fix(deploy): keep VM103's disk from filling with images and build cache

Every CI build and deploy left a 1.2 GB image of this app on the VM and the build cache kept growing, until the root disk was full and apt in CI failed. After a good deploy update.sh keeps the running image, the previous one and the three newest; the publish job prunes build cache older than two days. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat(deploy): Keycloak login in front of the app, open beyond the LAN
2026-09-30 13:07:45 +02:00 · 2026-09-30 12:31:29 +02:00 · 2026-09-30 12:27:24 +02:00 · 2026-09-30 12:23:14 +02:00 · 2026-09-30 12:21:17 +02:00 · 2026-09-30 12:15:18 +02:00
49 changed files with 1919 additions and 40 deletions
@@ -53,3 +53,5 @@ jobs:
          # Push only these refs: the daemon is the VM's, so `--all-tags` would also push the local :rollback tag from update.sh.
          for ref in "${refs[@]}"; do docker push "${ref}"; done
          docker logout "${REGISTRY}"
+          # Builds run on the VM's daemon: without this its build cache grows until the disk is full.
+          docker builder prune -f --filter until=48h >/dev/null 2>&1 || true
@@ -18,5 +18,6 @@
  {"app": "ombi", "service": "ombi", "imageRepo": "linuxserver/ombi", "tagPattern": "^v[0-9]+\\.[0-9]+\\.[0-9]+-ls[0-9]+$", "auto": "patch", "httpUrl": "https://ombi.mariuszpacek.pl/", "expectStatus": 200},
  {"app": "orcaslicer", "service": "orcaslicer", "imageRepo": "linuxserver/orcaslicer", "tagPattern": "^v[0-9]+\\.[0-9]+\\.[0-9]+-ls[0-9]+$", "auto": "minor", "httpUrl": "https://orca.mariuszpacek.pl/", "expectStatus": 401},
  {"app": "radarr", "service": "radarr", "imageRepo": "ghcr.io/linuxserver/radarr", "tagPattern": "^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+-ls[0-9]+$", "auto": "patch", "httpUrl": "https://radarr.mariuszpacek.pl/", "expectStatus": 302},
-  {"app": "sonarr", "service": "sonarr", "imageRepo": "ghcr.io/linuxserver/sonarr", "tagPattern": "^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+-ls[0-9]+$", "auto": "patch", "httpUrl": "https://sonarr.mariuszpacek.pl/", "expectStatus": 302}
+  {"app": "sonarr", "service": "sonarr", "imageRepo": "ghcr.io/linuxserver/sonarr", "tagPattern": "^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+-ls[0-9]+$", "auto": "patch", "httpUrl": "https://sonarr.mariuszpacek.pl/", "expectStatus": 302},
+  {"app": "trilium", "service": "trilium", "imageRepo": "triliumnext/trilium", "tagPattern": "^v[0-9]+\\.[0-9]+\\.[0-9]+$", "auto": "patch", "httpUrl": "https://trilium.mariuszpacek.pl/api/health-check", "expectStatus": 200, "notes": "0.x: every minor migrates the database one way"}
 ]
@@ -0,0 +1,15 @@
+# Trilium — VM103
+
+Usługa `trilium`, obraz `triliumnext/trilium` — TriliumNext, utrzymywany fork `zadam/trilium` (oryginał w trybie utrzymania). Domena `trilium.mariuszpacek.pl` (także `notes.mariuszpacek.pl`), port 8080 tylko w sieci `proxy`, bez portu na hoście. Whitelist traefika jak w bazarr (LAN, VPN, `172.16.0.1/32` dla drivera). Aplikacja ma własne logowanie hasłem.
+Dane: `/home/node/trilium-data` ← `/srv/appdata/trilium/data` (`document.db` SQLite, `config.ini`, `backup/`, `log/`), właściciel `1000:1000`, tryb `700`. Entrypoint startuje jako root, robi `chown -R node:node /home/node` i uruchamia serwer jako `node` (uid 1000) — nie ustawiaj `user:` w compose.
