm -rf "$staging"
     echo "seed-policies: leaving the policies already installed alone" >&2
     exit 0
diff --git a/scripts/setup-board.sh b/scripts/setup-board.sh
index a3743a9e..781ee875 100755
--- a/scripts/setup-board.sh
+++ b/scripts/setup-board.sh
@@ -48,6 +48,10 @@ CMDLINE="${CMDLINE:-/proc/cmdline}"
 
 BT_CONF=/etc/bluetooth/main.conf
 
+# BlueZ's input profile settings. One line in it decides who carries a classic (BR/EDR) gamepad's
+# reports — see `configure_classic_hid`. Every board gets that change; no flag.
+BT_INPUT_CONF=/etc/bluetooth/input.conf
+
 # Does this board need `Privacy = device`? `--weird-ble` on provision-board.sh.
 #
 # Off by default: some Zero 3W units bond a pad under BlueZ's own default and want nothing from
@@ -812,6 +816,49 @@ configure_bluetooth() {
     write_pause_marker
 }
 
+# A classic (BR/EDR) gamepad's reports go through the kernel, not through bluetoothd.
+#
+# BlueZ 5.82 defaults `UserspaceHID=true`: bluetoothd reads every HID report from the L2CAP socket
+# and re-injects it into the kernel through uhid. For an LE pad (Xbox) this setting is irrelevant —
+# HID over GATT is bluetoothd's own profile either way, and the Xbox sends nothing while idle. For a
+# classic pad it is the whole data path, and the no-name "Pro Controller" Switch clones stream IMU
+# samples in every packet at ~200 packets/s whether or not anyone touches them. Measured on graphite,
+# 2026-09-09, pad connected and untouched:
+#
+#   UserspaceHID=true   bluetoothd 15.8 % CPU, ~594 IMU reports/s on /dev/input/event5, nodes under
+#                       /sys/devices/virtual/misc/uhid/
+#   UserspaceHID=false  bluetoothd  0.0 %, same reports, nodes under .../hci0/hci0:128/ — the
+#                       kernel's hidp owns the channel and hid-nintendo binds exactly as before
+#
+# The bond, the reconnect after a reboot and `padd` driving from the pad were all unchanged by the
+# switch; the pad reconnected by itself on the first boot with the new value. No flag, because there
+# is no board on which the userspace path is the better one: it costs a core's worth of context
+# switches and buys nothing this robot uses.
+#
+# Applies at the next bluetoothd start, which on this board means a reboot — see the note on
+# `needs_reboot` above `configure_bluetooth`.
+configure_classic_hid() {
+    if [ ! -f "$BT_INPUT_CONF" ]; then
+        say "no ${BT_INPUT_CONF}; writing one with UserspaceHID=false"
+        printf '[General]\nUserspaceHID=false\n' > "$BT_INPUT_CONF"
+        needs_reboot=1
+        return 0
+    fi
+    if grep -Eq '^[[:space:]]*UserspaceHID[[:space:]]*=[[:space:]]*false' "$BT_INPUT_CONF"; then
+        say "bluetooth UserspaceHID already false (classic pads go through the kernel)"
+        return 0
+    fi
+    say "setting UserspaceHID=false in ${BT_INPUT_CONF} (classic pads through the kernel, not bluetoothd)"
+    if grep -Eq '^[[:space:]]*#?[[:space:]]*UserspaceHID[[:space:]]*=' "$BT_INPUT_CONF"; then
+        sed -i -E 's|^[[:space:]]*#?[[:space:]]*UserspaceHID[[:space:]]*=.*|UserspaceHID=false|' "$BT_INPUT_CONF"
+    elif grep -q '^\[General\]' "$BT_INPUT_CONF"; then
+        sed -i '/^\[General\]/a UserspaceHID=false' "$BT_INPUT_CONF"
+    else
+        printf '\n[General]\nUserspaceHID=false\n' >> "$BT_INPUT_CONF"
+    fi
+    needs_reboot=1
+}
+
 # The marker `robotctl` reads to decide whether to pause `btd` for a pairing.
 #
 # Its own function because both flags write it and only one of them touches `Privacy` — which is the
@@ -1059,6 +1106,7 @@ main() {
     check_network
     free_motor_port
     configure_bluetooth
+    configure_classic_hid
     configure_audio
     configure_tof
     # After configure_audio, which is what installs the vendor kernel: the camera's MIPI-CSI
diff --git a/scripts/setup-quiet-boot.sh b/scripts/setup-quiet-boot.sh
new file mode 100755
index 00000000..363b0d19
--- /dev/null
+++ b/scripts/setup-quiet-boot.sh
@@ -0,0 +1,87 @@
+#!/bin/sh
+# Take apt off the boot path.
+#
+# Every boot of a stock Armbian image runs `/usr/lib/armbian/armbian-apt-updates` from an `@reboot`
+# line in `/etc/cron.d/armbian-updates`. That script's whole job is a *simulated* upgrade —
+# `apt-get upgrade -s -qq` — whose output is counted into `/var/cache/apt/archives/updates.number`
+# so the login banner can say "3 updates available". On a Zero 3W that simulation pins one of the
+# four cores for several seconds, exactly while robotd is bringing up its control loop, and the
+# number it produces is read by nothing on a robot: the daemon does not update through apt, and
+# the operator does not `apt upgrade` a robot from the motd.
+#
+# The same reasoning removes the stock `apt-daily` and `apt-daily-upgrade` timers, which are the
+# other unattended apt work a board does: a real `apt-get update` shortly after every boot, and —
+# with `unattended-upgrades` present, which it is on the Ubuntu-based images — package upgrades
+# nobody asked for. A kernel or a userspace library swapping under a robot between two reboots is
+# how `setup-rkaiq.sh`'s shim stops matching, and it is not something a fleet of ducks should do on
+# its own. Releases reach a robot through `updaterd`; apt is for a human at a shell.
+#
+# Nothing here touches `apt` itself. `apt-get update`/`install` by hand keep working, and so does
+# `setup-board.sh`, which calls them.
+#
+# Idempotent, never fatal, and run on every install and every update, so a board provisioned
+# before this was written gets it at its next update (`docs/design/updater-design.md` §9.1).
+# `install.sh` and `hooks/postinstall` both call it; a failure there is a warning, because a
+# noisy boot is not worth rolling an update back for.
+set -eu
+
+say() { printf 'setup-quiet-boot: %s\n' "$*"; }
+warn() { printf 'setup-quiet-boot: warning: %s\n' "$*" >&2; }
+
+# Overridable so the board test can exercise this against a fixture rather than the host's
+# real crontab.
+ARMBIAN_CRON="${ARMBIAN_CRON:-/etc/cron.d/armbian-updates}"
+
+# The cron file is rewritten rather than deleted, and kept as a file with only comments in it.
+# It is a conffile of Armbian's bsp package: dpkg keeps a locally modified conffile across a
+# package upgrade, so this survives one, whereas a package postinst is free to recreate a file
+# it finds missing. An empty file would work too, but one that says why it is empty is what the
+# next person to open it needs.
+disable_armbian_update_check() {
+    if [ ! -f "$ARMBIAN_CRON" ]; then
+        say "no ${ARMBIAN_CRON}; nothing runs apt at boot from cron"
+        return 0
+    fi
+    # Anything that is not a comment or blank is a live crontab line.
+    if ! grep -Eq '^[[:space:]]*[^#[:space:]]' "$ARMBIAN_CRON"; then
+        say "${ARMBIAN_CRON} already holds no job"
+        return 0
+    fi
+    say "disabling Armbian's boot-time update count in ${ARMBIAN_CRON}"
+    cat > "$ARMBIAN_CRON" <<'EOF'
+# Emptied by the robot daemon installer (scripts/setup-quiet-boot.sh).
+#
+# Armbian ships two lines here that run /usr/lib/armbian/armbian-apt-updates at every boot and
+# once a day. That is a simulated `apt-get upgrade` whose only reader is the login banner, and it
+# holds one core for several seconds during boot on this board. The robot updates through
+# updaterd, not apt, so the count it produces is read by nothing here.
+#
+# Kept as a file, rather than deleted, so the package that owns it does not put its version back.
+EOF
+    chmod 644 "$ARMBIAN_CRON"
+}
+
+# The stock apt timers. Masked rather than disabled: `apt` re-enables them on its own upgrade,
+# and a mask is the one state a package postinst does not undo.
+mask_apt_timers() {
+    if ! command -v systemctl >/dev/null 2>&1; then
+        say "no systemctl; skipping the apt timers"
+        return 0
+    fi
+    for unit in apt-daily.timer apt-daily-upgrade.timer; do
+        if [ "$(systemctl is-enabled "$unit" 2>/dev/null)" = masked ]; then
+            say "${unit} already masked"
+            continue
+        fi
+        say "masking ${unit}"
+        # `disable --now` first so a timer already armed for later today does not fire once
+        # more before the mask lands; each step tolerated on its own, because an image that
+        # never had the unit reports an error here that means nothing.
+        systemctl disable --now "$unit" >/dev/null 2>&1 || true
+        systemctl mask "$unit" >/dev/null 2>&1 \
+            || warn "could not mask ${unit}; it keeps running apt in the background"
+    done
+}
+
+disable_armbian_update_check
+mask_apt_timers
diff --git a/sounds/src/lib.rs b/sounds/src/lib.rs
index e3770e75..e2013ad0 100644
--- a/sounds/src/lib.rs
+++ b/sounds/src/lib.rs
@@ -130,6 +130,14 @@ pub fn render_all(p: &Personality, out_dir: &Path) -> Result<Vec<PathBuf>> {
 /// board without one. sha256 decorrelates consecutive factory serials so two robots from
 /// the same batch don't get neighbouring (and thus meaninglessly different) seeds.
 pub fn hardware_seed() -> Result<u32> {
+    // **One machine, several ducks** — the one situation where deriving identity from hardware is
+    // wrong. The simulator runs a robot per container, or several on one laptop, and they would
+    // otherwise share a serial and therefore a voice *and a chorale id*: that id is how a duck
+    // recognises its own beacon reflected back, so identical ducks drop each other's beacons as
+    // their own and can never hear anybody. Nothing on a robot sets this.
+    if let Some(named) = std::env::var_os("DUCK_IDENTITY") {
+        return Ok(seed_from_id(&named.to_string_lossy()));
+    }
     let id = std::fs::read("/proc/device-tree/serial-number")
         .map(|raw| {
             String::from_utf8_lossy(&raw)
diff --git a/spaces/hello/Dockerfile b/spaces/hello/Dockerfile
new file mode 100644
index 00000000..a13ad3aa
--- /dev/null
+++ b/spaces/hello/Dockerfile
@@ -0,0 +1,22 @@
+FROM python:3.12-slim
+
+# `git` because Hugging Face appends a `git config --global` layer to every Docker Space, and a
+# `-slim` base has none — that layer then fails with exit 127 after the image has built fine.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends git \
+ && rm -rf /var/lib/apt/lists/*
+
+# The canonical uid-1000 `user` at `/home/user`: the platform's appended layers assume both.
+RUN useradd -m -u 1000 user
+USER user
+ENV HOME=/home/user \
+    PATH=/home/user/.local/bin:$PATH \
+    PYTHONUNBUFFERED=1
+WORKDIR $HOME/app
+
+COPY --chown=user requirements.txt $HOME/app/
+RUN pip install --no-cache-dir --user -r requirements.txt
+COPY --chown=user . $HOME/app
+
+EXPOSE 7860
+CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860"]
diff --git a/spaces/hello/README.md b/spaces/hello/README.md
new file mode 100644
index 00000000..5cf49c49
--- /dev/null
+++ b/spaces/hello/README.md
@@ -0,0 +1,18 @@
+---
+title: hello duck
+emoji: 🦆
+colorFrom: yellow
+colorTo: indigo
+sdk: docker
+app_port: 7860
+pinned: false
+short_description: Smallest Docker Space that has a WebSocket route and Gradio.
+---
+
+# hello duck
+
+A deliberately minimal Docker Space, published to find out which of four things breaks the real
+one: the container, a custom WebSocket route, Gradio mounted under FastAPI, or Hugging Face OAuth.
+
+It has the first three and **not** OAuth, which is where the last crash was. Grow it back one
+piece at a time rather than debugging four at once.
diff --git a/spaces/hello/app.py b/spaces/hello/app.py
new file mode 100644
index 00000000..a7c609c5
--- /dev/null
+++ b/spaces/hello/app.py
@@ -0,0 +1,76 @@
+"""The smallest thing that is still the shape of the real Space.
+
+FastAPI owns the server, one WebSocket route of our own, Gradio mounted at `/`. **No OAuth**,
+because that is where the real app died: a `gr.LoginButton` makes Gradio call `attach_oauth` while
+the Blocks is built, which mocks when `SPACE_ID` is absent, and the mock raises without a local
+`hf auth login`. A container has none.
+"""
+
+import os
+
+import gradio as gr
+from fastapi import FastAPI, WebSocket
+
+app = FastAPI()
+
+print(
+    "environment: SPACE_ID=%s SPACE_HOST=%s OAUTH_CLIENT_ID=%s"
+    % (
+        os.environ.get("SPACE_ID") or "absent",
+        os.environ.get("SPACE_HOST") or "absent",
+        "set" if os.environ.get("OAUTH_CLIENT_ID") else "absent",
+    ),
+    flush=True,
+)
+
+
+@app.get("/env")
+def env() -> dict:
+    """Which of the platform's variables actually arrived.
+
+    An endpoint rather than a log line, because reading a Space's logs needs write access to the
+    Space and every question about them has cost a round trip through somebody pasting one. This
+    reports presence, never a value — `OAUTH_CLIENT_SECRET` is in this environment too.
+    """
+    watched = (
+        "SPACE_ID",
+        "SPACE_HOST",
+        "SPACE_AUTHOR_NAME",
+        "OAUTH_CLIENT_ID",
+        "OAUTH_SCOPES",
+        "OPENID_PROVIDER_URL",
+        "HF_TOKEN",
+        "GRADIO_SSR_MODE",
+        "PORT",
+    )
+    return {
+        name: (os.environ[name] if name in ("SPACE_ID", "SPACE_HOST", "GRADIO_SSR_MODE", "PORT")
+               else "set")
+        if name in os.environ
+        else "absent"
+        for name in watched
+    }
+
+
+@app.websocket("/frames")
+async def frames(socket: WebSocket) -> None:
+    """A route of our own, which is the whole reason this is Docker and not the gradio SDK."""
+    await socket.accept()
+    await socket.send_text("hello from /frames")
+    await socket.close()
+
+
+with gr.Blocks(title="hello duck") as demo:
+    gr.Markdown(
+        """
+        # hello duck
+
+        A Docker Space where FastAPI owns the server and Gradio is mounted at `/`.
+        `wss://<this space>/frames` is a WebSocket route of our own — it answers with one line
+        and hangs up.
+        """
+    )
+    gr.Textbox(value="it runs", label="status", interactive=False)
+
+# `ssr_mode=False`: server-side rendering starts a Node server and this image has no Node.
+app = gr.mount_gradio_app(app, demo, path="/", ssr_mode=False)
diff --git a/spaces/hello/requirements.txt b/spaces/hello/requirements.txt
new file mode 100644
index 00000000..064500a9
--- /dev/null
+++ b/spaces/hello/requirements.txt
@@ -0,0 +1,4 @@
+gradio>=5
+fastapi
+uvicorn[standard]
+websockets
diff --git a/spaces/policy-shop/README.md b/spaces/policy-shop/README.md
new file mode 100644
index 00000000..e1899e7a
--- /dev/null
+++ b/spaces/policy-shop/README.md
@@ -0,0 +1,191 @@
+---
+title: microduck policy shop
+emoji: 🦆
+colorFrom: yellow
+colorTo: pink
+sdk: gradio
+app_file: app.py
+pinned: false
+hf_oauth: true
+short_description: Pick a policy off the Hub, put it on your duck, run it.
+---
+
+# microduck policy shop
+
+Everything published to the Hub as `microduck-…`, read the way the robot reads it, with a button
+that downloads one onto your duck and runs it.
+
+**Do not edit this Space directly.** The source is `spaces/policy-shop/` in
+`pollen-robotics/microduck`, and `scripts/publish-space.sh policy-shop` is what puts it here.
+
+## The one click
+
+Four calls over the session's `control` channel, in the order `robotctl policy add` makes them:
+
+| | |
+| --- | --- |
+| `policy.fetch {repo, file}` | `updaterd` downloads it and reads the `manifest.json` beside it |
+| `robot.setSkill {name, path, duration, …}` | `robotd` writes the entry and re-reads its skills |
+| `robot.policies` | did the reload take? `change_error` is where it says no |
+| `robot.do {skill}` | run it |
+
+Nothing is invented on either side: those are `duck-ipc-proto` method names, already in
+`mediad/src/route.rs`'s permitted set, and `mediad` knows none of them — the control channel is a
+pipe to the API the robot already serves.
+
+**The robot's reading of a manifest wins over this page's.** The catalogue is read here so a row
+can say what a policy claims to be before anybody clicks it, but the skill that gets written comes
+from `policy.fetch`'s answer, which is about the bytes that were actually downloaded.
+
+## The picture
+
+The session carries the camera as well as the channel, so the newest frame is shown beside the
+buttons — decoded from H.264 by `aiortc`, on whichever transport is connected, and repainted ten
+times a second. Watching the thing you installed do something is most of the point of installing
+it from here rather than from a terminal.
+
+It is put the right way up by asking. The camera is mounted a quarter turn off and nothing on the
+robot rotates the pixels; `media.video` carries `rotate` and the control channel sends it once
+when it opens, so there is no angle written down anywhere in this Space. `vision-demo` has to
+compile one in, because it has no control channel to ask on.
+
+## What it refuses, and why it is this side's job
+
+A policy whose command the daemon generates — a phase for a ground pick, a flag for a sit↔stand —
+cannot be a one-shot skill. `robot.setSkill` would accept the entry, and the robot would then feed
+a constant to a network trained on a phase: it moves plausibly and wrongly, which is worse than a
+refusal. `robotctl`'s `skill_encoding_refusal` is the rule, `robotctl` is not in the path of a
+click, so `catalogue.refusal` is the same rule again.
+
+The shape claims — `obs_len`, `action_len`, `model_api`, `robot.model` — are deliberately *not*
+repeated here. `policy.fetch` checks them itself, before the download, so "this policy is 51-D and
+this robot is 61-D" comes back in a second and comes back from the robot.
+
+A `perpetual` policy has no length of its own, so a one-shot made out of one is a hold and an
+unwind. `robotctl policy add` refuses without `--hold` rather than picking a number; this page asks
+instead, and that is the seconds box above the rows.
+
+## Two ways in
+
+**From anywhere** is the rendezvous: the robot registers as a producer holding its account token,
+this signs in as the visitor, and the service pairs them. It is the path that reaches a duck behind
+its owner's router, and it needs a candidate pair that works. The robot offers a `relay` candidate
+(`remote-access-design.md` §6), so a session between a home router and a data centre has a
+fallback for when host and srflx do not punch a hole — which they often do not. That fallback is
+somebody's bandwidth and it is metered, and because the control channel is SCTP over the same
+candidate pair, a relay that stops being available takes every button on this page with it. The
+status line names the stage it reached instead of saying "connecting…", so that failure is
+legible rather than mysterious.
+
+**On this network** needs none of that. `mediad` is already serving `webrtcsink`'s signalling
+server on `ws://<robot>:8443` — it is what the robot's own console talks to — and it carries the
+same gst envelopes the rendezvous carries over SSE and `POST /send`. So `lan.py` is one hop
+swapped and nothing above it changed: same `control` channel, same JSON-RPC, same buttons. No
+account, no lease, no rendezvous, no relay, and on one network both sides offer host candidates.
+
+That makes it the useful thing to reach for when a click does not work and nobody knows which
+layer to blame. **If it works on the LAN and not through the rendezvous, the transport is the
+problem** and nothing about the policy, the manifest or the robot is.
+
+A Space in a data centre cannot reach a LAN, so that tab is for running this yourself. Once:
+
+```bash
+uv venv && uv pip install -r requirements.txt
+```
+
+Then, and every time after:
+
+```bash
+uv run app.py
+```
+
+`uv run` picks up the `.venv` beside it, so nothing has to be activated and no flags are needed.
+There is deliberately no `pyproject.toml`: `requirements.txt` is what Hugging Face installs, and a
+second copy of one dependency list is a second copy to get wrong — which is the whole reason the
+install step is a separate line rather than something inferred from a manifest.
+
+`DUCK_HOST` pre-fills the address box. `HF_TOKEN` stands in for the sign-in, and so does whatever
+`hf auth login` stored — see **Identity** for why a local run needs one of those rather than the
+login button.
+
+**One consumer at a time.** The rendezvous's rule, not a simplification: while this holds a
+session, the robot's own console cannot open one, and neither can the vision demo. The LAN
+transport is subject to the same thing for a different reason — one `webrtcsink` session per
+consumer slot — so *disconnect* before opening the console.
+
+## Identity
+
+**A visitor's token by preference, and never the robot's.** The rendezvous maps a token to one
+peer, so a consumer authenticating as the robot would take the robot off its owner's listing.
+`hf_oauth: true` plus Gradio's login button gives each visitor their own, which reaches their own
+robots and nobody else's — and is what makes a public Space defensible.
+
+**Outside a Space, that button is a mock, and its token is a placeholder.** Gradio mocks its own
+login when `SPACE_ID` is unset: the buttons behave and the profile is real, but `access_token` is
+the literal string `mock-oauth-token-for-local-dev`. Sent to a service that resolves tokens
+through `whoami-v2`, it is a `401` — which is what "the rendezvous refused this token" meant the
+first time this page was run locally, while `microduck-console` listed the same duck perfectly.
+So a mocked token is dropped rather than preferred, and a local run uses `HF_TOKEN` or whatever
+`hf auth login` stored. The log line says which, on every press.
+
+Ducks are told from minis on `meta.kind`, and the chosen robot is pinned by `peerId` rather than by
+name: their consumer's auto-pick falls back to the only visible producer whatever it is called, so
+an account with one duck and one mini could otherwise hand this page a mini to drive with method
+names it does not serve. §5.1 has the other half, which is theirs.
+
+## When it does not work
+
+**The log says which of four things failed**, because they present identically as "the button did
+nothing" and have nothing in common. It is at the bottom of the page and on the terminal at once —
+a Space has logs nobody has open and a browser has no stderr — and it carries every HTTP status,
+every signalling frame, every JSON-RPC line and every refusal, with the token's *source* named and
+the token itself never written down.
+
+```bash
+DUCK_LOG=DEBUG uv run app.py
+```
+
+adds the streaming notifications and each ICE candidate — which is what to reach for when
+signalling crossed and media did not, and nothing else.
+
+Each layer is also checkable on its own, in the order the failures happen:
+
+```bash
+uv run rendezvous.py
+```
+
+lists the account's robots with their `kind` and their `busy` state. A `401` here is the token and
+nothing else. This needs no Gradio and no robot.
+
+```bash
+uv run catalogue.py
+```
+
+prints the whole Hub catalogue with what each policy claims and which are refused. Needs no token.
+
+```bash
+uv run lan.py
+```
+
+drives a real session against a producer on loopback. If this passes and a duck does not, the
+problem is between here and the duck rather than in this code.
+
+## What the checks above actually cover
+
+`catalogue.py` reads the Hub the way `updater/src/policy.rs` reads it — `?search=microduck` and a
+`manifest.json` per hit — so the gallery and `policy.search` cannot disagree about what exists.
+
+`rendezvous.py` is one `GET /api/robot-status`, read off `reachy_mini_central`'s own `app.py`:
+`Depends(_resolve_hf_token)` then one `whoami-v2` call, with no scope check and no requirement
+that the caller hold an event stream. Its docstring says it is for exactly this — "a passive
+status indicator without consuming a session slot" — which also makes it safe to press
+mid-session, where the console's `list` route would open a second stream on the same token and
+evict the peer the session is riding on (§3.7).
+
+`lan.py` stands up a producer on loopback that speaks what `webrtcsink`'s signaller speaks
+and drives a real session against it: welcome, list, startSession, an offer answered, DTLS, SCTP,
+the `control` channel, a call matched to its reply, and a video track decoded to check that frames
+arrive at all and arrive as RGB. Two aiortc peers on `127.0.0.1` are not a duck — they are the
+same protocol, and a dozen hand-written envelope shapes are exactly the thing that fails silently
+rather than loudly. The producer there sends VP8 where a duck sends H.264, because the codec is
+aiortc's to pick and the plumbing under test is the same one either way.
diff --git a/spaces/policy-shop/app.py b/spaces/policy-shop/app.py
new file mode 100644
index 00000000..12e218b4
--- /dev/null
+++ b/spaces/policy-shop/app.py
@@ -0,0 +1,930 @@
+"""Pick a policy off the Hub, put it on your duck, and watch it run — from anywhere.
+
+The robot is behind somebody's router and this is a container in a data centre; what joins them is
+the rendezvous service the duck registers with (`docs/design/remote-access-design.md` §3). The
+robot is a *producer*, this is a *consumer*, and the WebRTC session between them carries the
+camera and one data channel called `control` — JSON-RPC 2.0, `duck-ipc-proto`'s own wire, the same
+lines `robotctl` sends over a unix socket.
+
+## What the one click is
+
+Four calls, in the order `robotctl policy add` makes them, and nothing invented:
+
+    policy.fetch    {repo, file}   → updaterd downloads it and reads the manifest beside it
+    robot.setSkill  {name, path…}  → robotd writes the entry and re-reads its skills
+    robot.policies                 → did the reload take? `change_error` is where it says no
+    robot.do        {skill}        → run it
+
+Every one of them is in `mediad/src/route.rs`'s permitted set already, and the pipe is dumb: no
+method here is known to `mediad`, which is what `remote-webrtc.md` §5 means by the control channel
+being a pipe to the existing API.
+
+## Two things that will bite before the robot does
+
+**Media from a data centre now rests on the relay, and that is worth knowing before it bites.**
+The robot offers a `relay` candidate again (§6), so the session no longer depends on host and
+srflx punching a hole. But the control channel is SCTP over whatever pair ICE settled on, so
+anything that takes the relay away — an allowance spent, a proxy not answering — takes every
+method on this page with it, for calls whose payload is a few hundred bytes. Running this file on
+a laptop on the robot's own network needs no relay at all — `uv run app.py`, and the README's
+local-run section is the two lines that get there.
+
+**One consumer at a time.** That is the rendezvous's rule, not a simplification here: while this
+Space holds a session, the robot's own console cannot open one, and the vision demo cannot either.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import contextlib
+import logging
+import os
+import threading
+import time
+from collections import deque
+from dataclasses import dataclass
+from typing import Any
+
+import gradio as gr
+import numpy as np
+
+import catalogue
+import rendezvous
+from catalogue import Policy
+from control import Rpc, RpcError
+from lan import DEFAULT_SIGNALLING_PORT, LanConsumer
+from rendezvous import RendezvousError
+from wire import WireError, WsConsumer
+
+
+# ── the log ──────────────────────────────────────────────────────────────────
+#
+# **Every request, every frame and every refusal, to the terminal and to the page.** Not a
+# convenience: three protocols meet here and none of them fails loudly. A rendezvous that answers
+# 401, a candidate pair that never forms, a data channel with the wrong label and a policy the
+# robot refuses on its shape all present as "the button did nothing", and the difference between
+# them is one line each. `DUCK_LOG=DEBUG` adds the streaming notifications and the individual ICE
+# candidates.
+
+
+class Ring(logging.Handler):
+    """The last few hundred log lines, for the panel at the bottom of the page.
+
+    The page shows what the terminal shows, because whoever is looking at one is usually not
+    looking at the other — a Space has logs nobody has open, and a browser has no stderr.
+    """
+
+    def __init__(self, size: int = 400):
+        super().__init__()
+        self.lines: deque[str] = deque(maxlen=size)
+
+    def emit(self, record: logging.LogRecord) -> None:
+        try:
+            self.lines.append(self.format(record))
+        except Exception:  # noqa: BLE001 - a logger that raises is worse than a line lost
+            pass
+
+
+RING = Ring()
+RING.setFormatter(logging.Formatter("%(asctime)s %(name)-10s %(message)s", datefmt="%H:%M:%S"))
+
+LEVEL = os.environ.get("DUCK_LOG", "INFO").upper()
+logging.basicConfig(
+    level=LEVEL, format="%(asctime)s %(levelname)-5s %(name)-10s %(message)s", datefmt="%H:%M:%S"
+)
+logging.getLogger().addHandler(RING)
+# `aioice` logs a line per candidate pair check, which buries everything else. It is exactly what
+# is wanted when ICE is the suspect, and nothing but noise until then.
+for chatty in ("aioice", "aiortc", "aiohttp", "httpx", "urllib3"):
+    logging.getLogger(chatty).setLevel(logging.DEBUG if LEVEL == "DEBUG" else logging.WARNING)
+
+logger = logging.getLogger("shop")
+
+# How long to hold a policy that declares no length of its own. Perpetual means "until told
+# otherwise", so something has to choose, and `robotctl policy add` refuses rather than guessing —
+# a page can ask instead, which is what the number beside the button is.
+DEFAULT_HOLD = 3.0
+
+# Rows drawn for the catalogue. Gradio wants its components at build time, so this is a ceiling
+# rather than a count: 23 policies were published when this was written.
+MAX_ROWS = 40
+
+# What Gradio's local login mock puts in `access_token`. A constant rather than a `SPACE_ID`
+# check, because it is the exact thing to refuse: a real token that happened to arrive outside a
+# Space should still be used, and this string should never be sent anywhere whatever set it.
+MOCK_TOKEN = "mock-oauth-token-for-local-dev"
+
+# Whether this process *is* a Space, which changes what two of the tabs can honestly promise. Set
+# by the platform, and the same variable Gradio checks to decide whether to mock its login.
+ON_A_SPACE = bool(os.environ.get("SPACE_ID"))
+
+# The download happens on the robot, over the robot's wifi. Everything else here is a question
+# about state and answers in milliseconds.
+FETCH_TIMEOUT = 180.0
+
+CATALOGUE: list[Policy] = []
+CATALOGUE_ERROR: str | None = None
+CATALOGUE_READ_AT: float = 0.0
+# How long a peer id stays worth a name in the status line. Filled by the listing.
+NAMES: dict[str, str] = {}
+
+
+@dataclass
+class Link:
+    """The one session this Space holds, and the thread that owns its event loop.
+
+    A dedicated loop in a background thread rather than Gradio's: the connection outlives any one
+    request, `aiortc` wants a single loop for the life of a peer connection, and every send is
+    marshalled back onto it.
+    """
+
+    consumer: WsConsumer | LanConsumer | None = None
+    loop: asyncio.AbstractEventLoop | None = None
+    rpc: Rpc | None = None
+    robot: str | None = None
+    error: str | None = None
+    started_at: float | None = None
+    # Which hop got us here. The two transports fail for entirely different reasons — one can be
+    # defeated by a NAT and the other cannot — so a status line that does not say which one it is
+    # describing is describing nothing.
+    over_lan: bool = False
+
+    def __post_init__(self) -> None:
+        self.lock = threading.Lock()
+
+    # ── the listing ──────────────────────────────────────────────────────────
+
+    @staticmethod
+    def robots(token: str) -> tuple[list[tuple[str, str]], str]:
+        """The ducks this token can reach, and a line about what else was there.
+
+        Safe to press mid-session: `/api/robot-status` is one GET and opens no event stream, so it
+        cannot supersede the peer the session is riding on. That is why it is this endpoint rather
+        than the console's `list`.
+        """
+        try:
+            found, others = rendezvous.ducks(token)
+        except RendezvousError as e:
+            return [], str(e)
+
+        ducks = [(duck.label(), duck.peer_id) for duck in found]
+
+        if not ducks and others:
+            return [], (
+                f"{len(others)} robot(s) on this account and none of them a duck: "
+                + ", ".join(others)
+                + ". A duck registers with `kind: microduck`."
+            )
+        if not ducks:
+            return [], (
+                "no robots online for this account. A duck registers when it has been signed in "
+                "(`robotctl account login`) and has a network — `duckctl account status` says "
+                "which of the two is missing."
+            )
+        note = f"{len(ducks)} duck(s)"
+        if others:
+            note += f", and {len(others)} other robot(s) not listed here"
+        return ducks, note
+
+    # ── the session ──────────────────────────────────────────────────────────
+
+    def through_rendezvous(self, token: str, peer_id: str, label: str) -> str:
+        """From anywhere, over the control lane — no candidate pair, so nothing §6 can defeat.
+
+        **This used to be a WebRTC consumer and is not any more.** It negotiated a session,
+        exchanged ICE, and then sat in `connecting` forever from anywhere that needed a relay,
+        which is anywhere interesting. The rendezvous relays an `rpc` key on a `peer` envelope
+        verbatim, and `mediad`'s control lane answers it out of the same routing table the
+        datachannel uses — so the calls are identical and the transport underneath them is two
+        HTTP verbs. The cost is that there is no video on it; the LAN transport is where pixels
+        live.
+        """
+        return self._open(
+            label,
+            over_lan=False,
+            build=lambda rpc: WsConsumer(
+                token,
+                # **Pinned, not matched by name.** The listing already knows the id, and a name
+                # match would be the place a mini could be handed to a duck's client.
+                peer_id,
+                rpc,
+                label=f"microduck-policy-shop/{os.environ.get('SPACE_ID', 'local')}",
+            ),
+        )
+
+    def over_the_lan(self, host: str) -> str:
+        """From the robot's own network, needing no account and no relay.
+
+        The address is all this takes: `mediad` is already serving the signalling server the
+        console talks to, and on one network ICE has host candidates on both sides.
+        """
+        typed = (host or "").strip()
+        if not typed:
+            return "type the robot's address — a hostname like `olducky.local`, or its IP."
+
+        # **A pasted URL keeps its host and loses its port.** What is in somebody's clipboard is
+        # `http://olducky.local:8080/` from opening the console, and 8080 is the page's port, not
+        # the signaller's — dialling it gets an HTTP server that will not upgrade, which is a
+        # confusing way to learn you pasted the wrong thing. A bare `host:port` is somebody being
+        # deliberate, so that one is honoured.
+        pasted = typed.startswith(("http://", "https://", "ws://", "wss://"))
+        address = typed.split("//")[-1].split("/")[0]
+        port = DEFAULT_SIGNALLING_PORT
+        if ":" in address:
+            address, _, given = address.partition(":")
+            if given.isdigit() and not pasted:
+                port = int(given)
+        return self._open(
+            address, over_lan=True, build=lambda rpc: LanConsumer(address, rpc, port)
+        )
+
+    def _open(self, label: str, over_lan: bool, build: Any) -> str:
+        with self.lock:
+            if self.consumer is not None:
+                return f"already connected to {self.robot} — disconnect first"
+
+            self.error = None
+            rpc = Rpc()
+            loop = asyncio.new_event_loop()
+            thread = threading.Thread(target=loop.run_forever, name="duck-consumer", daemon=True)
+            thread.start()
+
+            consumer = build(rpc)
+            # The LAN consumer is `aiortc` and wants the loop; the wire is `requests` and wants
+            # none. Rather than give one of them a fake shape, the two are started differently and
+            # everything after this line treats them the same.
+            starting = (
+                asyncio.run_coroutine_threadsafe(consumer.start(), loop)
+                if over_lan
+                else None
+            )
+            try:
+                if starting is not None:
+                    starting.result(timeout=30)
+                else:
+                    consumer.start()
+            except (WireError, RendezvousError) as e:
+                self.error = str(e)
+                loop.call_soon_threadsafe(loop.stop)
+                return f"could not reach {label}: {self.error}"
+            except Exception as e:  # noqa: BLE001 - reported, never raised into a UI callback
+                # `TimeoutError` arrives with an empty message, which would print as a colon and
+                # nothing — the type name is the whole of what it has to say.
+                self.error = f"{type(e).__name__}: {e}" if str(e) else type(e).__name__
+                # Unwind before stopping the loop: a half-open connect leaves an aiohttp session
+                # behind, and stopping the loop under it is how "Unclosed client session" ends up
+                # on somebody's terminal instead of an explanation.
+                if starting is not None:
+                    starting.cancel()
+                    with contextlib.suppress(Exception):
+                        asyncio.run_coroutine_threadsafe(consumer.stop(), loop).result(timeout=5)
+                else:
+                    with contextlib.suppress(Exception):
+                        consumer.stop()
+                loop.call_soon_threadsafe(loop.stop)
+                return f"could not reach {label}: {self.error}"
+
+            self.consumer, self.loop, self.rpc = consumer, loop, rpc
+            self.robot, self.started_at, self.over_lan = label, time.monotonic(), over_lan
+            logger.info("session opening: %s over %s", label, "the LAN" if over_lan else "the rendezvous")
+
+        # Blocking here rather than leaving the page to poll: nothing below the buttons can be
+        # answered until the channel is open, and a page that says "connected" while every call
+        # fails is the worst of the three states.
+        deadline = time.monotonic() + 60
+        while time.monotonic() < deadline:
+            if rpc.is_open():
+                logger.info("control channel usable after %.1fs", time.monotonic() - (self.started_at or 0))
+                # **Asked, not waited for.** `mediad` pushes `media.video` the moment it hands
+                # over the channel, which races a consumer whose channel is not open yet — the
+                # console page carries the same note, and a dropped push is a sideways picture
+                # with nothing anywhere to say why. A question asked when we are ready cannot
+                # arrive too early. Best-effort: a transport with no video refuses it, which is
+                # the correct answer and not a failure to connect.
+                if over_lan:
+                    try:
+                        rpc.notifications["media.video"] = rpc.call("media.video", timeout=10)
+                    except RpcError as e:
+                        logger.info("no camera geometry: %s", e.message)
+                named = (self.consumer.meta or {}).get("name") if over_lan else None
+                self.robot = named or label
+                return f"connected to {self.robot}, control channel open"
+            if getattr(consumer, "error", None):
+                return f"**{consumer.error}**"
+            time.sleep(0.5)
+        return self.describe()
+
+    def disconnect(self) -> str:
+        logger.info("disconnecting")
+        with self.lock:
+            consumer, loop, rpc = self.consumer, self.loop, self.rpc
+            self.consumer, self.loop, self.rpc = None, None, None
+            self.robot, self.started_at, self.over_lan = None, None, False
+        if rpc is not None:
+            rpc.abandon("disconnected")
+        if consumer is None or loop is None:
+            return "not connected"
+        try:
+            if isinstance(consumer, LanConsumer):
+                asyncio.run_coroutine_threadsafe(consumer.stop(), loop).result(timeout=10)
+            else:
+                consumer.stop()
+        except Exception as e:  # noqa: BLE001 - a teardown that fails still ends the session
+            return f"disconnected, with a complaint: {type(e).__name__}: {e}"
+        finally:
+            loop.call_soon_threadsafe(loop.stop)
+        return "disconnected"
+
+    def call(self, method: str, params: dict[str, Any] | None = None, timeout: float | None = None) -> Any:
+        rpc = self.rpc
+        if rpc is None:
+            raise RpcError(method, {"message": "not connected"})
+        return rpc.call(method, params, timeout)
+
+    def describe(self) -> str:
+        """Which stage the connection reached, because the stages fail differently.
+
+        A blank "connecting…" is the worst thing this panel can say: signalling failing, ICE
+        failing and a data channel that never opened look identical from the outside and have
+        nothing in common.
+        """
+        consumer, rpc = self.consumer, self.rpc
+        if consumer is None:
+            return f"**not connected** — {self.error}" if self.error else "**not connected.**"
+
+        status = consumer.status()
+        session, state = status.get("session_id"), status.get("pc_state")
+        waited = time.monotonic() - (self.started_at or time.monotonic())
+
+        if not session:
+            return (
+                f"**no session yet** after {waited:.0f}s. The rendezvous has not paired this "
+                "consumer with the robot: either it went offline, or another consumer holds it — "
+                "one at a time, and the robot's own console counts."
+            )
+        if state != "connected":
+            if not self.over_lan:
+                # The control lane has no peer connection to be in a state about: it reports
+                # `connected` for as long as it holds a session. So this is a session that went
+                # away underneath us, which is the service ending it or the stream dropping.
+                why = self.error or "no reason given"
+                return (
+                    f"**the session ended** after {waited:.0f}s — {why}. Connect again."
+                )
+            if self.over_lan:
+                return (
+                    f"**signalling worked and the peer connection has not** — session "
+                    f"`{session[:8]}`, state `{state}` after {waited:.0f}s. On one network that is "
+                    "not a NAT problem: it is a firewall between here and the robot's UDP ports, "
+                    "or DTLS failing to agree a cipher — `journalctl -u mediad -b` is where the "
+                    "robot's half of it is."
+                )
+            return (
+                f"**signalling worked and the peer connection has not** — session "
+                f"`{session[:8]}`, state `{state}` after {waited:.0f}s. This is the case a data "
+                "centre is expected to hit: neither side offers a `relay` candidate, because the "
+                "TURN credentials endpoint has no DNS (§6). *connect over the LAN* is the way "
+                "through until that is fixed."
+            )
+        if rpc is None or not rpc.is_open():
+            return (
+                f"**connected, and no control channel** — session `{session[:8]}`, "
+                f"{status.get('frames') or 0} frames. Media crossed and `control` did not open, "
+                "which is a duck running a daemon that opens no data channel."
+            )
+        where = status.get("transport") or "the rendezvous"
+        return (
+            f"**connected to {self.robot}** over {where} — session `{session[:8]}`, "
+            f"{status.get('frames') or 0} frames, control channel open."
+        )
+
+    def picture(self) -> Any:
+        """The newest frame, turned the way the robot is looking.
+
+        The camera is mounted a quarter turn off and nothing on the robot rotates the pixels —
+        `media.video` carries `rotate` for exactly that, and the control channel sends it once
+        when it opens. So the angle is asked for rather than compiled in, and a robot whose
+        `--rotate` changes needs no edit here.
+        """
+        consumer, rpc = self.consumer, self.rpc
+        if consumer is None:
+            return None
+        frame = consumer.latest_frame()
+        if frame is None:
+            return None
+        picture = frame[1]
+        video = (rpc.notifications.get("media.video") if rpc else None) or {}
+        degrees = int(video.get("rotate") or 0) % 360
+        if degrees:
+            # `np.rot90` counts anticlockwise and the mount is measured clockwise.
+            picture = np.ascontiguousarray(np.rot90(picture, k=-(degrees // 90)))
+        return picture
+
+    def shows_video(self) -> bool:
+        """Whether this transport has pixels at all."""
+        return self.consumer is not None and self.over_lan
+
+    def picture_note(self) -> str:
+        """Why the picture is missing, when it is missing for a reason rather than by failure.
+
+        **An empty box reads as broken.** The control lane carries JSON-RPC relayed as HTTP and
+        no media at all — which is the whole reason it works where WebRTC does not, since pixels
+        are exactly what a media path is for. So on that transport there is nothing to show, and
+        the panel has to say which of the two it is rather than leave a hole.
+        """
+        if self.consumer is None or self.over_lan:
+            return ""
+        return (
+            "**No video on this transport, by design.** The rendezvous relays calls, not RTP: "
+            "this tab works precisely because there is no media path to negotiate, and pixels "
+            "are what a media path is for. `robot.policies` says what the robot did; the "
+            "*on this network* tab shows it doing it."
+        )
+
+    @staticmethod
+    def log() -> str:
+        """What the terminal has been saying, for whoever has no terminal."""
+        if not RING.lines:
+            return ""
+        return "```\n" + "\n".join(RING.lines) + "\n```"
+
+
+LINK = Link()
+
+
+# ── what the robot already has ───────────────────────────────────────────────
+
+
+def robot_state() -> tuple[str, list[str]]:
+    """What is loaded and what it can be asked to do, as one read.
+
+    `robot.policies` carries the skills as well as the slots — deliberately, because a client
+    cannot offer a "bow" button without knowing the robot has a bow, and the other place that
+    list is published is a 50 Hz stream.
+    """
+    try:
+        policies = LINK.call("robot.policies") or {}
+        skills = LINK.call("robot.skills") or {}
+    except RpcError as e:
+        return f"could not read this robot: {e.message}", []
+
+    lines = [f"**mode** `{policies.get('mode') or '?'}`"]
+    if not policies.get("enabled"):
+        lines.append(
+            "**policies are switched off on this robot** (`[policy] enabled`), so nothing below "
+            "will move it. A legitimate bench configuration, not a fault."
+        )
+    if policies.get("change_error"):
+        lines.append(f"**last change failed:** {policies['change_error']}")
+
+    slots = policies.get("slots") or []
+    if slots:
+        lines.append("")
+        lines.append("| slot | running | origin |")
+        lines.append("| --- | --- | --- |")
+        for slot in slots:
+            # `path` is what is *actually* loaded, which is the point of the call: a slot
+            # whose override failed reports the file it fell back to and says why.
+            path = slot.get("path") or "*empty*"
+            warn = f" — ⚠️ {slot['error']}" if slot.get("error") else ""
+            lines.append(
+                f"| `{slot.get('slot')}` | {path}{warn} | {slot.get('origin') or '–'} |"
+            )
+
+    table = skills.get("skills") or []
+    names = [s.get("name") for s in table if s.get("name")]
+    built_in = skills.get("built_in") or []
+    if table:
+        lines.append("")
+        lines.append("| skill | seconds | from config |")
+        lines.append("| --- | --- | --- |")
+        for skill in table:
+            seconds = skill.get("duration")
+            lines.append(
+                f"| `{skill.get('name')}` | {seconds if seconds is not None else '–'} | "
+                f"{'yes' if skill.get('overridden') else 'shipped'} |"
+            )
+    if built_in:
+        lines.append("")
+        lines.append(
+            "The daemon drives these itself, so they are not editable here: "
+            + ", ".join(f"`{name}`" for name in built_in)
+        )
+    return "\n".join(lines), names + [n for n in built_in if n not in names]
+
+
+def not_accepted(result: Any) -> str | None:
+    """Why a discrete intent said no, or `None`.
+
+    **`accepted: false` is a normal answer and not a JSON-RPC error**, which `IntentResult` says
+    outright: safety may refuse to run a policy on a fallen robot, and the caller needs the reason
+    rather than something that reads as "the call broke". A page that only caught errors would
+    report every one of those as a success and leave a motionless robot unexplained.
+
+    An `accepted: true` carrying a reason is `IntentResult::already` — it succeeded and queued no
+    work — so it is not a refusal and is worth saying anyway, which is `already_note`.
+    """
+    if not isinstance(result, dict) or "accepted" not in result:
+        return None
+    if result.get("accepted"):
+        return None
+    return result.get("reason") or "refused, with nothing said about why"
+
+
+def already_note(result: Any) -> str:
+    """An acceptance's reason, which means the robot was already in the state asked for."""
+    if isinstance(result, dict) and result.get("accepted") and result.get("reason"):
+        return f" — {result['reason']}"
+    return ""
+
+
+# ── the one click ────────────────────────────────────────────────────────────
+
+
+def install_and_run(index: int, hold: float) -> str:
+    """`policy.fetch`, `robot.setSkill`, `robot.policies`, `robot.do` — and stop at the first no.
+
+    Every refusal is worth showing verbatim. `policy.fetch` is the one that checks the claims that
+    matter — `obs_len`, `action_len`, `model_api`, `robot.model` — and it makes them *before* the
+    download, so "this policy is 51-D and this robot is 61-D" arrives in a second rather than
+    after 800 KB and a load failure.
+    """
+    if index >= len(CATALOGUE):
+        return "that row is stale — reload the catalogue."
+    policy = CATALOGUE[index]
+    logger.info("click: %s (hold %s)", policy.key, hold)
+
+    blocked = catalogue.refusal(policy)
+    if blocked:
+        return f"**not installed.** {blocked}"
+
+    params: dict[str, Any] = {"repo": policy.repo}
+    if policy.file:
+        params["file"] = policy.file
+
+    try:
+        fetched = LINK.call("policy.fetch", params, timeout=FETCH_TIMEOUT) or {}
+    except RpcError as e:
+        return f"**`policy.fetch` refused it.** {e.message}"
+
+    # The robot's own reading of the manifest wins over this Space's: it downloaded the file and
+    # parsed the manifest beside it, so its answer is about the bytes that are going to run.
+    if not fetched.get("duration_s") and not hold:
+        return (
+            f"**{policy.name} holds until it is told otherwise**, so it has no length of its own. "
+            "Say how many seconds to hold it, beside the button."
+        )
+    late_refusal = catalogue.refusal(
+        Policy(repo=policy.repo, name=policy.name, encoding=fetched.get("encoding"))
+    )
+    if late_refusal:
+        return f"**downloaded, and not installed.** {late_refusal}"
+
+    skill = catalogue.skill_for(fetched, hold)
+    logger.info("installing %r from the fetch answer", skill["name"])
+    try:
+        added = LINK.call("robot.setSkill", skill)
+    except RpcError as e:
+        return f"**downloaded to `{fetched.get('path')}`, and `robot.setSkill` refused.** {e.message}"
+    said_no = not_accepted(added)
+    if said_no:
+        return f"**downloaded to `{fetched.get('path')}`, and not added:** {said_no}"
+
+    # A skill accepted is not a skill the robot has: `robot.setSkill` triggers a reload, and a
+    # reload that failed says so here and nowhere else. Without this check the page would report
+    # success and the robot would do nothing.
+    try:
+        after = LINK.call("robot.policies") or {}
+    except RpcError as e:
+        after = {}
+        unconfirmed = f" (could not confirm the reload: {e.message})"
+    else:
+        unconfirmed = ""
+    if after.get("change_error"):
+        return f"**added, and the robot could not re-read it:** {after['change_error']}"
+
+    name = skill["name"]
+    try:
+        ran = LINK.call("robot.do", {"skill": name})
+    except RpcError as e:
+        return (
+            f"**`{name}` is installed** ({skill['duration']:g}s) **and it would not run:** "
+            f"{e.message}"
+        )
+    said_no = not_accepted(ran)
+    if said_no:
+        return (
+            f"**`{name}` is installed** ({skill['duration']:g}s) **and the robot would not run "
+            f"it:** {said_no}"
+        )
+    return (
+        f"**`{name}` installed and running** — {skill['duration']:g}s from "
+        f"`{policy.key}`{already_note(ran)}{unconfirmed}"
+    )
+
+
+def run_installed(name: str) -> str:
+    if not name:
+        return "pick a skill first."
+    try:
+        ran = LINK.call("robot.do", {"skill": name})
+    except RpcError as e:
+        return f"**`{name}` would not run:** {e.message}"
+    said_no = not_accepted(ran)
+    if said_no:
+        return f"**`{name}` would not run:** {said_no}"
+    return f"**`{name}` running.**{already_note(ran)}"
+
+
+def plain(method: str) -> str:
+    """The three buttons that take no parameters: init, stop, relax."""
+    try:
+        result = LINK.call(method)
+    except RpcError as e:
+        return f"**`{method}` refused:** {e.message}"
+    said_no = not_accepted(result)
+    if said_no:
+        return f"**`{method}` refused:** {said_no}"
+    return f"**`{method}` done.**{already_note(result)}"
+
+
+# ── the page ─────────────────────────────────────────────────────────────────
+
+
+def row_text(policy: Policy) -> str:
+    bits = [f"**{policy.name}** · {policy.headline()} · `{policy.origin}`"]
+    if policy.description:
+        bits.append(policy.description)
+    blocked = catalogue.refusal(policy)
+    warn = catalogue.caution(policy)
+    if blocked:
+        bits.append(f"⛔ {blocked}")
+    elif warn:
+        bits.append(f"⚠️ {warn}")
+    if catalogue.needs_a_length(policy) and not blocked:
+        bits.append("_declares no length — the seconds above are what it will be held for._")
+    bits.append(f"<sub>`{policy.key}`</sub>")
+    return "  \n".join(bits)
+
+
+def load_catalogue(force: bool = False) -> list[Any]:
+    """Render the rows, reading the Hub only when there is nothing to render.
+
+    `demo.load` fires per page view and the read is twenty-odd HTTPS requests, so a Space
+    with two visitors would spend its first four seconds fetching manifests it already has.