+Obraz ma healthcheck (`/api/health-check`) i etykietę OCI `org.opencontainers.image.version` z tagiem.
+Źródła: [wydania](https://github.com/TriliumNext/Trilium/releases), [dokumentacja](https://docs.triliumnotes.org/), [Docker](https://docs.triliumnotes.org/user-guide/setup/server/installation/docker).
+
+Wersje: tagi `vX.Y.Z` (bez `-rc`, `main`, `sha-*`, `latest`). Seria 0.x: każdy minor to wydanie z nowymi funkcjami i zwykle z jednokierunkową migracją bazy — stąd auto `patch`, a minor czeka na decyzję właściciela.
+Migracja bazy przy starcie w jednej transakcji; przed nią Trilium sam zapisuje `backup/backup-before-migration.db`. Historia: 2026-09-30 baza przeniesiona z `/fast-vm/docker/trilium/mariusz` na Proxmoksie (Trilium 0.60, dbVersion 214) i zmigrowana na v0.106.0 (dbVersion 240); kopia sprzed tej migracji: `backup/backup-before-migration-v060.db`.
+
+Kopia: codzienny vzdump VM103 obejmuje `/srv/appdata`; workflow kopiuje compose przed zmianą. Dodatkowa kopia bazy nie jest wymagana, bo Trilium robi ją sam przed migracją.
+
+Odbiór: kontener `healthy` na przypiętym obrazie; `/api/health-check` przez HTTPS → 200; w logu `Migration to version N has been successful` (jeśli była migracja) i `All consistency checks passed`; brak `Error` przy starcie. Treść notatek sprawdza właściciel po zalogowaniu.
+STOP: log pokazuje nieudaną migrację (`migration failed`, crash przy starcie) albo błędy spójności bazy — nie naprawiaj bazy, opisz i zostaw decyzję właścicielowi.
+Powrót: rollback przywraca compose sprzed aktualizacji, ale starsza wersja odmówi otwarcia bazy po migracji. Wtedy trzeba przy zatrzymanym kontenerze przywrócić `document.db` z `backup/backup-before-migration.db` (albo z vzdumpu) — tylko za zgodą właściciela.
@@ -120,6 +120,12 @@
      "cron": "0 17 * * 6",
      "mode": "real",
      "enabled": false
+    },
+    {
+      "workflowId": "update-trilium",
+      "cron": "0 16 * * 0",
+      "mode": "real",
+      "enabled": true
    }
  ]
 }
@@ -37,13 +37,15 @@ services:
      traefik.http.routers.homelab-upgrade.rule: 'Host(`upgrade.mariuszpacek.pl`)'
      traefik.http.routers.homelab-upgrade.entrypoints: "web-secured"
      traefik.http.routers.homelab-upgrade.priority: "100"
-      traefik.http.routers.homelab-upgrade.middlewares: "homelab-upgrade-lan"
+      traefik.http.routers.homelab-upgrade.middlewares: "homelab-upgrade-login"
      traefik.http.routers.homelab-upgrade.tls: "true"
      traefik.http.routers.homelab-upgrade.tls.certresolver: "http"
      traefik.http.routers.homelab-upgrade.service: "homelab-upgrade"
      traefik.http.services.homelab-upgrade.loadbalancer.server.port: "8080"
-      # No login yet: LAN only.
-      traefik.http.middlewares.homelab-upgrade-lan.ipwhitelist.sourcerange: "192.168.0.1/24,10.0.0.0/16"
+      # Every request asks the auth service first; without a session the browser goes to Keycloak (service auth below).
+      traefik.http.middlewares.homelab-upgrade-login.forwardauth.address: "http://homelab-upgrade-auth:4180/"
+      traefik.http.middlewares.homelab-upgrade-login.forwardauth.trustForwardHeader: "true"
+      traefik.http.middlewares.homelab-upgrade-login.forwardauth.authResponseHeaders: "X-Auth-Request-Email,X-Auth-Request-User"
      # Tile on dash.mariuszpacek.pl: homepage discovers it through its own Docker connection (my-docker), no edit of its files.
      homepage.group: "Infra"
      homepage.name: "Upgrade"
@@ -53,6 +55,57 @@ services:
      homepage.server: "my-docker"
      homepage.container: "homelab-upgrade-server-1"

+  # Login in front of the app (oauth2-proxy, Traefik forwardAuth with a static upstream): a request without a session
+  # is sent to Keycloak (realm home), and only the e-mail addresses in AUTH_ALLOWED_EMAILS get in. The client secret,
+  # the cookie secret and the addresses live in .env on VM103 (docs/DEPLOY.md, "Logowanie"). The session cookie lasts
+  # 7 days and is refreshed hourly. The manifest and the icon stay public: a phone fetches them without the cookie.
+  auth:
+    image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4@sha256:b1b2021fe8f4004573e8d690dec6c7bb29cc44364572cf8510a05bf3a0ae2ded
+    restart: unless-stopped
+    user: "65532:65532"
+    read_only: true
+    cap_drop: [ALL]
+    security_opt: ["no-new-privileges:true"]
+    environment:
+      OAUTH2_PROXY_PROVIDER: keycloak-oidc
+      OAUTH2_PROXY_OIDC_ISSUER_URL: https://login.mariuszpacek.pl/realms/home
+      OAUTH2_PROXY_CLIENT_ID: ${AUTH_CLIENT_ID:-homelab-upgrade}
+      OAUTH2_PROXY_CLIENT_SECRET: ${AUTH_CLIENT_SECRET:?AUTH_CLIENT_SECRET is not set in .env}
+      OAUTH2_PROXY_COOKIE_SECRET: ${AUTH_COOKIE_SECRET:?AUTH_COOKIE_SECRET is not set in .env}
+      OAUTH2_PROXY_CODE_CHALLENGE_METHOD: S256
+      OAUTH2_PROXY_REDIRECT_URL: https://upgrade.mariuszpacek.pl/oauth2/callback
+      OAUTH2_PROXY_HTTP_ADDRESS: 0.0.0.0:4180
+      OAUTH2_PROXY_REVERSE_PROXY: "true"
+      OAUTH2_PROXY_UPSTREAMS: static://202
+      OAUTH2_PROXY_EMAIL_DOMAINS: "*"
+      OAUTH2_PROXY_AUTHENTICATED_EMAILS_FILE: /etc/oauth2-proxy/emails
+      OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
+      OAUTH2_PROXY_SKIP_AUTH_ROUTES: "GET=^/manifest\\.webmanifest$$,GET=^/icon\\.svg$$"
+      OAUTH2_PROXY_COOKIE_NAME: _homelab_upgrade
+      OAUTH2_PROXY_COOKIE_SECURE: "true"
+      OAUTH2_PROXY_COOKIE_EXPIRE: 168h
+      OAUTH2_PROXY_COOKIE_REFRESH: 1h
+      OAUTH2_PROXY_SET_XAUTHREQUEST: "true"
+      OAUTH2_PROXY_SHOW_DEBUG_ON_ERROR: "false"
+    configs:
+      - source: auth-emails
+        target: /etc/oauth2-proxy/emails
+    networks:
+      proxy:
+        # A name no other project on the proxy network uses: Traefik's forwardAuth address points at it.
+        aliases: [homelab-upgrade-auth]
+    labels:
+      traefik.enable: "true"
+      traefik.docker.network: "proxy"
+      # The sign-in callback and sign-out go straight to the auth service.