+    *reload the catalogue* is the force, and a restart is the other one.
+    """
+    global CATALOGUE, CATALOGUE_ERROR, CATALOGUE_READ_AT
+    if force or not CATALOGUE:
+        CATALOGUE, CATALOGUE_ERROR = catalogue.read_hub()
+        CATALOGUE_READ_AT = time.time()
+
+    heading = (
+        CATALOGUE_ERROR
+        if CATALOGUE_ERROR
+        else (
+            f"{len(CATALOGUE)} policies on the Hub, official first — read "
+            f"{time.strftime('%H:%M UTC', time.gmtime(CATALOGUE_READ_AT))}."
+            # Gradio wants its components at build time, so the ceiling is real. Saying so is
+            # the difference between a short list and a list that quietly lost its tail.
+            + (
+                f" Only the first {MAX_ROWS} are shown — raise `MAX_ROWS`."
+                if len(CATALOGUE) > MAX_ROWS
+                else ""
+            )
+        )
+    )
+    updates: list[Any] = [heading]
+    for index in range(MAX_ROWS):
+        if index < len(CATALOGUE):
+            policy = CATALOGUE[index]
+            updates.append(gr.update(visible=True))
+            updates.append(gr.update(value=row_text(policy)))
+            updates.append(
+                gr.update(interactive=catalogue.refusal(policy) is None)
+            )
+        else:
+            updates.append(gr.update(visible=False))
+            updates.append(gr.update(value=""))
+            updates.append(gr.update(interactive=False))
+    return updates
+
+
+def token_of(oauth: gr.OAuthToken | None) -> str:
+    """A visitor's token by preference, and never the robot's — unless it is a mock.
+
+    The rendezvous maps a token to one peer, so a consumer authenticating *as* the robot takes the
+    robot off its owner's listing — the same fact §3.7 records about two robots sharing a
+    credential. A visitor's OAuth token reaches their own robots and nobody else's, which is what
+    makes a public Space defensible.
+
+    **And outside a Space that token is a placeholder**, which cost an afternoon of blaming the
+    rendezvous. Gradio mocks its own login when `SPACE_ID` is unset — the buttons behave, the
+    profile is real, and `_get_mocked_oauth_info` sets `access_token` to the literal string
+    `mock-oauth-token-for-local-dev`. Sent to a service that resolves tokens through `whoami-v2`,
+    that is a `401`, correctly, and the page's own error message said "sign in again" — the one
+    thing that could not help. So a mocked token is recognised and dropped rather than preferred,
+    and what a local run uses is `HF_TOKEN` or whatever `hf auth login` stored, which is what
+    `huggingface_hub.get_token` reads.
+    """
+    if oauth is not None and oauth.token and oauth.token != MOCK_TOKEN:
+        # Never the token itself, here or anywhere — which *source* it came from is the half that
+        # explains a refusal, and the half that is safe to write down.
+        logger.info("token: the visitor's Hugging Face sign-in")
+        return oauth.token
+
+    if oauth is not None and oauth.token == MOCK_TOKEN:
+        logger.info("token: Gradio's mocked sign-in, which no service accepts — using a real one")
+
+    from huggingface_hub import get_token
+
+    stored = (os.environ.get("HF_TOKEN") or get_token() or "").strip()
+    logger.info(
+        "token: %s",
+        "HF_TOKEN"
+        if os.environ.get("HF_TOKEN")
+        else "the one `hf auth login` stored"
+        if stored
+        else "none — sign in, set HF_TOKEN, or run `hf auth login`",
+    )
+    return stored
+
+
+def find_robots(oauth: gr.OAuthToken | None) -> tuple[Any, str]:
+    token = token_of(oauth)
+    if not token:
+        return gr.update(choices=[], value=None), (
+            "sign in with Hugging Face, or set an `HF_TOKEN` secret on this Space."
+        )
+    ducks, note = LINK.robots(token)
+    NAMES.update({peer: label for label, peer in ducks})
+    return gr.update(choices=ducks, value=ducks[0][1] if ducks else None), note
+
+
+def open_session(peer_id: str | None, oauth: gr.OAuthToken | None) -> str:
+    if not peer_id:
+        return "no duck chosen — press *find my ducks* first."
+    token = token_of(oauth)
+    if not token:
+        return "sign in with Hugging Face, or set an `HF_TOKEN` secret on this Space."
+    return LINK.through_rendezvous(token, peer_id, NAMES.get(peer_id, peer_id))
+
+
+with gr.Blocks(title="microduck policy shop") as demo:
+    gr.Markdown(
+        """
+        # Put a policy on your duck
+
+        Everything published to the Hub as `microduck-…`, read the way the robot reads it, with a
+        button that downloads one onto your duck and runs it. Four calls per click:
+        `policy.fetch`, `robot.setSkill`, `robot.policies`, `robot.do`.
+
+        One consumer at a time — while this holds a session, the robot's own console cannot open
+        one.
+        """
+    )
+
+    with gr.Tab("from anywhere"):
+        gr.Markdown(
+            "Through the rendezvous, which reaches a duck behind its owner's router. **Nothing "
+            "is configured on the robot for this** — it connects outward to "
+            "`reachy_mini_central` holding its own account token and registers as a producer, "
+            "this page signs in as you, and the service introduces the two.\n\n"
+            "**And there is no WebRTC in this path at all.** The calls are relayed as HTTP: the "
+            "rendezvous forwards an `rpc` key on a `peer` envelope verbatim, and `mediad`'s "
+            "control lane answers it out of the same routing table the datachannel uses. No ICE, "
+            "no DTLS, no relay candidate — so nothing here can be defeated by a NAT, and no "
+            "click waits on somebody's relay staying up (§6).\n\n"
+            "The cost is pixels: video is RTP on the media path, so there is none on this tab. "
+            "`robot.policies` says what the robot did; the tab beside this one shows it."
+        )
+        with gr.Row():
+            gr.LoginButton()
+            find = gr.Button("find my ducks")
+            chosen = gr.Dropdown(choices=[], label="your ducks", scale=2)
+            connect = gr.Button("connect", variant="primary")
+
+    with gr.Tab("on this network"):
+        gr.Markdown(
+            "Straight to the signalling server `mediad` is already running — no account, no "
+            "rendezvous, no relay, and nothing between here and the robot. `duckctl ip` prints "
+            "the address; `.local` works wherever mDNS does."
+            + (
+                # The confusion this exists to prevent: a duck is reached by the *rendezvous*
+                # introducing two peers, not by anything being pointed at this page's URL — so
+                # there is nothing to type here that would make a data centre reach a LAN.
+                "\n\n**This tab cannot work from a Space.** This page is running in a data "
+                "centre and your robot is behind your router; no address typed here is "
+                "reachable from here. It is for running this same file on the robot's own "
+                "network — the README's local-run section is two commands. Use *from "
+                "anywhere* instead, which is what the rendezvous is for."
+                if ON_A_SPACE
+                else ""
+            )
+        )
+        with gr.Row():
+            host = gr.Textbox(
+                value=os.environ.get("DUCK_HOST", ""),
+                placeholder="olducky.local",
+                label="the robot's address on this network",
+                scale=2,
+            )
+            connect_lan = gr.Button("connect over the LAN", variant="primary")
+
+    with gr.Row():
+        disconnect = gr.Button("disconnect")
+
+    link_state = gr.Markdown("**not connected.**")
+    # What the last click did. Separate from the line above because that one repaints on a
+    # timer, and a refusal worth reading would be gone a second after it arrived.
+    status = gr.Markdown("")
+
+    with gr.Row():
+        read = gr.Button("read this robot")
+        init = gr.Button("init (power the joints, stand)")
+        stop = gr.Button("stop")
+        relax = gr.Button("relax (cut torque — it will collapse)")
+
+    # Small, and beside the buttons rather than above them: the point of a picture here is
+    # seeing that the thing which was just installed did something, not watching a camera.
+    view = gr.Image(label="what the duck sees", height=260, visible=False)
+    # Why the box above is missing, when it is missing on purpose. Kept out of the image's own
+    # label because a label cannot say a paragraph and this is the paragraph somebody needs.
+    view_note = gr.Markdown("")
+
+    with gr.Accordion("what this duck has now", open=True):
+        robot_panel = gr.Markdown("Connect, then *read this robot*.")
+        with gr.Row():
+            installed = gr.Dropdown(choices=[], label="a skill it already has", scale=2)
+            run = gr.Button("run it")
+
+    gr.Markdown("## From the Hub")
+    with gr.Row():
+        hold = gr.Number(
+            value=DEFAULT_HOLD,
+            label="seconds to hold a policy that declares no length",
+            precision=1,
+            scale=2,
+        )
+        reload_catalogue = gr.Button("reload the catalogue")
+    catalogue_note = gr.Markdown("Loading…")
+
+    rows: list[Any] = []
+    for index in range(MAX_ROWS):
+        with gr.Row(visible=False) as row:
+            text = gr.Markdown("")
+            button = gr.Button("put it on the duck and run it", scale=0)
+        button.click(
+            lambda hold_s, index=index: install_and_run(index, hold_s),
+            inputs=hold,
+            outputs=status,
+        ).then(lambda: robot_state()[0], outputs=robot_panel)
+        rows.extend([row, text, button])
+
+    with gr.Accordion("the log — every request, every frame, every refusal", open=False):
+        gr.Markdown(
+            "The same lines the terminal gets. `DUCK_LOG=DEBUG` adds the streaming "
+            "notifications and each ICE candidate."
+        )
+        wire = gr.Markdown("")
+
+    find.click(find_robots, outputs=[chosen, status])
+    connect.click(open_session, inputs=chosen, outputs=status).then(
+        lambda: robot_state(), outputs=[robot_panel, installed]
+    )
+    connect_lan.click(lambda where: LINK.over_the_lan(where), inputs=host, outputs=status).then(
+        lambda: robot_state(), outputs=[robot_panel, installed]
+    )
+    disconnect.click(lambda: LINK.disconnect(), outputs=status)
+    read.click(lambda: robot_state(), outputs=[robot_panel, installed])
+    init.click(lambda: plain("robot.init"), outputs=status)
+    stop.click(lambda: plain("robot.stop"), outputs=status)
+    relax.click(lambda: plain("robot.relax"), outputs=status)
+    run.click(run_installed, inputs=installed, outputs=status)
+    reload_catalogue.click(
+        lambda: load_catalogue(force=True), outputs=[catalogue_note, *rows]
+    )
+
+    demo.load(load_catalogue, outputs=[catalogue_note, *rows])
+    # Once a second: it repaints a status line and a transcript, and the session it describes
+    # changes state on its own — an ICE failure two minutes in should not need a click to appear.
+    # Ten a second for the picture and once a second for the words: the stream is 30 fps and a
+    # browser will not notice the difference, while a status line that repainted at 10 Hz would
+    # be unreadable.
+    gr.Timer(0.1).tick(
+        lambda: (
+            gr.update(value=LINK.picture(), visible=LINK.shows_video()),
+            LINK.picture_note(),
+        ),
+        outputs=[view, view_note],
+        show_progress="hidden",
+    )
+    gr.Timer(1.0).tick(
+        lambda: (LINK.describe(), LINK.log()),
+        outputs=[link_state, wire],
+        show_progress="hidden",
+    )
+
+
+if __name__ == "__main__":
+    demo.launch(server_name="0.0.0.0", server_port=int(os.environ.get("PORT", 7860)))
diff --git a/spaces/policy-shop/catalogue.py b/spaces/policy-shop/catalogue.py
new file mode 100644
index 00000000..2f0f604d
--- /dev/null
+++ b/spaces/policy-shop/catalogue.py
@@ -0,0 +1,359 @@
+"""What the Hub offers a duck, read the way the robot itself reads it.
+
+`updater/src/policy.rs` searches `https://huggingface.co/api/models?search=microduck&limit=25`
+and reads `manifest.json` out of each hit — no tag filter, because `microduck` in the name is
+what the published policies have in common and a tag is something to add once there is something
+to tag. This file makes the same two requests, so the gallery and `policy.search` cannot disagree
+about what exists.
+
+**It reads more than the robot's search answers.** `PolicySearchHit` carries an id, an origin and
+two counters; a page that asks somebody to run a policy on their robot should show what the
+policy claims to be first — `docs/policy-manifest.md` is the vocabulary, and every field in it is
+the publisher's own. Untrusted, which here means "displayed, and never the thing acted on": the
+skill that gets written comes from the robot's own reading of the manifest it downloaded, which
+is what will actually run.
+
+**Two shapes, one vocabulary.** A single-policy repo carries one `policy.onnx` with the fields at
+the top level; the official set carries ten files and the same fields once per entry under
+`policies`. `policy.fetch` takes a `file`, so an entry out of the set is one click like any other.
+
+Runnable on its own — `uv run catalogue.py` prints what a duck would be offered — which is how
+this is checked without a robot, a token or a Space.
+"""
+
+from __future__ import annotations
+
+import json
+from concurrent.futures import ThreadPoolExecutor
+from dataclasses import dataclass, field
+from typing import Any
+
+import requests
+
+HUB_API = "https://huggingface.co/api/models"
+# What `origin_of_repo` calls official. Anything else is community, and the word is the only
+# difference the robot draws.
+OFFICIAL_ORG = "pollen-robotics"
+# The nine-policy set, listed entry by entry rather than as one repo: fetching it whole is
+# `policy.install`, which replaces what the robot walks with, and that is not a one-click.
+SET_REPO = "pollen-robotics/microduck-policies"
+SEARCH = "microduck"
+TIMEOUT = 15
+
+# What an entry in a set inherits from the manifest's top level: the claims that are about the
+# robot and the convention, and nothing that is about a policy. Inheriting `description` gave
+# every one of the official nine the same line — a sentence describing the set, printed nine
+# times as though it described each file.
+INHERITED = ("schema_version", "model_api", "obs_len", "action_len", "robot")
+
+
+@dataclass
+class Policy:
+    """One thing a person could put on their duck. Every field below the repo is a claim."""
+
+    repo: str
+    # Which file in the repo, for an entry out of the set. `None` means "the only `.onnx` in it",
+    # which is what `policy.fetch` defaults to and what every single-policy repo has.
+    file: str | None = None
+    name: str = ""
+    description: str | None = None
+    kind: str | None = None
+    encoding: str | None = None
+    duration_s: float | None = None
+    unwind_s: float | None = None
+    entry_pose: str | None = None
+    slot: str | None = None
+    chain: bool = False
+    # `command.idle` — the twist that means "stop doing the thing". Its presence is what tells a
+    # held perpetual policy apart from a gait; see `caution`.
+    idle: list[float] | None = None
+    obs_len: int | None = None
+    action_len: int | None = None
+    model_api: int | None = None
+    schema_version: int | None = None
+    likes: int | None = None
+    downloads: int | None = None
+    training: dict[str, Any] = field(default_factory=dict)
+
+    @property
+    def origin(self) -> str:
+        return "official" if self.repo.split("/")[0] == OFFICIAL_ORG else "community"
+
+    @property
+    def key(self) -> str:
+        return f"{self.repo}#{self.file}" if self.file else self.repo
+
+    def headline(self) -> str:
+        """The one line a row shows: what it is, and how long it takes."""
+        bits = [self.kind or "kind not declared"]
+        if self.duration_s:
+            bits.append(f"{self.duration_s:g}s")
+        elif (self.kind or "").lower() == "perpetual":
+            bits.append("holds until told otherwise")
+        if self.encoding and self.encoding != "constant":
+            bits.append(f"command: {self.encoding}")
+        return " · ".join(bits)
+
+
+def refusal(policy: Policy) -> str | None:
+    """Why this cannot be a one-shot skill, or `None`.
+
+    **The daemon does not make this check and `robot.setSkill` would accept the entry.** A policy
+    whose command the daemon has to generate — a phase for a ground pick, a flag for a sit↔stand —
+    fed a constant instead is a robot moving plausibly and wrongly, which is worse than a
+    refusal. `robotctl`'s `skill_encoding_refusal` is where this rule lives on the robot's side,
+    and it is repeated here rather than relied on: `robotctl` is not in the path of a click.
+
+    The shape claims — `obs_len`, `action_len`, `model_api`, `robot.model` — are deliberately not
+    repeated. `policy.fetch` refuses on those itself, before the download, and a robot refusing
+    is a better answer than a Space guessing what a robot is.
+    """
+    encoding = (policy.encoding or "constant").lower()
+    if encoding == "phase":
+        return (
+            f"{policy.name} is driven by a phase the daemon generates, so it cannot be a "
+            "one-shot — it is a ground pick, and it belongs in that slot "
+            "(`robotctl policy load ground_pick …`)."
+        )
+    if encoding == "posture_flag":
+        return (
+            f"{policy.name} is driven by a posture flag the daemon flips, so it cannot be a "
+            "one-shot — it is a sit↔stand, and it belongs in that slot "
+            "(`robotctl policy load sitstand …`)."
+        )
+    if encoding != "constant":
+        return (
+            f"{policy.name}'s manifest says its command encoding is {policy.encoding!r}, which "
+            "no daemon knows how to drive — a skill needs a constant command."
+        )
+    return None
+
+
+def needs_a_length(policy: Policy) -> bool:
+    """Whether somebody has to say how long to hold this one.
+
+    A `perpetual` policy has no length of its own — that is what perpetual means — so a one-shot
+    made out of one is a hold and an unwind, and `robotctl policy add` refuses without `--hold`
+    rather than picking a number. The page asks instead.
+    """
+    return not policy.duration_s
+
+
+def caution(policy: Policy) -> str | None:
+    """What is worth saying before this runs, when it is not a refusal.
+
+    **A perpetual policy that declares no way to stop is a gait, not a one-shot.** The manifest
+    convention is explicit about the difference: `RemiFabre/microduck-flamingo-cycle` is a
+    published perpetual policy meant to be held, and what makes that work is `command.idle` plus
+    `unwind_s` — the twist that means "stop" and how long it needs to get there. A perpetual
+    policy carrying neither is `alpha_walking`: a thing to load into the `walk` slot, which is
+    `policy load` and not a click here. Held anyway it runs for the seconds asked and hands
+    straight back to the gait, so this is a caution and not a refusal — the daemon guards the
+    encoding, and this is a judgement about intent rather than about safety.
+    """
+    if (policy.kind or "").lower() != "perpetual":
+        return None
+    if policy.idle or policy.unwind_s:
+        return None
+    return (
+        "declares no way to stop — no `command.idle`, no `unwind_s`. That reads as a gait for a "
+        "slot rather than a one-shot; held for the seconds below it hands straight back to "
+        "whatever the robot was walking with."
+    )
+
+
+def _policy_from(fields: dict[str, Any], repo: str, file: str | None) -> Policy:
+    command = fields.get("command") or {}
+    robot = fields.get("robot") or {}
+    name = fields.get("name") or _stem(file) or _stem(repo.split("/")[-1])
+    policy = Policy(
+        repo=repo,
+        file=file,
+        name=name,
+        description=fields.get("description"),
+        kind=fields.get("kind"),
+        encoding=command.get("encoding"),
+        duration_s=_number(fields.get("duration_s")),
+        unwind_s=_number(fields.get("unwind_s")),
+        entry_pose=fields.get("entry_pose"),
+        slot=fields.get("slot"),
+        chain=bool(fields.get("chain")),
+        idle=command.get("idle") if isinstance(command.get("idle"), list) else None,
+        obs_len=_integer(fields.get("obs_len")),
+        action_len=_integer(fields.get("action_len")),
+        model_api=_integer(fields.get("model_api")),
+        schema_version=_integer(fields.get("schema_version")),
+        training=fields.get("training") or {},
+    )
+    # A manifest that names another robot is kept and labelled rather than dropped: `policy.fetch`
+    # refuses on `robot.model` itself, and a row that says why is a better answer than a policy
+    # that silently is not in the list somebody was told to look in.
+    model = robot.get("model")
+    if model and model != "microduck":
+        policy.description = f"published for a {model}, not for a duck"
+    return policy
+
+
+def _merge(manifest: dict[str, Any], entry: dict[str, Any]) -> dict[str, Any]:
+    """One entry of a set, with the set's shape claims and none of its prose."""
+    return {**{k: v for k, v in manifest.items() if k in INHERITED}, **entry}
+
+
+def _stem(text: str | None) -> str:
+    if not text:
+        return ""
+    stem = text.rsplit(".", 1)[0] if text.endswith((".onnx", ".json")) else text
+    return stem.removeprefix("microduck-")
+
+
+def _number(value: Any) -> float | None:
+    return float(value) if isinstance(value, (int, float)) and not isinstance(value, bool) else None
+
+
+def _integer(value: Any) -> int | None:
+    return int(value) if isinstance(value, int) and not isinstance(value, bool) else None
+
+
+def _manifest(repo: str) -> dict[str, Any] | None:
+    """A repo's `manifest.json`, or `None` if it has none.
+
+    No token: these are public repos, and a Space that reads them signed in as whoever is looking
+    would show a different catalogue to each visitor for no reason.
+    """
+    url = f"https://huggingface.co/{repo}/resolve/main/manifest.json"
+    try:
+        answer = requests.get(url, timeout=TIMEOUT)
+    except requests.RequestException:
+        return None
+    if answer.status_code != 200:
+        return None
+    try:
+        manifest = answer.json()
+    except ValueError:
+        return None
+    return manifest if isinstance(manifest, dict) else None
+
+
+def _hits() -> list[dict[str, Any]]:
+    try:
+        answer = requests.get(
+            HUB_API, params={"search": SEARCH, "limit": 50}, timeout=TIMEOUT
+        )
+        answer.raise_for_status()
+        hits = answer.json()
+    except (requests.RequestException, ValueError):
+        return []
+    return hits if isinstance(hits, list) else []
+
+
+def read_hub() -> tuple[list[Policy], str | None]:
+    """Everything the Hub offers, and why the list is short if it is.
+
+    An unreachable Hub is a fact to report rather than an error to raise — the same call
+    `PolicyCheckResult.unreachable` makes — because a page that shows nothing and says nothing is
+    indistinguishable from a Hub with nothing in it.
+    """
+    hits = _hits()
+    if not hits:
+        return [], (
+            "the Hub answered nothing. Either it is unreachable from this Space, or no model "
+            f"matches {SEARCH!r} — `huggingface.co/api/models?search={SEARCH}` is the request."
+        )
+
+    counters = {
+        hit.get("modelId") or hit.get("id"): (hit.get("likes"), hit.get("downloads"))
+        for hit in hits
+        if isinstance(hit, dict)
+    }
+    repos = [repo for repo in counters if repo and repo != SET_REPO]
+
+    with ThreadPoolExecutor(max_workers=8) as pool:
+        manifests = dict(zip(repos, pool.map(_manifest, repos)))
+    manifests[SET_REPO] = _manifest(SET_REPO)
+
+    policies: list[Policy] = []
+
+    # The set first: its entries are the ones a stock duck already has, so they are the row a
+    # person recognises, and they are what says the transport works before anything new is tried.
+    official = manifests.get(SET_REPO) or {}
+    for entry in official.get("policies") or []:
+        if not isinstance(entry, dict):
+            continue
+        file = entry.get("file")
+        # A `file` with a path in it is skipped by the seeder and by `policy update` both
+        # (`docs/policy-manifest.md`), so it is skipped here for the same reason.
+        if not isinstance(file, str) or "/" in file or file.startswith("."):
+            continue
+        policies.append(_policy_from(_merge(official, entry), SET_REPO, file))
+
+    for repo in repos:
+        manifest = manifests.get(repo)
+        if not manifest:
+            continue
+        # A set published by somebody else is listed entry by entry, exactly like ours.
+        entries = manifest.get("policies")
+        if isinstance(entries, list) and entries:
+            for entry in entries:
+                if isinstance(entry, dict) and isinstance(entry.get("file"), str):
+                    policies.append(_policy_from(_merge(manifest, entry), repo, entry["file"]))
+            continue
+        policy = _policy_from(manifest, repo, None)
+        policy.likes, policy.downloads = counters.get(repo, (None, None))
+        policies.append(policy)
+
+    # Official first, then by likes: a page whose first row is a stranger's untested policy is
+    # asking for the wrong thing to be clicked first.
+    policies.sort(key=lambda p: (p.origin != "official", -(p.likes or 0), p.name))
+    return policies, None
+
+
+def skill_for(fetched: dict[str, Any], hold: float | None) -> dict[str, Any]:
+    """`robot.setSkill` parameters, from what the robot itself read off the manifest.
+
+    Mirrors `robotctl policy add` field for field, and takes its values from `policy.fetch`'s
+    answer rather than from this Space's own reading of the Hub: the robot downloaded the file
+    and parsed the manifest beside it, so its answer is about the bytes that are going to run.
+
+    `hold` is only consulted when the policy declares no length. A flag beating a manifest is
+    `robotctl`'s rule too, and for the same reason — a person watching the robot is a better
+    judge than a number measured in simulation — but a page cannot watch, so here the manifest
+    wins wherever it has an opinion.
+    """
+    duration = fetched.get("duration_s") or hold
+    params: dict[str, Any] = {
+        "name": fetched.get("name") or _stem(fetched.get("file")) or "policy",
+        "path": fetched["path"],
+        "duration": float(duration),
+        # Whether a held button chains another run is the policy's to say — the roulade does, a
+        # kick does not — and the manifest is where it says it.
+        "chain": bool(fetched.get("chain")),
+    }
+    # How to stop is the manifest's too: `command.idle` is the twist that means "stop doing the
+    # thing", and `unwind_s` is how long the policy needs to get there.
+    if fetched.get("idle"):
+        params["unwind"] = fetched["idle"]
+    if fetched.get("unwind_s"):
+        params["unwind_s"] = float(fetched["unwind_s"])
+    if fetched.get("action_scale"):
+        params["action_scale"] = float(fetched["action_scale"])
+    return params
+
+
+if __name__ == "__main__":
+    found, why = read_hub()
+    if why:
+        print(why)
+    for one in found:
+        mark = refusal(one)
+        print(f"{one.origin:9} {one.key}")
+        print(f"          {one.name} — {one.headline()}")
+        if one.description:
+            print(f"          {one.description}")
+        if mark:
+            print(f"          REFUSED: {mark}")
+        else:
+            if needs_a_length(one):
+                print("          needs a hold: its manifest declares no length")
+            if caution(one):
+                print(f"          caution: {caution(one)}")
+    print(f"\n{len(found)} policies")
diff --git a/spaces/policy-shop/control.py b/spaces/policy-shop/control.py
new file mode 120000
index 00000000..6db3c45a
--- /dev/null
+++ b/spaces/policy-shop/control.py
@@ -0,0 +1 @@
+../shared/control.py
\ No newline at end of file
diff --git a/spaces/policy-shop/lan.py b/spaces/policy-shop/lan.py
new file mode 100644
index 00000000..b207ce6c
--- /dev/null
+++ b/spaces/policy-shop/lan.py
@@ -0,0 +1,577 @@
+"""The same session over the robot's own signalling server, for a consumer already on the LAN.
+
+The rendezvous path is the one that reaches a duck from anywhere, and it leans on a relay
+candidate to do it: between a home router and a data centre, srflx-to-srflx punches often enough
+to be worth trying and not often enough to rely on, so the fallback carries the session
+(`docs/design/remote-access-design.md` §6). On the duck's own network none of that is needed —
+both sides offer host candidates and ICE pairs them immediately — and a driving session is
+exactly the kind that should not be paying a relay's latency to reach a robot two metres away.
+
+**This is a transport, not a second design.** `webrtcsink`'s signalling server is already running
+on the robot at `ws://<robot>:8443`, and it carries the same gst envelopes the rendezvous carries
+over SSE and `POST /send` — §3.2 has the two sides side by side. So everything above the session is
+untouched: the same `control` channel, the same JSON-RPC, the same `Rpc` object. What changes is
+one hop, and it changes in the direction of *fewer* moving parts: no account, no lease, no
+rendezvous, no relay.
+
+Which makes it the thing to reach for when a click does not work over the rendezvous and nobody
+knows which layer to blame. If it works here and not there, the transport is the problem and
+nothing about the policy, the manifest or the robot is.
+
+What is deliberately absent is a reconnect loop. Their consumer has one because a robot on the far
+side of the internet goes away for reasons nobody can see; a robot on this desk that stops
+answering is worth a sentence on the page rather than a silent retry every five seconds.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import contextlib
+import json
+import logging
+import re
+from typing import Any
+
+import aiohttp
+import numpy as np
+import numpy.typing as npt
+from aiortc import RTCDataChannel, RTCPeerConnection, RTCSessionDescription
+from aiortc.mediastreams import MediaStreamError
+from aiortc.sdp import candidate_from_sdp
+
+# **Their DTLS shim, called out loud.** aiortc's default cipher list shares no cipher with the
+# GStreamer `webrtcsink` a duck runs, so DTLS never completes and the peer connection never
+# reaches `connected` — a failure that looks exactly like a NAT problem and is not one. Their
+# module applies it at import; calling it here means this file does not depend on somebody else's
+# import having happened first, and it is idempotent by design.
+from reachy_mini.media.central_consumer import _patch_aiortc_dtls_ciphers
+
+from control import CONTROL_LABEL, Rpc
+
+logger = logging.getLogger(__name__)
+
+_patch_aiortc_dtls_ciphers()
+
+# What `mediad --port` defaults to, which is `webrtcsink`'s own signaller's default.
+DEFAULT_SIGNALLING_PORT = 8443
+
+
+def _log_candidates(side: str, sdp: str) -> None:
+    """How many candidates of each type one side offered.
+
+    The single most useful line when signalling crossed and media did not: `host` only on both
+    sides means nothing can work across networks, and no `relay` anywhere is §6.
+    """
+    kinds: dict[str, int] = {}
+    for kind in re.findall(r"candidate:[^\r\n]* typ (\w+)", sdp or ""):
+        kinds[kind] = kinds.get(kind, 0) + 1
+    logger.info("%s ICE candidates: %s", side, kinds or "none")
+
+
+class LanConsumer:
+    """One session with one robot on this network.
+
+    The surface is `ReachyCentralConsumer`'s — `start`, `stop`, `status`, `latest_frame`,
+    `send_command` — so `app.py` holds either without knowing which. That is not politeness: the
+    point of having two transports is that everything above them is the same code, and a page that
+    branched on which one it had would be two pages.
+    """
+
+    def __init__(self, host: str, rpc: Rpc, port: int = DEFAULT_SIGNALLING_PORT):
+        self.url = f"ws://{host}:{port}"
+        self.host = host
+        self._rpc = rpc
+
+        self._session: aiohttp.ClientSession | None = None
+        self._ws: aiohttp.ClientWebSocketResponse | None = None
+        self._task: asyncio.Task[None] | None = None
+        self._loop: asyncio.AbstractEventLoop | None = None
+        self._pc: RTCPeerConnection | None = None
+
+        self._self_peer_id: str | None = None
+        self._robot_peer_id: str | None = None
+        self._session_id: str | None = None
+        self._remote_desc_set = False
+        self._pending_ice: list[dict[str, Any]] = []
+
+        self.meta: dict[str, Any] = {}
+        self.error: str | None = None
+
+        self._cmd_channel: RTCDataChannel | None = None
+        self._cmd_channel_open = False
+        self._latest: tuple[int, npt.NDArray[np.uint8]] | None = None
+        self._frames = 0
+
+    # ── the surface `app.py` uses ────────────────────────────────────────────
+
+    async def start(self) -> None:
+        """Open the socket, then pump it.
+
+        The connect is awaited here rather than inside the task on purpose: a hostname that does
+        not resolve, a robot that is off, and a port nothing is listening on are all worth
+        reporting to whoever just typed the address, and a task that swallows them turns every one
+        of them into "connecting…".
+        """
+        # The budget goes on the *connect* and not on the socket's life: a WebSocket that is
+        # working is idle most of the time, and a `total` here would end a healthy session. Eight
+        # seconds is enough for mDNS plus a TCP handshake on a LAN, and short enough that a
+        # mistyped address comes back while somebody is still looking at it.
+        session = aiohttp.ClientSession(
+            timeout=aiohttp.ClientTimeout(total=None, sock_connect=8)
+        )
+        try:
+            self._ws = await session.ws_connect(self.url, heartbeat=20)
+        except Exception:
+            await session.close()
+            raise
+        logger.info("signalling socket open: %s", self.url)
+        self._session = session
+        self._loop = asyncio.get_running_loop()
+        self._task = asyncio.create_task(self._pump(), name="lan-signalling")
+
+    async def stop(self) -> None:
+        if self._task is not None:
+            self._task.cancel()
+            with contextlib.suppress(asyncio.CancelledError):
+                await self._task
+            self._task = None
+        if self._session_id and self._ws is not None and not self._ws.closed:
+            with contextlib.suppress(Exception):
+                await self._ws.send_json({"type": "endSession", "sessionId": self._session_id})
+        if self._pc is not None:
+            with contextlib.suppress(Exception):
+                await self._pc.close()
+            self._pc = None
+        if self._ws is not None:
+            with contextlib.suppress(Exception):
+                await self._ws.close()
+            self._ws = None
+        if self._session is not None:
+            with contextlib.suppress(Exception):
+                await self._session.close()
+            self._session = None
+        self._cmd_channel, self._cmd_channel_open = None, False
+
+    def status(self) -> dict[str, Any]:
+        return {
+            "connected": self._pc is not None and self._pc.connectionState == "connected",
+            "self_peer_id": self._self_peer_id,
+            "robot_peer_id": self._robot_peer_id,
+            "session_id": self._session_id,
+            "pc_state": self._pc.connectionState if self._pc is not None else None,
+            "frames": self._frames,
+            # Not in their status, and the whole reason this transport exists — a page that says
+            # "over the LAN" is saying which failure modes do not apply.
+            "transport": f"ws {self.url}",
+        }
+
+    def latest_frame(self) -> tuple[int, npt.NDArray[np.uint8]] | None:
+        return self._latest
+
+    def send_command(self, envelope: dict[str, Any]) -> bool:
+        """Write one JSON line to the control channel, from whatever thread asks.
+
+        `RTCDataChannel.send` is not thread-safe and a Gradio callback runs in a worker thread, so
+        the send is marshalled onto the loop that owns the peer connection — the same arrangement,
+        and for the same reason, as the one their consumer makes.
+        """
+        channel, loop = self._cmd_channel, self._loop
+        if channel is None or not self._cmd_channel_open or loop is None:
+            return False
+        payload = json.dumps(envelope)
+
+        def do_send() -> None:
+            try:
+                channel.send(payload)
+            except Exception as e:  # noqa: BLE001 - a failed send is a closed channel, reported
+                logger.warning("send failed: %r", e)
+
+        try:
+            loop.call_soon_threadsafe(do_send)
+            return True
+        except RuntimeError:
+            return False
+
+    # ── the signalling protocol, read off net/webrtc/protocol ────────────────
+
+    async def _send(self, message: dict[str, Any]) -> None:
+        if self._ws is None or self._ws.closed:
+            raise RuntimeError("the signalling socket is closed")
+        logger.info("→ %s", json.dumps(message)[:240])
+        await self._ws.send_json(message)
+
+    async def _pump(self) -> None:
+        assert self._ws is not None
+        try:
+            async for raw in self._ws:
+                if raw.type is not aiohttp.WSMsgType.TEXT:
+                    continue
+                try:
+                    message = json.loads(raw.data)
+                except ValueError:
+                    logger.warning("unparseable signalling frame: %r", raw.data[:120])
+                    continue
+                await self._handle(message)
+        except asyncio.CancelledError:
+            raise
+        except Exception as e:  # noqa: BLE001 - reported on the page, not raised into a callback
+            self.error = f"{type(e).__name__}: {e}"
+            logger.warning("signalling ended: %r", e)
+        else:
+            self.error = self.error or "the robot closed the signalling socket"
+
+    async def _handle(self, message: dict[str, Any]) -> None:
+        kind = message.get("type")
+        logger.info("← %s", json.dumps(message)[:240])
+
+        if kind == "welcome":
+            # The server names us, then we ask who is producing. `list` takes no fields.
+            self._self_peer_id = message.get("peerId")
+            await self._send({"type": "list"})
+
+        elif kind == "list":
+            producers = message.get("producers") or []
+            if not producers:
+                self.error = (
+                    "the robot's signalling server has no producer. `mediad` registers as one "
+                    "when its pipeline reaches PLAYING — `journalctl -u mediad -b` is where a "
+                    "pipeline that would not start says why."
+                )
+                return
+            producer = producers[0]
+            self._robot_peer_id = producer.get("id")
+            self.meta = producer.get("meta") or {}
+            # No `offer` of our own: the producer offers and we answer, which is the direction
+            # `webrtcsink` wants — it is the side that knows what it is sending.
+            await self._send({"type": "startSession", "peerId": self._robot_peer_id})
+
+        elif kind == "sessionStarted":
+            self._session_id = message.get("sessionId")
+            await self._build_pc()
+
+        elif kind == "peer":
+            if message.get("sdp"):
+                await self._on_offer(message["sdp"])
+            elif message.get("ice"):
+                await self._on_ice(message["ice"])
+
+        elif kind == "endSession":
+            self.error = "the robot ended the session"
+            self._session_id = None
+
+        elif kind == "error":
+            self.error = str(message.get("details") or "the signalling server refused something")
+
+    async def _on_offer(self, sdp: dict[str, Any]) -> None:
+        if self._pc is None or sdp.get("type") != "offer":
+            return
+        await self._pc.setRemoteDescription(
+            RTCSessionDescription(sdp=sdp["sdp"], type="offer")
+        )
+        self._remote_desc_set = True
+        pending, self._pending_ice = self._pending_ice, []
+        for candidate in pending:
+            await self._add_ice(candidate)
+
+        _log_candidates("remote", sdp["sdp"])
+        answer = await self._pc.createAnswer()
+        await self._pc.setLocalDescription(answer)
+        _log_candidates("local", self._pc.localDescription.sdp)
+        # aiortc has finished gathering by the time `setLocalDescription` returns, so the answer
+        # carries every candidate we have and nothing is trickled outbound. Their consumer relies
+        # on the same thing.
+        await self._send(
+            {
+                "type": "peer",
+                "sessionId": self._session_id,
+                "sdp": {
+                    "type": self._pc.localDescription.type,
+                    "sdp": self._pc.localDescription.sdp,
+                },
+            }
+        )
+
+    async def _on_ice(self, ice: dict[str, Any]) -> None:
+        if not self._remote_desc_set or self._pc is None:
+            # Candidates before the offer are ordinary trickle, not an error.
+            self._pending_ice.append(ice)
+            return
+        await self._add_ice(ice)
+
+    async def _add_ice(self, ice: dict[str, Any]) -> None:
+        text = (ice.get("candidate") or "").strip()
+        if not text:
+            return  # end-of-candidates; aiortc wants nothing for it
+        try:
+            candidate = candidate_from_sdp(text.removeprefix("candidate:"))
+            candidate.sdpMid = ice.get("sdpMid")
+            if ice.get("sdpMLineIndex") is not None:
+                candidate.sdpMLineIndex = int(ice["sdpMLineIndex"])
+            await self._pc.addIceCandidate(candidate)
+            logger.debug("+remote candidate %s", text[:90])
+        except Exception as e:  # noqa: BLE001 - one bad candidate is not a dead session
+            logger.warning("addIceCandidate failed: %r (%r)", e, text[:80])
+
+    async def _build_pc(self) -> None:
+        # **No ICE servers.** This is a client on the robot's own network, which is the case that
+        # needs neither STUN nor a relay — and asking for STUN here would make a LAN session wait
+        # on a Google address to answer before it could offer anything.
+        pc = RTCPeerConnection()
+        self._pc = pc
+        self._remote_desc_set = False
+
+        # The three states that fail for unrelated reasons and look identical from outside.
+        @pc.on("connectionstatechange")
+        async def on_state() -> None:
+            logger.info("peer connection: %s", pc.connectionState)
+
+        @pc.on("iceconnectionstatechange")
+        async def on_ice_state() -> None:
+            logger.info("ice: %s", pc.iceConnectionState)
+
+        @pc.on("icegatheringstatechange")
+        async def on_gathering() -> None:
+            logger.info("ice gathering: %s", pc.iceGatheringState)
+
+        @pc.on("track")
+        def on_track(track: Any) -> None:
+            logger.info("track: %s", track.kind)
+            if track.kind == "video":
+                asyncio.ensure_future(self._consume_video(track))
+
+        @pc.on("datachannel")
+        def on_datachannel(channel: RTCDataChannel) -> None:
+            if channel.label != CONTROL_LABEL:
+                logger.info("ignoring data channel %r", channel.label)
+                return
+            logger.info("control channel attached (state=%s)", channel.readyState)
+            self._cmd_channel = channel
+
+            def opened() -> None:
+                self._cmd_channel_open = True
+                self._rpc.bound_to(self.send_command)
+                logger.info("control channel open (%s)", self.url)
+
+            def closed() -> None:
+                self._cmd_channel_open = False
+                self._rpc.abandon("the control channel closed")
+
+            if channel.readyState == "open":
+                opened()
+            channel.on("open")(opened)
+            channel.on("close")(closed)
+            channel.on("message")(self._rpc.on_message)
+
+    async def _consume_video(self, track: Any) -> None:
+        """Decode frames so the page can show what the policy did.
+
+        The camera is mounted a quarter turn off and nothing on the robot rotates the picture —
+        `media.video` carries `rotate` for exactly this, and the control channel sends it once when
+        it opens, so the page can put the duck upright without a constant anywhere.
+        """
+        try:
+            while True:
+                frame = await track.recv()
+                self._frames += 1
+                # `rgb24` because that is what their consumer promises `latest_frame`'s callers,
+                # and the page holds either transport without asking which.
+                # Every frame is decoded and only the newest is kept: the page polls, and a queue
+                # of frames nobody looked at is a memory leak with extra steps.
+                self._latest = (self._frames, frame.to_ndarray(format="rgb24"))
+        except (MediaStreamError, asyncio.CancelledError):
+            return
+        except Exception as e:  # noqa: BLE001 - a dead decoder is not a dead session
+            logger.warning("video ended: %r", e)
+
+
+# ── checking it without a duck ────────────────────────────────────────────────
+#
+# `uv run lan.py` stands up a producer on loopback that speaks what `webrtcsink`'s signaller
+# speaks, and drives a real session against it: welcome, list, startSession, an offer answered,
+# DTLS, SCTP, the `control` channel, and a JSON-RPC call matched to its reply.
+#
+# **Which is the only way this file gets checked at all.** Every other part of the page can be
+# read against a fake dict; the signalling protocol is a dozen envelope shapes written from
+# `net/webrtc/protocol` and the console page, and getting one of them wrong produces silence
+# rather than an error. Two aiortc peers on 127.0.0.1 is not a duck — it is the same protocol,
+# and it catches the mistakes that are about the protocol.
+
+
+async def _selfcheck(port: int = 8443) -> None:  # pragma: no cover - a script, not a test suite
+    import json as _json
+
+    import av
+    from aiohttp import WSMsgType, web
+    from aiortc import VideoStreamTrack
+
+    class Stripes(VideoStreamTrack):
+        """A picture with a top and a bottom, and wider than it is tall.
+
+        Both on purpose: an upside-down frame and an unrotated one have the same shape, so the
+        asymmetry is what makes `rotate` checkable at all — 180×320 turned a quarter is 320×180,
+        and the red half moves to a side.
+        """
+
+        async def recv(self) -> av.VideoFrame:
+            pts, time_base = await self.next_timestamp()
+            picture = np.zeros((180, 320, 3), dtype=np.uint8)
+            picture[:90] = (255, 0, 0)
+            frame = av.VideoFrame.from_ndarray(picture, format="rgb24")
+            frame.pts, frame.time_base = pts, time_base
+            return frame
+
+    answers = {"robot.policies": {"mode": "walk", "enabled": True, "slots": []}}
+    calls: list[str] = []
+
+    async def producer(request: web.Request) -> web.WebSocketResponse:
+        ws = web.WebSocketResponse()
+        await ws.prepare(request)
+        pc: RTCPeerConnection | None = None
+        await ws.send_json({"type": "welcome", "peerId": "consumer-1"})
+        async for raw in ws:
+            if raw.type is not WSMsgType.TEXT:
+                continue
+            message = _json.loads(raw.data)
+            if message["type"] == "list":
+                await ws.send_json(
+                    {
+                        "type": "list",
+                        "producers": [
+                            {"id": "robot-1", "meta": {"name": "fakeducky", "kind": "microduck"}}
+                        ],
+                    }
+                )
+            elif message["type"] == "startSession":
+                await ws.send_json(
+                    {"type": "sessionStarted", "peerId": "robot-1", "sessionId": "session-1"}
+                )
+                pc = RTCPeerConnection()
+                # The robot opens the channel, which is why a consumer that opens its own gets an
+                # unrouted one: `mediad` calls create-data-channel per consumer.
+                channel = pc.createDataChannel(CONTROL_LABEL)
+                # And it sends pixels, which is the half of "run it" that a table cannot show.
+                # VP8 here where a duck sends H.264 — the codec is aiortc's to pick and the
+                # plumbing under test is the same: a track offered, answered, decoded, and the
+                # newest frame kept.
+                pc.addTrack(Stripes())
+
+                @channel.on("message")
+                def _on_call(text: str) -> None:
+                    call = _json.loads(text)
+                    calls.append(call["method"])
+                    answer = answers.get(call["method"])
+                    body = (
+                        {"result": answer}
+                        if answer is not None
+                        else {"error": {"code": -32601, "message": "no such method here"}}
+                    )
+                    channel.send(_json.dumps({"jsonrpc": "2.0", "id": call["id"], **body}))
+
+                await pc.setLocalDescription(await pc.createOffer())
+                await ws.send_json(
+                    {
+                        "type": "peer",
+                        "sessionId": "session-1",
+                        "sdp": {"type": "offer", "sdp": pc.localDescription.sdp},
+                    }
+                )
+            elif message["type"] == "peer" and message.get("sdp"):
+                assert pc is not None
+                await pc.setRemoteDescription(
+                    RTCSessionDescription(sdp=message["sdp"]["sdp"], type=message["sdp"]["type"])
+                )
+        return ws
+
+    application = web.Application()
+    application.router.add_get("/", producer)
+    runner = web.AppRunner(application)
+    await runner.setup()
+    await web.TCPSite(runner, "127.0.0.1", port).start()
+
+    rpc = Rpc(timeout=15)
+    consumer = LanConsumer("127.0.0.1", rpc, port)
+    await consumer.start()
+    try:
+        await _exercise(consumer, rpc, calls)
+    finally:
+        # Torn down whatever happened: a check that fails should print why, not print why and
+        # then bury it under "Unclosed client session".
+        await consumer.stop()
+        await runner.cleanup()
+    print("\nok — the protocol this file writes is the protocol a duck answers")
+
+
+async def _exercise(  # pragma: no cover - the body of the script above
+    consumer: LanConsumer, rpc: Rpc, calls: list[str]
+) -> None:
+    for _ in range(120):
+        if rpc.is_open():
+            break
+        await asyncio.sleep(0.25)
+
+    assert rpc.is_open(), f"no control channel: {consumer.error}"
+
+    for _ in range(80):
+        if consumer.latest_frame() is not None:
+            break
+        await asyncio.sleep(0.25)
+    frame = consumer.latest_frame()
+    assert frame is not None, "the control channel opened and no frame ever arrived"
+    identifier, picture = frame
+    assert picture.shape == (180, 320, 3), picture.shape
+    # `rgb24`, which is what their consumer promises `latest_frame`'s callers — so the red half
+    # has to come back red rather than blue, or the page shows a duck in the wrong colours.
+    # Dominance rather than equality: the codec is lossy, and pure red arrives as (251, 1, 0).
+    red, green, blue = (int(channel) for channel in picture[0, 0])
+    assert red > 200 and green < 40 and blue < 40, (red, green, blue)
+
+    print("session:", consumer.status())
+    print("meta:   ", consumer.meta)
+    print(f"frame:   #{identifier} {picture.shape} rgb, top-left {tuple(picture[0, 0])}")
+    print("call:   ", await asyncio.to_thread(rpc.call, "robot.policies"))
+    try:
+        await asyncio.to_thread(rpc.call, "robot.nonsense")
+    except Exception as e:  # noqa: BLE001 - the refusal is the thing being shown
+        print("refusal:", e)
+    assert calls == ["robot.policies", "robot.nonsense"], calls
+
+
+async def _ask(host: str) -> None:  # pragma: no cover - a script, not a test suite
+    """Open a lane to a real duck on this network and ask it two read-only questions.
+
+    Nothing here asks the robot to move: `robot.policies` and `robot.skills` are what it is
+    running and what it could be asked to do. It does take the robot's one session slot for a few
+    seconds, so its console cannot connect while this runs.
+    """
+    rpc = Rpc(timeout=20)
+    consumer = LanConsumer(host, rpc)
+    await consumer.start()
+    for _ in range(160):
+        if rpc.is_open():
+            break
+        await asyncio.sleep(0.25)
+    if not rpc.is_open():
+        print(f"\nno control channel: {consumer.error or consumer.status()}")
+        await consumer.stop()
+        return
+    print(f"\nrobot:  {consumer.meta}")
+    print(f"session: {consumer.status()}")
+    try:
+        for method in ("robot.policies", "robot.skills", "media.video"):
+            print(f"\n{method}:\n  {await asyncio.to_thread(rpc.call, method)}")
+    finally:
+        await consumer.stop()
+    print("\ndisconnected")
+
+
+if __name__ == "__main__":
+    import sys
+
+    logging.basicConfig(level=logging.INFO, format="%(name)-6s %(message)s")
+    if len(sys.argv) > 1:
+        # A real duck on this network: `uv run lan.py olducky.local`, or its IP.
+        asyncio.run(_ask(sys.argv[1]))
+    else:
+        # No argument: the loopback producer, which needs no robot at all.
+        logging.getLogger().setLevel(logging.WARNING)
+        asyncio.run(_selfcheck())
diff --git a/spaces/policy-shop/rendezvous.py b/spaces/policy-shop/rendezvous.py
new file mode 120000
index 00000000..044f900e
--- /dev/null
+++ b/spaces/policy-shop/rendezvous.py
@@ -0,0 +1 @@
+../shared/rendezvous.py
\ No newline at end of file
diff --git a/spaces/policy-shop/requirements.txt b/spaces/policy-shop/requirements.txt
new file mode 100644
index 00000000..589dae94
--- /dev/null
+++ b/spaces/policy-shop/requirements.txt
@@ -0,0 +1,23 @@
+# The consumer, and the WebRTC stack under it. The `central-consumer` extra is what pulls
+# `aiortc` and `av`: a robot never runs the consumer, so the base install leaves them out.
+#
+# **Unpinned deliberately, for now**, for the reason `vision-demo` gives: the drift that matters
+# here is between the consumer and a duck, and pinning a version whose DTLS shim we depend on
+# before knowing which versions work would pin the wrong thing. The first time this breaks, pin
+# it here with the version that worked.
+#
+# `control.py` subclasses `ReachyCentralConsumer` and overrides one private method, so this is
+# the dependency most likely to break silently across a version — the shim's docstring says what