+      traefik.http.routers.homelab-upgrade-auth.rule: 'Host(`upgrade.mariuszpacek.pl`) && PathPrefix(`/oauth2/`)'
+      traefik.http.routers.homelab-upgrade-auth.entrypoints: "web-secured"
+      traefik.http.routers.homelab-upgrade-auth.priority: "200"
+      traefik.http.routers.homelab-upgrade-auth.tls: "true"
+      traefik.http.routers.homelab-upgrade-auth.tls.certresolver: "http"
+      traefik.http.routers.homelab-upgrade-auth.service: "homelab-upgrade-auth"
+      traefik.http.services.homelab-upgrade-auth.loadbalancer.server.port: "4180"
+
  # The driver: runs queued workflow runs one step at a time and pushes to the owner's phone when a run waits for them,
  # fails, or a real run ends. It finds the running containers by their compose labels (docker ps through the socket proxy
  # below, GET only) and asks the registries what is newer. It reads no compose project file and changes nothing itself:
@@ -205,6 +258,11 @@ services:
    cap_drop: [ALL]
    security_opt: ["no-new-privileges:true"]

+configs:
+  # One address per line; nobody else gets in, whatever else Keycloak's realm holds.
+  auth-emails:
+    content: ${AUTH_ALLOWED_EMAILS:?AUTH_ALLOWED_EMAILS is not set in .env}
+
 networks:
  proxy:
    name: proxy
@@ -15,6 +15,7 @@ cd "${DEPLOY_DIR:-$script_dir}"
 image_repo=git.mariuszpacek.pl/mariusz.pacek/homelab-upgrade
 healthy_timeout=${HEALTHY_TIMEOUT:-90}
 backups_kept=${BACKUPS_KEPT:-5}
+images_kept=${IMAGES_KEPT:-3}

 tag_arg=""
 force=0
@@ -91,6 +92,21 @@ restore_compose() {
  fi
 }

+# Each CI build and each deploy leaves an image of this app on the VM (over a gigabyte each), and a full disk stops
+# every app on it. Kept: the one running, the previous one (to go back) and the newest $images_kept; a failure here
+# never fails the deploy.
+prune_images() {
+  local running id count=0
+  running=$(docker inspect --format '{{.Image}}' "$(service_container server)" 2>/dev/null || true)
+  # `docker images` lists the newest first; an image with several tags appears once per tag.
+  for id in $(docker images --no-trunc --format '{{.ID}}' "$image_repo" | awk '!seen[$0]++'); do
+    count=$((count + 1))
+    [[ "$id" == "$running" || "$id" == "$previous_image" ]] && continue
+    ((count <= images_kept)) && continue
+    docker image rm -f "$id" >/dev/null 2>&1 || true
+  done
+}
+
 wait_until_up() {
  local deadline=$((SECONDS + healthy_timeout)) status
  while ((SECONDS < deadline)); do
@@ -99,9 +115,10 @@ wait_until_up() {
    sleep 3
  done
  [[ "$status" == healthy ]] || return 1
-  sleep 5 # the driver and the socket proxy have no healthcheck: they must still be running, and not restarting, after a few seconds
+  sleep 5 # services without a healthcheck must still be running, and not restarting, after a few seconds
  local service
-  for service in driver docker-proxy executor model-claude model-codex function-runtime; do
+  for service in $(docker compose config --services); do
+    [[ "$service" == server ]] && continue
    [[ "$(docker inspect --format '{{.State.Status}} {{.RestartCount}}' "$(service_container "$service")" 2>/dev/null)" == "running 0" ]] || return 1