+# the failure looks like and what makes it stop being needed.
+reachy_mini[central-consumer]
+
+# **`[oauth]`, not bare `gradio`.** `gr.LoginButton` needs `itsdangerous` and `authlib`, which
+# only the extra pulls in, and without them a Space with `hf_oauth: true` fails at *import* —
+# `Cannot initialize OAuth due to a missing library` — rather than at the first click. Nothing
+# about the page says which one is missing, so it is worth the four characters.
+gradio[oauth]>=5
+
+# Reading the Hub: `huggingface.co/api/models?search=microduck`, and a `manifest.json` per hit.
+# The same two requests `updater/src/policy.rs` makes, so the gallery and `policy.search` cannot
+# disagree about what exists.
+requests
diff --git a/spaces/policy-shop/wire.py b/spaces/policy-shop/wire.py
new file mode 120000
index 00000000..2db9e255
--- /dev/null
+++ b/spaces/policy-shop/wire.py
@@ -0,0 +1 @@
+../shared/wire.py
\ No newline at end of file
diff --git a/spaces/shared/control.py b/spaces/shared/control.py
new file mode 100644
index 00000000..f9b8faf2
--- /dev/null
+++ b/spaces/shared/control.py
@@ -0,0 +1,164 @@
+"""JSON-RPC 2.0 over whatever carries it: ids out, answers and notifications back.
+
+`duck-ipc-proto`'s own wire, one object per line — the same lines `robotctl` sends over a unix
+socket, the console page sends over a datachannel, and `mediad`'s control lane relays inside a
+`peer` envelope. Ids are handed out here and answers matched to them, which is what lets a Gradio
+callback block on one.
+
+**Transport-agnostic, and that is now load-bearing rather than tidy.** Three of them have been
+tried: a datachannel over the rendezvous, a datachannel on the LAN, and JSON-RPC relayed as HTTP
+with no WebRTC at all. Every one of them hands lines to this object and takes lines back, so none
+of the page above it changed when the first was replaced by the third.
+
+It once also held a shim over `ReachyCentralConsumer`, whose `pc.on("datachannel")` handler drops
+any label but `"data"` while `mediad` opens `"control"` — `remote-access-design.md` §5.1 records
+it, and it is still true of their client. It is gone because the transport that needed it is gone:
+a rendezvous session that has to negotiate ICE cannot connect from a data centre while §6 stands,
+so `wire.py` replaced it, and with it the only dependency this file had on another package's
+private method.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import itertools
+import json
+import logging
+import threading
+from concurrent.futures import Future
+from concurrent.futures import TimeoutError as FutureTimeout
+from typing import Any, Callable
+
+logger = logging.getLogger(__name__)
+
+# What `mediad` calls the channel it opens on every consumer's peer connection.
+CONTROL_LABEL = "control"
+
+
+class RpcError(Exception):
+    """A refusal from the robot, carrying the code it refused with.
+
+    Distinct from a transport failure on purpose: `policy.fetch` answering "obs_len 51, this
+    robot is 61" is the robot working correctly and is the most useful thing this Space can
+    show, while "no answer in 30s" means something else entirely.
+    """
+
+    def __init__(self, method: str, error: dict[str, Any]):
+        self.method = method
+        self.code = error.get("code")
+        self.message = error.get("message") or "refused, with nothing said about why"
+        super().__init__(f"{method}: {self.message}")
+
+
+class Rpc:
+    """Requests out, answers and notifications in, over one data channel.
+
+    Not a session and not a connection — those are the consumer's. This owns the id space and
+    the pending table, and it survives a channel closing: the futures are failed rather than
+    left for a caller to time out on one at a time.
+    """
+
+    def __init__(self, timeout: float = 30.0):
+        self.timeout = timeout
+        self._ids = itertools.count(1)
+        # The method rides along with the future so a refusal can name what was refused: a
+        # reply carries an id and nothing else, and "call: no such method" is a worse sentence
+        # than "robot.setSkill: no such method" for the sake of one tuple.
+        self._pending: dict[int, tuple[str, Future]] = {}
+        self._lock = threading.Lock()
+        self._send: Callable[[dict[str, Any]], bool] | None = None
+        # The last one of each notification. A duck streams `robot.state` at whatever rate it was
+        # asked for, so keeping them all is a leak and keeping the last is what a panel shows.
+        self.notifications: dict[str, Any] = {}
+
+    def bound_to(self, send: Callable[[dict[str, Any]], bool]) -> None:
+        self._send = send
+
+    def is_open(self) -> bool:
+        return self._send is not None
+
+    def call(
+        self, method: str, params: dict[str, Any] | None = None, timeout: float | None = None
+    ) -> Any:
+        """Send one request and wait for its answer.
+
+        Blocking, because every caller here is a Gradio callback with nothing else to do. The
+        timeout is not a budget on the robot's behalf: a promise nobody settles is a leak, and a
+        method that never answers is worth seeing rather than a panel that quietly stopped.
+        `policy.fetch` is the one call that wants its own — it is a download over the robot's
+        wifi, not a question about state.
+        """
+        budget = self.timeout if timeout is None else timeout
+        send = self._send
+        if send is None:
+            raise RpcError(method, {"message": "no control channel — connect first"})
+
+        call_id = next(self._ids)
+        future: Future = Future()
+        with self._lock:
+            self._pending[call_id] = (method, future)
+        logger.info("→ %s %s", method, json.dumps(params or {}))
+
+        if not send({"jsonrpc": "2.0", "id": call_id, "method": method, "params": params or {}}):
+            with self._lock:
+                self._pending.pop(call_id, None)
+            raise RpcError(method, {"message": "the control channel would not take the request"})
+
+        try:
+            return future.result(timeout=budget)
+        except FutureTimeout:
+            with self._lock:
+                self._pending.pop(call_id, None)
+            raise RpcError(
+                method, {"message": f"no answer in {budget:.0f}s"}
+            ) from None
+
+    def on_message(self, raw: Any) -> None:
+        """One line off the channel. Runs on the consumer's event loop, so it does not block."""
+        if isinstance(raw, bytes):
+            raw = raw.decode("utf-8", "replace")
+        try:
+            message = json.loads(raw)
+        except (TypeError, ValueError):
+            logger.warning("← unparseable: %s", str(raw)[:160])
+            return
+
+        call_id = message.get("id")
+        if call_id is None:
+            # A notification. `robot.state` streams, `media.video` arrives once when the channel
+            # opens, and `media.detections` a couple of times a second — none of them answer
+            # anything anybody asked for.
+            method = message.get("method")
+            if method:
+                self.notifications[method] = message.get("params")
+                # DEBUG, not INFO: `media.detections` arrives a couple of times a second and
+                # `robot.state` at whatever rate it was asked for, and a log that scrolls is a
+                # log nobody reads the top of.
+                logger.debug("← %s %s", method, json.dumps(message.get("params"))[:200])
+            return
+
+        with self._lock:
+            waiting = self._pending.pop(call_id, None)
+        if waiting is None:
+            # A duck does not correlate replies (`remote-webrtc.md` §5), so this is ordinary:
+            # a fire-and-forget intent's answer, or one that arrived after its timeout.
+            return
+        method, future = waiting
+        if "error" in message:
+            error = message["error"] or {}
+            logger.warning("← %s refused: %s", method, error.get("message"))
+            future.set_exception(RpcError(method, error))
+        else:
+            result = message.get("result")
+            logger.info("← %s %s", method, json.dumps(result)[:240])
+            future.set_result(result)
+
+    def abandon(self, why: str) -> None:
+        """Fail everything in flight. A closed channel answers nothing, ever."""
+        logger.info("control channel gone: %s", why)
+        with self._lock:
+            pending, self._pending = self._pending, {}
+            self._send = None
+        for method, future in pending.values():
+            if not future.done():
+                future.set_exception(RpcError(method, {"message": why}))
diff --git a/spaces/shared/rendezvous.py b/spaces/shared/rendezvous.py
new file mode 100644
index 00000000..47b60058
--- /dev/null
+++ b/spaces/shared/rendezvous.py
@@ -0,0 +1,156 @@
+"""Which robots an account can reach, and whether each one is busy.
+
+`GET /api/robot-status` with `Authorization: Bearer <hf token>`. Read off
+`pollen-robotics/reachy_mini_central`'s `app.py` rather than guessed, because a `401` from it was
+first mistaken here for something structural: the endpoint is `Depends(_resolve_hf_token)` and then
+`validate_hf_token`, which is one `whoami-v2` call and **no scope check, no token-type check and no
+requirement that the caller hold an event stream**. Its own docstring says what it is for — "render
+a passive status indicator without consuming a session slot" — filtered to `p.username ==
+username`, so an account sees its own robots and nobody else's.
+
+Which makes it the right call for a listing, and better than the console's route for one:
+`mediad/webclient/index.html` lists by opening `GET /events` and asking `list`, because a browser
+that is about to start a session needs the stream anyway. Peers are keyed by token, so a second
+`/events` on the same one supersedes the first (`remote-access-design.md` §3.7) — a page that
+listed that way could not refresh its list without dropping the session it was holding. This one
+opens nothing.
+
+**A `401` here means the token, and nothing else.** Worth stating plainly because the first thing
+that produced one was not a robot problem at all: run outside a Space, Gradio mocks its login and
+hands the app the literal string `mock-oauth-token-for-local-dev`, which `whoami-v2` refuses
+exactly as it should. `app.py`'s `token_of` is where that is dealt with.
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+from typing import Any
+
+import requests
+
+# The Space the mini's fleet registers with, and now ours: `mediad::relay::DEFAULT_RENDEZVOUS`.
+#
+# Written here rather than imported from `reachy_mini.media.central_consumer`, which is where it
+# was read from originally. One constant is not worth a dependency on `aiortc`, `av` and a WebRTC
+# stack in a Space that speaks only HTTP — and it made this module unimportable in the vision Space
+# for no reason. `REACHY_CENTRAL_URL` overrides it, the same name their own `from_env` reads.
+DEFAULT_CENTRAL_URL = os.environ.get(
+    "REACHY_CENTRAL_URL", "https://pollen-robotics-reachy-mini-central.hf.space"
+).rstrip("/")
+
+# `meta.kind`, which is on the wire so one client can list two families of robot without opening a
+# session to ask what it found. §5.1: their clients do not read it, this one does — an account with
+# a duck and a mini on it would otherwise offer either as a duck.
+DUCK = "microduck"
+
+TIMEOUT = 20
+
+
+logger = logging.getLogger(__name__)
+
+
+class RendezvousError(Exception):
+    """Something the person who pressed the button can act on."""
+
+
+class Robot:
+    """One producer as the rendezvous describes it."""
+
+    def __init__(self, entry: dict[str, Any]):
+        meta = entry.get("meta") or {}
+        self.peer_id: str = entry.get("peerId") or entry.get("id") or ""
+        self.name: str = meta.get("name") or entry.get("robotName") or "a robot with no name"
+        self.kind: str | None = meta.get("kind")
+        self.release: str = meta.get("release") or "release unknown"
+        self.busy: bool = bool(entry.get("busy"))
+        # Who has it, when it is busy. The rendezvous reports the *consumer's* name here, which
+        # is why this Space sends a `consumer_label` worth reading.
+        self.active_app: str | None = entry.get("activeApp")
+        self.age: float | None = entry.get("last_seen_age_seconds")
+
+    def label(self) -> str:
+        """What the dropdown shows: enough to choose by, and the reason not to.
+
+        `busy` matters more than it looks. One consumer at a time is the rendezvous's rule, so a
+        robot somebody's console is already watching will refuse a session — and a dropdown that
+        did not say so would make that look like a fault here.
+        """
+        bits = [self.name, self.release]
+        if self.busy:
+            bits.append(f"busy with {self.active_app or 'something'}")
+        if self.age is not None and self.age > 60:
+            bits.append(f"last heard from {self.age / 60:.0f} min ago")
+        return " — ".join(bits)
+
+
+def ducks(token: str, base: str = DEFAULT_CENTRAL_URL) -> tuple[list[Robot], list[str]]:
+    """This account's ducks, and the names of whatever else was listed.
+
+    Blocking: every caller is a Gradio callback with nothing else to do.
+    """
+    if not token:
+        raise RendezvousError("no token to ask with")
+
+    logger.info("GET %s/api/robot-status", base)
+    try:
+        answer = requests.get(
+            f"{base}/api/robot-status",
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=TIMEOUT,
+        )
+    except requests.RequestException as e:
+        raise RendezvousError(f"the rendezvous could not be reached: {e}") from None
+
+    logger.info("GET %s/api/robot-status -> HTTP %s", base, answer.status_code)
+    if answer.status_code == 401:
+        raise RendezvousError(
+            "the rendezvous refused this token — `whoami-v2` did not recognise it. On a Space, "
+            "sign in again. Running locally, Gradio's login button is a mock that hands the app "
+            "a placeholder string, so the token comes from `HF_TOKEN` or `hf auth login` "
+            "instead — the log line above says which one was used."
+        )
+    if answer.status_code == 429:
+        raise RendezvousError("the rendezvous is rate-limiting this token; wait a minute.")
+    if answer.status_code != 200:
+        raise RendezvousError(
+            f"the rendezvous answered HTTP {answer.status_code}: {answer.text[:200]}"
+        )
+    try:
+        listed = answer.json().get("robots") or []
+    except ValueError:
+        raise RendezvousError("the rendezvous answered something that is not JSON") from None
+
+    logger.info("%d producer(s) listed", len(listed))
+    ours, theirs = [], []
+    for entry in listed:
+        robot = Robot(entry)
+        logger.info(
+            "  %s kind=%s busy=%s peer=%s", robot.name, robot.kind, robot.busy, robot.peer_id[:8]
+        )
+        if not robot.peer_id:
+            continue
+        if robot.kind == DUCK:
+            ours.append(robot)
+        else:
+            theirs.append(f"{robot.name} ({robot.kind or 'no kind declared'})")
+    return ours, theirs
+
+
+if __name__ == "__main__":
+    import os
+    import sys
+
+    from huggingface_hub import get_token
+
+    logging.basicConfig(level=logging.INFO, format="%(name)s: %(message)s")
+    credential = os.environ.get("HF_TOKEN") or get_token()
+    if not credential:
+        sys.exit("no token: run `hf auth login`, or set HF_TOKEN")
+    try:
+        found, others = ducks(credential)
+    except RendezvousError as e:
+        sys.exit(str(e))
+    for duck in found:
+        print(f"  {duck.peer_id}  {duck.label()}")
+    print(f"\n{len(found)} duck(s)" + (f"; also listed: {', '.join(others)}" if others else ""))
diff --git a/spaces/shared/wire.py b/spaces/shared/wire.py
new file mode 100644
index 00000000..398e9898
--- /dev/null
+++ b/spaces/shared/wire.py
@@ -0,0 +1,406 @@
+"""JSON-RPC to a duck over the rendezvous, with no WebRTC in the path at all.
+
+The other two transports negotiate: they exchange SDP and ICE so the two ends can find a route
+between them, and then speak WebRTC over it. That works on one network, and across NATs it works
+*when a relay candidate exists* — which now it does (`remote-access-design.md` §6), but the
+control channel is hostage to it either way, because SCTP rides the same candidate pair as the
+media. A relay that is rate-limited, metered out, or briefly not answering takes the click with
+it, for a call whose whole payload is a few hundred bytes.
+
+This needs none of it. The rendezvous already relays what is wanted: `handle_peer_message` in its
+`app.py` forwards **every key of a `peer` envelope except `type` and `sessionId`** verbatim to the
+session partner, without looking at `sdp` or `ice`. So a `peer` envelope carrying an `rpc` key is a
+control call, and `mediad::relay`'s control lane answers it out of the same routing table and the
+same per-lane sockets the datachannel uses.
+
+    POST /send  {"type": "peer", "sessionId": S, "rpc": {"jsonrpc": "2.0", "id": 1, …}}
+    SSE         {"type": "peer", "sessionId": S, "rpc": {"jsonrpc": "2.0", "id": 1, "result": …}}
+
+Two HTTP verbs, one stream, and nothing a NAT can refuse. What it costs:
+
+**No video.** Pixels are RTP on the media path. Over this they would be base64 inside JSON at the
+rate limit below — a snapshot, not a stream — so this transport shows none, and the page says so.
+
+**It is not a teleop lane.** The rendezvous allows 1200 requests per 60 s per peer, and going over
+earns a `429` on everything that token does. The robot's lane budgets its own notifications for
+that reason (`NOTIFICATIONS_PER_WINDOW`); this side simply does not stream, and a click is four
+calls.
+
+**The peer is bound by the stream.** `POST /send` before `GET /events` is a 400 — identity comes
+from the bearer token and the stream is what binds it — so the stream opens first and everything
+else follows the `welcome`. Which is the same order `mediad::relay` uses on the robot's side, for
+the same reason.
+
+**And `startSession`'s answer is in the POST body**, not on the stream, which is the one shape a
+reader of this protocol gets wrong once. `list` is the same. Everything else arrives on the stream.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import json
+import logging
+import queue
+import threading
+from typing import Any
+
+import requests
+
+from rendezvous import DEFAULT_CENTRAL_URL
+
+logger = logging.getLogger(__name__)
+
+# Long enough for a Space's egress and a cold Space on the other end.
+CONNECT_TIMEOUT = 20
+# The SSE stream sends a comment ping every 30 s to hold itself open through its own proxy, so
+# silence for appreciably longer than that is a dead stream rather than a quiet one.
+READ_TIMEOUT = 90
+
+
+class WireError(Exception):
+    """Something the person pressing the button can act on."""
+
+
+class WsConsumer:
+    """One control-only session with one duck.
+
+    The surface is the other two consumers' — `start`, `stop`, `status`, `latest_frame`,
+    `send_command` — so `app.py` holds any of the three without knowing which. `latest_frame`
+    always answers `None` here, which is not a stub: there is no video on this transport, and a
+    page that showed the last frame of a *previous* session would be lying about what it is
+    looking at.
+    """
+
+    def __init__(self, token: str, peer_id: str, rpc: Any, base: str = DEFAULT_CENTRAL_URL,
+                 label: str = "microduck-policy-shop"):
+        self._token = token
+        self._peer_id = peer_id
+        self._rpc = rpc
+        self._base = base.rstrip("/")
+        self._label = label
+
+        # **Two sessions, because `requests.Session` is not thread-safe.** The pump thread holds
+        # a streaming `GET /events` open for the life of the connection while every call POSTs
+        # from whichever Gradio worker thread the click landed on. One shared connection pool
+        # across those two is a stream that loses messages — a reply that never arrives, or a
+        # `startSession` the far end never sees.
+        self._streaming = requests.Session()
+        self._posting = requests.Session()
+        self._stream: requests.Response | None = None
+        self._thread: threading.Thread | None = None
+        self._stop = threading.Event()
+
+        self._self_peer_id: str | None = None
+        self._session_id: str | None = None
+        self._welcome: queue.Queue[dict[str, Any]] = queue.Queue(maxsize=1)
+        self.meta: dict[str, Any] = {}
+        self.error: str | None = None
+
+    # ── the surface `app.py` uses ────────────────────────────────────────────
+
+    def start(self) -> None:
+        """Open the stream, register, and ask for a session.
+
+        Synchronous and blocking, because every step has to happen before the next one can and
+        because a caller with nothing to do while it waits is not made better by a coroutine.
+        """
+        self._open_stream()
+        self._thread = threading.Thread(target=self._pump, name="duck-wire", daemon=True)
+        self._thread.start()
+
+        try:
+            welcome = self._welcome.get(timeout=CONNECT_TIMEOUT)
+        except queue.Empty:
+            raise WireError(
+                "the rendezvous accepted the stream and never said hello"
+            ) from None
+        self._self_peer_id = welcome.get("peerId")
+        logger.info(
+            "welcome: peer %s, account %s",
+            (self._self_peer_id or "?")[:8],
+            welcome.get("username") or "unknown",
+        )
+
+        # A name in the listing, so the owner's other devices can see who holds the robot — the
+        # service reports a consumer's `meta.name` back as `activeApp`.
+        self._post({"type": "setPeerStatus", "roles": ["listener"], "meta": {"name": self._label}})
+
+        # **The session is what makes a `peer` envelope routable**: the service drops one naming a
+        # session it does not know. Nothing about it commits either end to WebRTC — no offer is
+        # sent, and the robot's control lane does not need one.
+        answer = self._post({"type": "startSession", "peerId": self._peer_id})
+        kind = (answer or {}).get("type")
+        if kind == "sessionRejected":
+            raise WireError(
+                "this duck is busy with "
+                f"{(answer or {}).get('activeApp') or 'something else'} — one consumer at a time, "
+                "and the robot's own console counts."
+            )
+        if kind == "error":
+            raise WireError(str((answer or {}).get("details") or "the rendezvous refused"))
+        if kind != "sessionStarted":
+            raise WireError(f"`startSession` answered {answer!r} rather than a session")
+        self._session_id = (answer or {}).get("sessionId")
+        logger.info("session %s open, control only", (self._session_id or "?")[:8])
+        self._rpc.bound_to(self.send_command)
+
+    def stop(self) -> None:
+        # Set first, so the pump reads it as deliberate rather than reporting a failed stream.
+        self._stop.set()
+        if self._session_id:
+            try:
+                self._post({"type": "endSession", "sessionId": self._session_id})
+            except WireError:
+                # A teardown that cannot be delivered still ends this side of the session, and the
+                # robot's lane is dropped by the service's own endSession broadcast either way.
+                pass
+        self._session_id = None
+        if self._stream is not None:
+            self._stream.close()
+            self._stream = None
+        self._streaming.close()
+        self._posting.close()
+
+    def status(self) -> dict[str, Any]:
+        return {
+            "connected": self._session_id is not None,
+            "self_peer_id": self._self_peer_id,
+            "robot_peer_id": self._peer_id,
+            "session_id": self._session_id,
+            # There is no peer connection, which is the whole point — so it is reported as the
+            # state it is in rather than left blank for a panel to interpret as a failure.
+            "pc_state": "connected" if self._session_id else None,
+            "frames": 0,
+            "transport": "the rendezvous, control only",
+        }
+
+    @staticmethod
+    def latest_frame() -> None:
+        return None
+
+    def send_command(self, envelope: dict[str, Any]) -> bool:
+        """One JSON-RPC object out, as a `peer` envelope. Thread-safe by having no shared state."""
+        if not self._session_id:
+            return False
+        try:
+            self._post({"type": "peer", "sessionId": self._session_id, "rpc": envelope})
+        except WireError as e:
+            logger.warning("a call could not be posted: %s", e)
+            return False
+        return True
+
+    # ── the wire ────────────────────────────────────────────────────────────
+
+    def _open_stream(self) -> None:
+        logger.info("GET %s/events", self._base)
+        try:
+            stream = self._streaming.get(
+                f"{self._base}/events",
+                headers={
+                    "authorization": f"Bearer {self._token}",
+                    "accept": "text/event-stream",
+                },
+                stream=True,
+                timeout=(CONNECT_TIMEOUT, READ_TIMEOUT),
+            )
+        except requests.RequestException as e:
+            raise WireError(f"the rendezvous could not be reached: {e}") from None
+        logger.info("GET %s/events -> HTTP %s", self._base, stream.status_code)
+        if stream.status_code == 401:
+            raise WireError("the rendezvous refused this token — `whoami-v2` did not know it.")
+        if stream.status_code != 200:
+            raise WireError(f"the event stream answered HTTP {stream.status_code}")
+        self._stream = stream
+
+    def _post(self, message: dict[str, Any]) -> dict[str, Any] | None:
+        """`POST /send`, returning the body when the service answers in it.
+
+        `startSession` and `list` are answered in the response body; everything else comes back on
+        the stream and answers `{"status": "ok"}` here. A reader that discards this body loses the
+        session id and then fails on the robot's offer for a session it was never told about —
+        which is a mistake the console page made first and documented.
+        """
+        redacted = {k: v for k, v in message.items() if k != "rpc"}
+        logger.info("→ %s %s", message.get("type"), json.dumps(redacted.get("rpc") or redacted)[:180])
+        try:
+            answer = self._posting.post(
+                f"{self._base}/send",
+                headers={"authorization": f"Bearer {self._token}"},
+                json=message,
+                timeout=CONNECT_TIMEOUT,
+            )
+        except requests.RequestException as e:
+            raise WireError(f"POST /send: {e}") from None
+        if answer.status_code == 429:
+            raise WireError(
+                "the rendezvous is rate-limiting this token (1200 requests a minute). "
+                "Something is streaming over a lane that is not for streaming."
+            )
+        if answer.status_code == 400:
+            raise WireError(
+                "the rendezvous says this peer does not exist — its event stream is gone. "
+                "Disconnect and connect again."
+            )
+        if answer.status_code != 200:
+            raise WireError(f"POST /send answered HTTP {answer.status_code}: {answer.text[:200]}")
+        try:
+            body = answer.json()
+        except ValueError:
+            return None
+        if isinstance(body, dict) and body.get("type"):
+            logger.info("← (body) %s", json.dumps(body)[:200])
+            return body
+        return None
+
+    def _pump(self) -> None:
+        """Read the stream, hand `rpc` payloads to `Rpc`, and remember the welcome.
+
+        **CRLF normalised on arrival, because the framing is not ours.** SSE permits `\\r\\n` and a
+        proxy is free to rewrite them; splitting on `\\n\\n` alone then matches nothing and every
+        message is swallowed in silence — a stream that looks connected and says nothing.
+        """
+        assert self._stream is not None
+        buffer = ""
+        try:
+            for chunk in self._stream.iter_content(chunk_size=None):
+                if self._stop.is_set():
+                    return
+                buffer += chunk.decode("utf-8", "replace").replace("\r\n", "\n")
+                while "\n\n" in buffer:
+                    frame, _, buffer = buffer.partition("\n\n")
+                    data = "".join(
+                        line[len("data:") :].strip()
+                        for line in frame.split("\n")
+                        if line.startswith("data:")
+                    )
+                    if data:
+                        self._handle(data)
+        except Exception as e:  # noqa: BLE001 - see below; a reader cannot pick its exception
+            # **Broad on purpose, and the breadth is the point.** `stop` closes the response while
+            # this thread is blocked inside `iter_content`, and what comes out of that is not a
+            # `RequestException`: it is whatever urllib3 was in the middle of — a `ProtocolError`,
+            # a closed-socket `ValueError`, an `AttributeError` on a released connection. Catching
+            # only the polite one printed `Exception in thread duck-wire` after every clean
+            # disconnect, which is a traceback that says a bug where there is none, next to the
+            # word "disconnected".
+            if not self._stop.is_set():
+                self.error = f"the event stream failed: {type(e).__name__}: {e}"
+                logger.warning("%s", self.error)
+            else:
+                logger.debug("the event stream closed on teardown: %r", e)
+        finally:
+            if not self._stop.is_set():
+                self.error = self.error or "the rendezvous closed the event stream"
+                self._rpc.abandon(self.error)
+
+    def _handle(self, data: str) -> None:
+        try:
+            message = json.loads(data)
+        except ValueError:
+            logger.warning("← unparseable frame: %s", data[:160])
+            return
+
+        kind = message.get("type")
+        if kind == "welcome":
+            # A second welcome supersedes nothing here: the queue holds the first, which is the
+            # one `start` is waiting on.
+            with contextlib.suppress(queue.Full):
+                self._welcome.put_nowait(message)
+            return
+
+        if kind == "peer":
+            payload = message.get("rpc")
+            if payload is None:
+                # An `sdp` or an `ice`: the robot's media path answering a negotiation this
+                # transport never started. Nothing here can use it, and it is not an error.
+                logger.debug("← a peer envelope with no rpc; ignoring it")
+                return
+            self._rpc.on_message(json.dumps(payload))
+            return
+
+        if kind in ("endSession", "sessionRejected"):
+            self.error = (
+                f"the session ended: {message.get('reason') or 'no reason given'}"
+            )
+            logger.info("← %s", json.dumps(message)[:200])
+            self._session_id = None
+            self._rpc.abandon(self.error)
+            return
+
+        logger.debug("← %s", json.dumps(message)[:200])
+
+
+def connect(token: str, peer_id: str, rpc: Any, label: str) -> WsConsumer:
+    consumer = WsConsumer(token, peer_id, rpc, label=label)
+    consumer.start()
+    return consumer
+
+
+if __name__ == "__main__":
+    # ── checking the lane against the real rendezvous and a real duck ─────────
+    #
+    # `uv run wire.py` — no Gradio, no browser, and read-only calls: it asks the robot what it is
+    # running and what it can do, and asks for nothing to move. Which makes it the thing to run
+    # first when a click does not work, because it isolates the transport from everything else on
+    # the page.
+    #
+    # A timeout here has exactly one likely cause and the message says so: the envelope crossed
+    # the rendezvous and the robot did not answer it, which is a `mediad` without the control
+    # lane. That was every duck until this branch is installed on one.
+    import logging as _logging
+    import os
+    import sys
+
+    import rendezvous
+    from control import Rpc, RpcError
+    from huggingface_hub import get_token
+
+    _logging.basicConfig(level=_logging.INFO, format="%(name)-10s %(message)s")
+
+    credential = os.environ.get("HF_TOKEN") or get_token()
+    if not credential:
+        sys.exit("no token: run `hf auth login`, or set HF_TOKEN")
+
+    wanted = sys.argv[1] if len(sys.argv) > 1 else None
+    try:
+        found, others = rendezvous.ducks(credential)
+    except rendezvous.RendezvousError as e:
+        sys.exit(str(e))
+    if not found:
+        sys.exit(f"no ducks online for this account{f'; also listed: {others}' if others else ''}")
+
+    duck = next((d for d in found if wanted in (d.name, d.peer_id)), None) if wanted else found[0]
+    if duck is None:
+        sys.exit(f"no duck called {wanted!r}; found {[d.name for d in found]}")
+    print(f"\n{duck.label()}\n  peer {duck.peer_id}\n")
+    if duck.busy:
+        sys.exit("it is busy — one consumer at a time, and the robot's own console counts.")
+
+    # Shorter than the page's, because a person is watching this one.
+    rpc = Rpc(timeout=15)
+    consumer = WsConsumer(credential, duck.peer_id, rpc, label="microduck-policy-shop/wire-check")
+    try:
+        consumer.start()
+    except WireError as e:
+        sys.exit(f"\ncould not open the lane: {e}")
+
+    try:
+        for method in ("robot.policies", "robot.skills"):
+            try:
+                print(f"\n{method}:\n  {rpc.call(method)}")
+            except RpcError as e:
+                if "no answer in" in e.message:
+                    print(
+                        f"\n{method}: no answer.\n\n"
+                        "  The envelope crossed the rendezvous — the session opened, so the robot "
+                        "is\n  listening — and nothing answered it. That is a `mediad` without the "
+                        "control\n  lane: it reads a `peer` envelope carrying `rpc` as a step of a "
+                        "negotiation it\n  has no session for, and drops it. Install this branch on "
+                        "the board:\n\n    scripts/dev-push.sh --name "
+                        f"{duck.name}\n"
+                    )
+                    break
+                print(f"\n{method}: refused — {e.message}")
+    finally:
+        consumer.stop()
+        print("\ndisconnected")
diff --git a/spaces/vision-demo/Dockerfile b/spaces/vision-demo/Dockerfile
new file mode 100644
index 00000000..97df3da0
--- /dev/null
+++ b/spaces/vision-demo/Dockerfile
@@ -0,0 +1,68 @@
+# A Docker Space, because FastAPI owns the server here: the robot's frames arrive on a WebSocket
+# route of ours, with Gradio mounted underneath it. `remote-access-design.md` §5.0 has the other
+# reason a Space in this project ends up as Docker.
+#
+# **The user is `user` at `/home/user`, and that is not a preference.** Hugging Face appends its
+# own layers to a Docker Space's build — a dev-mode init process, an openvscode-server, a
+# `git config --global` — and they assume the canonical uid-1000 `user` with a writable
+# `/home/user`. Naming it `duck` and putting `HOME` elsewhere built fine locally and failed in
+# their builder with `exit code 1` under a page of cache-miss noise, which names no step at all.
+FROM python:3.12-slim
+
+# As root, before dropping privileges.
+#
+# `libgl1` and `libglib2.0-0` are what `opencv-python-headless` still links against — headless
+# drops the GUI toolkit, not the whole of GL.
+#
+# **`git` is for Hugging Face, not for us.** Their builder appends layers to every Docker Space,
+# and one of them is `git config --global user.email …`. A `-slim` base has no git, so that layer
+# dies with `exit code: 127` *after* the whole image has built successfully — and the error the
+# API reports for it is a page of cache-miss noise naming one of their own steps, which is not
+# something anybody guesses from. This line is the fix.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends git libgl1 libglib2.0-0 \
+ && rm -rf /var/lib/apt/lists/*
+
+RUN useradd -m -u 1000 user
+USER user
+ENV HOME=/home/user \
+    PATH=/home/user/.local/bin:$PATH \
+    PYTHONUNBUFFERED=1
+
+# Ruled out explicitly rather than left to the environment, and on its own line because a comment
+# inside a line continuation is not something to gamble a build on. Gradio's server-side rendering
+# starts a **Node** server of its own and this image has no Node, so a platform that sets
+# `GRADIO_SSR_MODE=true` would have `mount_gradio_app` try to launch one. SSR buys SEO for a page
+# that sits behind a sign-in, which is nothing worth a second process for.
+ENV GRADIO_SSR_MODE=false
+
+# **`SYSTEM=spaces`, and this one line is what four rounds of debugging were about.**
+#
+# Gradio decides whether it is running on a Space with `get_space()`, which is
+# `os.getenv("SYSTEM") == "spaces"` and then `SPACE_ID` — *not* `SPACE_ID` alone. Hugging Face
+# sets `SYSTEM=spaces` for gradio-SDK Spaces and **not** for Docker ones, so on a Docker Space
+# Gradio concludes it is on somebody's laptop: `attach_oauth` installs its *mocked* login routes,
+# and the mock calls `_get_mocked_oauth_info()`, which raises without a local `hf auth login`.
+# A container has none, so the module fails at import, uvicorn never binds, and the platform
+# reports "App process crashed" — while the UI you can see for a second is the previous container
+# still serving.
+#
+# `SPACE_ID` and `OAUTH_CLIENT_ID` were both set the whole time. The only thing missing was this.
+ENV SYSTEM=spaces
+WORKDIR $HOME/app
+
+# Requirements first, so a change to the app does not reinstall `av` and OpenCV.
+COPY --chown=user requirements.txt $HOME/app/
+RUN pip install --no-cache-dir --user -r requirements.txt
+
+COPY --chown=user . $HOME/app
+
+# `app_port` in the README metadata has to agree with this.
+EXPOSE 7860
+
+# **`boot.py`, which serves the app or serves the reason it would not import.** A container that
+# exits is reported as "App process crashed" with a truncated first line, and reading a Space's own
+# logs needs write access to it — so a broken import cost a round trip through a pasted traceback
+# every time. This way the Space stays up and `curl /` answers the question. Its header has the
+# reasoning; `app.py`'s `__main__` block stays for laptops.
+CMD ["python", "boot.py"]
diff --git a/spaces/vision-demo/README.md b/spaces/vision-demo/README.md
new file mode 100644
index 00000000..cf2f3756
--- /dev/null
+++ b/spaces/vision-demo/README.md
@@ -0,0 +1,114 @@
+---
+title: microduck vision demo
+emoji: 🦆
+colorFrom: yellow
+colorTo: indigo
+sdk: docker
+app_port: 7860
+pinned: false
+hf_oauth: true
+short_description: A duck's camera, processed on Hugging Face hardware.
+---
+
+# microduck vision demo
+
+A robot on somebody's home network streams its camera to this Space as H.264, and OpenCV runs
+over each decoded frame here. Nothing is on the robot's network and no relay is involved.
+
+**Do not edit this Space directly.** The source is `spaces/vision-demo/` in
+`pollen-robotics/microduck`, and `scripts/publish-space.sh vision-demo` is what puts it here.
+
+## The robot dials us, and that is the whole design
+
+Pulling the camera through the rendezvous means WebRTC, and WebRTC between a robot behind a home
+router and a container in a data centre needs a **relay candidate** to fall back on. For this
+Space's whole history there was none — the relay default every robot shipped with named a host
+with no DNS behind it — and "signalling worked and media did not" was its documented expected
+outcome. That default is fixed (`remote-access-design.md` §6), and inverting the direction is
+still what this Space wants: a relay spends the robot owner's metered allowance on every frame,
+and these frames are only ever decoded by a program.
+
+So the direction is inverted:
+
+```
+this Space ──media.stream {url: "wss://…/frames"}──► rendezvous ──► the duck
+the duck   ═════════ H.264, outbound wss, direct ═════════════════►  this Space
+```
+
+An outbound WebSocket is the one thing that always works — the robot is already holding one to a
+Space every second it is reachable, which is how it appears in your robot list at all. NAT stops
+being a participant, no credentials proxy has to exist, and **the rendezvous carries an instruction
+rather than pixels**, which is what makes this scale where relaying payload through a service the
+mini fleet depends on would not.
+
+`media.stream` is the call, answered by `mediad` itself (`mediad/src/stream.rs`), and it reads
+three ways off one key: a `url` starts a stream, `url: null` stops it, and no `url` asks what is
+streaming.
+
+## What that costs
+
+**No return media path.** This cannot drive the robot or watch it in real time; a viewer wants
+WebRTC and §6 is still what that needs. This is for the case where the consumer is a program.
+
+**A few frames a second, not thirty.** Five at 640 px is plenty for a model and a fraction of the
+encode the video track is already doing. The rate is imposed on the robot by a `videorate` in the
+branch rather than by the receiver asking politely.
+
+**H.264, with JPEG still reachable.** The board has a hardware encoder, so H.264 costs the VPU
+rather than a core, and inter-frame prediction is worth a lot of bytes: on synthetic frames it
+measured 0.5 KB against JPEG's 6.5 KB, and real camera footage will be less dramatic than that but
+the same direction. What it costs is that a receiver cannot decode anything until a keyframe
+arrives, and a dropped unit corrupts every unit after it until the next one. Both are handled
+rather than hoped about — `mediad` asks its encoder for a keyframe the moment the valve opens,
+repeats SPS/PPS in front of every keyframe, and abandons the stream to the next keyframe rather
+than sending across a gap. `media.stream {"encoding": "jpeg"}` is the other option, for a receiver
+that reconnects often enough to care more about starting instantly than about bandwidth.
+
+**Frames arrive upright.** The pipeline's turn happens before the tee, so both the video track and
+this branch carry an upright picture and the hello says `rotate: 0` with the mount angle beside it
+for information. `filters.upright` is therefore unused here, and kept because it is still right
+for a WebRTC consumer, which is told the angle and turns the picture itself.
+
+## Whose camera this is
+
+The frame endpoint is public — a Space's URL is a Space's URL — so the robot presents **its own
+account token** on the handshake and this resolves it through `whoami-v2`, exactly as the
+rendezvous does. Frames are filed under the username it answers with, and a visitor is shown only
+their own account's robots. Without that, anybody could push frames into the demo and, worse, a
+visitor could be shown a stranger's camera. The token is resolved once per connection and never
+stored.
+
+## Running it yourself
+
+Once:
+
+```bash
+uv venv && uv pip install -r requirements.txt
+```
+
+Then:
+
+```bash
+DUCK_RECEIVER=ws://192.168.1.50:7860/frames uv run app.py
+```
+
+`DUCK_RECEIVER` has to be an address **the robot can reach** — your machine's address on the
+robot's network, not `localhost`. On a Space it is derived from `SPACE_HOST` and needs no setting.
+`HF_TOKEN` or what `hf auth login` stored stands in for the sign-in button, which is mocked outside
+a Space.
+
+## Why this is a Docker Space
+
+FastAPI owns the server and Gradio is mounted into it, because the frames arrive on a WebSocket
+route of our own. That is the documented direction — the reverse, adding routes to Gradio's app,
+has known WebSocket breakage — and running `uvicorn` ourselves removes any question about whether
+the platform will carry a custom route. `microduck-console` is a Docker Space for an unrelated
+reason (§5.0), so this is the second.
+
+## There is no WebRTC stack in here any more
+
+It used to pull frames with `reachy_mini[central-consumer]`, which meant `aiortc`, `av`, and a DTLS
+cipher shim over one of their private methods — and which could never connect from a data centre.
+The robot dials us now, so what is left is `gradio`, `fastapi`, `opencv`, `requests` and `av`. That
+last one is back for H.264, and it is a decoder rather than a transport: no ICE, no DTLS, no
+signalling, nothing that a NAT gets a vote on.
diff --git a/spaces/vision-demo/app.py b/spaces/vision-demo/app.py
new file mode 100644
index 00000000..dc4f65b8
--- /dev/null
+++ b/spaces/vision-demo/app.py
@@ -0,0 +1,502 @@
+"""A duck's camera, processed on Hugging Face hardware — with the robot doing the dialling.
+
+The robot is behind somebody's router and this runs in a container in a data centre. The obvious
+way to join them is the one this Space used to take: a WebRTC consumer pulls the stream through
+`reachy_mini_central`. That ran into the one thing WebRTC cannot do unaided — a relay candidate —
+and the relay default every robot shipped with pointed at a name with no DNS behind it, so
+signalling crossed and media never did, from every Space, every time. That default is fixed
+(`docs/design/remote-access-design.md` §6) and this design is still the right one: a relay costs
+somebody's bandwidth, metered against the robot owner's Hugging Face allowance, for every frame
+of a stream only a program is going to look at.
+
+**So the direction is inverted and the problem disappears.** The rendezvous is used for one small
+thing — telling the robot where to send frames — and the frames come **outbound from the robot** to
+a WebSocket on this Space. A robot dialling out is the one thing that always works; it is doing it
+right now to stay reachable at all. NAT stops being a participant, no relay is needed, and the
+rendezvous carries an instruction rather than pixels, which is also why this scales where relaying
+payload through a shared service would not.
+
+    this Space ──media.stream {url: "wss://…/frames"}──► rendezvous ──► the duck
+    the duck   ═════════ JPEG frames, outbound wss, direct ═════════►  this Space
+
+Two consequences worth knowing. There is **no return media path**, so this cannot drive the robot
+or speak to it except through the control lane above — which is enough to start and stop a stream
+and to ask what the robot is doing. And the frames are **upright already**: `mediad` turns them
+while converting, because that conversion is a per-pixel loop either way and what receives them is
+a model that wants the picture the way up it was trained on.
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+import sys
+import time
+from collections import deque
+from typing import Any
+
+import gradio as gr
+import numpy as np
+from fastapi import FastAPI
+
+# `spaces/shared`, flattened beside this file at publish time by `scripts/publish-space.sh`.
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+import receiver
+import rendezvous
+from control import Rpc, RpcError
+from filters import FILTERS
+from rendezvous import RendezvousError
+from wire import WireError, WsConsumer
+
+ON_A_SPACE = bool(os.environ.get("SPACE_ID"))
+
+# **Whether to ask Gradio for a sign-in button at all**, and it is not a style choice.
+#
+# A `gr.LoginButton` sets `blocks.expects_oauth`, which makes Gradio call `attach_oauth` while the
+# Blocks is being *built* — at import, before anything serves. That then does one of two things,
+# and both raise in a container:
+#
+# - `SPACE_ID` absent → the *mocked* routes, whose `_get_mocked_oauth_info()` needs a local
+#   `hf auth login`. A container has none: `ValueError: Your machine must be logged in to HF`.
+# - `SPACE_ID` present but `OAUTH_CLIENT_ID` absent → the real routes, which raise
+#   `OAUTH_CLIENT_ID environment variable is not set`.
+#
+# Either way uvicorn never binds, and Hugging Face reports an exiting container as "App process
+# crashed" — with the UI apparently visible for a second, because the *previous* container was
+# still serving it. That cost four rounds of blaming the port.
+#
+# The condition is therefore the variable Gradio actually needs, read from inside the container
+# (`/env` on the hello Space is how this was established rather than guessed): OAuth is available
+# when the platform provisioned it, which needs `hf_oauth: true` in the README *and* a Space that
+# has rebuilt since. When it has not, a token box takes the button's place and the page still
+# works — which is the property worth having, because this is exactly the state a freshly
+# recreated Space is in.
+OAUTH_AVAILABLE = bool(os.environ.get("OAUTH_CLIENT_ID"))
+
+LEVEL = os.environ.get("DUCK_LOG", "INFO").upper()
+
+
+class Ring(logging.Handler):
+    """The last few hundred log lines, for a panel on the page.
+
+    **A Space's logs are on a page only its owner can open**, and reading them needs write access
+    to the Space — so "click the button and tell me what it said" was a round trip through
+    somebody's screenshot. The panel shows what the container's stderr shows, to whoever is
+    already looking at the thing that failed. `policy-shop` has the same handler for the same
+    reason.
+    """
+
+    def __init__(self, size: int = 400):
+        super().__init__()
+        self.lines: deque[str] = deque(maxlen=size)
+
+    def emit(self, record: logging.LogRecord) -> None:
+        try:
+            self.lines.append(self.format(record))
+        except Exception:  # noqa: BLE001 - a logger that raises is worse than a line lost
+            pass
+
+
+RING = Ring()
+RING.setFormatter(logging.Formatter("%(asctime)s %(name)-10s %(message)s", datefmt="%H:%M:%S"))
+logging.basicConfig(
+    level=LEVEL, format="%(asctime)s %(levelname)-5s %(name)-10s %(message)s", datefmt="%H:%M:%S"
+)
+logging.getLogger().addHandler(RING)
+for chatty in ("urllib3", "httpx", "requests"):
+    logging.getLogger(chatty).setLevel(logging.WARNING)
+logger = logging.getLogger("vision")
+
+# Which of the platform's variables actually arrived. The absence of `SPACE_ID` is what decides
+# whether a sign-in button can exist at all, so it is worth one line at startup rather than a
+# traceback later.
+logger.info(
+    "environment: SPACE_ID=%s SPACE_HOST=%s OAUTH_CLIENT_ID=%s -> sign-in %s",
+    "set" if os.environ.get("SPACE_ID") else "absent",
+    os.environ.get("SPACE_HOST") or "absent",
+    "set" if os.environ.get("OAUTH_CLIENT_ID") else "absent",
+    "available" if os.environ.get("OAUTH_CLIENT_ID") else "unavailable; using the token box",
+)
+
+PORT = int(os.environ.get("PORT", 7860))
+
+# Where the robot is told to send frames. Derived rather than configured, because a wrong url here
+# is a robot streaming into nowhere with nothing anywhere to say so.
+#
+# On a Space, `SPACE_HOST` is the Space's own hostname and `wss://` is the only thing that will
+# work through the platform's proxy. Locally the default is loopback, because the common local case
+# is `fake_duck.py` on this same machine — and loopback is then exactly right. A *real* robot is on
+# another machine, so it needs this host's address on the robot's network instead, which is what
+# the box on the page is for.
+def default_receiver() -> str:
+    if os.environ.get("DUCK_RECEIVER"):
+        return os.environ["DUCK_RECEIVER"]
+    if os.environ.get("SPACE_HOST"):
+        return f"wss://{os.environ['SPACE_HOST']}/frames"
+    return f"ws://127.0.0.1:{PORT}/frames"
+
+
+RECEIVER_URL = default_receiver()
+
+# What to ask the robot for. Five a second is plenty for a model and cheap on a board that is also
+# running a control loop; 640 keeps a frame around 40 KB at quality 70.
+FPS = float(os.environ.get("DUCK_FPS", "5"))
+LONGEST = int(os.environ.get("DUCK_LONGEST", "640"))
+QUALITY = int(os.environ.get("DUCK_QUALITY", "70"))
+
+
+class Link:
+    """The control lane to one duck: enough to start a stream and to stop it.
+
+    No media rides this — that is the point — so it is two HTTP verbs and an SSE stream, and it
+    survives every NAT the WebRTC version did not.
+    """
+
+    def __init__(self) -> None:
+        self.consumer: WsConsumer | None = None
+        self.rpc: Rpc | None = None
+        self.robot: str | None = None
+
+    def connect(self, token: str, peer_id: str, name: str) -> str:
+        self.disconnect()
+        rpc = Rpc(timeout=20)
+        consumer = WsConsumer(
+            token, peer_id, rpc, label=f"microduck-vision-demo/{os.environ.get('SPACE_ID', 'local')}"
+        )
+        try:
+            consumer.start()
+        except WireError as e:
+            return f"**could not reach {name}:** {e}"
+        self.consumer, self.rpc, self.robot = consumer, rpc, name
+        return f"**connected to {name}.** Now tell it where to send frames."
+
+    def disconnect(self) -> str:
+        consumer, self.consumer, self.rpc, self.robot = self.consumer, None, None, None
+        if consumer is None:
+            return "not connected"
+        try:
+            consumer.stop()
+        except Exception as e:  # noqa: BLE001 - a teardown that fails still ends this side
+            return f"disconnected, with a complaint: {e}"
+        return "disconnected"
+
+    def call(self, method: str, params: dict[str, Any] | None = None) -> Any:
+        if self.rpc is None:
+            raise RpcError(method, {"message": "not connected to a duck"})
+        return self.rpc.call(method, params)
+
+
+LINK = Link()
+
+# The frame id last handed to the browser. **Re-sending an unchanged picture is what made Safari
+# complain**: the stream is five frames a second and the timer polled ten times a second, so half
+# the responses re-encoded a picture the page already had — and every one of those is a PNG plus a
+# markdown blob for Safari's client to parse. `gr.skip()` leaves a component untouched, so a tick
+# with no new frame sends nothing at all.
+LAST_SENT: dict[str, int] = {}
+
+
+def token_of(typed: str | None, oauth: gr.OAuthToken | None) -> str:
+    """A visitor's token, and never a mocked one.
+
+    Outside a Space, Gradio mocks its own login and hands the app the literal string
+    `mock-oauth-token-for-local-dev`, which every service correctly refuses. `HF_TOKEN` or what
+    `hf auth login` stored is what a local run uses instead.
+    """
+    if typed and typed.strip():
+        logger.info("token: the one typed into the page")
+        return typed.strip()
+    if oauth is not None and oauth.token and oauth.token != "mock-oauth-token-for-local-dev":
+        logger.info("token: the visitor's Hugging Face sign-in")
+        return oauth.token
+    from huggingface_hub import get_token
+
+    stored = (os.environ.get("HF_TOKEN") or get_token() or "").strip()
+    logger.info("token: %s", "a locally stored one" if stored else "none")
+    return stored
+
+
+def find(typed: str, oauth: gr.OAuthToken | None) -> tuple[Any, str]:
+    token = token_of(typed, oauth)
+    if not token:
+        return gr.update(choices=[]), (
+            "sign in with Hugging Face, or paste a token above."
+            if OAUTH_AVAILABLE
+            else "paste a Hugging Face token above — this Space has no sign-in available."
+        )
+    try:
+        ducks, others = rendezvous.ducks(token)
+    except RendezvousError as e:
+        return gr.update(choices=[]), f"**{e}**"
+    if not ducks:
+        extra = f" Also listed: {', '.join(others)}." if others else ""
+        return gr.update(choices=[]), (
+            "no ducks online for this account. A duck registers once it has been signed in "
+            f"(`robotctl account login`) and has a network.{extra}"
+        )
+    return (
+        gr.update(choices=[(d.label(), d.peer_id) for d in ducks], value=ducks[0].peer_id),
+        f"{len(ducks)} duck(s). Connect, then start the stream.",
+    )
+
+
+def connect(peer_id: str | None, typed: str, oauth: gr.OAuthToken | None) -> str:
+    if not peer_id:
+        return "pick a duck first — press *find my ducks*."
+    token = token_of(typed, oauth)
+    if not token:
+        return "sign in with Hugging Face, or set `HF_TOKEN`."
+    return LINK.connect(token, peer_id, peer_id[:8])
+
+
+def start(url: str, fps: float, longest: int) -> str:
+    """`media.stream` — the one call this whole Space is arranged around."""
+    url = (url or "").strip()
+    if not url:
+        return "**no receiver url.** The box beside the button is where the robot is told to send."
+    if not url.startswith(("ws://", "wss://")):
+        return f"**`{url}` is not a ws:// or wss:// url**, so the robot will refuse it."
+    if "127.0.0.1" in url or "localhost" in url:
+        # Right for `fake_duck.py` on this machine, and wrong for anything else — a real robot's
+        # loopback is its own, so it would dial itself and find nothing.
+        logger.info("the receiver is loopback, which only a duck on this machine can reach")
+
+    try:
+        answer = LINK.call(
+            "media.stream",
+            # `quality` is JPEG's, and H.264 is the default — the bitrate is the pipeline's, so
+            # there is no knob here worth putting on the page.
+            {"url": url, "fps": fps, "longest": int(longest), "quality": QUALITY},
+        )
+    except RpcError as e:
+        return f"**`media.stream` refused:** {e.message}"
+    logger.info("media.stream accepted: %s", answer)
+    note = (
+        f"**streaming to `{url}`** at {fps:g} fps, {int(longest)} px. Frames should appear within "
+        "a second or two."
+    )
+    if ("127.0.0.1" in url or "localhost" in url) and not ON_A_SPACE:
+        note += (
+            " That address is loopback, so it only works for a duck running on this machine — "
+            "`fake_duck.py`. A robot elsewhere needs this host's address on *its* network."
+        )
+    return note
+
+
+def stop() -> str:
+    try:
+        LINK.call("media.stream", {"url": None})
+    except RpcError as e:
+        return f"**could not stop it:** {e.message}"
+    return "**stopped.** The robot is no longer sending frames."
+
+
+def render(filter_name: str, oauth: gr.OAuthProfile | None) -> tuple[Any, str]:
+    """The newest frame from this visitor's own robot, processed.
+
+    **Filed by account, so a visitor sees their own duck.** The receiver resolves the token the
+    robot connected with, and this reads only that account's streams — which is what makes a
+    public Space carrying somebody's camera defensible at all.
+    """
+    who = getattr(oauth, "username", None) or os.environ.get("DUCK_ACCOUNT", "")
+    if not who:
+        return None, "sign in to see your robot's frames."
+
+    stream = receiver.FRAMES.newest(who)
+    if stream is None:
+        LAST_SENT.pop(who, None)
+        return None, (
+            "**no stream yet.** Connect to a duck and press *start streaming*. If it was already "
+            "streaming, the robot may still be redialling — a Space restarts on every push, and "
+            "the robot backs off before trying again."
+        )
+    if stream.picture is None:
+        # Ordinary for the first moment of an H.264 stream: the decoder has nothing to predict
+        # from until a keyframe arrives. Saying which of the two states this is saves somebody
+        # deciding the Space is broken.
+        waiting = (
+            f"{stream.undecoded} unit(s) arrived and produced no picture yet — normal for the "
+            "first moment of an H.264 stream, which cannot decode anything before a keyframe."
+            if stream.undecoded
+            else "the stream opened and nothing has arrived on it."
+        )
+        note = f"**{stream.robot}:** {waiting}"
+        if stream.last_error:
+            note += f" Last decode error: {stream.last_error}"
+        return None, note
+
+    # Nothing new since the last tick: say so rather than re-encoding the same frame. The filter
+    # is part of the identity — switching filters has to redraw even when the frame has not moved.
+    fingerprint = stream.frames * 1000 + (hash(filter_name) % 1000)
+    if LAST_SENT.get(who) == fingerprint:
+        return gr.skip(), gr.skip()
+    LAST_SENT[who] = fingerprint
+
+    picture = stream.picture
+    processed = FILTERS.get(filter_name, FILTERS["raw"])(picture, None)
+    age = time.monotonic() - stream.last_at
+    encoding = (stream.hello.get("frames") or {}).get("encoding", "?")
+    per_frame = stream.bytes_in / stream.frames if stream.frames else 0
+    note = (
+        f"**{stream.robot}** — {stream.frames} frames, {stream.fps:.1f}/s, "
+        f"{picture.shape[1]}×{picture.shape[0]}, {encoding}, "
+        f"{per_frame / 1024:.0f} KB/frame, {stream.bytes_in / 1e6:.1f} MB in"
+    )
+    if stream.stale:
+        note += f". **Nothing for {age:.0f}s** — the robot stopped sending, or its wifi went."
+    return processed, note
+
+
+with gr.Blocks(title="duck vision demo") as demo:
+    gr.Markdown(
+        f"""
+        # A duck's camera, processed in a data centre
+
+        The robot **dials this Space** and pushes JPEG frames; OpenCV runs over them here. Nothing
+        is on the robot's network, and no relay candidate is involved — so no shared relay carries
+        the pixels, and none of this is spent against the robot owner's TURN allowance.
+
+        Frames arrive at `{RECEIVER_URL}` — change it below if the robot cannot reach that.
+        """
+    )
+
+    with gr.Row():
+        if OAUTH_AVAILABLE:
+            gr.LoginButton()
+        # **Always offered, not only when the button is missing.** The sign-in stores its session
+        # in a cookie, and a Space runs in an iframe on `huggingface.co` — so Safari's tracking
+        # prevention drops it as third-party whatever `SameSite` says, and signing in appears to
+        # do nothing. A pasted token needs no cookie, so it works in every browser and on a phone.
+        # Opening the Space's own `…hf.space` URL directly also fixes it, by making the cookie
+        # first-party; this is the path that does not require knowing that.
+        typed_token = gr.Textbox(
+            value="",
+            label="…or paste a Hugging Face token",
+            placeholder="hf_…",
+            info=(
+                "Needed if the sign-in button does nothing — Safari and some phone browsers drop "
+                "the session cookie because this page is in an iframe. Opening "
+                f"https://{os.environ.get('SPACE_HOST', 'this-space.hf.space')} directly works too."
+                if OAUTH_AVAILABLE
+                else "This Space has no sign-in button, so a token is how it knows who you are."
+            ),
+            type="password",
+            scale=2,
+        )
+        finding = gr.Button("find my ducks")
+        chosen = gr.Dropdown(choices=[], label="your ducks", scale=2)
+        connecting = gr.Button("connect", variant="primary")
+        disconnecting = gr.Button("disconnect")
+
+    status = gr.Markdown("**not connected.**")
+
+    with gr.Row():
+        receiver_url = gr.Textbox(
+            value=RECEIVER_URL,
+            label="where the robot should send frames",
+            info=(
+                "This Space's own address, as the robot sees it."
+                if ON_A_SPACE
+                else "Loopback works for `fake_duck.py` on this machine; a real robot needs this "
+                "host's address on its own network."
+            ),
+            scale=3,
+        )
+        fps = gr.Number(value=FPS, label="frames a second", precision=1)
+        longest = gr.Number(value=LONGEST, label="longest side (px)", precision=0)
+        starting = gr.Button("start streaming", variant="primary")
+        stopping = gr.Button("stop")
+
+    chosen_filter = gr.Dropdown(
+        choices=list(FILTERS), value="edges (Canny)", label="what to run on each frame"
+    )
+    picture = gr.Image(label="from the robot", height=520)
+    frame_note = gr.Markdown("")
+
+    # Defined here rather than beside its `tick`, because the buttons below switch it on and off
+    # and Gradio needs the component to exist before an event can name it.
+    ticker = gr.Timer(0.5, active=False)
+
+    with gr.Accordion("the log — every call, every frame stream, every refusal", open=False):
+        gr.Markdown(
+            "The same lines the container's stderr gets. `DUCK_LOG=DEBUG` adds more. Paste this "
+            "rather than describing a symptom — four things meet in one button and they all fail "
+            "as nothing happening."
+        )
+        wire_log = gr.Markdown("")
+
+    finding.click(find, inputs=typed_token, outputs=[chosen, status])
+    connecting.click(connect, inputs=[chosen, typed_token], outputs=status)
+    disconnecting.click(lambda: LINK.disconnect(), outputs=status)
+    # The frame poll follows the stream: on when one is asked for, off when it is stopped or the
+    # session ends.
+    starting.click(start, inputs=[receiver_url, fps, longest], outputs=status).then(
+        lambda: gr.Timer(active=True), outputs=ticker
+    )
+    stopping.click(stop, outputs=status).then(
+        lambda: gr.Timer(active=False), outputs=ticker
+    )
+    disconnecting.click(lambda: gr.Timer(active=False), outputs=ticker)
+
+    # **Twice a second, and only while something is streaming.**
+    #
+    # Every tick is a request to the Space whether or not there is a new frame, and an idle page
+    # polling forever is what earns a `429` from the platform's edge — which looks exactly like a
+    # broken Space and is nobody's bug. So the timer starts inactive and the buttons turn it on
+    # and off: a page that nobody has connected costs nothing at all.
+    #
+    # Two a second for a five-frame-a-second stream shows every other frame, which for a
+    # perception demo is the difference between "smooth" and "polite". `render` still skips an
+    # unchanged frame on top of that.
+    ticker.tick(
+        render, inputs=chosen_filter, outputs=[picture, frame_note], show_progress="hidden"
+    )
+
+    # The log, every three seconds and only its tail. It used to ship all four hundred lines every
+    # second, which is a large payload arriving constantly for a panel that is usually closed.
+    def tail() -> str:
+        lines = list(RING.lines)[-40:]
+        return ("```\n" + "\n".join(lines) + "\n```") if lines else ""
+
+    # Ten seconds: it is a diagnostic, read after something went wrong rather than watched.
+    gr.Timer(10.0).tick(tail, outputs=wire_log, show_progress="hidden")
+
+
+# **FastAPI owns the server and Gradio is mounted into it**, not the other way round: the robot's
+# frames arrive on a WebSocket route of our own, and mounting Gradio inside FastAPI is the
+# documented direction. The reverse — adding routes to Gradio's app — has known WebSocket breakage,
+# which is a poor thing to discover from inside a Space.
+app = FastAPI()
+
+
+@app.get("/env")
+def env() -> dict[str, str]:
+    """Which of the platform's variables arrived, and what this app concluded from them.
+
+    An endpoint rather than a log line: reading a Space's logs needs write access to the Space, and
+    every question about this has otherwise cost a round trip through a pasted log. Presence only,
+    never a value — `OAUTH_CLIENT_SECRET` is in this environment too.
+    """
+    shown = ("SPACE_ID", "SPACE_HOST", "PORT")
+    watched = shown + ("OAUTH_CLIENT_ID", "OAUTH_SCOPES", "HF_TOKEN", "GRADIO_SSR_MODE")
+    answer = {
+        name: (os.environ[name] if name in shown else "set") if name in os.environ else "absent"
+        for name in watched
+    }
+    answer["sign_in"] = "available" if OAUTH_AVAILABLE else "token box"
+    answer["receiver"] = RECEIVER_URL
+    return answer
+
+
+receiver.mount(app)
+# `ssr_mode=False` for the reason the Dockerfile sets `GRADIO_SSR_MODE=false`: server-side
+# rendering starts a Node server, this image has no Node, and a page behind a sign-in has no use
+# for SEO. Passed here as well as set there so the answer does not depend on the environment.
+app = gr.mount_gradio_app(app, demo, path="/", ssr_mode=False)
+
+
+if __name__ == "__main__":
+    import uvicorn
+
+    uvicorn.run(app, host="0.0.0.0", port=int(os.environ.get("PORT", 7860)))
diff --git a/spaces/vision-demo/boot.py b/spaces/vision-demo/boot.py
new file mode 100644
index 00000000..14dc9a9a
--- /dev/null
+++ b/spaces/vision-demo/boot.py
@@ -0,0 +1,60 @@
+"""Start the app — and when it cannot start, **serve the reason instead of exiting**.
+
+A container that exits is reported by Hugging Face as "App process crashed", and the only detail
+that reaches its API is a truncated first line: four rounds of this went into the port before a
+pasted traceback showed the real fault was an import-time `ValueError` from Gradio's OAuth setup.
+Reading a Space's own logs needs write access to the Space, so every question cost a round trip.
+
+So: import the app inside a `try`. If it works, serve it. If it does not, serve a page that *is*
+the traceback, on the port the platform expects. The Space stays up, `curl` answers the question,
+and nobody has to paste a log again.
+"""
+
+from __future__ import annotations
+
+import os
+import traceback
+
+PORT = int(os.environ.get("PORT", 7860))
+
+try:
+    from app import app as application
+
+    FAILURE: str | None = None
+except Exception:  # noqa: BLE001 - the whole point is that any failure becomes a page
+    FAILURE = traceback.format_exc()
+    print("the app did not import:\n" + FAILURE, flush=True)
+
+    from fastapi import FastAPI
+    from fastapi.responses import PlainTextResponse
+
+    application = FastAPI()
+
+    @application.get("/", response_class=PlainTextResponse)
+    @application.get("/env", response_class=PlainTextResponse)
+    def why() -> str:
+        watched = (
+            "SPACE_ID",
+            "SPACE_HOST",
+            "OAUTH_CLIENT_ID",
+            "OAUTH_SCOPES",
+            "HF_TOKEN",
+            "GRADIO_SSR_MODE",
+            "PORT",
+        )
+        shown = ("SPACE_ID", "SPACE_HOST", "GRADIO_SSR_MODE", "PORT")
+        env = "\n".join(
+            f"  {name} = "
+            + ((os.environ[name] if name in shown else "set") if name in os.environ else "absent")
+            for name in watched
+        )
+        return (
+            "This Space is running, and its app did not import.\n\n"
+            f"environment:\n{env}\n\nthe traceback:\n\n{FAILURE}"
+        )
+
+
+if __name__ == "__main__":
+    import uvicorn
+
+    uvicorn.run(application, host="0.0.0.0", port=PORT)
diff --git a/spaces/vision-demo/control.py b/spaces/vision-demo/control.py
new file mode 120000
index 00000000..6db3c45a
--- /dev/null
+++ b/spaces/vision-demo/control.py
@@ -0,0 +1 @@
+../shared/control.py
\ No newline at end of file
diff --git a/spaces/vision-demo/fake_duck.py b/spaces/vision-demo/fake_duck.py
new file mode 100644
index 00000000..b7667e7f
--- /dev/null
+++ b/spaces/vision-demo/fake_duck.py
@@ -0,0 +1,388 @@
+"""A duck that is a laptop: registers with the rendezvous, answers `media.stream`, and pushes H.264.
+
+For testing a **deployed** Space from outside its network without a board. It plays the robot's
+whole side of `remote-access-design.md` §5.3, using the same wire `mediad` uses:
+
+1. `GET /events` with a bearer token, then `setPeerStatus {roles:["producer"]}` — which is what
+   puts it in the account's robot list, so *find my ducks* finds it. `mediad::relay` does this.
+2. Answers `peer` envelopes carrying `rpc` — the control lane (§5.2). Enough of the API to be
+   driven: `media.stream`, and read-only answers for what a client asks while looking around.
+3. On `media.stream {url}`, dials that url and pushes H.264 access units, Annex-B, one per
+   message. `mediad::stream` does this.
+
+Frames come from the webcam if there is one, and from a moving test pattern if there is not.
+
+## Two tokens, and this is the thing that will waste an afternoon otherwise
+
+**The rendezvous keys a peer by token string.** A second `/events` on the same token supersedes the
+first (§3.7), so if this duck and the Space sign in with the *same* token they take turns
+existing: the Space connects, the duck vanishes from the listing, and nothing works in a way that
+looks like the duck crashed.
+
+So give this one its own token — a second access token on the **same Hugging Face account**, from
+`huggingface.co/settings/tokens`. Same account matters: the rendezvous only lets a consumer open a
+session with a producer whose `username` matches, so a duck on another account is invisible rather
+than shared.
+
+    DUCK_HF_TOKEN=hf_the_second_one uv run fake_duck.py
+
+Everything else is `HF_TOKEN` or `hf auth login` as usual, and the Space keeps using that one.
+
+The variable is `DUCK_HF_TOKEN` and not `DUCK_TOKEN` for a boring reason worth writing down:
+`DUCK_TOKEN` was already set in the environment this was first run in, to a GitHub token, and the
+rendezvous spent ten seconds failing to resolve it before answering `401 Invalid token`. Which
+read exactly like a broken script. Hence the name, and hence the two log lines below that say
+which credential is in use and whether it is even shaped like a Hugging Face one.
+
+**It is a prototype, not a simulator.** No config, no policies, no motion — it answers the handful
+of calls a client asks while finding its way to the camera, and refuses the rest by name.
+"""
+
+from __future__ import annotations
+
+import fractions
+import json
+import logging
+import os
+import sys
+import socket as socket_module
+import threading
+import time
+from typing import Any
+
+import av
+import numpy as np
+import requests
+import websockets.sync.client as wsc
+
+RENDEZVOUS = os.environ.get(
+    "REACHY_CENTRAL_URL", "https://pollen-robotics-reachy-mini-central.hf.space"
+).rstrip("/")
+NAME = os.environ.get("DUCK_NAME", "a-laptop-pretending")
+FPS = int(os.environ.get("DUCK_FPS", "5"))
+WIDTH, HEIGHT = 640, 360
+
+logging.basicConfig(level=logging.INFO, format="%(asctime)s %(name)-6s %(message)s",
+                    datefmt="%H:%M:%S")
+logger = logging.getLogger("duck")
+
+
+# ── the camera ───────────────────────────────────────────────────────────────
+
+
+def pictures():
+    """RGB frames from the webcam, or a moving pattern when there is no camera."""
+    import cv2
+
+    camera = cv2.VideoCapture(0)
+    if camera.isOpened():
+        logger.info("using the webcam")
+        try:
+            while True:
+                ok, frame = camera.read()
+                if not ok:
+                    break
+                yield cv2.resize(frame, (WIDTH, HEIGHT))[:, :, ::-1]
+        finally:
+            camera.release()
+        return
+
+    logger.info("no webcam; sending a test pattern")
+    step = 0
+    while True:
+        picture = np.zeros((HEIGHT, WIDTH, 3), dtype=np.uint8)
+        picture[: HEIGHT // 2] = (200, 40, 40)
+        picture[:, step % (WIDTH - 40) : step % (WIDTH - 40) + 40] = 255
+        step += 12
+        yield picture
+        time.sleep(1.0 / FPS)
+
+
+# ── pushing frames at whatever asked for them ────────────────────────────────
+
+
+class Pusher:
+    """One outbound frame stream, started and stopped by `media.stream`."""
+
+    def __init__(self) -> None:
+        self.url: str | None = None
+        self.sent = 0
+        self.bytes_out = 0
+        self._stop = threading.Event()
+        self._thread: threading.Thread | None = None
+
+    def start(self, url: str, token: str) -> None:
+        self.stop()
+        self._stop.clear()
+        self.url, self.sent, self.bytes_out = url, 0, 0
+        self._thread = threading.Thread(
+            target=self._run, args=(url, token), name="pusher", daemon=True
+        )
+        self._thread.start()
+
+    def stop(self) -> None:
+        self._stop.set()
+        self.url = None
+
+    def status(self) -> dict[str, Any]:
+        return {
+            "streaming": self.url is not None,
+            "url": self.url,
+            "sent": self.sent,
+            "dropped": 0,
+            "connected": self.url is not None,
+            "fps": FPS,
+            "longest": WIDTH,
+            "encoding": "h264",
+        }
+
+    def _run(self, url: str, token: str) -> None:
+        container = av.open("/dev/null", "w", format="h264")
+        stream = container.add_stream("libx264", rate=FPS)
+        stream.width, stream.height, stream.pix_fmt = WIDTH, HEIGHT, "yuv420p"
+        # `repeat-headers` is `h264parse config-interval=-1`'s job on the robot: parameter sets in
+        # front of every keyframe, so a receiver that connects mid-stream needs nothing it missed.
+        stream.options = {"tune": "zerolatency", "g": str(FPS), "x264-params": "repeat-headers=1"}
+
+        try:
+            logger.info("dialling %s", url)
+            with wsc.connect(url, additional_headers={"authorization": f"Bearer {token}"}) as sock:
+                sock.send(
+                    json.dumps(
+                        {
+                            "type": "hello",
+                            "robot": {"name": NAME, "kind": "microduck", "release": "fake"},
+                            "frames": {
+                                "encoding": "h264",
+                                "annexb": True,
+                                "fps": FPS,
+                                "longest": WIDTH,
+                                "rotate": 0,
+                            },
+                        }
+                    )
+                )
+                logger.info("streaming to %s", url)
+                interval = 1.0 / FPS
+                for index, picture in enumerate(pictures()):
+                    if self._stop.is_set():
+                        break
+                    began = time.monotonic()
+                    frame = av.VideoFrame.from_ndarray(
+                        np.ascontiguousarray(picture), format="rgb24"
+                    )
+                    frame.pts = index
+                    frame.time_base = fractions.Fraction(1, FPS)
+                    for packet in stream.encode(frame):
+                        unit = bytes(packet)
+                        sock.send(unit)
+                        self.sent += 1
+                        self.bytes_out += len(unit)
+                    if self.sent and self.sent % (FPS * 5) == 0:
+                        logger.info(
+                            "%d units, %.0f KB, %.0f B/unit",
+                            self.sent,
+                            self.bytes_out / 1024,
+                            self.bytes_out / self.sent,
+                        )
+                    rest = interval - (time.monotonic() - began)
+                    if rest > 0:
+                        time.sleep(rest)
+        except Exception as e:  # noqa: BLE001 - a prototype says why and stops
+            logger.warning("the frame stream ended: %r", e)
+        finally:
+            self.url = None
+
+
+# ── the control lane, from the robot's side ──────────────────────────────────
+
+
+ANSWERS: dict[str, Any] = {
+    # Enough for a client to look around and find the camera. A real duck answers these out of
+    # `robotd`; this one is a prototype and says so by having no policies at all.
+    "robot.policies": {"mode": "walk", "enabled": False, "slots": [], "skills": []},
+    "robot.skills": {"skills": [], "built_in": []},
+    "media.video": {"width": WIDTH, "height": HEIGHT, "rotate": 0},
+}
+
+
+class FakeDuck:
+    def __init__(self, token: str) -> None:
+        self.token = token
+        # **Two sessions, and this is not tidiness.** `requests.Session` is not thread-safe, and
+        # this holds a streaming `GET /events` open on one thread while the heartbeat and every
+        # reply POST from another. Sharing one connection pool across that is a corrupted stream:
+        # messages arrive mangled or not at all, which showed up as a `startSession` this duck
+        # never saw followed by two `endSession`s it could not explain.
+        self.streaming = requests.Session()
+        self.posting = requests.Session()
+        self.peer_id: str | None = None
+        self.session_id: str | None = None
+        self.pusher = Pusher()
+
+    def headers(self) -> dict[str, str]:
+        return {"authorization": f"Bearer {self.token}"}
+
+    def post(self, message: dict[str, Any]) -> dict[str, Any] | None:
+        answer = self.posting.post(
+            f"{RENDEZVOUS}/send", headers=self.headers(), json=message, timeout=20
+        )
+        if answer.status_code != 200:
+            logger.warning("POST /send -> HTTP %s %s", answer.status_code, answer.text[:120])
+            return None
+        try:
+            body = answer.json()
+        except ValueError:
+            return None
+        return body if isinstance(body, dict) else None
+
+    def register(self) -> None:
+        """`setPeerStatus`, which is what puts this in the account's robot list.
+
+        `hardware_id` matters: the rendezvous only sweeps producers that carry one, so a fake duck
+        without it would haunt the listing after this process exits (§3.7).
+        """
+        self.post(
+            {
+                "type": "setPeerStatus",
+                "roles": ["producer"],
+                "meta": {
+                    # **Stable across runs, not per process.** The rendezvous evicts an older
+                    # producer of the same user carrying the same `hardware_id`, which is how a
+                    # restarted robot replaces itself instead of appearing twice (§3.7). With the
+                    # pid in here every run of this script left another duck in the listing —
+                    # which is exactly the ghost that field exists to prevent. `mediad` uses the
+                    # SoC serial for the same reason.
+                    "hardware_id": f"fake-{socket_module.gethostname()}",
+                    "name": NAME,
+                    "kind": "microduck",
+                    "release": "fake",
+                    "api_version": 23,
+                },
+            }
+        )
+
+    def heartbeat(self) -> None:
+        """The lease is refreshed by inbound POSTs, not by a socket that looks healthy (§3.3)."""
+        while True:
+            time.sleep(10)
+            self.register()
+
+    def rpc(self, call: dict[str, Any]) -> dict[str, Any]:
+        method, params = call.get("method"), call.get("params") or {}
+        logger.info("← %s %s", method, json.dumps(params)[:160])
+
+        if method == "media.stream":
+            if "url" not in params:
+                return {"result": self.pusher.status()}
+            if params["url"] is None:
+                self.pusher.stop()
+                return {"result": {"streaming": False, "was": None}}
+            self.pusher.start(params["url"], self.token)
+            return {"result": self.pusher.status()}
+
+        if method in ANSWERS:
+            return {"result": ANSWERS[method]}
+        return {"error": {"code": -32601, "message": f"{method} is not something a fake duck does"}}
+
+    def handle(self, message: dict[str, Any]) -> None:
+        kind = message.get("type")
+        if kind == "welcome":
+            self.peer_id = message.get("peerId")
+            logger.info(
+                "registered as %s for %s", (self.peer_id or "?")[:8], message.get("username")
+            )
+            self.register()
+            threading.Thread(target=self.heartbeat, daemon=True).start()
+        elif kind == "startSession":
+            self.session_id = message.get("sessionId")
+            logger.info("a consumer opened session %s", (self.session_id or "?")[:8])
+        elif kind == "endSession":
+            logger.info("the session ended")
+            self.session_id = None
+            self.pusher.stop()
+        elif kind == "peer" and message.get("rpc") is not None:
+            call = message["rpc"]
+            body = self.rpc(call)
+            self.post(
+                {
+                    "type": "peer",
+                    "sessionId": message.get("sessionId"),
+                    "rpc": {"jsonrpc": "2.0", "id": call.get("id"), **body},
+                }
+            )
+
+    def run(self) -> None:
+        logger.info("GET %s/events", RENDEZVOUS)
+        stream = self.streaming.get(
+            f"{RENDEZVOUS}/events",
+            headers={**self.headers(), "accept": "text/event-stream"},
+            stream=True,
+            timeout=(20, 120),
+        )
+        logger.info("GET /events -> HTTP %s", stream.status_code)
+        if stream.status_code != 200:
+            # The status *and* the body: "refused this token" was the message here first, and it
+            # is a guess dressed as a diagnosis — the same mistake as the Space's 403.
+            sys.exit(
+                f"the rendezvous answered HTTP {stream.status_code}: {stream.text[:300]}"
+            )
+
+        buffer = ""
+        for chunk in stream.iter_content(chunk_size=None):
+            buffer += chunk.decode("utf-8", "replace").replace("\r\n", "\n")
+            while "\n\n" in buffer:
+                frame, _, buffer = buffer.partition("\n\n")
+                data = "".join(
+                    line[len("data:") :].strip()
+                    for line in frame.split("\n")
+                    if line.startswith("data:")
+                )
+                if data:
+                    try:
+                        self.handle(json.loads(data))
+                    except Exception as e:  # noqa: BLE001 - a prototype logs and carries on
+                        logger.warning("a message went wrong: %r", e)
+
+
+def main() -> None:
+    from huggingface_hub import get_token
+
+    token = os.environ.get("DUCK_HF_TOKEN")
+    if not token:
+        token = os.environ.get("HF_TOKEN") or get_token()
+        logger.warning(
+            "no DUCK_HF_TOKEN, so this duck is using the same token the Space will. The "
+            "rendezvous keys a peer by token, so whichever connects second evicts the first — see "
+            "this file's header. Fine for checking the listing; not for the whole loop."
+        )
+    if not token:
+        sys.exit("no token: set DUCK_TOKEN, or run `hf auth login`")
+    # The shape, never the token: which credential this is, is the thing that explains a refusal,
+    # and it is the half that is safe to write down.
+    logger.info(
+        "token: %d chars, starts %r, from %s",
+        len(token),
+        token[:8],
+        "DUCK_HF_TOKEN"
+        if os.environ.get("DUCK_HF_TOKEN")
+        else "HF_TOKEN"
+        if os.environ.get("HF_TOKEN")
+        else "`hf auth login`",
+    )
+    if not token.startswith("hf_"):
+        # Cheap, and it is the check that would have saved the afternoon this file's header
+        # describes: only Hugging Face tokens mean anything to `whoami-v2`, and everything else
+        # comes back as a slow, unexplained 401.
+        logger.warning(
+            "that token does not start with `hf_`, so it is probably not a Hugging Face one — the "
+            "rendezvous will answer 401 after about ten seconds of trying to resolve it"
+        )
+    FakeDuck(token).run()
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except KeyboardInterrupt:
+        logger.info("stopped")
diff --git a/spaces/vision-demo/filters.py b/spaces/vision-demo/filters.py
new file mode 100644
index 00000000..ff91925c
--- /dev/null
+++ b/spaces/vision-demo/filters.py
@@ -0,0 +1,146 @@
+"""The pixels half of the demo: what runs on each frame.
+
+Separate from `app.py`, and for the same reason `mediad`'s `session.rs` is transport-agnostic: it
+imports OpenCV and numpy and nothing else, so it can be exercised on a synthetic frame pair without
+a WebRTC stack, a robot, or a Hugging Face token. Every one of these is a few lines whose failure
+mode is a wrong picture rather than an exception, which is exactly the kind of thing to run before
+a Space builds rather than after.
+"""
+
+from __future__ import annotations
+
+import cv2
+import numpy as np
+
+# The camera is mounted a quarter turn off upright and nothing on the robot rotates pixels: a
+# `videoflip` in the pipeline cost the encoder its zero-copy path and the board 22 fps. So every
+# consumer turns the picture itself. A client that can read `media.video` is told the angle; this
+# one cannot (see the module docstring), so it is named here.
+MOUNT_ROTATION_DEGREES = 90
+
+# The focal length in pixels at the sensor's native pitch: 3.04 mm over 1.12 µm. `mediad::camera`
+# derives the published intrinsics from this and the sensor mode, and this is the same arithmetic
+# for the same reason — it can be checked rather than trusted.
+NATIVE_FOCAL_PX = 3.04 * 1000.0 / 1.12
+PINNED_SENSOR_WIDTH = 1920
+
+
+def upright(frame: np.ndarray) -> np.ndarray:
+    """Turn the picture the way the robot is looking.
+
+    **Unused on the frame-stream path, and kept because it is still right for a WebRTC one.**
+    `mediad`'s `stream.rs` turns a frame upright while it converts the colours, since that is a
+    per-pixel loop either way and the turn is a change of which source pixel is fetched — free,
+    and what receives the frames is a model that wants them the way up it was trained on. A
+    consumer pulling H.264 through WebRTC gets the picture the camera took and has to do this
+    itself, which is what `media.video`'s `rotate` is for.
+    """
+    if MOUNT_ROTATION_DEGREES % 360 == 0:
+        return frame
+    # `np.rot90` counts anticlockwise and the mount is measured clockwise.
+    return np.ascontiguousarray(np.rot90(frame, k=-(MOUNT_ROTATION_DEGREES // 90)))
+
+
+def edges(frame: np.ndarray) -> np.ndarray:
+    """Canny, on the picture rather than beside it, so the alignment is visible."""
+    grey = cv2.cvtColor(frame, cv2.COLOR_RGB2GRAY)
+    found = cv2.Canny(grey, 80, 180)
+    tinted = np.zeros_like(frame)
+    tinted[found > 0] = (255, 220, 40)
+    return cv2.addWeighted(frame, 0.6, tinted, 1.0, 0)
+
+
+def motion(frame: np.ndarray, previous: np.ndarray | None) -> np.ndarray:
+    """What changed since the last frame, which on a duck is mostly the duck moving."""
+    if previous is None or previous.shape != frame.shape:
+        return frame
+    difference = cv2.absdiff(
+        cv2.cvtColor(frame, cv2.COLOR_RGB2GRAY),
+        cv2.cvtColor(previous, cv2.COLOR_RGB2GRAY),
+    )
+    _, mask = cv2.threshold(difference, 18, 255, cv2.THRESH_BINARY)
+    mask = cv2.dilate(mask, np.ones((5, 5), np.uint8), iterations=1)
+    tinted = np.zeros_like(frame)
+    tinted[mask > 0] = (255, 60, 60)
+    return cv2.addWeighted(frame, 0.7, tinted, 0.9, 0)
+
+
+def flow(frame: np.ndarray, previous: np.ndarray | None) -> np.ndarray:
+    """Sparse optical flow: where the corners went, which is where the robot did not.
+
+    Lucas–Kanade on a few hundred corners rather than a dense field: it costs a few milliseconds
+    on a CPU Space, and it is the same measurement visual odometry starts from.
+    """
+    if previous is None or previous.shape != frame.shape:
+        return frame
+    grey_now = cv2.cvtColor(frame, cv2.COLOR_RGB2GRAY)
+    grey_was = cv2.cvtColor(previous, cv2.COLOR_RGB2GRAY)
+    corners = cv2.goodFeaturesToTrack(grey_was, maxCorners=200, qualityLevel=0.01, minDistance=12)
+    if corners is None:
+        return frame
+    moved, found, _ = cv2.calcOpticalFlowPyrLK(grey_was, grey_now, corners, None)
+    if moved is None:
+        return frame
+
+    drawn = frame.copy()
+    for new, old, ok in zip(moved, corners, found.ravel()):
+        if not ok:
+            continue
+        (x1, y1), (x0, y0) = new.ravel(), old.ravel()
+        # Sub-pixel jitter on a static scene would fill the picture with noise.
+        if (x1 - x0) ** 2 + (y1 - y0) ** 2 < 4:
+            continue
+        cv2.arrowedLine(
+            drawn, (int(x0), int(y0)), (int(x1), int(y1)), (60, 220, 255), 2, tipLength=0.35
+        )
+    return drawn
+
+
+def geometry(frame: np.ndarray) -> np.ndarray:
+    """The camera's geometry, drawn on the picture it describes.
+
+    **Derived here, and it should not be.** `media.video` publishes `fx`, `fy`, `cx`, `cy` and
+    whether they were calibrated — but this consumer cannot read the robot's control channel (see
+    the module docstring), so the numbers are recomputed from the sensor's optics: the focal length
+    in pixels at native pitch, scaled by how much the ISP shrank the pinned 1920×1080 mode. It
+    lands on the same value the robot publishes, which is the point: the arithmetic is checkable.
+    """
+    height, width = frame.shape[:2]
+    # The frame arrives rotated by the mount, so the sensor's width is this frame's *height*.
+    sensor_axis = max(width, height)
+    focal = NATIVE_FOCAL_PX * sensor_axis / PINNED_SENSOR_WIDTH
+    hfov = 2.0 * np.degrees(np.arctan(sensor_axis / 2.0 / focal))
+
+    drawn = frame.copy()
+    centre = (width // 2, height // 2)
+    cv2.drawMarker(drawn, centre, (255, 255, 255), cv2.MARKER_CROSS, 28, 2)
+    cv2.circle(drawn, centre, 6, (255, 255, 255), 1)
+    for label, position in (
+        (f"fx = fy = {focal:.0f} px", 26),
+        (f"principal point ~ {centre[0]}, {centre[1]}", 50),
+        (f"field of view ~ {hfov:.0f} deg across the long axis", 74),
+        ("derived, not calibrated - media.video is the source of truth", 98),
+    ):
+        cv2.putText(
+            drawn, label, (12, position), cv2.FONT_HERSHEY_SIMPLEX, 0.5, (0, 0, 0), 3, cv2.LINE_AA
+        )
+        cv2.putText(
+            drawn,
+            label,
+            (12, position),
+            cv2.FONT_HERSHEY_SIMPLEX,
+            0.5,
+            (255, 255, 255),
+            1,
+            cv2.LINE_AA,
+        )
+    return drawn
+
+
+FILTERS = {
+    "raw": lambda frame, previous: frame,
+    "edges (Canny)": lambda frame, previous: edges(frame),
+    "motion": motion,
+    "optical flow": flow,
+    "camera geometry": lambda frame, previous: geometry(frame),
+}
diff --git a/spaces/vision-demo/receiver.py b/spaces/vision-demo/receiver.py
new file mode 100644
index 00000000..6cc5e850
--- /dev/null
+++ b/spaces/vision-demo/receiver.py
@@ -0,0 +1,301 @@
+"""The endpoint a duck dials, and the frames it leaves behind.
+
+**The robot connects to us, which is the whole reason this exists.** Pulling the camera through
+the rendezvous means WebRTC, and WebRTC between a robot behind a home router and a container in a
+data centre needs a relay candidate to fall back on (`remote-access-design.md` §6) — somebody's
+bandwidth, metered against the robot owner's Hugging Face allowance, for every frame of a stream
+that is only going to be decoded by a program. An outbound WebSocket needs nobody's: the robot
+already holds one to a Space every second it is reachable. So the direction is inverted, NAT
+stops being a participant, and this is the socket at the far end.
+
+`mediad`'s `stream.rs` is the other half. It sends one text frame describing what is coming, then
+one binary message per JPEG, upright, at the rate it was asked for.
+
+## Whose camera this is, which is not optional
+
+This endpoint is public — a Space's URL is a Space's URL — so anything that can reach the internet
+can open it. Two things would go wrong without a check: anybody could push frames into somebody
+else's demo, and worse, a visitor could be shown a stranger's camera. So the robot presents its
+own account token on the handshake and this resolves it through `whoami-v2`, exactly as the
+rendezvous does, and frames are filed under the username it answers with. A visitor sees the
+robots on their own account and nothing else.
+
+The token never leaves this process and is never stored: it is resolved once per connection and
+what is kept is the username.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import threading
+import time
+from dataclasses import dataclass, field
+from typing import Any
+
+import numpy as np
+import requests
+from fastapi import WebSocket, WebSocketDisconnect
+
+logger = logging.getLogger(__name__)
+
+WHOAMI = "https://huggingface.co/api/whoami-v2"
+
+# A frame older than this is not what the robot is looking at any more. Shown as stale rather than
+# hidden, because "the stream stopped" and "there was never a stream" are different problems.
+STALE_AFTER = 5.0
+
+
+@dataclass
+class Stream:
+    """The newest picture from one robot, and how the stream has been going.
+
+    **A decoded picture rather than the bytes, because H.264 is stateful.** A JPEG can be kept
+    and decoded whenever somebody looks; an H.264 access unit means nothing without every unit
+    before it, so units are decoded in arrival order as they land and what is kept is the result.
+    JPEG goes the same way rather than keeping two rules — at a few frames a second the decode is
+    free either way.
+    """
+
+    username: str
+    robot: str
+    hello: dict[str, Any] = field(default_factory=dict)
+    picture: np.ndarray | None = None
+    frames: int = 0
+    first_at: float = 0.0
+    last_at: float = 0.0
+    bytes_in: int = 0
+    #: What turns a unit into pictures, chosen from the hello. Stateful for H.264, which is why it
+    #: belongs to the stream rather than being made per call.
+    decoder: Any = None
+    #: Units that arrived and produced no picture yet — every H.264 stream starts with some,
+    #: because the decoder has nothing to predict from until a keyframe and its parameter sets
+    #: have both arrived.
+    undecoded: int = 0
+    last_error: str | None = None
+
+    @property
+    def fps(self) -> float:
+        span = self.last_at - self.first_at
+        return (self.frames - 1) / span if self.frames > 1 and span > 0 else 0.0
+
+    @property
+    def stale(self) -> bool:
+        return time.monotonic() - self.last_at > STALE_AFTER
+
+
+class Frames:
+    """Every live stream, by account.
+
+    A dict rather than one slot, because a Space serves whoever opens it and two people's robots
+    must not land in the same place. Keyed by username and then by robot name: one account can have
+    more than one duck, and a demo that silently showed the last one to connect would be a demo
+    that lies about which robot it is looking at.
+    """
+
+    def __init__(self) -> None:
+        self._lock = threading.Lock()
+        self._streams: dict[tuple[str, str], Stream] = {}
+
+    def opened(self, username: str, robot: str, hello: dict[str, Any]) -> Stream:
+        with self._lock:
+            stream = Stream(username=username, robot=robot, hello=hello)
+            stream.decoder = decoder_for(hello)
+            stream.first_at = stream.last_at = time.monotonic()
+            self._streams[(username, robot)] = stream
+            return stream
+
+    def arrived(self, stream: Stream, unit: bytes) -> None:
+        """Decode one unit and keep what came out, if anything.
+
+        No lock: one writer per stream, and a reader takes the ndarray by reference. A reader
+        either sees the previous picture or this one, never half of either — which is why the
+        assignment is the last thing that happens.
+        """
+        stream.bytes_in += len(unit)
+        stream.last_at = time.monotonic()
+        try:
+            pictures = stream.decoder(unit)
+        except Exception as e:  # noqa: BLE001 - a bad unit is not a bad stream
+            stream.last_error = f"{type(e).__name__}: {e}"
+            logger.warning("a unit would not decode: %s", stream.last_error)
+            return
+        if not pictures:
+            # Ordinary at the start of an H.264 stream, and worth counting rather than hiding: a
+            # stream that only ever does this is a stream whose keyframe never arrived.
+            stream.undecoded += 1
+            return
+        for picture in pictures:
+            stream.frames += 1
+            stream.picture = picture
+
+    def closed(self, username: str, robot: str) -> None:
+        with self._lock:
+            self._streams.pop((username, robot), None)
+
+    def of(self, username: str) -> list[Stream]:
+        with self._lock:
+            return [s for (user, _), s in self._streams.items() if user == username]
+
+    def newest(self, username: str) -> Stream | None:
+        streams = sorted(self.of(username), key=lambda s: s.last_at, reverse=True)
+        return streams[0] if streams else None
+
+
+FRAMES = Frames()
+
+
+def whoami(token: str) -> str | None:
+    """The account a token belongs to, or `None`.
+
+    The same one call the rendezvous makes (`validate_hf_token`), and deliberately no more: no
+    scope check and no token-type check, because a robot's device-flow token and a visitor's OAuth
+    token are both legitimate here and neither carries anything this needs to inspect.
+    """
+    try:
+        answer = requests.get(
+            WHOAMI, headers={"Authorization": f"Bearer {token}"}, timeout=10
+        )
+    except requests.RequestException as e:
+        logger.warning("whoami-v2 unreachable: %s", e)
+        return None
+    if answer.status_code != 200:
+        logger.info("whoami-v2 refused a token: HTTP %s", answer.status_code)
+        return None
+    try:
+        return answer.json().get("name")
+    except ValueError:
+        return None
+
+
+def decoder_for(hello: dict[str, Any]) -> Any:
+    """A callable turning one unit into zero or more RGB pictures.
+
+    Chosen from `frames.encoding` in the hello rather than sniffed from the bytes, which is why
+    `mediad` sends that field: a JPEG's magic and an Annex-B start code are both recognisable, but
+    a receiver that guessed would be a receiver that guesses wrong on the day a third encoding
+    appears.
+    """
+    encoding = ((hello.get("frames") or {}).get("encoding") or "h264").lower()
+    if encoding in ("jpeg", "jpg", "mjpeg"):
+        return jpeg_decoder()
+    if encoding in ("h264", "avc"):
+        return h264_decoder()
+    raise ValueError(f"a robot offered frames as {encoding!r}, which this Space cannot decode")
+
+
+def jpeg_decoder() -> Any:
+    """One JPEG in, one picture out. Stateless, which is the point of it.
+
+    OpenCV rather than PIL because the filters are OpenCV anyway. `imdecode` gives BGR, flipped
+    once here so everything downstream — the filters, Gradio — deals in RGB like the rest of this
+    project.
+    """
+    import cv2
+
+    def decode(unit: bytes) -> list[np.ndarray]:
+        picture = cv2.imdecode(np.frombuffer(unit, dtype=np.uint8), cv2.IMREAD_COLOR)
+        return [] if picture is None else [picture[:, :, ::-1]]
+
+    return decode
+
+
+def h264_decoder() -> Any:
+    """Annex-B access units in, pictures out — with the first few producing nothing.
+
+    **Stateful, and the state is the whole difference from JPEG.** A predicted frame means nothing
+    without the frames it refers to, so this holds one decoder for the life of a connection and
+    feeds it in arrival order. It produces nothing until a keyframe and its parameter sets have
+    both arrived, which `mediad` makes certain of by asking its encoder for a keyframe when the
+    valve opens and by carrying SPS/PPS in front of every one (`h264parse config-interval=-1`).
+
+    `parse` before `decode` even though `mediad` sends whole access units: the parser is what
+    strips start codes and splits a unit that arrived with its parameter sets glued in front,
+    which is exactly what a keyframe looks like here.
+    """
+    import av
+
+    codec = av.CodecContext.create("h264", "r")
+
+    def decode(unit: bytes) -> list[np.ndarray]:
+        pictures: list[np.ndarray] = []
+        for packet in codec.parse(unit):
+            for frame in codec.decode(packet):
+                pictures.append(frame.to_ndarray(format="rgb24"))
+        return pictures
+
+    return decode
+
+
+def mount(app: Any) -> None:
+    """Add `GET /frames` (WebSocket) to a FastAPI app.
+
+    A route on a FastAPI app that *owns* the server, with Gradio mounted into it — not a route
+    added to Gradio's own app. Mounting Gradio inside FastAPI is the documented direction; the
+    reverse has known WebSocket breakage, which would be an unusually annoying thing to discover
+    from inside a Space.
+
+    **`WebSocket` is imported at module level and must stay there.** This file has
+    `from __future__ import annotations`, so every annotation is a string that FastAPI resolves
+    with `get_type_hints` against the *module's* globals. Imported inside this function instead,
+    the name is a local: FastAPI cannot resolve `socket: WebSocket`, stops recognising the
+    parameter as the connection, fails to build the route's dependencies, and closes every
+    incoming socket before the handler runs — which the robot is told as an HTTP 403 and reads as
+    a wrong url. It took a header probe to find, because nothing logs it at either end.
+    """
+    @app.websocket("/frames")
+    async def frames(socket: WebSocket) -> None:  # pyright: ignore[reportUnusedFunction]
+        # **Resolved before the upgrade is accepted.** A socket accepted and then closed looks to
+        # the robot exactly like a receiver that hung up, and it would redial forever.
+        header = socket.headers.get("authorization") or ""
+        token = header[len("Bearer ") :].strip() if header.lower().startswith("bearer ") else ""
+        if not token:
+            # **Said out loud**, because a refusal is invisible from the robot's side: closing
+            # before `accept` is reported to it as an HTTP 403, which reads exactly like a wrong
+            # url. This line is the difference between "the Space refused my token" and an
+            # afternoon of guessing.
+            logger.info(
+                "a frame stream was refused: no bearer token (authorization header %s)",
+                "absent" if not header else f"present, {len(header)} chars, not Bearer",
+            )
+            await socket.close(code=1008, reason="no bearer token")
+            return
+        username = whoami(token)
+        if not username:
+            logger.info("a frame stream was refused: whoami-v2 did not know that token")
+            await socket.close(code=1008, reason="Hugging Face did not know that token")
+            return
+
+        await socket.accept()
+        logger.info("a robot on %s's account opened a frame stream", username)
+
+        stream: Stream | None = None
+        robot = "a duck"
+        try:
+            while True:
+                message = await socket.receive()
+                if "text" in message and message["text"] is not None:
+                    # The hello. One per connection, and a redial sends a new one — a Space
+                    # restarts on every push, so the robot cannot assume we remember anything.
+                    try:
+                        hello = json.loads(message["text"])
+                    except ValueError:
+                        continue
+                    robot = (hello.get("robot") or {}).get("name") or robot
+                    stream = FRAMES.opened(username, robot, hello)
+                    logger.info("hello from %s: %s", robot, message["text"][:200])
+                elif "bytes" in message and message["bytes"] is not None:
+                    if stream is None:
+                        # Frames before a hello: acceptable rather than fatal, since what is
+                        # missing is a label rather than a picture.
+                        stream = FRAMES.opened(username, robot, {})
+                    FRAMES.arrived(stream, message["bytes"])
+                elif message.get("type") == "websocket.disconnect":
+                    break
+        except WebSocketDisconnect:
+            pass
+        except Exception as e:  # noqa: BLE001 - one bad socket is not a bad Space
+            logger.warning("a frame stream failed: %r", e)
+        finally:
+            FRAMES.closed(username, robot)
+            logger.info("the frame stream from %s ended", robot)
diff --git a/spaces/vision-demo/rendezvous.py b/spaces/vision-demo/rendezvous.py
new file mode 120000
index 00000000..044f900e
--- /dev/null
+++ b/spaces/vision-demo/rendezvous.py
@@ -0,0 +1 @@
+../shared/rendezvous.py
\ No newline at end of file
diff --git a/spaces/vision-demo/requirements.txt b/spaces/vision-demo/requirements.txt
new file mode 100644
index 00000000..736cdd3c
--- /dev/null
+++ b/spaces/vision-demo/requirements.txt
@@ -0,0 +1,32 @@
+# The UI. Gradio because its OAuth support is a button rather than a flow to implement — the
+# console page learned what implementing one costs (`remote-access-design.md` §5.0).
+#
+# **`[oauth]`, not bare `gradio`**: `gr.LoginButton` needs `itsdangerous` and `authlib`, and
+# without them a Space with `hf_oauth: true` fails at *import* rather than at the first click,
+# with nothing on the page to say which library is missing.
+gradio[oauth]>=5
+
+# FastAPI owns the server here and Gradio is mounted into it, because the robot's frames arrive on
+# a WebSocket route of our own. `uvicorn` is what serves it, and `websockets` is the protocol
+# implementation uvicorn needs for a `ws://` route — a Space without it answers the robot's
+# handshake with a 404 that looks like a wrong url.
+fastapi
+uvicorn[standard]
+websockets
+
+# The H.264 decoder, and nothing else from the WebRTC world: `av` is FFmpeg's bindings, which is
+# what turns the robot's access units back into pictures. It is the one thing H.264 costs this
+# Space over JPEG, and it is a decoder rather than a transport — `aiortc` is not back.
+av
+
+# The processing. `-headless` because a container has no display and the GUI build drags in the
+# whole of GTK to be linked and never used.
+opencv-python-headless
+numpy
+
+# Reading the rendezvous and `whoami-v2`. Both are plain HTTP now: **there is no WebRTC stack in
+# this Space any more.** It used to pull frames with `reachy_mini[central-consumer]`, which meant
+# `aiortc` and `av` and a DTLS cipher shim, and which could never connect from a data centre for
+# want of a relay candidate. The robot dials us instead, so all of that is gone.
+requests
+huggingface_hub
diff --git a/spaces/vision-demo/wire.py b/spaces/vision-demo/wire.py
new file mode 120000
index 00000000..2db9e255
--- /dev/null
+++ b/spaces/vision-demo/wire.py
@@ -0,0 +1 @@
+../shared/wire.py
\ No newline at end of file
diff --git a/tof/Cargo.toml b/tof/Cargo.toml
index c3791724..e49f73c9 100644
--- a/tof/Cargo.toml
+++ b/tof/Cargo.toml
@@ -23,6 +23,9 @@ path = "src/main.rs"
 anyhow = "1"
 clap = { workspace = true, features = ["derive"] }
 duck-ipc-proto = { path = "../duck-ipc-proto" }
+# `[head_imu]` lives in `robotd.toml`, and this crate is the schema for that file — the same
+# dependency, for the same reason, that `mediad` takes on for `[media]`. See `src/config.rs`.
+robotd-params = { path = "../robotd-params" }
 libc = "0.2"
 serde = { workspace = true }
 serde_json.workspace = true
@@ -30,5 +33,22 @@ tokio = { workspace = true, features = ["macros", "net", "rt", "signal", "sync",
 tracing.workspace = true
 tracing-subscriber = { workspace = true, features = ["env-filter"] }
 