  done
  # The executor has a healthcheck of its own; give it the rest of the time to pass it.
@@ -148,6 +165,7 @@ if wait_until_up; then
    { grep -v '^TAG=' .env || true; printf 'TAG=%s\n' "$tag"; } > .env.new && chmod --reference=.env .env.new && mv .env.new .env
  fi
  revision=$(docker inspect --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' "$(service_container server)")
+  prune_images
  echo "ok: $image_repo:$tag revision ${revision:-unknown}"
  exit 0
 fi
@@ -5,7 +5,7 @@ Stan na 2026-09-19: na VM103 działa łańcuch prawdziwej aktualizacji przez sid
 | | |
 |---|---|
 | Adres | https://upgrade.mariuszpacek.pl (traefik, `web-secured`, certyfikat `http`, wildcard DNS na 192.168.0.139) |
-| Dostęp | tylko LAN: middleware `ipwhitelist` `192.168.0.1/24,10.0.0.0/16`; **appka nie ma logowania** |
+| Dostęp | z LAN i z internetu, **tylko po zalogowaniu Keycloakiem** (realm `home`, usługa `auth` = oauth2-proxy jako forwardAuth Traefika; sekcja „Logowanie”) |
 | Manifest | `/opt/homelab/compose/homelab-upgrade/compose.yaml` (kopia `deploy/compose.yaml`) |
 | Obraz | `git.mariuszpacek.pl/mariusz.pacek/homelab-upgrade:<tag>` z rejestru Gitei, budowany przez Gitea Actions (etykieta `org.opencontainers.image.revision` = sha commita) |
 | Dashboard | kafelek „Upgrade” w grupie Infra na https://dash.mariuszpacek.pl z etykiet `homepage.*` na `server` (homepage czyta je przez swoje połączenie z Dockerem; jego pliki nie są zmieniane) |
@@ -50,6 +50,27 @@ Ręczny `update.sh` nie wgrywa `compose.yaml`; po zmianie `deploy/compose.yaml`

 Przy zmianie schematu bazy nowa wersja migruje bazę przy starcie (migracje są transakcyjne; nowszej bazy niż kod odmawia otwarcia). Wycofanie do starszego obrazu po zmianie schematu nie zadziała, bo starszy kod odmówi otwarcia nowszej bazy: wtedy przywraca się kopię `queue.sqlite.before-deploy-*` z kroku 2.

+### Logowanie (Keycloak)
+
+Usługa `auth` (oauth2-proxy, `deploy/compose.yaml`) stoi przed aplikacją: Traefik pyta ją o każde zapytanie (forwardAuth); bez sesji przeglądarka idzie do `https://login.mariuszpacek.pl/realms/home`, po powrocie wpuszczane są tylko adresy z `AUTH_ALLOWED_EMAILS`. Sesja trwa 7 dni (odświeżana co godzinę), wylogowanie: `https://upgrade.mariuszpacek.pl/oauth2/sign_out`. Publiczne zostają tylko `manifest.webmanifest` i `icon.svg`.
+
+Jednorazowo w Keycloaku (realm `home`):
+
+1. Clients → Create client: typ OpenID Connect, Client ID `homelab-upgrade`; Client authentication **on**, Standard flow **on**, Direct access grants off.
+2. Valid redirect URIs `https://upgrade.mariuszpacek.pl/oauth2/callback`, Web origins `https://upgrade.mariuszpacek.pl`.
+3. Client scopes → `homelab-upgrade-dedicated` → Add mapper → By configuration → **Audience**: Included Client Audience `homelab-upgrade`, Add to access token on (oauth2-proxy sprawdza audience).
+4. Credentials → skopiuj Client secret.
+
+W `/opt/homelab/compose/homelab-upgrade/.env` na VM103 (root, 600):
+
+```bash
+AUTH_CLIENT_SECRET=<client secret z Keycloaka>
+AUTH_COOKIE_SECRET=<openssl rand -base64 32 | tr -- '+/' '-_'>
+AUTH_ALLOWED_EMAILS=<adres e-mail konta w Keycloaku>
+```
+
+Bez tych trzech wartości `docker compose` odmawia (wdrożenie kończy się bez restartu, `update.sh` przywraca poprzedni `compose.yaml`).
+
 ### Jednorazowa konfiguracja

 1. **Rejestr**: działa od razu (Packages w Gitei są domyślnie włączone; `https://git.mariuszpacek.pl/v2/` odpowiada 401).