+# The head IMU (`src/imu.rs`) reaches the BMI088 through `/dev/i2c-*`, which exists on no other
+# platform — the same rule `build.rs` already applies to the vendored ULDs, and for the same reason:
+# `cargo test --workspace` has to run on a developer's Mac. Off Linux `tofd` still builds, still
+# serves depth from `--fake` or `--sim`, and answers `head_imu.stream` with why it has no sensor.
+[target.'cfg(target_os = "linux")'.dependencies]
+# The BMI088 driver and its Madgwick fusion, ours because the crates.io ones stop at the raw
+# registers. Pinned to a tag: it is a second repository and a moving `main` is not a dependency.
+# v0.1.2 is the one that has `Bmi088Ahrs::update_all`, which is what takes a head-IMU sample
+# from three I²C transactions to two.
+bmi088 = { git = "https://github.com/pollen-robotics/bmi088-rs", tag = "v0.1.2" }
+# `I2cdev`, the `embedded-hal` bus the driver is generic over. Linux-only by construction —
+# `i2cdev`'s `linux` module is the whole crate.
+linux-embedded-hal = "0.4"
+
 [build-dependencies]
 cc = "1"
+
+[dev-dependencies]
+tempfile = "3.27.0"
diff --git a/tof/src/config.rs b/tof/src/config.rs
new file mode 100644
index 00000000..65dbd0ac
--- /dev/null
+++ b/tof/src/config.rs
@@ -0,0 +1,66 @@
+//! `[head_imu]` in `/etc/robot/robotd.toml`, which is where this daemon's one switch lives.
+//!
+//! Read out of `robotd`'s file rather than a file of its own, exactly as `mediad` reads
+//! `[media]`: the schema, the defaults and the validation are `robotd_params`'s, so the value
+//! `robotctl configure` writes is the value this daemon understands, and a key cannot drift
+//! between an editor and a reader.
+//!
+//! Its own module rather than four lines in `main`, for the reason `mediad`'s config is: `main`
+//! here is largely Linux-only, so anything living in it is not compiled — let alone tested — on
+//! the machine it is written on.
+
+use std::path::{Path, PathBuf};
+
+use robotd_params::Params;
+
+/// The file, when `--config` said nothing.
+pub fn default_path() -> PathBuf {
+    PathBuf::from(robotd_params::DEFAULT_PATH)
+}
+
+/// Read the file, or fall back to the built-in defaults.
+///
+/// **A file this daemon cannot read is not a reason to stop ranging.** `robotd` refuses to start
+/// on a broken params file, which is the loud signal and belongs to the daemon whose control loop
+/// the file configures; depth is what somebody looks at while sorting that out. So this warns,
+/// names the file, and carries on with the defaults — which for `[head_imu]` means off, the same
+/// answer an unprovisioned board gets.
+pub fn load(path: &Path, explicit: bool) -> Params {
+    match Params::load(path, explicit) {
+        Ok(params) => params,
+        Err(e) => {
+            tracing::warn!(
+                error = %e,
+                path = %path.display(),
+                "unusable params file; carrying on with the built-in defaults"
+            );
+            Params::default()
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The default is off, and it is the answer on a board with no file at all — which is what
+    /// makes "no head IMU samples" the normal state rather than a fault to chase.
+    #[test]
+    fn the_head_imu_is_off_by_default_and_on_an_unprovisioned_board() {
+        assert!(!Params::default().head_imu.enabled);
+
+        let dir = tempfile::tempdir().expect("tempdir");
+        let missing = dir.path().join("robotd.toml");
+        assert!(!load(&missing, false).head_imu.enabled);
+    }
+
+    /// And on it when somebody has said so. The point of reading `robotd`'s file at all: this is
+    /// the key `robotctl configure` writes.
+    #[test]
+    fn the_file_turns_it_on() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("robotd.toml");
+        std::fs::write(&path, "[head_imu]\nenabled = true\n").expect("write");
+        assert!(load(&path, true).head_imu.enabled);
+    }
+}
diff --git a/tof/src/imu.rs b/tof/src/imu.rs
new file mode 100644
index 00000000..66e4462b
--- /dev/null
+++ b/tof/src/imu.rs
@@ -0,0 +1,299 @@
+//! The head IMU (BMI088 on the HAT), read by `tofd` because `tofd` owns this I²C bus.
+//!
+//! The BMI088 sits on the same bus as the ToF (accel `0x19`, gyro `0x68` per the HAT schematic —
+//! next to the ToF's `0x29` and the audio codec's `0x18`, no collision). The bus is accessed one
+//! transaction at a time (each carries its slave address), so a second `i2cdev` handle for the IMU
+//! coexists with the ToF driver's handle; the kernel serialises transactions at the adapter.
+//!
+//! Runs on its own std thread, not the ToF thread: the ToF blocks for seconds uploading firmware
+//! and backs off for up to a minute when no sensor is fitted, and the IMU stream must not stall
+//! behind that. Same shape as the ToF loop otherwise — open, read at `hz`, broadcast frames,
+//! retry with backoff on error — so a BMI088 fitted later needs no reconnect.
+//!
+//! **Linux only, and quietly so**, like the vendored ULDs `build.rs` skips off a board: the bus is
+//! `/dev/i2c-*` and the driver is `linux-embedded-hal`, so on a developer's Mac there is no sensor
+//! to open and `imu_loop` says as much instead of being compiled. `tofd` still builds and still
+//! serves depth from `--fake` or `--sim` there, which is what a laptop runs it for.
+//!
+//! Orientation is a Madgwick fusion (the `bmi088` crate's `Bmi088Ahrs`); `gyro`/`accel` are the
+//! raw sensor axes. Placing the sample in the head frame (the IMU is rigid to the camera) is a
+//! `kinematics` job for the consumer, not this daemon's.
+
+use std::path::Path;
+use std::sync::Arc;
+use std::sync::atomic::AtomicBool;
+
+use duck_ipc_proto as proto;
+
+#[cfg(target_os = "linux")]
+use std::path::PathBuf;
+#[cfg(target_os = "linux")]
+use std::sync::atomic::Ordering;
+#[cfg(target_os = "linux")]
+use std::time::{Duration, Instant};
+
+#[cfg(target_os = "linux")]
+use bmi088::{Bmi088, Bmi088Ahrs, Config};
+#[cfg(target_os = "linux")]
+use linux_embedded_hal::I2cdev;
+
+#[cfg(target_os = "linux")]
+use crate::BUS_CANDIDATES;
+
+/// Madgwick convergence rate. 0.1 is the crate's recommended starting point: fast enough to track
+/// a walking head, slow enough not to chase gyro noise.
+#[cfg(target_os = "linux")]
+const BETA: f64 = 0.1;
+
+/// Reopen backoff after an I²C error, same reasoning as the ToF loop: a bus glitch and a missing
+/// chip look alike from here, and one backoff serves both without hammering a shared bus.
+#[cfg(target_os = "linux")]
+const RETRY_MIN: Duration = Duration::from_millis(500);
+#[cfg(target_os = "linux")]
+const RETRY_MAX: Duration = Duration::from_secs(30);
+
+/// How far an IMU subscriber may fall behind before it loses samples. At 100 Hz this is ~2.5 s.
+pub const FRAME_BUFFER: usize = 256;
+
+/// Read `temp_c` this often (every Nth sample); it barely moves and costs a bus read.
+#[cfg(target_os = "linux")]
+const TEMP_EVERY: u64 = 100;
+
+/// What the `head_imu.stream` answer reports — whether a BMI088 was found and at what rate.
+#[derive(Clone)]
+pub struct ImuStatus {
+    hz: u8,
+    inner: Arc<std::sync::Mutex<Inner>>,
+}
+
+#[derive(Default)]
+struct Inner {
+    sensor: Option<String>,
+    unavailable: Option<String>,
+}
+
+impl ImuStatus {
+    pub fn new(hz: u8) -> Self {
+        Self {
+            hz,
+            inner: Arc::new(std::sync::Mutex::new(Inner {
+                unavailable: Some("no reading yet".to_owned()),
+                ..Inner::default()
+            })),
+        }
+    }
+
+    #[cfg(target_os = "linux")]
+    fn found(&self, sensor: &str) {
+        let mut inner = self.inner.lock().unwrap();
+        inner.sensor = Some(sensor.to_owned());
+        inner.unavailable = None;
+    }
+
+    /// Switched off in the config, rather than absent or broken.
+    ///
+    /// A separate sentence from [`Self::lost`] on purpose: every other reason this stream has
+    /// nothing is a board to go and look at, and this one is a line in `robotd.toml`. A
+    /// subscriber that cannot tell them apart sends somebody to check a cable.
+    pub fn off(&self) {
+        self.lost(
+            "the head IMU is off — `[head_imu] enabled = true` in robotd.toml, then restart tofd"
+                .to_owned(),
+        );
+    }
+
+    fn lost(&self, why: String) {
+        let mut inner = self.inner.lock().unwrap();
+        inner.sensor = None;
+        inner.unavailable = Some(why);
+    }
+
+    pub fn result(&self) -> proto::HeadImuStreamResult {
+        let inner = self.inner.lock().unwrap();
+        proto::HeadImuStreamResult {
+            accepted: true,
+            sensor: inner.sensor.clone(),
+            unavailable: inner.unavailable.clone(),
+            hz: self.hz,
+        }
+    }
+}
+
+/// Read the BMI088 forever, broadcasting [`proto::HeadImuFrame`]. Returns only at shutdown.
+#[cfg(target_os = "linux")]
+pub fn imu_loop(
+    bus: Option<&Path>,
+    hz: u8,
+    status: &ImuStatus,
+    frames: &tokio::sync::broadcast::Sender<proto::HeadImuFrame>,
+    shutdown: &Arc<AtomicBool>,
+) {
+    let started = Instant::now();
+    let period = Duration::from_secs_f64(1.0 / f64::from(hz.max(1)));
+    let mut seq = 0u64;
+    let mut backoff = RETRY_MIN;
+
+    while !shutdown.load(Ordering::Acquire) {
+        let mut ahrs = match open_imu(bus) {
+            Ok(a) => {
+                tracing::info!("head IMU found: BMI088");
+                status.found("BMI088");
+                backoff = RETRY_MIN;
+                a
+            }
+            Err(e) => {
+                status.lost(e.to_string());
+                tracing::warn!(error = %e, backoff_ms = backoff.as_millis(), "no head IMU; will retry");
+                sleep_unless_shutdown(backoff, shutdown);
+                backoff = (backoff * 2).min(RETRY_MAX);
+                continue;
+            }
+        };
+
+        // Read until an error, then fall out to reopen. `last` gives Madgwick its dt.
+        let mut last = Instant::now();
+        let mut temp_c = 0.0f32;
+        while !shutdown.load(Ordering::Acquire) {
+            let tick = Instant::now();
+            let dt = (tick - last).as_secs_f32().clamp(1e-4, 0.2);
+            last = tick;
+            // `update_all` rather than `update`: both read the accelerometer and the gyroscope,
+            // and only this one hands the accelerometer sample back. Asking for it afterwards —
+            // which is what this loop used to do — read the same six registers a second time.
+            //
+            // **Not for the CPU.** A transaction is worth about 9 µs of the ~440 µs a sample
+            // costs on this board (`bench_imu` at 100 Hz: 4.53% for three reads against 4.46%
+            // for two), so this buys nothing measurable and the idle cost of this thread is
+            // somewhere else entirely. What it buys is that the published `accel` is the sample
+            // the quaternion was computed from, rather than one read ~200 µs later, and that a
+            // read can fail in one place instead of two — either chip failing reopens rather
+            // than publishing a zero acceleration, which a consumer cannot tell from free-fall.
+            match ahrs.update_all(dt) {
+                Ok((accel, gyro, quat)) => {
+                    if seq.is_multiple_of(TEMP_EVERY)
+                        && let Ok(t) = ahrs.imu().read_temperature()
+                    {
+                        temp_c = t;
+                    }
+                    seq += 1;
+                    let _ = frames.send(proto::HeadImuFrame {
+                        seq,
+                        at_us: started.elapsed().as_micros() as u64,
+                        t_ns: proto::clock::monotonic_ns(),
+                        gyro,
+                        accel,
+                        quat,
+                        temp_c,
+                    });
+                }
+                Err(e) => {
+                    status.lost(format!("read failed: {e:?}"));
+                    tracing::warn!("head IMU read failed; reopening");
+                    break;
+                }
+            }
+            let elapsed = tick.elapsed();
+            if elapsed < period {
+                sleep_unless_shutdown(period - elapsed, shutdown);
+            }
+        }
+
+        // A read failure fell straight back into `open_imu`: a chip that answers its ID but
+        // cannot stream was reopened in a tight loop, warning each time, on the bus the audio
+        // codec shares. Same backoff as the open-failure path above.
+        sleep_unless_shutdown(backoff, shutdown);
+        backoff = (backoff * 2).min(RETRY_MAX);
+    }
+}
+
+/// Off Linux there is no `/dev/i2c-*` to open, so this returns at once and the status says why —
+/// the same answer `head_imu.stream` gives on a board whose HAT has no BMI088 fitted, which is the
+/// shape every consumer already handles.
+#[cfg(not(target_os = "linux"))]
+pub fn imu_loop(
+    _bus: Option<&Path>,
+    _hz: u8,
+    status: &ImuStatus,
+    _frames: &tokio::sync::broadcast::Sender<proto::HeadImuFrame>,
+    _shutdown: &Arc<AtomicBool>,
+) {
+    status.lost("the head IMU is on an I2C bus, which exists only on Linux".to_owned());
+}
+
+/// Open the BMI088 on the first bus that answers. The `bmi088` crate hardwires accel `0x19` /
+/// gyro `0x68` (the HAT's addresses), so there is nothing to sweep — a failure to read the
+/// chip-id in `Bmi088::new` is the "not fitted / bus glitch" signal.
+#[cfg(target_os = "linux")]
+fn open_imu(bus: Option<&Path>) -> anyhow::Result<Bmi088Ahrs<I2cdev>> {
+    let buses: Vec<PathBuf> = match bus {
+        Some(bus) => vec![bus.to_path_buf()],
+        None => BUS_CANDIDATES.iter().map(PathBuf::from).collect(),
+    };
+    let mut last = None;
+    for bus in &buses {
+        if !bus.exists() {
+            last = Some(anyhow::anyhow!("{} does not exist", bus.display()));
+            continue;
+        }
+        let i2c = match I2cdev::new(bus) {
+            Ok(i2c) => i2c,
+            Err(e) => {
+                last = Some(anyhow::anyhow!("open {}: {e}", bus.display()));
+                continue;
+            }
+        };
+        match Bmi088::new(i2c, Config::default()) {
+            Ok(imu) => {
+                tracing::info!(bus = %bus.display(), "BMI088 answered");
+                return Ok(Bmi088Ahrs::new(imu, BETA));
+            }
+            Err(e) => last = Some(anyhow::anyhow!("BMI088 init on {}: {e:?}", bus.display())),
+        }
+    }
+    Err(last.unwrap_or_else(|| anyhow::anyhow!("no bus to look on")))
+}
+
+#[cfg(target_os = "linux")]
+fn sleep_unless_shutdown(dur: Duration, shutdown: &Arc<AtomicBool>) {
+    // Slice the sleep so shutdown is prompt even during a long backoff.
+    let slice = Duration::from_millis(50);
+    let mut left = dur;
+    while left > Duration::ZERO && !shutdown.load(Ordering::Acquire) {
+        let step = left.min(slice);
+        std::thread::sleep(step);
+        left = left.saturating_sub(step);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The three answers a subscriber can get, and the one this switch adds.
+    ///
+    /// "Off" has to be distinguishable from "not fitted" in the sentence itself, because they
+    /// are the same silence: one is a line in a file and the other is a board to go and look
+    /// at. So the reason names the key.
+    #[test]
+    fn switched_off_reads_differently_from_absent() {
+        let status = ImuStatus::new(100);
+
+        let fresh = status.result();
+        assert!(fresh.sensor.is_none());
+        assert_eq!(fresh.hz, 100);
+
+        status.off();
+        let off = status.result();
+        let why = off.unavailable.expect("a reason");
+        assert!(why.contains("[head_imu] enabled"), "{why}");
+        assert!(off.sensor.is_none());
+        // Still `accepted`: the subscription is fine, there is simply nothing coming. A refusal
+        // would send a client into a reconnect loop over a setting.
+        assert!(off.accepted);
+
+        status.lost("nothing answered on any bus".to_owned());
+        let absent = status.result();
+        let why = absent.unavailable.expect("a reason");
+        assert!(!why.contains("[head_imu]"), "{why}");
+    }
+}
diff --git a/tof/src/main.rs b/tof/src/main.rs
index 9280eabc..70a4339a 100644
--- a/tof/src/main.rs
+++ b/tof/src/main.rs
@@ -38,7 +38,10 @@ use duck_ipc_proto as proto;
 use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
 use tokio::net::{UnixListener, UnixStream};
 
+mod config;
+mod imu;
 mod status;
+use imu::ImuStatus;
 use status::Status;
 
 /// Same mode and reasoning as every other socket here: the group decides who may
@@ -94,7 +97,7 @@ const RETRY_MAX: Duration = Duration::from_secs(60);
 /// answer on a board provisioned before that rule existed. Trying both means a
 /// board that predates the rule still finds its sensor, and the log says which
 /// path answered.
-const BUS_CANDIDATES: [&str; 2] = ["/dev/i2c-pihat", "/dev/i2c-3"];
+pub(crate) const BUS_CANDIDATES: [&str; 2] = ["/dev/i2c-pihat", "/dev/i2c-3"];
 
 /// Addresses to try when none was named.
 ///
@@ -132,6 +135,38 @@ struct Args {
     /// been drawn.
     #[arg(long)]
     fake: bool,
+
+    /// Head-IMU (BMI088) sample rate, Hz. The chip's default bandwidth is 100 Hz.
+    #[arg(long, default_value_t = 100)]
+    imu_hz: u8,
+
+    /// Read the head IMU for this session, whatever `[head_imu] enabled` says.
+    ///
+    /// The switch lives in `robotd.toml` because that is what `robotctl configure` writes; this
+    /// is for trying the chip by hand on a board that has not opted in.
+    #[arg(long, conflicts_with = "no_imu")]
+    imu: bool,
+
+    /// Do not read the head IMU, whatever the file says (a board without the HAT module, or to
+    /// free the bus for a measurement).
+    #[arg(long)]
+    no_imu: bool,
+
+    /// Params file. `[head_imu]` is read from it; everything else here is a flag.
+    #[arg(long)]
+    config: Option<PathBuf>,
+
+    /// Read frames from a simulated body at `host:port` instead of a sensor.
+    ///
+    /// **The fake at the loop level, with a simulator behind it** — which is where a fake belongs
+    /// here: `sensor.rs` says in as many words that the off-board `Sensor` "is not a fake sensor and
+    /// must never become one", because the thing it stands for is a vendor C library talking to a
+    /// bus. A frame arriving from somewhere else is a different question from a sensor that lies.
+    ///
+    /// The simulator answers `{"op":"tof"}` with the same 8x8 of distances and per-zone statuses
+    /// this daemon publishes, so nothing downstream — `robotd`, the viewer — can tell.
+    #[arg(long, conflicts_with = "fake")]
+    sim: Option<String>,
 }
 
 fn parse_address(s: &str) -> Result<u8, String> {
@@ -176,10 +211,13 @@ async fn main() -> std::process::ExitCode {
         let address = args.address;
         let hz = args.hz;
         let fake = args.fake;
+        let sim = args.sim.clone();
         std::thread::Builder::new()
             .name("tof-sensor".to_owned())
             .spawn(move || {
-                if fake {
+                if let Some(addr) = sim {
+                    sim_loop(&addr, hz, &status, &frames, &shutdown);
+                } else if fake {
                     fake_loop(hz, &status, &frames, &shutdown);
                 } else {
                     sensor_loop(bus.as_deref(), address, hz, &status, &frames, &shutdown);
@@ -188,9 +226,57 @@ async fn main() -> std::process::ExitCode {
             .expect("spawn the sensor thread")
     };
 
-    let served = serve(&args.socket, &status, &frames).await;
+    // The head IMU on its own thread and channel, on the same bus. Its socket is the same one;
+    // subscribers pick the stream by method.
+    //
+    // **Off unless `[head_imu] enabled` says otherwise**, and that default is the measurement in
+    // `docs/project/tof-on-demand.md`: reading this chip at 100 Hz costs ~3.5-4.5% of a core, of
+    // which the wakeups are 0.7 points and the fusion 0.3 — the rest is two I²C transactions a
+    // sample, which is what a gyro and an accelerometer sample *is*. Nothing in the loop was
+    // worth fixing, nothing subscribes to the stream yet, and a duck that is not mapping was
+    // paying for it from boot.
+    //
+    // Skipped for --sim/--fake too: there is no real bus behind either.
+    let imu_status = Arc::new(ImuStatus::new(args.imu_hz));
+    let (imu_frames, _) = tokio::sync::broadcast::channel(imu::FRAME_BUFFER);
+    let config_path = args.config.clone().unwrap_or_else(config::default_path);
+    let configured = config::load(&config_path, args.config.is_some())
+        .head_imu
+        .enabled;
+    let wanted = args.imu || (configured && !args.no_imu);
+    let imu_thread = if !wanted || args.fake || args.sim.is_some() {
+        // Said out loud, and said by the stream too: a subscriber gets this sentence instead of
+        // frames, because "no samples" and "no BMI088 fitted" are different answers and only one
+        // of them is somebody's mistake.
+        if !wanted {
+            tracing::info!(
+                config = %config_path.display(),
+                "the head IMU is off; set [head_imu] enabled = true to read it"
+            );
+            imu_status.off();
+        }
+        None
+    } else {
+        let (imu_status, imu_frames, shutdown) =
+            (imu_status.clone(), imu_frames.clone(), shutdown.clone());
+        let bus = args.bus.clone();
+        let hz = args.imu_hz;
+        Some(
+            std::thread::Builder::new()
+                .name("head-imu".to_owned())
+                .spawn(move || {
+                    imu::imu_loop(bus.as_deref(), hz, &imu_status, &imu_frames, &shutdown)
+                })
+                .expect("spawn the head-imu thread"),
+        )
+    };
+
+    let served = serve(&args.socket, &status, &frames, &imu_status, &imu_frames).await;
     shutdown.store(true, Ordering::Release);
     let _ = sensor_thread.join();
+    if let Some(t) = imu_thread {
+        let _ = t.join();
+    }
 
     match served {
         Ok(()) => std::process::ExitCode::SUCCESS,
@@ -267,6 +353,7 @@ fn sensor_loop(
                                 let _ = frames.send(proto::TofFrame {
                                     seq,
                                     at_us: started.elapsed().as_micros() as u64,
+                                    t_ns: proto::clock::monotonic_ns(),
                                     rows: frame.rows,
                                     cols: frame.cols,
                                     distance_mm: frame.distance_mm,
@@ -349,6 +436,7 @@ fn fake_loop(
         let _ = frames.send(proto::TofFrame {
             seq,
             at_us: started.elapsed().as_micros() as u64,
+            t_ns: proto::clock::monotonic_ns(),
             rows: tof::ROWS as u8,
             cols: tof::COLS as u8,
             distance_mm,
@@ -358,6 +446,113 @@ fn fake_loop(
     }
 }
 
+/// Frames from a simulated body, at the sensor's own rate.
+///
+/// Newline-delimited JSON over TCP, the same link `duck_control::sim` uses for the servo bus — one
+/// handshake, then a request per frame. A simulator that goes away is one missed frame and a
+/// reconnect, not a dead daemon: MuJoCo is restarted whenever the number of ducks changes, and a
+/// duck is expected to live through that.
+fn sim_loop(
+    addr: &str,
+    hz: u8,
+    status: &Arc<Status>,
+    frames: &tokio::sync::broadcast::Sender<proto::TofFrame>,
+    shutdown: &Arc<AtomicBool>,
+) {
+    use std::io::{BufRead, Write};
+
+    let started = Instant::now();
+    let period = Duration::from_secs_f64(1.0 / f64::from(hz.max(1)));
+    let mut seq = 0u64;
+    let mut link: Option<SimLink> = None;
+    let mut complained = false;
+
+    while !shutdown.load(Ordering::Acquire) {
+        if link.is_none() {
+            match connect_sim(addr) {
+                Ok(fresh) => {
+                    tracing::info!(%addr, "simulated depth");
+                    status.up("sim");
+                    complained = false;
+                    link = Some(fresh);
+                }
+                Err(e) => {
+                    if !complained {
+                        complained = true;
+                        tracing::warn!(%addr, error = %e, "no simulated body; retrying");
+                        status.down(&format!("no simulated body at {addr}"));
+                    }
+                    sleep_unless_shutdown(period, shutdown);
+                    continue;
+                }
+            }
+        }
+
+        let (write, read) = link.as_mut().expect("just connected");
+        let frame = write.write_all(b"{\"op\":\"tof\"}\n").and_then(|()| {
+            let mut line = String::new();
+            read.read_line(&mut line)?;
+            if line.is_empty() {
+                return Err(std::io::Error::other("the simulator closed the connection"));
+            }
+            serde_json::from_str::<SimDepth>(&line).map_err(std::io::Error::other)
+        });
+
+        match frame {
+            Ok(depth) => {
+                seq += 1;
+                let _ = frames.send(proto::TofFrame {
+                    seq,
+                    at_us: started.elapsed().as_micros() as u64,
+                    t_ns: proto::clock::monotonic_ns(),
+                    rows: depth.rows,
+                    cols: depth.cols,
+                    distance_mm: depth.distance_mm,
+                    status: depth.status,
+                });
+            }
+            Err(e) => {
+                tracing::debug!(error = %e, "lost the simulated body");
+                link = None;
+                continue;
+            }
+        }
+        sleep_unless_shutdown(period, shutdown);
+    }
+}
+
+type SimLink = (std::net::TcpStream, std::io::BufReader<std::net::TcpStream>);
+
+/// One connection to a simulated body, handshake included.
+fn connect_sim(addr: &str) -> std::io::Result<SimLink> {
+    use std::io::{BufRead, Write};
+
+    let stream = std::net::TcpStream::connect(addr)?;
+    // Nagle would add tens of milliseconds to a 15 Hz request/response, which is most of a frame.
+    let _ = stream.set_nodelay(true);
+    let _ = stream.set_read_timeout(Some(Duration::from_millis(500)));
+    let mut write = stream.try_clone()?;
+    let mut read = std::io::BufReader::new(stream);
+    write.write_all(b"{\"op\":\"hello\",\"protocol\":1,\"joints\":15}\n")?;
+    let mut line = String::new();
+    read.read_line(&mut line)?;
+    if line.is_empty() {
+        return Err(std::io::Error::other(
+            "the simulator hung up during the handshake",
+        ));
+    }
+    Ok((write, read))
+}
+
+/// What the simulator answers `{"op":"tof"}` with.
+#[derive(serde::Deserialize)]
+struct SimDepth {
+    rows: u8,
+    cols: u8,
+    distance_mm: Vec<i16>,
+    status: Vec<u8>,
+}
+
 /// Try the named bus and address, or every candidate, and return the first
 /// sensor that comes up ranging.
 fn open_sensor(bus: Option<&Path>, address: Option<u8>, hz: u8) -> Result<tof::Sensor> {
@@ -409,6 +604,8 @@ async fn serve(
     socket: &Path,
     status: &Arc<Status>,
     frames: &tokio::sync::broadcast::Sender<proto::TofFrame>,
+    imu_status: &Arc<ImuStatus>,
+    imu_frames: &tokio::sync::broadcast::Sender<proto::HeadImuFrame>,
 ) -> Result<()> {
     if let Some(parent) = socket.parent() {
         // `RuntimeDirectory=tofd` has already made this on a board; tried anyway
@@ -448,9 +645,11 @@ async fn serve(
             accepted = listener.accept() => match accepted {
                 Ok((stream, _)) => {
                     let status = status.clone();
+                    let imu_status = imu_status.clone();
                     let frames = frames.subscribe();
+                    let imu_frames = imu_frames.subscribe();
                     tokio::spawn(async move {
-                        if let Err(e) = subscriber(stream, &status, frames).await {
+                        if let Err(e) = subscriber(stream, &status, frames, &imu_status, imu_frames).await {
                             tracing::debug!(error = %e, "subscriber ended");
                         }
                     });
@@ -474,6 +673,8 @@ async fn subscriber(
     stream: UnixStream,
     status: &Arc<Status>,
     mut frames: tokio::sync::broadcast::Receiver<proto::TofFrame>,
+    imu_status: &Arc<ImuStatus>,
+    mut imu_frames: tokio::sync::broadcast::Receiver<proto::HeadImuFrame>,
 ) -> Result<()> {
     let (read, mut write) = stream.into_split();
     let mut reader = BufReader::new(read);
@@ -503,31 +704,63 @@ async fn subscriber(
             Ok(proto::Call::TofStream) => {
                 let response = proto::Response::ok(id, &status.result());
                 write_line(&mut write, &response).await?;
-                break;
+                return stream_tof(&mut write, &mut frames).await;
+            }
+            Ok(proto::Call::HeadImuStream) => {
+                let response = proto::Response::ok(id, &imu_status.result());
+                write_line(&mut write, &response).await?;
+                return stream_imu(&mut write, &mut imu_frames).await;
             }
             _ => {
                 let response = proto::Response::err(
                     id,
                     proto::Error::new(
                         proto::code::METHOD_NOT_FOUND,
-                        "tofd serves tof.stream and nothing else",
+                        "tofd serves tof.stream and head_imu.stream and nothing else",
                     ),
                 );
                 write_line(&mut write, &response).await?;
             }
         }
     }
+}
 
-    // Frames, as notifications, until the socket closes or this consumer falls
-    // too far behind. A lag is not fatal: the gap shows in `seq`, and the next
-    // frame is 66 ms away.
+/// Stream ToF frames as notifications until the socket closes or the consumer lags out. A lag is
+/// not fatal — the gap shows in `seq`, and the next frame is 66 ms away.
+async fn stream_tof(
+    write: &mut tokio::net::unix::OwnedWriteHalf,
+    frames: &mut tokio::sync::broadcast::Receiver<proto::TofFrame>,
+) -> Result<()> {
     loop {
         match frames.recv().await {
             Ok(frame) => {
                 let notification = proto::Request::notify_tof_frame(&frame);
-                if let Err(e) = write_line(&mut write, &notification).await {
-                    // A subscriber that went away mid-write is the ordinary end
-                    // of a `robotctl monitor` session, not an incident.
+                if let Err(e) = write_line(write, &notification).await {
+                    return if e.kind() == ErrorKind::BrokenPipe {
+                        Ok(())
+                    } else {
+                        Err(e.into())
+                    };
+                }
+            }
+            Err(tokio::sync::broadcast::error::RecvError::Lagged(missed)) => {
+                tracing::debug!(missed, "a tof subscriber fell behind");
+            }
+            Err(tokio::sync::broadcast::error::RecvError::Closed) => return Ok(()),
+        }
+    }
+}
+
+/// Stream head-IMU samples as notifications; same lag/broken-pipe handling as the ToF stream.
+async fn stream_imu(
+    write: &mut tokio::net::unix::OwnedWriteHalf,
+    frames: &mut tokio::sync::broadcast::Receiver<proto::HeadImuFrame>,
+) -> Result<()> {
+    loop {
+        match frames.recv().await {
+            Ok(frame) => {
+                let notification = proto::Request::notify_head_imu_frame(&frame);
+                if let Err(e) = write_line(write, &notification).await {
                     return if e.kind() == ErrorKind::BrokenPipe {
                         Ok(())
                     } else {
@@ -536,10 +769,8 @@ async fn subscriber(
                 }
             }
             Err(tokio::sync::broadcast::error::RecvError::Lagged(missed)) => {
-                tracing::debug!(missed, "a subscriber fell behind");
+                tracing::debug!(missed, "an imu subscriber fell behind");
             }
-            // The sender lives as long as the process, so this cannot happen
-            // before shutdown — at which point ending the connection is right.
             Err(tokio::sync::broadcast::error::RecvError::Closed) => return Ok(()),
         }
     }
diff --git a/updater/Cargo.toml b/updater/Cargo.toml
index 31477192..a34d1131 100644
--- a/updater/Cargo.toml
+++ b/updater/Cargo.toml
@@ -20,6 +20,11 @@ path = "src/main.rs"
 
 [dependencies]
 duck-ipc-proto = { path = "../duck-ipc-proto" }
+# The Hugging Face device-code login. Extracted from this crate, because a robot signing in to an
+# account has nothing to do with updating one and every other robot wants the same thing.
+# `src/account.rs` is what is left here: where the credential lives on *this* robot, and how the
+# crate's answers become `proto`'s.
+hf-robot-account = "0.1"
 # For `ETXTBSY` by name in the hook-spawn retry. Already in the tree via tokio, and an errno
 # spelled 26 in our own source is the kind of thing that is fine until it is not.
 libc = "0.2.189"
@@ -60,9 +65,7 @@ tar = "0.4.46"
 zstd = "0.13.3"
 toml = "1.1.3"
 futures-util = "0.3.33"
-# `form` is for `account.rs`: OAuth token endpoints take `application/x-www-form-urlencoded`
-# bodies, not JSON, and RFC 8628 is no exception. It pulls in `serde_urlencoded` and nothing else.
-reqwest = { version = "0.13.4", default-features = false, features = ["rustls", "json", "stream", "http2", "charset", "form"] }
+reqwest = { version = "0.13.4", default-features = false, features = ["rustls", "json", "stream", "http2", "charset"] }
 
 [dev-dependencies]
 test-support = { path = "../test-support" }
diff --git a/updater/src/account.rs b/updater/src/account.rs
index 2d118a25..c10e7963 100644
--- a/updater/src/account.rs
+++ b/updater/src/account.rs
@@ -1,77 +1,32 @@
-//! Which Hugging Face account this robot belongs to.
+//! Which Hugging Face account this robot belongs to — the duck's half of it.
 //!
-//! A duck on a LAN needs no account: `mediad` serves the console, a browser on the same wifi
-//! reaches it, and nothing here is involved. An account is what makes a robot reachable from
-//! *outside* the LAN — the relay proves to a rendezvous service that this robot belongs to an
-//! account, the service shows a client only its own robots, and the pair of those is the
-//! authorisation a bridged session arrives with. `docs/design/remote-access-design.md` owns that
-//! argument; this module owns the credential.
+//! The flow itself is [`hf_robot_account`]: an OAuth device grant against Hugging Face, a
+//! credential on disk, and a loop that renews it. It was written here and lives there now,
+//! because a robot signing in to an account has nothing to do with updating one, and because
+//! every other robot wants exactly the same thing.
 //!
-//! # The flow is RFC 8628, because the robot has no browser
+//! What stays is everything that is a fact about *this* robot rather than about the flow:
 //!
-//! `reachy_mini` started with authorization code + PKCE and HF's callback pointed at a URL on the
-//! robot, which needs a redirect URI registered per hostname and a browser that can resolve the
-//! robot. A duck asks Hugging Face for a code instead, says *"type `M8HJ-FMGN` at
-//! hf.co/oauth/device"*, and polls. The phone that approves it need not be able to reach the
-//! robot at all.
+//! - **[`DEFAULT_PATH`] and [`TOKEN_GROUP`]**, which are this board's filesystem and this board's
+//!   user database.
+//! - **The mapping onto [`proto`]**, below. The crate's types happen to serialise identically
+//!   today, so `Response::ok` could be handed one directly and the wire would not change — and
+//!   that is exactly the shortcut not to take. `API_VERSION` versions these structs; a field
+//!   renamed in a crate we do not release must be a compile error here, not a silently different
+//!   answer to a client that has been told the version did not move.
+//! - **The error mapping**, in `impl From<hf_robot_account::Error> for crate::Error`, because
+//!   which JSON-RPC code a refusal deserves is a question about this protocol.
 //!
-//! Three consequences shape the code below:
-//!
-//! - **[`Account::login`] returns a code, not a token.** The waiting happens in a task this
-//!   process owns, and a client comes back to [`Account::status`]. A login that reported success
-//!   by holding the connection open would work from a laptop and fail from the device it is for:
-//!   a phone that opens a browser backgrounds itself, and iOS tears the GATT link down.
-//! - **The client displays the code, and the code has to be typed.** HF sends no
-//!   `verification_uri_complete` and its device page prefills nothing, so no URL carries the code
-//!   — which makes showing it the client's whole job. Whether a client also *opens* the page
-//!   depends on what it is: `remote-access-design.md` §2.1 has three answers, for a robot, a
-//!   terminal and a phone.
-//! - **A token expires in 30 days and its refresh token rotates.** So [`maintain`] renews well
-//!   before expiry, and the store is written atomically — see [`Store::save`] for the one window
-//!   that cannot be closed.
-//!
-//! # The client id is Hugging Face's own, and that is a decision to revisit
-//!
-//! [`CLIENT_ID`] is the first-party device-code client `huggingface_hub` ships, so this needs no
-//! OAuth app registered anywhere and works on a robot that has never met Pollen. What comes back
-//! is a token with **every scope HF grants** — `write-repos`, `manage-repos`, `jobs`,
-//! `read-billing` — because that client takes no `scope` parameter. A duck therefore holds a
-//! credential that can push to its owner's repositories, which is worse than it needs to be for
-//! something whose whole job is proving an identity to a rendezvous service.
-//!
-//! The alternative is a public device-code client registered to `pollen-robotics` with
-//! `openid profile read-repos`, which is one constant here and one click by an org admin. Worth
-//! doing before a duck ships; not worth blocking on now. `remote-access-design.md` §2.4.
-
-use std::path::{Path, PathBuf};
-use std::time::{Duration, SystemTime, UNIX_EPOCH};
+//! An account is what makes a robot reachable from *outside* the LAN: the relay proves the robot
+//! belongs to an account, the rendezvous service shows a client only its own robots, and the pair
+//! of those is the authorisation a bridged session arrives with. A duck on a LAN needs none of it.
+//! `docs/design/remote-access-design.md` §2 owns that argument.
 
-use serde::{Deserialize, Serialize};
-use tokio::sync::Mutex;
+use hf_robot_account::{Config, FileStore, Identity, LoginCode, Status};
 
-use crate::Error;
 use crate::proto;
-use crate::source::http;
 
-/// Hugging Face's first-party device-code OAuth client.
-///
-/// `huggingface_hub`'s `DEVICE_CODE_OAUTH_CLIENT_ID`, which is what `hf auth login` uses. Public
-/// — no secret, and none can be sent: HF refuses the device grant for a *confidential* client
-/// unless it is given the secret, which is why `reachy_mini`'s own OAuth app cannot be used here.
-///
-/// See the module header for what this costs in scopes and what replaces it.
-pub const CLIENT_ID: &str = "26be6b09-91c5-47da-9861-d2d2bb7a7e36";
-
-/// Hugging Face, overridable so tests can point the whole flow at a local server.
-///
-/// `HF_ENDPOINT` is the variable `huggingface_hub` itself reads, so a board pointed at a mirror
-/// for one reason is pointed at it for all of them.
-fn endpoint() -> String {
-    std::env::var("HF_ENDPOINT")
-        .ok()
-        .filter(|s| !s.trim().is_empty())
-        .unwrap_or_else(|| "https://huggingface.co".to_string())
-}
+pub use hf_robot_account::{Account, maintain};
 
 /// Where the credential lives.
 ///
@@ -87,1495 +42,126 @@ pub const DEFAULT_PATH: &str = "/etc/robot/hf-token";
 /// needs the token — it is the one holding the relay. `updaterd` runs as root and writes it. So
 /// the file is `root:robot` and `0640`: readable by the daemons that belong to this robot, and by
 /// nothing else with a login on the board.
-const TOKEN_GROUP: &str = "robot";
-
-/// How long an HTTP round trip to Hugging Face gets.
-const HTTP_TIMEOUT: Duration = Duration::from_secs(20);
-
-/// RFC 8628's fallback when the server sends no `interval`. HF sends none.
-const DEFAULT_POLL_INTERVAL: u64 = 5;
-
-/// RFC 8628 requires `expires_in`; defaulted defensively so a poll loop stays bounded.
-const DEFAULT_EXPIRES_IN: u64 = 900;
-
-/// How often [`maintain`] wakes to look at the token's remaining life.
-const MAINTAIN_INTERVAL: Duration = Duration::from_secs(6 * 60 * 60);
-
-/// Renew a token with less than this left.
-///
-/// HF issues 30 days, so this refreshes at three-quarters of the way through the token's life and
-/// leaves a week of retries. A robot switched off for longer than the whole 30 days cannot be
-/// saved by any margin — it comes back needing a login, which [`proto::Account::token_expires_in`]
-/// going negative is how a client says so.
-const REFRESH_WHEN_UNDER: Duration = Duration::from_secs(7 * 24 * 60 * 60);
-
-// ── the stored credential ────────────────────────────────────────────────────
-
-/// What is on disk.
-///
-/// The shape mirrors what the token endpoint returns, plus the two things it does not: an
-/// absolute expiry (the response gives a duration, and a duration is meaningless after a reboot)
-/// and the username, so [`Account::status`] answers without a network round trip.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct Stored {
-    pub access_token: String,
-    /// Absent when HF issues none, which would make the token unrenewable rather than broken.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub refresh_token: Option<String>,
-    /// Unix seconds. Absent means "HF did not say", which is treated as not expiring.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub expires_at: Option<i64>,
-    /// As `/oauth/userinfo` reported it at login.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub username: Option<String>,
-}
-
-impl Stored {
-    /// Seconds until the access token expires; negative once it has. `i64::MAX` when unknown.
-    fn expires_in(&self) -> i64 {
-        match self.expires_at {
-            None => i64::MAX,
-            Some(at) => at.saturating_sub(now_secs()),
-        }
-    }
-}
-
-/// The token file, and the two operations anything has on it.
-#[derive(Debug, Clone)]
-pub struct Store {
-    path: PathBuf,
-}
-
-impl Store {
-    pub fn new(path: impl Into<PathBuf>) -> Self {
-        Self { path: path.into() }
-    }
-
-    pub fn path(&self) -> &Path {
-        &self.path
-    }
-
-    /// What is stored, or `None` when the robot belongs to nobody.
-    ///
-    /// A file that will not parse is `None` with a warning rather than an error: the recovery for
-    /// a corrupt credential is signing in again, and a daemon that refuses to start — or a status
-    /// call that fails — because of one would make that harder rather than safer.
-    pub fn load(&self) -> Option<Stored> {
-        let bytes = std::fs::read(&self.path).ok()?;
-        match serde_json::from_slice::<Stored>(&bytes) {
-            Ok(stored) => Some(stored),
-            Err(e) => {
-                tracing::warn!(
-                    path = %self.path.display(),
-                    error = %e,
-                    "the stored account credential does not parse; treating this robot as signed out"
-                );
-                None
-            }
-        }
-    }
-
-    /// Replace the credential, atomically, readable only by root and the `robot` group.
-    ///
-    /// **The one window this cannot close.** HF rotates the refresh token on every refresh, so
-    /// between "HF issued a new pair" and "the new pair is on disk" the old refresh token is
-    /// already dead. A power cut in that window leaves a robot holding a credential HF will not
-    /// renew, and no ordering here fixes it — the rotation happened on their side. It surfaces as
-    /// a refresh failure in [`proto::AccountStatusResult::last_error`] and is fixed by signing in
-    /// again, which is why [`maintain`] starts trying a week early rather than on the last day.
-    pub fn save(&self, stored: &Stored) -> Result<(), Error> {
-        let bytes = serde_json::to_vec_pretty(stored).map_err(|e| Error::Io {
-            path: self.path.clone(),
-            source: std::io::Error::other(e),
-        })?;
-
-        // Written 0600 first and relaxed to 0640 after the group is set, so the file is never
-        // group-readable while it is owned by root's default group.
-        write_private(&self.path, &bytes)?;
-        if let Some(gid) = crate::unix::group_id(TOKEN_GROUP) {
-            set_group(&self.path, gid)?;
-            set_mode(&self.path, 0o640)?;
-        } else {
-            // No `robot` group means a developer's laptop or a half-provisioned board. Root can
-            // still read it, so a login is not lost; `mediad` will not be able to, and saying so
-            // once is better than a relay that cannot explain why it has no token.
-            tracing::warn!(
-                group = TOKEN_GROUP,
-                path = %self.path.display(),
-                "no such group, so the token stays root-only — mediad will not be able to read it"
-            );
-        }
-        Ok(())
-    }
-
-    /// Forget the credential. Returns who it belonged to, if anyone.
-    pub fn clear(&self) -> Result<Option<String>, Error> {
-        let was = self.load().and_then(|s| s.username);
-        match std::fs::remove_file(&self.path) {
-            Ok(()) => Ok(was),
-            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),
-            Err(e) => Err(Error::Io {
-                path: self.path.clone(),
-                source: e,
-            }),
-        }
-    }
-}
-
-// ── the Hugging Face half ────────────────────────────────────────────────────
-
-/// A started device authorization.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct DeviceCode {
-    pub device_code: String,
-    pub user_code: String,
-    pub verification_uri: String,
-    pub verification_uri_complete: String,
-    pub expires_in: u64,
-    pub interval: u64,
-}
-
-/// What `POST /oauth/device` answers, before normalisation.
-#[derive(Debug, Deserialize)]
-struct DeviceCodeResponse {
-    device_code: String,
-    user_code: String,
-    verification_uri: String,
-    verification_uri_complete: Option<String>,
-    expires_in: Option<u64>,
-    interval: Option<u64>,
-}
-
-/// What `POST /oauth/token` answers on success.
-#[derive(Debug, Clone, Deserialize)]
-pub struct TokenResponse {
-    pub access_token: String,
-    #[serde(default)]
-    pub refresh_token: Option<String>,
-    #[serde(default)]
-    pub expires_in: Option<u64>,
-}
+pub const TOKEN_GROUP: &str = "robot";
 
-/// What `POST /oauth/token` answers while nobody has approved yet.
-#[derive(Debug, Deserialize)]
-struct OAuthError {
-    error: String,
-    #[serde(default)]
-    error_description: Option<String>,
+/// The account this robot belongs to, at [`DEFAULT_PATH`].
+pub fn account() -> Account {
+    Account::new(store(DEFAULT_PATH), Config::from_env())
 }
 