@@ -176,7 +197,7 @@ Arcane v2.13.1 działa pod `https://arcane.mariuszpacek.pl`. Projekty używają

 Początkowe synchronizacje 18 projektów zachowały SHA plików env i nie zmieniły startów kontenerów; Arcane może utworzyć pusty `.env`. Źródła nie wymagały restartu podczas importu. Test Jackett przez API executora potwierdził ścieżkę komentarz → commit `47c2b7f` → push → udany sync Arcane i HTTP 301; rollback executora wykonał `git revert`, przywrócił pierwotny SHA i zakończył się powodzeniem.

-`config/workflow-schedules.json` rozkłada starty w strefie `Europe/Warsaw` (czas polski): poniedziałek Bazarr 19:00, Jackett 21:00; wtorek Radarr 19:00, Sonarr 21:00; środa Deluge 19:00, Ombi 21:00; czwartek Homepage 19:00, OrcaSlicer 21:00; piątek Gitea 18:00, baza 19:00, Keycloak 20:00, baza 22:00; sobota Home Assistant 18:00, Nextcloud 20:00, baza 22:00, Redis 23:00; niedziela Grafana 18:00, Jellyfin 20:00. InfluxDB i Dockge są wyłączone.
+`config/workflow-schedules.json` rozkłada starty w strefie `Europe/Warsaw` (czas polski): poniedziałek Bazarr 19:00, Jackett 21:00; wtorek Radarr 19:00, Sonarr 21:00; środa Deluge 19:00, Ombi 21:00; czwartek Homepage 19:00, OrcaSlicer 21:00; piątek Gitea 18:00, baza 19:00, Keycloak 20:00, baza 22:00; sobota Home Assistant 18:00, Nextcloud 20:00, baza 22:00, Redis 23:00; niedziela Trilium 16:00, Grafana 18:00, Jellyfin 20:00. InfluxDB i Dockge są wyłączone.

 Konfiguracja prywatna `/srv/appdata/homelab-upgrade/git-config/deployments.json` jest montowana jako `/git-config` tylko do odczytu, a `GIT_DEPLOYMENTS_FILE=/git-config/deployments.json`. Schemat v1: `repoPath=/git/repo`, `branch=master`, `sshKeyPath=/git-ssh/id_ed25519`, `knownHostsPath=/git-ssh/known_hosts`; projekty mają tryb `direct` albo `git`, `webhookUrl` i opcjonalny `redeployWebhookUrl`. Executor ma checkout do zapisu, katalog `git-ssh` tylko do odczytu oraz sieci `executor` i `default`; git i OpenSSH są częścią obrazu. Klucz executora z prawem zapisu znajduje się w `/srv/appdata/homelab-upgrade/git-ssh/id_ed25519`, klucz Arcane tylko do odczytu w `/srv/appdata/arcane/git-ssh/id_ed25519`. `known_hosts` przypina trzy publiczne algorytmy Gitei porównane z plikiem `.pub` kontenera. Nie umieszczaj tokenów ani webhook URL zawierających sekrety w dokumentacji, repo ani logach.

@@ -169,3 +169,14 @@ Decyzje: sidebar + karty, ciemny motyw domyślny z przełącznikiem; wykresy w E
 - **G5** strona runu: Gantt kroków (klik zaznacza węzeł), historia w oknie.
 - **G6** Models: koszt dziennie wg modelu, udział modeli, wyniki wg rodzaju pytania; edycja profilu w panelu bocznym.
 - **G7** porządki stylów, dokumentacja. Przegląd na żywo w przeglądarce jeszcze nie zrobiony (brak przeglądarki na hoście).
+
+### Faza H — wygoda na co dzień (zatwierdzona przez właściciela 2026-09-30)
+
+Decyzje: logowanie Keycloak dla wszystkich (oauth2-proxy jako forwardAuth Traefika) i dostęp spoza LAN; cisza nocna 01:00–07:30 (wieczorne awarie pushują od razu), w ciszy nic nie dzwoni, bramki i błędy trafiają do porannego raportu o 7:30; godziny zmienia się w UI. Etapy wdrażane przyciskiem `deploy` bez osobnej zgody.