-/// One poll of the token endpoint.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum Poll {
-    /// Nobody has approved it yet.
-    Pending,
-    /// The server wants a longer interval. RFC 8628 §3.5: add five seconds.
-    SlowDown,
-    /// Approved.
-    Token(Box<TokenResponse>),
-    /// The user said no, or the code ran out. Either way, start again.
-    Refused(String),
-    /// Anything inconclusive — a 5xx, a proxy's error page, a network blip. **Not** a failure:
-    /// RFC 8628 §3.5 says keep polling until the code expires, and the deadline bounds the wait.
-    Inconclusive(String),
-}
-
-impl PartialEq for TokenResponse {
-    fn eq(&self, other: &Self) -> bool {
-        self.access_token == other.access_token
-            && self.refresh_token == other.refresh_token
-            && self.expires_in == other.expires_in
-    }
-}
-impl Eq for TokenResponse {}
-
-/// Ask Hugging Face to start a device authorization.
-pub async fn request_device_code(
-    client: &reqwest::Client,
-    base: &str,
-) -> Result<DeviceCode, Error> {
-    let url = format!("{base}/oauth/device");
-    let response = client
-        .post(&url)
-        .timeout(HTTP_TIMEOUT)
-        .form(&[("client_id", CLIENT_ID)])
-        .send()
-        .await
-        .map_err(|e| Error::Network(format!("POST {url}: {e}")))?;
-
-    let status = response.status();
-    let body = response
-        .text()
-        .await
-        .map_err(|e| Error::Network(format!("reading {url}: {e}")))?;
-    if !status.is_success() {
-        return Err(Error::Network(format!(
-            "POST {url}: HTTP {status}: {}",
-            body.chars().take(300).collect::<String>()
-        )));
-    }
-
-    let raw: DeviceCodeResponse = serde_json::from_str(&body).map_err(|e| {
-        Error::Network(format!(
-            "POST {url}: could not parse the device code response: {e}"
-        ))
-    })?;
-
-    // HF sends neither `interval` nor `verification_uri_complete`, so both are defaulted here —
-    // the same normalisation `huggingface_hub` does, in the same place, so nothing downstream has
-    // to know which fields a server bothered with.
-    //
-    // **The fallback is the plain URI, and the code still has to be typed.** An earlier version
-    // of this appended `?user_code=`, on the strength of a claim in `reachy_mini`'s setup notes
-    // that `huggingface_hub` synthesises that form. It does not — it falls back to
-    // `verification_uri` unchanged — and Hugging Face's device page ignores the parameter: it
-    // survives the login redirect and prefills nothing, which was confirmed in a browser. A URL
-    // carrying a query the other end drops is worse than no query, because it reads like a
-    // promise the page then breaks.
-    //
-    // The field stays because it is the protocol's, and a server that starts sending a real one
-    // is then used without a change here.
-    let verification_uri_complete = raw
-        .verification_uri_complete
-        .unwrap_or_else(|| raw.verification_uri.clone());
-    Ok(DeviceCode {
-        device_code: raw.device_code,
-        user_code: raw.user_code,
-        verification_uri: raw.verification_uri,
-        verification_uri_complete,
-        expires_in: raw.expires_in.unwrap_or(DEFAULT_EXPIRES_IN),
-        interval: raw.interval.unwrap_or(DEFAULT_POLL_INTERVAL),
-    })
-}
-
-/// Poll the token endpoint once.
-pub async fn poll_token(client: &reqwest::Client, base: &str, device_code: &str) -> Poll {
-    let url = format!("{base}/oauth/token");
-    let response = client
-        .post(&url)
-        .timeout(HTTP_TIMEOUT)
-        .form(&[
-            ("grant_type", "urn:ietf:params:oauth:grant-type:device_code"),
-            ("client_id", CLIENT_ID),
-            ("device_code", device_code),
-        ])
-        .send()
-        .await;
-
-    let response = match response {
-        Ok(response) => response,
-        Err(e) => return Poll::Inconclusive(format!("POST {url}: {e}")),
-    };
-    // A 5xx is a Hugging Face problem, not an answer about this login.
-    if response.status().is_server_error() {
-        return Poll::Inconclusive(format!("POST {url}: HTTP {}", response.status()));
-    }
-    let body = match response.text().await {
-        Ok(body) => body,
-        Err(e) => return Poll::Inconclusive(format!("reading {url}: {e}")),
-    };
-
-    if let Ok(token) = serde_json::from_str::<TokenResponse>(&body) {
-        return Poll::Token(Box::new(token));
-    }
-    match serde_json::from_str::<OAuthError>(&body) {
-        Ok(err) => classify(&err),
-        // JSON without an `error` member, or not JSON at all: a gateway's error page. Transient.
-        Err(_) => Poll::Inconclusive(format!(
-            "POST {url}: unexpected answer: {}",
-            body.chars().take(200).collect::<String>()
-        )),
-    }
-}
-
-/// Which OAuth errors end a login and which are the login working normally.
-fn classify(err: &OAuthError) -> Poll {
-    let detail = err
-        .error_description
-        .clone()
-        .unwrap_or_else(|| err.error.clone());
-    match err.error.as_str() {
-        "authorization_pending" => Poll::Pending,
-        "slow_down" => Poll::SlowDown,
-        "expired_token" => Poll::Refused(
-            "the code expired before it was approved — start the login again".to_string(),
-        ),
-        "access_denied" => Poll::Refused("the login was refused on Hugging Face".to_string()),
-        // An OAuth error we do not know is still an answer about this login rather than a blip:
-        // `invalid_client` and `invalid_grant` will not fix themselves by being asked again.
-        other => Poll::Refused(format!("Hugging Face said {other}: {detail}")),
-    }
-}
-
-/// Exchange a refresh token for a new pair. HF rotates the refresh token, so the answer's is the
-/// one to keep.
-pub async fn refresh(
-    client: &reqwest::Client,
-    base: &str,
-    refresh_token: &str,
-) -> Result<TokenResponse, Error> {
-    let url = format!("{base}/oauth/token");
-    let response = client
-        .post(&url)
-        .timeout(HTTP_TIMEOUT)
-        .form(&[
-            ("grant_type", "refresh_token"),
-            ("client_id", CLIENT_ID),
-            ("refresh_token", refresh_token),
-        ])
-        .send()
-        .await
-        .map_err(|e| Error::Network(format!("POST {url}: {e}")))?;
-    let body = response
-        .text()
-        .await
-        .map_err(|e| Error::Network(format!("reading {url}: {e}")))?;
-    serde_json::from_str::<TokenResponse>(&body).map_err(|_| {
-        let detail = serde_json::from_str::<OAuthError>(&body)
-            .map(|e| format!("{}: {}", e.error, e.error_description.unwrap_or_default()))
-            .unwrap_or_else(|_| body.chars().take(200).collect());
-        Error::Network(format!("could not refresh the account token: {detail}"))
-    })
-}
-
-/// Who a token belongs to.
+/// As [`account`], against a token file and a Hugging Face of your choosing.
 ///
-/// `/oauth/userinfo` rather than decoding the `id_token`: one round trip against an endpoint that
-/// is part of the flow already, versus a JWT parser and a JWKS fetch for the same string.
-pub async fn userinfo(
-    client: &reqwest::Client,
-    base: &str,
-    access_token: &str,
-) -> Result<String, Error> {
-    #[derive(Deserialize)]
-    struct UserInfo {
-        /// The handle — `PierreRouanet`. `name` is the display name and can be anything.
-        preferred_username: Option<String>,
-        name: Option<String>,
-    }
-
-    let url = format!("{base}/oauth/userinfo");
-    let response = client
-        .get(&url)
-        .timeout(HTTP_TIMEOUT)
-        .bearer_auth(access_token)
-        .send()
-        .await
-        .map_err(|e| Error::Network(format!("GET {url}: {e}")))?;
-    let status = response.status();
-    let body = response
-        .text()
-        .await
-        .map_err(|e| Error::Network(format!("reading {url}: {e}")))?;
-    if !status.is_success() {
-        return Err(Error::Network(format!("GET {url}: HTTP {status}")));
-    }
-    let info: UserInfo = serde_json::from_str(&body)
-        .map_err(|e| Error::Network(format!("GET {url}: could not parse the answer: {e}")))?;
-    info.preferred_username
-        .or(info.name)
-        .ok_or_else(|| Error::Network(format!("GET {url}: no username in the answer")))
+/// Only for tests, and it is not optional there: the real path is a robot's real credential, and
+/// a test that ran against it would read — or on a developer's machine try to write — that.
+#[doc(hidden)]
+pub fn account_for_test(path: impl Into<std::path::PathBuf>, endpoint: String) -> Account {
+    Account::new(store(path), Config::at(endpoint))
 }
 
-// ── what `updaterd` serves ───────────────────────────────────────────────────
-
-/// A login in flight.
-#[derive(Debug, Clone)]
-struct Pending {
-    login: proto::AccountLoginResult,
-    /// When the code stops being good for anything, so `status` can count down.
-    deadline: SystemTime,
+fn store(path: impl Into<std::path::PathBuf>) -> FileStore {
+    FileStore::at(path).readable_by_group(TOKEN_GROUP)
 }
 
-/// The account, as the three `account.*` calls see it.
-#[derive(Debug)]
-pub struct Account {
-    store: Store,
-    /// Where Hugging Face is. Read once at construction rather than per call, so nothing below
-    /// this struct reads the environment — which is what lets a test serve a fake one without
-    /// mutating a variable the whole process shares.
-    endpoint: String,
-    /// `Mutex` rather than a channel because there is at most one login at a time and both
-    /// `login` and `status` need to see it; the lock is held for a field read, and deliberately
-    /// never across a network call — `status` is polled *while* a login is in flight, so
-    /// anything that made it queue behind an HTTP round trip would make a wizard look stuck.
-    pending: Mutex<Option<Pending>>,
-    /// Which login is the current one.
-    ///
-    /// A flow lives in a spawned task that outlives the call that started it, and two things can
-    /// happen to it while it waits: `--force` starts another, or `logout` says the robot belongs
-    /// to nobody. In both cases the old task is still holding a device code Hugging Face will
-    /// happily approve, and without this it would write that approval to the store — a robot
-    /// signed back in a minute after being signed out, or signed in as the account somebody just
-    /// replaced. Each flow carries the number it was started with and does nothing at all if it
-    /// is no longer the current one.
-    generation: std::sync::atomic::AtomicU64,
-    /// Held for the whole of starting a login, which the one above cannot be.
-    ///
-    /// Two callers arriving together both read `pending` as empty, both ask Hugging Face for a
-    /// code, and both spawn a poller: the store then holds whichever approval landed last, which
-    /// is neither predictable nor explicable to whoever was reading the other code. The window is
-    /// the round trip to `/oauth/device`, so the guard has to cover it — and it is its own lock
-    /// rather than `pending` because `status` must not wait on that round trip.
-    starting: Mutex<()>,
-    last_error: Mutex<Option<String>>,
-}
-
-impl Account {
-    /// Infallible, so a daemon whose TLS stack will not build still starts and still answers
-    /// `account.status` — which is how anybody finds out. The HTTP client is built per operation
-    /// instead: `status` and `logout` need none at all, and the one operation that polls in a
-    /// loop wants a client that lives exactly as long as the loop.
-    pub fn new(store: Store) -> Self {
-        Self::with_endpoint(store, endpoint())
-    }
+// ── onto the wire ────────────────────────────────────────────────────────────
 
-    /// As [`Self::new`], against a named endpoint. For tests, and for a board pointed at a
-    /// mirror by something other than `HF_ENDPOINT`.
-    pub fn with_endpoint(store: Store, endpoint: String) -> Self {
-        Self {
-            store,
-            endpoint,
-            pending: Mutex::new(None),
-            generation: std::sync::atomic::AtomicU64::new(0),
-            starting: Mutex::new(()),
-            last_error: Mutex::new(None),
-        }
-    }
-
-    pub fn store(&self) -> &Store {
-        &self.store
-    }
-
-    /// Start a device-code login, and answer with the code to show somebody.
-    ///
-    /// The polling runs in a task this returns without waiting for. `force` is what it takes to
-    /// replace an account the robot already belongs to — see [`proto::AccountLoginParams::force`].
-    pub async fn login(
-        self: &std::sync::Arc<Self>,
-        force: bool,
-    ) -> Result<proto::AccountLoginResult, Error> {
-        if let Some(stored) = self.store.load()
-            && !force
-        {
-            let who = stored.username.unwrap_or_else(|| "another account".into());
-            return Err(Error::AlreadySignedIn(who));
-        }
-
-        // One login at a time, and the gate has to hold across the round trip below rather than
-        // only across the check — see [`Self::starting`] for what two of them leave behind.
-        // `try_lock`, so the second caller is told so now instead of queueing behind somebody
-        // else's twenty-second timeout and then starting a login nobody is waiting for.
-        let _starting = self.starting.try_lock().map_err(|_| Error::LoginInFlight)?;
-        // A code that is still good refuses a second login — **unless `force`**. Without that
-        // exception the only ways out of a code nobody is going to approve are waiting five
-        // minutes and `logout`, and `logout` throws away a working credential to clear a
-        // *pending* one, which is a remedy worse than the problem. `force` already means "replace
-        // what this robot belongs to"; replacing an attempt at it is the smaller version.
-        if !force {
-            let pending = self.pending.lock().await;
-            if let Some(pending) = pending.as_ref()
-                && pending.deadline > SystemTime::now()
-            {
-                return Err(Error::LoginInFlight);
-            }
-        }
-
-        let client = http::client()?;
-        let code = request_device_code(&client, &self.endpoint).await?;
-        let login = proto::AccountLoginResult {
-            user_code: code.user_code.clone(),
-            verification_uri: code.verification_uri.clone(),
-            verification_uri_complete: code.verification_uri_complete.clone(),
-            expires_in: code.expires_in,
-            interval: code.interval,
-        };
-        // Claimed before the old flow can be told it has been replaced, so there is no instant
-        // in which two tasks both believe they are current.
-        let generation = self
-            .generation
-            .fetch_add(1, std::sync::atomic::Ordering::SeqCst)
-            + 1;
-        *self.pending.lock().await = Some(Pending {
-            login: login.clone(),
-            deadline: SystemTime::now() + Duration::from_secs(code.expires_in),
-        });
-        *self.last_error.lock().await = None;
-
-        tracing::info!(
-            user_code = %code.user_code,
-            uri = %code.verification_uri,
-            expires_in = code.expires_in,
-            "account login started; waiting for approval"
-        );
-
-        let this = std::sync::Arc::clone(self);
-        tokio::spawn(async move { this.wait_for_approval(client, code, generation).await });
-        Ok(login)
-    }
-
-    /// Poll Hugging Face until the code is approved, refused, or out of time.
-    async fn wait_for_approval(&self, client: reqwest::Client, code: DeviceCode, generation: u64) {
-        let deadline = tokio::time::Instant::now() + Duration::from_secs(code.expires_in);
-        let mut interval = Duration::from_secs(code.interval.max(1));
-
-        let outcome = loop {
-            tokio::time::sleep(interval).await;
-            if tokio::time::Instant::now() >= deadline {
-                break Err("the code expired before it was approved".to_string());
-            }
-            match poll_token(&client, &self.endpoint, &code.device_code).await {
-                Poll::Pending => continue,
-                Poll::SlowDown => {
-                    interval += Duration::from_secs(5);
-                    continue;
-                }
-                // Logged rather than surfaced: a 502 from a proxy is not news about this login,
-                // and RFC 8628 says to keep asking until the code expires.
-                Poll::Inconclusive(why) => {
-                    tracing::debug!(%why, "inconclusive poll; still waiting");
-                    continue;
-                }
-                Poll::Refused(why) => break Err(why),
-                Poll::Token(token) => break Ok(*token),
-            }
-        };
-
-        // Superseded, and therefore silent: a `--force` login replaced this one, or `logout`
-        // said the robot belongs to nobody. Either way an approval that arrives now is an answer
-        // to a question that has been withdrawn, and writing it would sign the robot into the
-        // account somebody just replaced or out of. Checked *before* the store is touched.
-        if !self.is_current(generation) {
-            tracing::info!(
-                user_code = %code.user_code,
-                "a login was superseded before it finished; dropping its result"
-            );
-            return;
-        }
-
-        let result = match outcome {
-            Err(why) => Err(why),
-            Ok(token) => self
-                .persist(&client, token)
-                .await
-                .map_err(|e| e.to_string()),
-        };
-
-        // And again after it, because `persist` awaits: a `logout` landing during the write is
-        // the same withdrawal, and the record it left behind has to go with it.
-        if !self.is_current(generation) {
-            let _ = self.store.clear();
-            tracing::info!("a login completed after being superseded; its token was discarded");
-            return;
-        }
-
-        *self.pending.lock().await = None;
-        match result {
-            Ok(username) => {
-                let username = username.unwrap_or_else(|| "an account it cannot name yet".into());
-                tracing::info!(%username, "this robot now belongs to a Hugging Face account");
-                *self.last_error.lock().await = None;
-            }
-            Err(why) => {
-                tracing::warn!(%why, "account login did not complete");
-                *self.last_error.lock().await = Some(why);
-            }
-        }
-    }
-
-    /// Whether the flow started as `generation` is still the one this robot is waiting on.
-    fn is_current(&self, generation: u64) -> bool {
-        self.generation.load(std::sync::atomic::Ordering::SeqCst) == generation
-    }
-
-    /// Store a fresh token, and return the username it belongs to if the name could be had.
-    ///
-    /// The username is asked for *before* the write and stored with it, so `status` never needs
-    /// the network — and a robot that is offline still knows who it belongs to.
-    ///
-    /// **A failure to read the name must not lose the token.** By this point somebody has
-    /// approved a code on their phone; throwing the credential away because `/oauth/userinfo`
-    /// answered a 502 would make them do the whole flow again for a field that is a label. So
-    /// the name is optional: the record lands either way, `status` says `unknown` until it is
-    /// known, and [`maintain`] fills it in within six hours — see [`Self::name_if_unknown`].
-    async fn persist(
-        &self,
-        client: &reqwest::Client,
-        token: TokenResponse,
-    ) -> Result<Option<String>, Error> {
-        let username = match userinfo(client, &self.endpoint, &token.access_token).await {
-            Ok(username) => Some(username),
-            Err(e) => {
-                tracing::warn!(
-                    error = %e,
-                    "signed in, but could not read the account name; storing the token anyway"
-                );
-                None
-            }
-        };
-        self.store.save(&Stored {
-            access_token: token.access_token,
-            refresh_token: token.refresh_token,
-            expires_at: token.expires_in.map(|s| now_secs() + s as i64),
-            username: username.clone(),
-        })?;
-        Ok(username)
-    }
-
-    /// Who this robot belongs to, and whether a login is in flight.
-    pub async fn status(&self) -> proto::AccountStatusResult {
-        let account = self.store.load().map(|stored| proto::Account {
-            username: stored
-                .username
-                .clone()
-                .unwrap_or_else(|| "unknown".to_string()),
-            token_expires_in: stored.expires_in(),
-            refreshable: stored.refresh_token.is_some(),
-        });
-
-        // The code's remaining life rather than its original one: a client polling this wants a
-        // countdown, and `expires_in` is documented as what is *left* here.
-        let login = self.pending.lock().await.as_ref().and_then(|pending| {
-            let left = pending
-                .deadline
-                .duration_since(SystemTime::now())
-                .ok()?
-                .as_secs();
-            Some(proto::AccountLoginResult {
-                expires_in: left,
-                ..pending.login.clone()
-            })
-        });
-
-        proto::AccountStatusResult {
-            account,
-            login,
-            last_error: self.last_error.lock().await.clone(),
-        }
-    }
-
-    /// Forget the account. A login in flight is abandoned with it.
-    ///
-    /// **Forgets rather than revokes.** The file goes, so the robot stops being able to prove it
-    /// belongs to anybody, which is what signing out is for. The token itself stays valid at
-    /// Hugging Face until it expires — up to thirty days — for anything that read the file while
-    /// it was there. `remote-access-design.md` §2.6 says why that is where the line is and what
-    /// closing it would take.
-    pub async fn logout(&self) -> Result<proto::AccountLogoutResult, Error> {
-        // Before the file goes, so a flow that approves during this call sees itself superseded
-        // rather than writing a token into a robot that has just been signed out.
-        self.generation
-            .fetch_add(1, std::sync::atomic::Ordering::SeqCst);
-        let was = self.store.clear()?;
-        *self.pending.lock().await = None;
-        *self.last_error.lock().await = None;
-        if let Some(username) = &was {
-            tracing::info!(%username, "this robot no longer belongs to a Hugging Face account");
-        }
-        Ok(proto::AccountLogoutResult { was })
-    }
-
-    /// Renew the token before it expires. One pass; [`maintain`] is the loop.
-    ///
-    /// Returns `true` when it wrote a new token. Does nothing when the robot is signed out, when
-    /// there is no refresh token, or when there is plenty of time left.
-    pub async fn refresh_if_due(&self) -> Result<bool, Error> {
-        let Some(stored) = self.store.load() else {
-            return Ok(false);
-        };
-        let Some(refresh_token) = stored.refresh_token.clone() else {
-            return Ok(false);
-        };
-        if stored.expires_in() > REFRESH_WHEN_UNDER.as_secs() as i64 {
-            return Ok(false);
-        }
-
-        let token = refresh(&http::client()?, &self.endpoint, &refresh_token).await?;
-        // Keep the username rather than re-asking: a refresh cannot change who the token belongs
-        // to, and this path runs unattended on a board whose network may be marginal.
-        self.store.save(&Stored {
-            access_token: token.access_token,
-            refresh_token: token.refresh_token,
-            expires_at: token.expires_in.map(|s| now_secs() + s as i64),
-            username: stored.username,
-        })?;
-        Ok(true)
-    }
-
-    /// Ask who the token belongs to, when the stored record cannot say.
-    ///
-    /// Only ever the case after a login whose `/oauth/userinfo` call failed — [`Self::persist`]
-    /// keeps the token in that case rather than losing it over a label. Left alone,
-    /// `account.status` would answer `unknown` until somebody signed in again; this is what makes
-    /// it answer properly on the next [`maintain`] pass instead. Returns `true` when it wrote a
-    /// name.
-    pub async fn name_if_unknown(&self) -> Result<bool, Error> {
-        let Some(stored) = self.store.load() else {
-            return Ok(false);
-        };
-        if stored.username.is_some() {
-            return Ok(false);
-        }
-        let username = userinfo(&http::client()?, &self.endpoint, &stored.access_token).await?;
-        self.store.save(&Stored {
-            username: Some(username),
-            ..stored
-        })?;
-        Ok(true)
+/// The answer to `account.login`.
+pub fn login_result(code: LoginCode) -> proto::AccountLoginResult {
+    proto::AccountLoginResult {
+        user_code: code.user_code,
+        verification_uri: code.verification_uri,
+        verification_uri_complete: code.verification_uri_complete,
+        expires_in: code.expires_in,
+        interval: code.interval,
     }
 }
 
-/// Keep the token fresh for as long as this process runs.
-///
-/// Spawned once at startup. It is a slow loop on purpose: the thing it guards against is a robot
-/// that has been on for a month, and the cost of asking too often is a request to Hugging Face
-/// that answers "not yet".
-pub async fn maintain(account: std::sync::Arc<Account>) {
-    loop {
-        match account.refresh_if_due().await {
-            Ok(true) => tracing::info!("renewed the account token"),
-            Ok(false) => {}
-            // Not fatal and not silent: a week of retries is left, and `account.status` carries
-            // the reason for anyone asking why remote access stopped.
-            Err(e) => {
-                let why = e.to_string();
-                tracing::warn!(%why, "could not renew the account token");
-                *account.last_error.lock().await = Some(why);
-            }
-        }
-        // A missing name is cosmetic, so its failure stays in the journal rather than going to
-        // `last_error`: that field answers "why did remote access stop", and this did not stop
-        // it. Nothing happens here at all on the overwhelmingly common path — the name is only
-        // absent after a login that could not reach `/oauth/userinfo`.
-        match account.name_if_unknown().await {
-            Ok(true) => tracing::info!("filled in the account name a login could not read"),
-            Ok(false) => {}
-            Err(e) => tracing::debug!(error = %e, "still cannot read the account name"),
-        }
-        tokio::time::sleep(MAINTAIN_INTERVAL).await;
+/// The answer to `account.status`.
+pub fn status_result(status: Status) -> proto::AccountStatusResult {
+    proto::AccountStatusResult {
+        account: status.account.map(identity),
+        login: status.login.map(login_result),
+        last_error: status.last_error,
     }
 }
 
-// ── small things ─────────────────────────────────────────────────────────────
-
-fn now_secs() -> i64 {
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .map(|d| d.as_secs() as i64)
-        .unwrap_or(0)
-}
-
-/// Write via a temp file and rename, with the temp file created `0600` from the start.
-///
-/// `fsutil::write_atomic` is the same dance without the mode, and this cannot use it: a token
-/// written `0644` and chmodded afterwards is world-readable for the moment in between, which is
-/// exactly the kind of window that is invisible in testing and permanent in a log.
-fn write_private(path: &Path, bytes: &[u8]) -> Result<(), Error> {
-    use std::io::Write;
-    use std::os::unix::fs::OpenOptionsExt;
-
-    let tmp = path.with_extension("tmp");
-    let io = |source: std::io::Error, path: &Path| Error::Io {
-        path: path.to_path_buf(),
-        source,
-    };
-    {
-        let mut file = std::fs::OpenOptions::new()
-            .write(true)
-            .create(true)
-            .truncate(true)
-            .mode(0o600)
-            .open(&tmp)
-            .map_err(|e| io(e, &tmp))?;
-        file.write_all(bytes).map_err(|e| io(e, &tmp))?;
-        file.sync_all().map_err(|e| io(e, &tmp))?;
+fn identity(who: Identity) -> proto::Account {
+    proto::Account {
+        username: who.username,
+        token_expires_in: who.token_expires_in,
+        refreshable: who.refreshable,
     }
-    std::fs::rename(&tmp, path).map_err(|e| io(e, path))?;
-    crate::fsutil::fsync_parent(path)
-}
-
-fn set_mode(path: &Path, mode: u32) -> Result<(), Error> {
-    use std::os::unix::fs::PermissionsExt;
-    std::fs::set_permissions(path, std::fs::Permissions::from_mode(mode)).map_err(|e| Error::Io {
-        path: path.to_path_buf(),
-        source: e,
-    })
 }
 
-fn set_group(path: &Path, gid: u32) -> Result<(), Error> {
-    use std::os::unix::ffi::OsStrExt;
-    let cpath = std::ffi::CString::new(path.as_os_str().as_bytes()).map_err(|_| Error::Io {
-        path: path.to_path_buf(),
-        source: std::io::Error::other("path contains a NUL"),
-    })?;
-    // SAFETY: both pointers are valid for the call; `-1` as the uid leaves the owner alone.
-    let rc = unsafe { libc::chown(cpath.as_ptr(), u32::MAX, gid) };
-    if rc != 0 {
-        return Err(Error::Io {
-            path: path.to_path_buf(),
-            source: std::io::Error::last_os_error(),
-        });
-    }
-    Ok(())
+/// The answer to `account.logout`.
+pub fn logout_result(was: Option<String>) -> proto::AccountLogoutResult {
+    proto::AccountLogoutResult { was }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
-    fn store_in(dir: &tempfile::TempDir) -> Store {
-        Store::new(dir.path().join("hf-token"))
-    }
-
-    fn token(access: &str) -> Stored {
-        Stored {
-            access_token: access.to_string(),
-            refresh_token: Some("refresh-1".into()),
-            expires_at: Some(now_secs() + 30 * 24 * 60 * 60),
-            username: Some("PierreRouanet".into()),
-        }
-    }
-
-    /// The store is a file, and the file survives being replaced.
-    #[test]
-    fn a_credential_round_trips() {
-        let dir = tempfile::tempdir().unwrap();
-        let store = store_in(&dir);
-
-        assert!(store.load().is_none(), "nothing stored yet");
-        store.save(&token("first")).unwrap();
-        assert_eq!(store.load().unwrap().access_token, "first");
-
-        store.save(&token("second")).unwrap();
-        assert_eq!(store.load().unwrap().access_token, "second");
-        assert_eq!(
-            store.clear().unwrap(),
-            Some("PierreRouanet".to_string()),
-            "clear reports who it forgot, so a CLI can say so"
-        );
-        assert!(store.load().is_none());
-        assert_eq!(
-            store.clear().unwrap(),
-            None,
-            "clearing nothing is not an error — `logout` twice is not a failure"
-        );
-    }
-
-    /// **A token must never be world-readable, at any point.**
+    /// **The wire is this crate's contract, not the account crate's.**
     ///
-    /// The mode is checked on the file that lands, and the temp file it was written through is
-    /// checked by construction: `write_private` opens it `0600` rather than chmodding afterwards,
-    /// which is the window this test cannot see and the reason the helper exists.
+    /// The two shapes agree field for field today, which is what makes it tempting to serialise
+    /// the crate's struct straight onto the wire. This test is the reason not to: it pins the
+    /// JSON a client actually receives, so a field renamed upstream shows up here — as a compile
+    /// error in the mapping above, or failing that as this test — rather than as an `API_VERSION`
+    /// that did not move and an answer that changed anyway.
     #[test]
-    fn the_token_file_is_not_world_readable() {
-        use std::os::unix::fs::PermissionsExt;
-
-        let dir = tempfile::tempdir().unwrap();
-        let store = store_in(&dir);
-        store.save(&token("secret")).unwrap();
-
-        let mode = std::fs::metadata(store.path())
-            .unwrap()
-            .permissions()
-            .mode()
-            & 0o777;
-        assert_eq!(
-            mode & 0o007,
-            0,
-            "the token file is readable by other users: {mode:o}"
-        );
-        // 0640 on a board with a `robot` group, 0600 without one — a developer's laptop has no
-        // such group, and the test has to pass in both places.
-        assert!(mode == 0o600 || mode == 0o640, "unexpected mode {mode:o}");
-        assert!(
-            !dir.path().join("hf-token.tmp").exists(),
-            "the temp file must not be left behind holding a copy of the token"
-        );
-    }
-
-    /// A file somebody edited by hand reads as "signed out", not as a broken daemon.
-    #[test]
-    fn a_corrupt_credential_is_signed_out_rather_than_an_error() {
-        let dir = tempfile::tempdir().unwrap();
-        let store = store_in(&dir);
-        std::fs::write(store.path(), b"{ this is not json").unwrap();
-        assert!(store.load().is_none());
-    }
-
-    /// Which OAuth errors end a login, and which are it working normally.
-    ///
-    /// The two in the middle are the ones worth pinning: treating `slow_down` as a failure would
-    /// abandon a login that was about to succeed, and treating `expired_token` as transient would
-    /// poll a dead code until the deadline.
-    #[test]
-    fn oauth_errors_are_classified() {
-        let of = |error: &str| {
-            classify(&OAuthError {
-                error: error.to_string(),
-                error_description: None,
-            })
-        };
-        assert_eq!(of("authorization_pending"), Poll::Pending);
-        assert_eq!(of("slow_down"), Poll::SlowDown);
-        assert!(matches!(of("expired_token"), Poll::Refused(_)));
-        assert!(matches!(of("access_denied"), Poll::Refused(_)));
-        // An error we have never seen is still an answer about this login: `invalid_client` will
-        // not fix itself by being asked again, and polling it for five minutes hides the cause.
-        assert!(matches!(of("invalid_client"), Poll::Refused(_)));
-    }
-
-    /// Hugging Face sends neither `interval` nor `verification_uri_complete`. Both are
-    /// synthesised here so nothing downstream has to know that.
-    #[tokio::test]
-    async fn a_device_code_response_is_normalised() {
-        // Exactly what huggingface.co answered on 2026-09-02, field for field.
-        let server = fake_hf(
-            r#"{"device_code":"41ad39ae","user_code":"A6MY-0314",
-                "verification_uri":"https://hf.co/oauth/device","expires_in":300}"#,
-        )
-        .await;
-
-        let code = request_device_code(&http::client().unwrap(), &server.base)
-            .await
-            .unwrap();
-
-        assert_eq!(code.user_code, "A6MY-0314");
-        assert_eq!(code.expires_in, 300);
-        assert_eq!(
-            code.interval, DEFAULT_POLL_INTERVAL,
-            "RFC 8628's fallback, because HF sends no interval"
-        );
-        assert_eq!(
-            code.verification_uri_complete, "https://hf.co/oauth/device",
-            "the plain URI when the server sends none — HF's device page ignores a `?user_code=` \
-             query, so inventing one would promise a prefill that does not happen"
-        );
-    }
-
-    /// A robot that already belongs to somebody refuses without `force`, and says who.
-    ///
-    /// The check is before any network call, which is what makes this testable offline — and is
-    /// also the behaviour that matters: a login that reached Hugging Face first would have burned
-    /// a device code to arrive at the same refusal.
-    #[tokio::test]
-    async fn signing_in_over_an_existing_account_is_refused_by_name() {
-        let dir = tempfile::tempdir().unwrap();
-        let store = store_in(&dir);
-        store.save(&token("already-here")).unwrap();
-
-        let account = std::sync::Arc::new(Account::new(store));
-        let error = account.login(false).await.expect_err("must refuse");
-        assert!(
-            matches!(&error, Error::AlreadySignedIn(who) if who == "PierreRouanet"),
-            "{error:?}"
-        );
-        assert_eq!(
-            error.code(),
-            crate::proto::code::INVALID_PARAMS,
-            "the fix is a parameter, and a client should be able to tell that from the code"
-        );
-        assert!(
-            error.to_string().contains("--force"),
-            "the message must name the way past it: {error}"
-        );
-    }
-
-    /// `status` on a robot that belongs to nobody, which is every robot out of the box.
-    #[tokio::test]
-    async fn status_of_a_robot_that_belongs_to_nobody() {
-        let dir = tempfile::tempdir().unwrap();
-        let account = Account::new(store_in(&dir));
-        let status = account.status().await;
-        assert!(status.account.is_none());
-        assert!(status.login.is_none());
-        assert!(status.last_error.is_none());
-    }
-
-    /// `status` reports the account from disk, with no network call.
-    #[tokio::test]
-    async fn status_names_the_account_without_asking_anybody() {
-        let dir = tempfile::tempdir().unwrap();
-        let store = store_in(&dir);
-        store.save(&token("stored")).unwrap();
-
-        let status = Account::new(store).status().await;
-        let account = status.account.expect("signed in");
-        assert_eq!(account.username, "PierreRouanet");
-        assert!(account.refreshable, "a refresh token was stored");
-        assert!(
-            account.token_expires_in > 29 * 24 * 60 * 60,
-            "about thirty days: {}",
-            account.token_expires_in
-        );
-    }
-
-    /// A token with a month left is not renewed, and a robot with no token is not renewed either.
-    ///
-    /// Both are the "do nothing" case and both would otherwise be an HTTP request on every tick
-    /// of [`maintain`] — on a board whose network may not be there.
-    #[tokio::test]
-    async fn a_fresh_token_is_left_alone() {
-        let dir = tempfile::tempdir().unwrap();
-        let store = store_in(&dir);
-        let account = Account::new(store.clone());
-
-        assert!(!account.refresh_if_due().await.unwrap(), "signed out");
-
-        store.save(&token("fresh")).unwrap();
-        assert!(!account.refresh_if_due().await.unwrap(), "plenty of time");
-
-        // No refresh token: nothing to renew with, and it must not be an error — the robot is
-        // signed in and working, it just cannot renew unattended.
-        store
-            .save(&Stored {
-                refresh_token: None,
-                expires_at: Some(now_secs() + 60),
-                ..token("expiring")
-            })
-            .unwrap();
-        assert!(!account.refresh_if_due().await.unwrap());
-    }
-
-    /// A one-route stand-in for huggingface.co.
-    struct FakeHf {
-        base: String,
-        /// Every `grant_type` the token endpoint was asked for, in order. Empty for a fake that
-        /// does not serve `/oauth/token`.
-        grants: std::sync::Arc<std::sync::Mutex<Vec<String>>>,
-        /// How many times the route under test was asked, for the tests where *once* is the
-        /// property rather than the answer.
-        hits: std::sync::Arc<std::sync::atomic::AtomicUsize>,
-        _task: tokio::task::JoinHandle<()>,
-    }
-
-    impl FakeHf {
-        fn grants(&self) -> Vec<String> {
-            self.grants.lock().unwrap().clone()
-        }
-
-        fn hits(&self) -> usize {
-            self.hits.load(std::sync::atomic::Ordering::SeqCst)
-        }
-    }
-
-    #[derive(Default)]
-    struct Records {
-        grants: std::sync::Arc<std::sync::Mutex<Vec<String>>>,
-        hits: std::sync::Arc<std::sync::atomic::AtomicUsize>,
-    }
-
-    async fn serve(app: axum::Router, records: Records) -> FakeHf {
-        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let base = format!("http://{}", listener.local_addr().unwrap());
-        let task = tokio::spawn(async move {
-            let _ = axum::serve(listener, app).await;
-        });
-        FakeHf {
-            base,
-            grants: records.grants,
-            hits: records.hits,
-            _task: task,
-        }
-    }
-
-    async fn fake_hf(device_response: &'static str) -> FakeHf {
-        use axum::routing::post;
-
-        let app = axum::Router::new().route(
-            "/oauth/device",
-            post(move || async move { ([("content-type", "application/json")], device_response) }),
-        );
-        serve(app, Records::default()).await
-    }
-
-    /// A stand-in for the token endpoint alone, which is all a refresh touches.
-    ///
-    /// It records the `grant_type` it was asked for, because a refresh sent as a device-code
-    /// grant would be refused by Hugging Face and by nobody here.
-    async fn fake_hf_token(answer: &'static str) -> FakeHf {
-        use axum::routing::post;
-
-        let records = Records::default();
-        let seen = std::sync::Arc::clone(&records.grants);
-        let app = axum::Router::new().route(
-            "/oauth/token",
-            post(
-                move |axum::extract::Form(form): axum::extract::Form<
-                    std::collections::HashMap<String, String>,
-                >| {
-                    let seen = std::sync::Arc::clone(&seen);
-                    async move {
-                        seen.lock()
-                            .unwrap()
-                            .push(form.get("grant_type").cloned().unwrap_or_default());
-                        ([("content-type", "application/json")], answer)
-                    }
-                },
-            ),
-        );
-        serve(app, records).await
-    }
-
-    /// A stand-in for `/oauth/userinfo` alone, answering with whatever status is asked for.
-    async fn fake_hf_userinfo(answer: &'static str, status: u16) -> FakeHf {
-        use axum::routing::get;
-
-        let code = axum::http::StatusCode::from_u16(status).unwrap();
-        let app = axum::Router::new().route(
-            "/oauth/userinfo",
-            get(move || async move { (code, [("content-type", "application/json")], answer) }),
-        );
-        serve(app, Records::default()).await
-    }
-
-    /// A device endpoint that takes its time, and counts how often it was asked.
-    ///
-    /// The delay is the point: the window two logins race for is exactly this round trip, so a
-    /// fake that answered instantly would leave the test passing for the wrong reason.
-    async fn fake_hf_slow_device() -> FakeHf {
-        use axum::routing::post;
-
-        let records = Records::default();
-        let hits = std::sync::Arc::clone(&records.hits);
-        let app = axum::Router::new().route(
-            "/oauth/device",
-            post(move || {
-                let hits = std::sync::Arc::clone(&hits);
-                async move {
-                    hits.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
-                    tokio::time::sleep(Duration::from_millis(200)).await;
-                    (
-                        [("content-type", "application/json")],
-                        r#"{"device_code":"device-abc","user_code":"A6MY-0314",
-                            "verification_uri":"https://hf.co/oauth/device",
-                            "expires_in":60,"interval":1}"#,
-                    )
-                }
+    fn a_status_serialises_the_way_the_protocol_says() {
+        let status = status_result(Status {
+            account: Some(Identity {
+                username: "PierreRouanet".into(),
+                token_expires_in: 2_591_999,
+                refreshable: true,
             }),
-        );
-        serve(app, records).await
-    }
-
-    /// Two logins arriving together: one starts, the other is told the robot is busy.
-    ///
-    /// The guard has to cover the round trip to `/oauth/device`, not just the check before it —
-    /// two codes handed out means two pollers, and the store then holds whichever approval landed
-    /// last while somebody stares at the other code wondering why it did nothing.
-    #[tokio::test]
-    async fn two_logins_at_once_do_not_both_reach_hugging_face() {
-        let dir = tempfile::tempdir().unwrap();
-        let hf = fake_hf_slow_device().await;
-        let account = std::sync::Arc::new(Account::with_endpoint(store_in(&dir), hf.base.clone()));
-
-        let (first, second) = tokio::join!(account.login(false), account.login(false));
-
-        let outcomes = [first, second];
-        assert_eq!(
-            outcomes.iter().filter(|r| r.is_ok()).count(),
-            1,
-            "exactly one login starts: {outcomes:?}"
-        );
-        let refusal = outcomes
-            .iter()
-            .find_map(|r| r.as_ref().err())
-            .expect("the other is refused");
-        assert!(
-            matches!(refusal, Error::LoginInFlight),
-            "and refused as busy, which is a state that passes: {refusal:?}"
-        );
-        assert_eq!(refusal.code(), crate::proto::code::BUSY, "retryable");
-        assert!(
-            refusal.to_string().contains("account status"),
-            "and it says where the code that already exists can be read: {refusal}"
-        );
-        assert_eq!(
-            hf.hits(),
-            1,
-            "one device code asked for, so there is only one code to read"
-        );
-    }
-
-    /// A whole fake Hugging Face: a device code, a token, and a name.
-    ///
-    /// `approve_after` is how many `authorization_pending` answers to give first; `0` approves on
-    /// the first poll, which is what the tests about *abandoning* a login want — the approval has
-    /// to land while the test is still watching.
-    async fn fake_hf_full(approve_after: usize) -> FakeHf {
-        use axum::routing::{get, post};
-
-        let records = Records::default();
-        let polls = std::sync::Arc::clone(&records.hits);
-        let app = axum::Router::new()
-            .route(
-                "/oauth/device",
-                post(|| async {
-                    (
-                        [("content-type", "application/json")],
-                        r#"{"device_code":"device-abc","user_code":"A6MY-0314",
-                            "verification_uri":"https://hf.co/oauth/device",
-                            "expires_in":60,"interval":1}"#,
-                    )
-                }),
-            )
-            .route(
-                "/oauth/token",
-                post(move || {
-                    let polls = std::sync::Arc::clone(&polls);
-                    async move {
-                        let n = polls.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
-                        let body = if n < approve_after {
-                            r#"{"error":"authorization_pending"}"#
-                        } else {
-                            r#"{"access_token":"approved","refresh_token":"refresh-1",
-                                "expires_in":2591999}"#
-                        };
-                        ([("content-type", "application/json")], body)
-                    }
-                }),
-            )
-            .route(
-                "/oauth/userinfo",
-                get(|| async {
-                    (
-                        [("content-type", "application/json")],
-                        r#"{"preferred_username":"PierreRouanet"}"#,
-                    )
-                }),
-            );
-        serve(app, records).await
-    }
-
-    /// `--force` abandons a code nobody is going to approve.
-    ///
-    /// Without this the only ways past a live code are waiting five minutes and `logout`, and
-    /// `logout` destroys a working credential to clear a *pending* one. The refusal has to name a
-    /// way through it, and this is that way.
-    #[tokio::test]
-    async fn force_replaces_a_login_that_is_still_waiting() {
-        let dir = tempfile::tempdir().unwrap();
-        let hf = fake_hf_slow_device().await;
-        let account = std::sync::Arc::new(Account::with_endpoint(store_in(&dir), hf.base.clone()));
-
-        let first = account.login(false).await.expect("the first login starts");
-        assert_eq!(hf.hits(), 1);
-
-        let refused = account
-            .login(false)
-            .await
-            .expect_err("a live code refuses a second login");
-        assert!(matches!(refused, Error::LoginInFlight), "{refused:?}");
-        assert!(
-            refused.to_string().contains("--force"),
-            "and says how to get past itself: {refused}"
-        );
-
-        account.login(true).await.expect("`force` gets past it");
-        assert_eq!(hf.hits(), 2, "a new code was asked for");
-        let waiting = account
-            .status()
-            .await
-            .login
-            .expect("one login is in flight");
-        assert_eq!(
-            waiting.user_code, first.user_code,
-            "this fake answers with one code, so what is pinned here is that `status` describes \
-             the current login and not a stale one"
-        );
-    }
-
-    /// An approval that lands after `logout` is dropped, not written.
-    ///
-    /// The flow lives in a task that outlives the call that started it, so signing out while a
-    /// code is live leaves somebody able to approve it a minute later. Writing that would sign
-    /// the robot back in on its own, which is the one thing `logout` has to be able to promise it
-    /// will not do.
-    #[tokio::test]
-    async fn a_login_approved_after_logout_is_discarded() {
-        let dir = tempfile::tempdir().unwrap();
-        let store = store_in(&dir);
-        let hf = fake_hf_full(0).await;
-        let account = std::sync::Arc::new(Account::with_endpoint(store.clone(), hf.base.clone()));
-
-        account.login(false).await.expect("a login starts");
-        account.logout().await.expect("and is signed out under it");
-
-        // The fake approves on the first poll, one second in. Well past that, and nothing has
-        // been written: the flow saw itself superseded before it touched the store.
-        tokio::time::sleep(Duration::from_millis(2_500)).await;
-        assert!(
-            hf.hits() >= 1,
-            "the abandoned flow did reach the token endpoint"
-        );
-        assert!(
-            store.load().is_none(),
-            "a robot signed out must stay signed out"
-        );
-        let status = account.status().await;
-        assert!(status.account.is_none());
-        assert!(status.login.is_none());
-    }
-
-    /// An approved token is not thrown away because `/oauth/userinfo` failed.
-    ///
-    /// By the time this runs somebody has typed a code into a phone. Losing the credential over
-    /// the *label* would make them do all of it again, and on the board this is for — one whose
-    /// network is the reason the call failed — quite possibly twice. So the name is optional, and
-    /// the next `maintain` pass is what fills it in.
-    #[tokio::test]
-    async fn an_approved_token_survives_a_userinfo_failure() {
-        let dir = tempfile::tempdir().unwrap();
-        let store = store_in(&dir);
-        let approved = || TokenResponse {
-            access_token: "approved".into(),
-            refresh_token: Some("refresh-1".into()),
-            expires_in: Some(2_591_999),
-        };
-
-        let broken = fake_hf_userinfo("<html>502 Bad Gateway</html>", 502).await;
-        let account = Account::with_endpoint(store.clone(), broken.base.clone());
-        let named = account
-            .persist(&http::client().unwrap(), approved())
-            .await
-            .expect("a name that cannot be read is not a failed login");
-        assert!(named.is_none());
-
-        let stored = store.load().expect("the credential is on disk regardless");
-        assert_eq!(stored.access_token, "approved");
-        assert_eq!(stored.refresh_token.as_deref(), Some("refresh-1"));
-        assert!(stored.username.is_none(), "the name is what is missing");
-        assert_eq!(
-            account.status().await.account.unwrap().username,
-            "unknown",
-            "a client is told the robot belongs to somebody it cannot name, not that it is \
-             signed out"
-        );
+            login: Some(LoginCode {
+                user_code: "A6MY-0314".into(),
+                verification_uri: "https://hf.co/oauth/device".into(),
+                verification_uri_complete: "https://hf.co/oauth/device".into(),
+                expires_in: 240,
+                interval: 5,
+            }),
+            last_error: None,
+        });
 
-        // And the next pass names it, without touching the credential.
-        let working = fake_hf_userinfo(r#"{"preferred_username":"PierreRouanet"}"#, 200).await;
-        let account = Account::with_endpoint(store.clone(), working.base.clone());
-        assert!(account.name_if_unknown().await.unwrap());
-        let stored = store.load().unwrap();
-        assert_eq!(stored.username.as_deref(), Some("PierreRouanet"));
         assert_eq!(
-            stored.access_token, "approved",
-            "the backfill writes the name and nothing else"
-        );
-        assert!(
-            !account.name_if_unknown().await.unwrap(),
-            "and asks nobody once it knows — this runs every six hours forever"
-        );
-    }
-
-    /// A token near the end of its life is renewed, and **the rotated refresh token replaces the
-    /// one that was spent**.
-    ///
-    /// The rotation is the part worth a test rather than a comment: Hugging Face spends the old
-    /// refresh token on every refresh, so storing the one already on disk — the obvious mistake,
-    /// since the rest of the record is carried over — leaves a robot that renews exactly once and
-    /// then quietly stops being reachable. `remote-access-design.md` §2.7.
-    #[tokio::test]
-    async fn a_due_token_is_renewed_and_the_rotation_lands_on_disk() {
-        let dir = tempfile::tempdir().unwrap();
-        let store = store_in(&dir);
-        // Six days left: inside `REFRESH_WHEN_UNDER`, which is how a board with a marginal
-        // network gets a week of retries instead of one last day.
-        store
-            .save(&Stored {
-                expires_at: Some(now_secs() + 6 * 24 * 60 * 60),
-                ..token("spent")
+            serde_json::to_value(&status).unwrap(),
+            serde_json::json!({
+                "account": {
+                    "username": "PierreRouanet",
+                    "token_expires_in": 2_591_999,
+                    "refreshable": true,
+                },
+                "login": {
+                    "user_code": "A6MY-0314",
+                    "verification_uri": "https://hf.co/oauth/device",
+                    "verification_uri_complete": "https://hf.co/oauth/device",
+                    "expires_in": 240,
+                    "interval": 5,
+                },
+                "last_error": null,
             })
-            .unwrap();
-
-        let hf = fake_hf_token(
-            r#"{"access_token":"renewed","refresh_token":"refresh-2","expires_in":2591999}"#,
-        )
-        .await;
-        let account = Account::with_endpoint(store.clone(), hf.base.clone());
-
-        assert!(
-            account.refresh_if_due().await.unwrap(),
-            "a token with six days left is due"
-        );
-
-        let stored = store.load().unwrap();
-        assert_eq!(stored.access_token, "renewed");
-        assert_eq!(
-            stored.refresh_token.as_deref(),
-            Some("refresh-2"),
-            "the answer's refresh token, not the one it was traded for"
         );
-        assert_eq!(
-            stored.username.as_deref(),
-            Some("PierreRouanet"),
-            "kept rather than re-asked: a refresh cannot change who a token belongs to, and this              path runs unattended"
-        );
-        assert!(
-            stored.expires_in() > 29 * 24 * 60 * 60,
-            "the new expiry is absolute and thirty days out: {}",
-            stored.expires_in()
-        );
-        assert_eq!(
-            hf.grants(),
-            vec!["refresh_token".to_string()],
-            "one refresh, sent as a refresh"
-        );
-
-        // And now it is not due again, which is what stops `maintain` renewing on every tick.
-        assert!(!account.refresh_if_due().await.unwrap());
-        assert_eq!(hf.grants().len(), 1, "no second round trip");
     }
 
-    /// A refresh Hugging Face refuses leaves the credential alone and says so in `status`.
-    ///
-    /// This is the visible half of the window §2.7 says cannot be closed: once the old refresh
-    /// token is spent, no ordering here can recover it, so what the code owes is (a) not making
-    /// it worse by writing a half-record and (b) telling somebody. `maintain` is what turns the
-    /// error into an answer a client can read, so it is driven here rather than trusted.
-    #[tokio::test]
-    async fn a_refused_refresh_is_left_alone_and_reported() {
-        let dir = tempfile::tempdir().unwrap();
-        let store = store_in(&dir);
-        store
-            .save(&Stored {
-                expires_at: Some(now_secs() + 60 * 60),
-                ..token("spent")
-            })
-            .unwrap();
-
-        let hf = fake_hf_token(
-            r#"{"error":"invalid_grant","error_description":"refresh token is expired"}"#,
-        )
-        .await;
-        let account = std::sync::Arc::new(Account::with_endpoint(store.clone(), hf.base.clone()));
+    /// A refusal keeps its code, and a login that cannot say who owns the robot still refuses.
+    #[test]
+    fn errors_keep_the_code_a_client_branches_on() {
+        use hf_robot_account::Error as Hf;
 
-        let error = account
-            .refresh_if_due()
-            .await
-            .expect_err("a refused refresh is an error");
+        let already: crate::Error = Hf::AlreadySignedIn("PierreRouanet".into()).into();
+        assert_eq!(already.code(), proto::code::INVALID_PARAMS);
         assert!(
-            error.to_string().contains("invalid_grant"),
-            "the reason has to survive to the surface: {error}"
-        );
-        assert_eq!(
-            store.load().unwrap().access_token,
-            "spent",
-            "the stored credential is untouched — an hour of access left is worth more than a              record half-replaced by a failed refresh"
+            already.to_string().contains("--force"),
+            "the daemon's message names the flag, which the crate cannot know: {already}"
         );
 
-        let task = tokio::spawn(maintain(std::sync::Arc::clone(&account)));
-        let mut reported = None;
-        for _ in 0..200 {
-            if let Some(why) = account.status().await.last_error {
-                reported = Some(why);
-                break;
-            }
-            tokio::time::sleep(Duration::from_millis(20)).await;
-        }
-        task.abort();
-        let reported = reported.expect("`maintain` must put the failure where a client can see it");
-        assert!(
-            reported.contains("invalid_grant"),
-            "`account.status` is where somebody asks why remote access stopped: {reported}"
-        );
+        let busy: crate::Error = Hf::LoginInFlight.into();
+        assert_eq!(busy.code(), proto::code::BUSY);
+
+        let down: crate::Error = Hf::Network("POST /oauth/device: timed out".into()).into();
+        assert_eq!(down.code(), proto::code::NETWORK);
     }
 }
diff --git a/updater/src/engine.rs b/updater/src/engine.rs
index 09bcdab8..0c7c552f 100644
--- a/updater/src/engine.rs
+++ b/updater/src/engine.rs
@@ -1299,6 +1299,42 @@ impl Engine {
         })
     }
 
+    /// Install a duck detector from the Hub, and restart `mediad` onto it.
+    ///
+    /// `mediad` loads the model once, at startup, so a swapped set is invisible to it until it
+    /// restarts — and unlike `robotd`'s policies there is no live reload to ask for, because the
+    /// detector is a thread holding an NPU context and the honest way to replace it is to start
+    /// again. The restart drops every video session, which is why `detector.install` is gated
+    /// like `policy.install`. `reloaded` is whether the restart took; a `mediad` this board does
+    /// not have (a bench) counts as taken, since there is nothing running the old one.
+    pub async fn install_detector(
+        &self,
+        version: Option<&str>,
+    ) -> Result<crate::proto::PolicyInstallResult, Error> {
+        let root = std::path::Path::new(crate::policy::DETECTOR_ROOT);
+        let (installed, previous) = crate::policy::install_set(
+            root,
+            version,
+            crate::policy::Contents::Fixed(&crate::policy::DETECTOR_FILES),
+        )
+        .await?;
+        let reloaded = match &previous {
+            None => true,
+            Some(_) => match restart_one(SYSTEMCTL, MEDIAD_UNIT).await {
+                Ok(()) => true,
+                Err(e) => {
+                    tracing::warn!(error = %e, "mediad did not restart onto the new detector");
+                    false
+                }
+            },
+        };
+        Ok(crate::proto::PolicyInstallResult {
+            installed,
+            previous,
+            reloaded,
+        })
+    }
+
     /// Fetch one policy from any Hub repo into this robot's library.
     ///
     /// The model API comes from the running `robotd` rather than from a constant here, because it
@@ -2427,6 +2463,9 @@ const SYSTEMCTL: &str = "systemctl";
 /// Where `hooks/postinstall` installs unit files, and so where the orphan check reads them.
 const UNIT_DIR: &str = "/etc/systemd/system";
 
+/// The daemon that loads the duck detector, restarted by [`Engine::install_detector`].
+const MEDIAD_UNIT: &str = "mediad";
+
 /// This process's own unit, which the reconciliation must recognise and never restart.
 ///
 /// The bare name rather than `updaterd.service`, matching what [`units_shipped`] yields — it takes
diff --git a/updater/src/ipc.rs b/updater/src/ipc.rs
index c5919144..58a248ca 100644
--- a/updater/src/ipc.rs
+++ b/updater/src/ipc.rs
@@ -146,9 +146,7 @@ impl Server {
             allow_uids,
             allow_gids,
             forced_owner_uid: None,
-            account: Arc::new(crate::account::Account::new(crate::account::Store::new(
-                crate::account::DEFAULT_PATH,
-            ))),
+            account: Arc::new(crate::account::account()),
         }
     }
 
@@ -159,10 +157,7 @@ impl Server {
     /// developer's machine try to write — the real robot's credential.
     #[doc(hidden)]
     pub fn with_account_for_test(mut self, token_path: PathBuf, endpoint: String) -> Self {
-        self.account = Arc::new(crate::account::Account::with_endpoint(
-            crate::account::Store::new(token_path),
-            endpoint,
-        ));
+        self.account = Arc::new(crate::account::account_for_test(token_path, endpoint));
         self
     }
 
@@ -635,6 +630,32 @@ impl Server {
                     Err(e) => Response::err(Some(id), e.to_rpc_error()),
                 }
             }
+            // The detector's set: the same two questions against the other root, and the same
+            // locking — a read that takes no lock, an install that must not run beside a release
+            // install because both would be restarting daemons at once.
+            Call::DetectorCheck => {
+                Response::ok(Some(id), &crate::policy::check(
+                    std::path::Path::new(crate::policy::DETECTOR_ROOT),
+                ).await)
+            }
+            Call::DetectorInstall(params) => {
+                let engine = match self.engine.try_lock() {
+                    Ok(engine) => engine,
+                    Err(_) => {
+                        return Response::err(
+                            Some(id),
+                            proto::Error::new(
+                                proto::code::BUSY,
+                                "an update is in progress; retry shortly",
+                            ),
+                        );
+                    }
+                };
+                match engine.install_detector(params.version.as_deref()).await {
+                    Ok(result) => Response::ok(Some(id), &result),
+                    Err(e) => Response::err(Some(id), e.to_rpc_error()),
+                }
+            }
             // ── account.* ───────────────────────────────────────────────────────
             //
             // None of the three touches the engine, so none takes its lock: a login is an HTTP
@@ -642,14 +663,17 @@ impl Server {
             // what makes `status` answerable during an update, which it has to be.
             Call::AccountLogin(params) => {
                 match Arc::clone(&self.account).login(params.force).await {
-                    Ok(login) => Response::ok(Some(id), &login),
-                    Err(e) => Response::err(Some(id), e.to_rpc_error()),
+                    Ok(code) => Response::ok(Some(id), &crate::account::login_result(code)),
+                    Err(e) => Response::err(Some(id), crate::Error::from(e).to_rpc_error()),
                 }
             }
-            Call::AccountStatus => Response::ok(Some(id), &self.account.status().await),
+            Call::AccountStatus => Response::ok(
+                Some(id),
+                &crate::account::status_result(self.account.status().await),
+            ),
             Call::AccountLogout => match self.account.logout().await {
-                Ok(result) => Response::ok(Some(id), &result),
-                Err(e) => Response::err(Some(id), e.to_rpc_error()),
+                Ok(was) => Response::ok(Some(id), &crate::account::logout_result(was)),
+                Err(e) => Response::err(Some(id), crate::Error::from(e).to_rpc_error()),
             },
 
             // Read-only and no engine lock: asking the Hub what exists changes nothing here.
@@ -745,6 +769,7 @@ impl Server {
             | Call::RobotEnable(_)
             | Call::RobotInit
             | Call::RobotRelax
+            | Call::RobotRebootMotors(_)
             | Call::RobotDo(_)
             | Call::RobotSound(_)
             | Call::RobotPose(_)
@@ -758,6 +783,7 @@ impl Server {
             | Call::RobotMode
             | Call::RobotSetMode(_)
             | Call::RobotPolicies
+            | Call::RobotModel
             | Call::RobotLoadPolicy(_)
             | Call::RobotReloadPolicies
             | Call::RobotSubscribe(_) => Response::err(
@@ -777,6 +803,7 @@ impl Server {
             | Call::NetForget(_)
             | Call::SystemInfo
             | Call::SystemServices
+            | Call::SystemLogs(_)
             | Call::SystemSetName(_)
             | Call::SystemReboot
             | Call::SystemPairingPin
@@ -815,11 +842,11 @@ impl Server {
             ),
 
             // Same story one namespace over: `tofd` owns the sensor and answers for it.
-            Call::TofStream => Response::err(
+            Call::TofStream | Call::HeadImuStream => Response::err(
                 Some(id),
                 proto::Error::new(
                     proto::code::METHOD_NOT_FOUND,
-                    "tof.stream is served by tofd itself, on /run/tofd/tof.sock",
+                    "tof.stream and head_imu.stream are served by tofd itself, on /run/tofd/tof.sock",
                 ),
             ),
 
diff --git a/updater/src/lib.rs b/updater/src/lib.rs
index 2682d34b..ac19cecd 100644
--- a/updater/src/lib.rs
+++ b/updater/src/lib.rs
@@ -235,6 +235,24 @@ pub enum Error {
     Internal(String),
 }
 
+/// A refusal from the account crate, as this protocol's refusals.
+///
+/// The crate's own messages are deliberately not carried through. It cannot know that the way
+/// past `AlreadySignedIn` on a duck is spelled `--force` on a command line, and a message that
+/// says "force" where a person has to type `--force` is the kind of near-miss that costs a
+/// support round trip. The variants map; the words are this crate's.
+impl From<hf_robot_account::Error> for Error {
+    fn from(e: hf_robot_account::Error) -> Self {
+        use hf_robot_account::Error as Hf;
+        match e {
+            Hf::LoginInFlight => Error::LoginInFlight,
+            Hf::AlreadySignedIn(who) => Error::AlreadySignedIn(who),
+            Hf::Io { path, source } => Error::Io { path, source },
+            Hf::Network(why) => Error::Network(why),
+        }
+    }
+}
+
 impl Error {
     /// JSON-RPC error code for this failure.
     pub fn code(&self) -> i32 {
diff --git a/updater/src/policy.rs b/updater/src/policy.rs
index 975cc724..6e841606 100644
--- a/updater/src/policy.rs
+++ b/updater/src/policy.rs
@@ -7,7 +7,7 @@
 //! an HTTP client because it is the tool that has to work when everything else is broken.
 //!
 //! **Why it exists.** A board installs its set from a pin that ships inside the daemon release
-//! (`scripts/seed-policies.sh`), which makes the pin a *floor* rather than a ceiling: without
+//! (`scripts/seed-policies.sh`), which makes the pin a *minimum* rather than a ceiling: without
 //! something to move past it, a retrained gait would still need a daemon release to reach a
 //! robot, which is the thing the whole channel was meant to stop. This is that something.
 //!
@@ -24,6 +24,29 @@ use crate::source::http;
 /// Where the sets live. Matches `robotd_params::POLICY_DIR`'s parent and the seeder's default.
 pub const POLICY_ROOT: &str = "/opt/robot/policies";
 
+/// Where the duck detector lives. Matches `robotd_params::DETECTOR_DIR`'s parent and
+/// `scripts/seed-detector.sh`'s default — the same layout as the policies, one directory over,
+/// so [`check`], [`install_set`] and the seeder's rules apply unchanged.
+pub const DETECTOR_ROOT: &str = "/opt/robot/detector";
+
+/// What a detector set holds, NPU first. The detector's repo carries no manifest — its file
+/// names are fixed — so this list is the download list, and `scripts/seed-detector.sh` and
+/// `robotd_params::DETECTOR_FILES` carry the same one; an xtask test holds the three together.
+///
+/// The model repo shares its name with the dataset repo. Everything here addresses the model
+/// (`resolve/` without a `datasets/` prefix, `api/models/`), so the shared name cannot cross.
+pub const DETECTOR_FILES: [&str; 2] = ["duck_detect.rknn", "duck_detect.onnx"];
+
+/// Where a set's file list comes from.
+#[derive(Debug, Clone, Copy)]
+pub enum Contents {
+    /// The revision's `manifest.json`, falling back to what the installed set holds — the
+    /// official policy set, whose list can grow with a tag.
+    Manifest,
+    /// A fixed list — the detector, whose two files have fixed names and no manifest.
+    Fixed(&'static [&'static str]),
+}
+
 /// The provenance record the seeder writes beside a set.
 const SOURCE_FILE: &str = ".source";
 
@@ -221,14 +244,23 @@ fn files_in_manifest(bytes: &[u8]) -> Vec<String> {
         .unwrap_or_default()
 }
 
+/// Download one revision of the official policy set into `root`, and point `current` at it.
+pub async fn install(
+    root: &Path,
+    version: Option<&str>,
+) -> Result<(String, Option<String>), Error> {
+    install_set(root, version, Contents::Manifest).await
+}
+
 /// Download one revision of a repo into `root`, and point `current` at it.
 ///
 /// Nothing partial goes live: the files land in a staging directory and the symlink moves only
 /// once every one of them has arrived. Same rule the seeder follows, and for the same reason —
-/// a half-written set is one a restarting `robotd` could read.
-pub async fn install(
+/// a half-written set is one a restarting `robotd` (or `mediad`) could read.
+pub async fn install_set(
     root: &Path,
     version: Option<&str>,
+    contents: Contents,
 ) -> Result<(String, Option<String>), Error> {
     let source = installed(root).ok_or_else(|| {
         Error::Network("no policy set is installed, so there is no repo to install from".into())
@@ -257,10 +289,15 @@ pub async fn install(
         return Ok((version, None));
     }
 
-    let (files, manifest) = set_files(&client, &source.repo, &version).await;
-    let files = match files.is_empty() {
-        false => files,
-        true => installed_files(root),
+    let (files, manifest) = match contents {
+        Contents::Manifest => {
+            let (files, manifest) = set_files(&client, &source.repo, &version).await;
+            match files.is_empty() {
+                false => (files, manifest),
+                true => (installed_files(root), None),
+            }
+        }
+        Contents::Fixed(names) => (names.iter().map(|n| (*n).to_owned()).collect(), None),
     };
     if files.is_empty() {
         return Err(Error::Network(format!(
diff --git a/updater/tests/ipc.rs b/updater/tests/ipc.rs
index aa945da8..f6c33c18 100644
--- a/updater/tests/ipc.rs
+++ b/updater/tests/ipc.rs
@@ -1182,8 +1182,7 @@ impl FakeHub {
                 // `interval` HF omits, and only to keep the suite quick: the robot sleeps one
                 // interval before its first poll, so the real five seconds would make every
                 // login test five seconds long. That HF's omission falls back to five is pinned
-                // in `account::tests::a_device_code_response_is_normalised`, where it costs
-                // nothing.
+                // in `hf_robot_account`'s own tests, where it costs nothing.
                 post(|| async {
                     axum::Json(serde_json::json!({
                         "device_code": "device-abc",
@@ -1202,7 +1201,7 @@ impl FakeHub {
                         async move {
                             assert_eq!(
                                 form.get("client_id").map(String::as_str),
-                                Some(updater::account::CLIENT_ID),
+                                Some(hf_robot_account::HUGGINGFACE_CLIENT_ID),
                                 "the device flow must identify itself as the public client"
                             );
                             let n = counter.fetch_add(1, Ordering::SeqCst);
diff --git a/xtask/src/main.rs b/xtask/src/main.rs
index 178d79ea..5ae3647e 100644
--- a/xtask/src/main.rs
+++ b/xtask/src/main.rs
@@ -1173,7 +1173,7 @@ mod tests {
         let link = std::fs::read_link(root.join("current"))
             .ok()
             .map(|p| p.display().to_string());
-        let content = std::fs::read_to_string(root.join("current/alpha_walking.onnx")).ok();
+        let content = std::fs::read_to_string(root.join("current/velstand.onnx")).ok();
         (link, content)
     }
 
@@ -1210,6 +1210,193 @@ mod tests {
         }
     }
 
+    /// **The detector's pin is in two places too**, for the same reason: `seed-detector.sh` runs
+    /// from inside a release and cannot read Cargo.toml.
+    #[test]
+    fn seed_detector_pins_the_same_detector() {
+        let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("..");
+        let manifest: toml::Value =
+            toml::from_str(&std::fs::read_to_string(root.join("Cargo.toml")).unwrap()).unwrap();
+        let meta = &manifest["workspace"]["metadata"]["detector"];
+        let version = meta["version"].as_str().unwrap();
+        let repo = meta["repo"].as_str().unwrap();
+
+        let script = std::fs::read_to_string(root.join("scripts/seed-detector.sh")).unwrap();
+        for expected in [
+            format!("DETECTOR_VERSION=\"${{DETECTOR_VERSION:-{version}}}\""),
+            format!("DETECTOR_REPO=\"${{DETECTOR_REPO:-{repo}}}\""),
+        ] {
+            assert!(
+                script.contains(&expected),
+                "seed-detector.sh must carry the line {expected:?}"
+            );
+        }
+    }
+
+    /// **The detector's file list lives in three places and they must agree**: what the seeder
+    /// downloads, what `robotctl duck-detector update` downloads, and what `mediad` looks for. A name
+    /// missing from either downloader is a detector that is installed and cannot be found; a
+    /// name only the downloaders know is dead weight on the eMMC.
+    #[test]
+    fn the_detector_file_list_is_the_same_everywhere() {
+        let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("..");
+        let expected: Vec<String> = robotd_params::DETECTOR_FILES
+            .iter()
+            .map(|s| (*s).to_owned())
+            .collect();
+
+        let script = std::fs::read_to_string(root.join("scripts/seed-detector.sh")).unwrap();
+        let line = script
+            .lines()
+            .find(|l| l.starts_with("DETECTOR_FILES="))
+            .expect("seed-detector.sh must declare DETECTOR_FILES");
+        let listed: Vec<String> = line
+            .trim_start_matches("DETECTOR_FILES=")
+            .trim_matches('"')
+            .split_whitespace()
+            .map(str::to_owned)
+            .collect();
+        assert_eq!(
+            listed, expected,
+            "seed-detector.sh and robotd_params have drifted"
+        );
+
+        // `updater` cannot depend on `robotd-params`, so its copy is checked as text.
+        let updater = std::fs::read_to_string(root.join("updater/src/policy.rs")).unwrap();
+        let rendered = format!(
+            "pub const DETECTOR_FILES: [&str; {}] = [{}];",
+            expected.len(),
+            expected
+                .iter()
+                .map(|f| format!("{f:?}"))
+                .collect::<Vec<_>>()
+                .join(", ")
+        );
+        assert!(
+            updater.contains(&rendered),
+            "updater/src/policy.rs must carry {rendered}"
+        );
+    }
+
+    /// Run `scripts/seed-detector.sh` against a throwaway tree, with the Hub faked by a directory.
+    fn seed_detector(
+        root: &std::path::Path,
+        version: &str,
+        base_url: Option<&std::path::Path>,
+    ) -> (Option<String>, Option<String>) {
+        let repo_root = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+            .parent()
+            .expect("xtask/ has a parent");
+        let url = match base_url {
+            Some(dir) => format!("file://{}", dir.display()),
+            None => "file:///nonexistent-hub".to_owned(),
+        };
+        let status = std::process::Command::new("sh")
+            .arg(repo_root.join("scripts/seed-detector.sh"))
+            .arg(root)
+            .env("DETECTOR_VERSION", version)
+            .env("DETECTOR_BASE_URL", url)
+            .stderr(std::process::Stdio::null())
+            .status()
+            .expect("sh");
+        assert!(status.success(), "the seeder must never fail an update");
+
+        let link = std::fs::read_link(root.join("current"))
+            .ok()
+            .map(|p| p.display().to_string());
+        let content = std::fs::read_to_string(root.join("current/duck_detect.rknn")).ok();
+        (link, content)
+    }
+
+    fn fake_detector_hub(dir: &std::path::Path, marker: &str) {
+        std::fs::create_dir_all(dir).expect("mkdir");
+        for name in robotd_params::DETECTOR_FILES {
+            std::fs::write(dir.join(name), format!("{marker}-{name}")).expect("model");
+        }
+    }
+
+    /// Nothing installed, the Hub reachable: both files arrive, `current` points at the pin,
+    /// and the provenance record names the repo `robotctl duck-detector check` will ask.
+    #[test]
+    fn the_pinned_detector_is_downloaded_from_the_hub() {
+        let tmp = tempfile::tempdir().unwrap();
+        let hub = tmp.path().join("hub");
+        let root = tmp.path().join("detector");
+        fake_detector_hub(&hub, "hub");
+        std::fs::create_dir_all(&root).unwrap();
+
+        let (link, content) = seed_detector(&root, "duck-v1", Some(&hub));
+        assert_eq!(link.as_deref(), Some("releases/seed-duck-v1"));
+        assert_eq!(content.as_deref(), Some("hub-duck_detect.rknn"));
+        for name in robotd_params::DETECTOR_FILES {
+            assert!(root.join("current").join(name).exists(), "{name} missing");
+        }
+        let source = std::fs::read_to_string(root.join("current/.source")).unwrap();
+        assert!(
+            source.contains("repo=pollen-robotics/microduck-duck-detector"),
+            "{source}"
+        );
+        assert!(source.contains("version=duck-v1"), "{source}");
+    }
+
+    /// A revision missing the CPU fallback is not installed at all: half a set is worse than
+    /// none, because a board whose NPU is off would have a detector that exists and never loads.
+    #[test]
+    fn a_detector_revision_missing_a_file_is_not_installed() {
+        let tmp = tempfile::tempdir().unwrap();
+        let hub = tmp.path().join("hub");
+        let root = tmp.path().join("detector");
+        std::fs::create_dir_all(&hub).unwrap();
+        std::fs::write(hub.join("duck_detect.rknn"), "npu only").unwrap();
+        std::fs::create_dir_all(&root).unwrap();
+
+        let (link, _) = seed_detector(&root, "duck-v1", Some(&hub));
+        assert_eq!(link, None, "nothing partial goes live");
+        assert!(
+            !root.join("releases/.staging").exists(),
+            "staging is cleaned up"
+        );
+    }
+
+    /// The rule the handover rests on: a set already installed — the pin, a newer one from
+    /// `robotctl duck-detector update`, or somebody else's — is never replaced by a daemon update.
+    #[test]
+    fn an_installed_detector_is_left_alone() {
+        let tmp = tempfile::tempdir().unwrap();
+        let hub = tmp.path().join("hub");
+        let root = tmp.path().join("detector");
+        fake_detector_hub(&hub, "one");
+        std::fs::create_dir_all(&root).unwrap();
+        seed_detector(&root, "duck-v1", Some(&hub));
+
+        fake_detector_hub(&hub, "two");
+        let (link, content) = seed_detector(&root, "duck-v2", Some(&hub));
+        assert_eq!(
+            link.as_deref(),
+            Some("releases/seed-duck-v1"),
+            "the newer pin is a floor"
+        );
+        assert_eq!(content.as_deref(), Some("one-duck_detect.rknn"));
+
+        // Something else's set, under a name that is not ours.
+        let theirs = root.join("releases/theirs");
+        std::fs::create_dir_all(&theirs).unwrap();
+        std::fs::remove_file(root.join("current")).unwrap();
+        std::os::unix::fs::symlink("releases/theirs", root.join("current")).unwrap();
+        let (link, _) = seed_detector(&root, "duck-v2", Some(&hub));
+        assert_eq!(link.as_deref(), Some("releases/theirs"));
+    }
+
+    /// A board that cannot reach the Hub ends up with no detector, and the update is not failed.
+    #[test]
+    fn an_unreachable_hub_leaves_the_board_without_a_detector() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path().join("detector");
+        std::fs::create_dir_all(&root).unwrap();
+        let (link, _) = seed_detector(&root, "duck-v1", None);
+        assert_eq!(link, None);
+    }
+
     /// **The fallback list must still be what `robotd` can ask for.**
     ///
     /// The download list comes from the set's own `manifest.json` now, so a tenth policy is a tag
@@ -1320,7 +1507,7 @@ mod tests {
 
         let (link, content) = seed(&root, "v1", Some(&hub));
         assert_eq!(link.as_deref(), Some("releases/seed-v1"));
-        assert_eq!(content.as_deref(), Some("hub-alpha_walking.onnx"));
+        assert_eq!(content.as_deref(), Some("hub-velstand.onnx"));
 
         let mut installed: Vec<String> = std::fs::read_dir(root.join("releases/seed-v1"))
             .unwrap()
@@ -1354,7 +1541,7 @@ mod tests {
             serde_json::to_string_pretty(&serde_json::json!({
                 "schema_version": 1,
                 "policies": [
-                    { "file": "alpha_walking.onnx", "kind": "perpetual" },
+                    { "file": "velstand.onnx", "kind": "perpetual" },
                     { "file": escape },
                 ]
             }))
@@ -1366,7 +1553,7 @@ mod tests {
 
         let (link, content) = seed(&root, "v1", Some(&hub));
         assert_eq!(link.as_deref(), Some("releases/seed-v1"));
-        assert_eq!(content.as_deref(), Some("hub-alpha_walking.onnx"));
+        assert_eq!(content.as_deref(), Some("hub-velstand.onnx"));
         assert!(
             !root.join("escaped.onnx").exists() && !tmp.path().join("escaped.onnx").exists(),
             "nothing was written outside the set"
@@ -1439,16 +1626,17 @@ mod tests {
         );
     }
 
-    /// **An installed set is never replaced, whatever the pin says.**
+    /// **A set past the pin is never moved back to it.**
     ///
-    /// The pin is a floor — what a board with nothing gets — and not a ceiling. This used to
-    /// replace an older set on the reasoning that a daemon update was still how a retrained gait
-    /// reached a board; `robotctl policy update` is now how, and the old rule became a trap. A
-    /// board moved forward to v2 by hand had `current -> releases/seed-v2`, which matches the
-    /// `seed-*` the seeder called its own, so the next unrelated daemon update would have put v1
-    /// back — silently reverting somebody's gait as a side effect of a binary update.
+    /// The pin is a minimum — what a board with nothing gets, and the oldest set the daemon runs
+    /// with — and not a ceiling. This used to replace any older set on the reasoning that a daemon
+    /// update was still how a retrained gait reached a board; `robotctl policy update` is now how,
+    /// and that rule was a trap. A board moved forward to v2 by hand had `current ->
+    /// releases/seed-v2`, which matches the `seed-*` the seeder called its own, so the next
+    /// unrelated daemon update would have put v1 back — silently reverting somebody's gait as a
+    /// side effect of a binary update.
     #[test]
-    fn a_set_already_installed_is_left_alone_whatever_the_pin_says() {
+    fn a_set_past_the_pin_is_left_alone() {
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path().join("policies");
         std::fs::create_dir_all(&root).unwrap();
@@ -1463,7 +1651,95 @@ mod tests {
         let (link, content) = seed(&root, "v1", Some(&v1));
 
         assert_eq!(link.as_deref(), Some("releases/seed-v2"));
-        assert_eq!(content.as_deref(), Some("chosen-alpha_walking.onnx"));
+        assert_eq!(content.as_deref(), Some("chosen-velstand.onnx"));
+    }
+
+    /// **A set below the pin is moved up to it.** The daemon's slot defaults name files, and a
+    /// default that names a file only the newer set carries — v5's `velstand.onnx` — would leave a
+    /// board that updated the daemon but not its set unable to load its gait, unhealthy, and
+    /// rolled back. So the pin is the minimum the daemon runs with, and the hook enforces it.
+    #[test]
+    fn a_set_below_the_pin_is_moved_up_to_it() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path().join("policies");
+        std::fs::create_dir_all(&root).unwrap();
+
+        let v4 = tmp.path().join("hub-v4");
+        fake_hub(&v4, "old");
+        seed(&root, "v4", Some(&v4));
+
+        let v5 = tmp.path().join("hub-v5");
+        fake_hub(&v5, "pinned");
+        let (link, content) = seed(&root, "v5", Some(&v5));
+
+        assert_eq!(link.as_deref(), Some("releases/seed-v5"));
+        assert_eq!(content.as_deref(), Some("pinned-velstand.onnx"));
+        let record = std::fs::read_to_string(root.join("current/.source")).unwrap();
+        assert!(record.contains("version=v5"), "{record}");
+        assert!(
+            root.join("releases/seed-v4/velstand.onnx").exists(),
+            "the set it came from is kept, the way the updater keeps a predecessor"
+        );
+    }
+
+    /// The comparison is on numbers, so `v10` is past `v9` and not below it.
+    #[test]
+    fn the_minimum_compares_versions_as_numbers() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path().join("policies");
+        std::fs::create_dir_all(&root).unwrap();
+
+        let v10 = tmp.path().join("hub-v10");
+        fake_hub(&v10, "ten");
+        seed(&root, "v10", Some(&v10));
+
+        let v9 = tmp.path().join("hub-v9");
+        fake_hub(&v9, "nine");
+        let (link, content) = seed(&root, "v9", Some(&v9));
+
+        assert_eq!(link.as_deref(), Some("releases/seed-v10"));
+        assert_eq!(content.as_deref(), Some("ten-velstand.onnx"));
+    }
+
+    /// Only *our* sets move. One whose record names another repo is somebody's choice, whatever
+    /// its version says, and the minimum has nothing to say about it.
+    #[test]
+    fn a_set_from_another_repo_is_left_alone_below_the_pin() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path().join("policies");
+        std::fs::create_dir_all(root.join("releases/seed-v1")).unwrap();
+        std::fs::write(root.join("releases/seed-v1/velstand.onnx"), "theirs").unwrap();
+        std::fs::write(
+            root.join("releases/seed-v1/.source"),
+            "repo=someone/microduck-policies\nversion=v1\nfetched=2026-01-01T00:00:00Z\n",
+        )
+        .unwrap();
+        std::os::unix::fs::symlink("releases/seed-v1", root.join("current")).unwrap();
+
+        let hub = tmp.path().join("hub");
+        fake_hub(&hub, "pinned");
+        let (link, content) = seed(&root, "v5", Some(&hub));
+
+        assert_eq!(link.as_deref(), Some("releases/seed-v1"));
+        assert_eq!(content.as_deref(), Some("theirs"));
+    }
+
+    /// A board below the minimum that cannot reach the Hub stays where it is — nothing partial,
+    /// nothing removed, and the seeder still does not fail. What happens next is `robotd`'s to
+    /// report: a default it cannot load is unhealthy, and the update rolls back with the reason.
+    #[test]
+    fn a_set_below_the_pin_stays_when_the_hub_is_unreachable() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path().join("policies");
+        std::fs::create_dir_all(&root).unwrap();
+
+        let v4 = tmp.path().join("hub-v4");
+        fake_hub(&v4, "old");
+        seed(&root, "v4", Some(&v4));
+
+        let (link, content) = seed(&root, "v5", None);
+        assert_eq!(link.as_deref(), Some("releases/seed-v4"));
+        assert_eq!(content.as_deref(), Some("old-velstand.onnx"));
     }
 
     /// A board that cannot reach the Hub on a first install ends up with no policies, and that
@@ -1493,7 +1769,7 @@ mod tests {
         fake_hub(&hub, "hub");
         std::fs::create_dir_all(root.join("releases/from-a-tool")).unwrap();
         std::fs::write(
-            root.join("releases/from-a-tool/alpha_walking.onnx"),
+            root.join("releases/from-a-tool/velstand.onnx"),
             "installed-by-something-else",
         )
         .unwrap();
@@ -1530,7 +1806,7 @@ mod tests {
         );
         assert_eq!(
             content.as_deref(),
-            Some("one-alpha_walking.onnx"),
+            Some("one-velstand.onnx"),
             "and the board keeps something that works"
         );
     }
@@ -1559,6 +1835,33 @@ mod tests {
         }
     }
 
+    /// The duck detector left the release the way the policies did: it is seeded from the Hub
+    /// by a script the release carries, and the model files themselves are no longer vendored.
+    /// A site that still packages `models/duck_detect.*` would ship fourteen megabytes nothing
+    /// reads; one that forgets the seeder leaves fresh boards with a detector that cannot start.
+    #[test]
+    fn the_detector_seeder_is_packaged_and_the_model_is_not() {
+        let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+            .parent()
+            .expect("xtask/ has a parent");
+        assert!(
+            !root.join("duck-detect/models").exists(),
+            "the detector model is vendored again; it belongs on the Hub"
+        );
+        for site in PACKAGING_SITES {
+            let text =
+                std::fs::read_to_string(root.join(site)).unwrap_or_else(|e| panic!("{site}: {e}"));
+            assert!(
+                text.contains("=scripts/seed-detector.sh"),
+                "{site} does not package the detector seeder"
+            );
+            assert!(
+                !text.contains("duck_detect"),
+                "{site} still packages the detector model inside the release"
+            );
+        }
+    }
+
     /// The stable manifest names an artifact URL under the stable tag — so the workflow
     /// that creates that release must actually upload the artifact to it.
     ///