+
+- **H1** stan „tu i teraz”: driver co minutę zbiera `docker ps` kontenerów compose (przez proxy tylko do odczytu) i rekord vzdump, zapisuje migawkę w `settings`; Overview pokazuje zdrowie aplikacji i wiek kopii VM.
+- **H2** historia wersji aplikacji (z runów: z czego na co, którym runem, naprawy i rollbacki) i oznaczenie aplikacji, które często wymagają uwagi.
+- **H3** ustawienia powiadomień w UI, cisza nocna i poranny raport (push + karta „Ostatnia noc” na Overview).
+- **H4** decyzja z telefonu: strona runu z bramką na górze i przyciskami przyklejonymi do dołu ekranu; push otwiera ją bezpośrednio.
+- **H5** czasy względne, szybkie wyszukiwanie `Ctrl+K`, dry run wszystkich aplikacji z dostępną aktualizacją.
+- **H6** logowanie Keycloak i zdjęcie ograniczenia do LAN.
@@ -0,0 +1,43 @@
+import { describe, expect, it } from 'vitest';
+import { isQuiet, sendDigestIfDue } from './digest.ts';
+import { createSqliteNotificationSettingsStore } from '../infra/sqlite/notification-settings-store.ts';
+import { openDatabase } from '../infra/sqlite/open.ts';
+import { FakeClock } from '../testing/fake-clock.ts';
+import { RecordingNotifier } from '../testing/fakes.ts';
+
+// 05:30 UTC is 07:30 in Warsaw (summer time).
+function setup(start: string) {
+  const clock = new FakeClock(start);
+  const settings = createSqliteNotificationSettingsStore(openDatabase(':memory:'));
+  const notifier = new RecordingNotifier();
+  const failed = { app: 'bazarr', workflowId: 'update-bazarr', status: 'failed', mode: 'real' as const, current: '1', candidate: '2', running: '1', outcome: 'Verify failed', step: null, updatedAt: '2026-09-30T01:00:00.000Z' };
+  return { clock, settings, notifier, deps: { clock, timeZone: 'Europe/Warsaw', settings, notifier, runs: () => [failed], down: () => ['grafana'] } };
+}
+
+describe('sendDigestIfDue', () => {
+  it('sends the report once a day from 07:30 on, with what happened since the last one', async () => {
+    const { clock, notifier, settings, deps } = setup('2026-09-30T05:29:00.000Z');
+    expect(await sendDigestIfDue(deps)).toBe(false);
+    await clock.advance(60_000);
+    expect(await sendDigestIfDue(deps)).toBe(true);
+    expect(await sendDigestIfDue(deps)).toBe(false);
+    expect(notifier.sent).toEqual([
+      { runId: 'digest-2026-09-30', title: 'Night report: 2 need you', detail: 'Failed: bazarr (Verify failed)\nDown now: grafana', link: '#/overview' },
+    ]);
+    expect(settings.lastDigest()).toEqual({ day: '2026-09-30', at: '2026-09-30T05:30:00.000Z' });
+  });
+
+  it('tries again next time when the push fails', async () => {
+    const { notifier, settings, deps } = setup('2026-09-30T06:00:00.000Z');
+    notifier.failWith = new Error('HA down');
+    await expect(sendDigestIfDue(deps)).rejects.toThrow('HA down');
+    expect(settings.lastDigest()).toBeNull();
+  });
+});
+
+describe('isQuiet', () => {
+  it('follows the owner’s quiet hours in the schedules’ time zone', () => {
+    expect(isQuiet(setup('2026-09-29T23:30:00.000Z').deps)).toBe(true); // 01:30 in Warsaw
+    expect(isQuiet(setup('2026-09-29T20:30:00.000Z').deps)).toBe(false); // 22:30 in Warsaw
+  });
+});
@@ -0,0 +1,51 @@
+import { zonedMinute } from '../domain/cron.ts';
+import { digestDue, inQuietHours, nightDigest } from '../domain/notification-settings.ts';
+import type { DigestRun } from '../domain/notification-settings.ts';
+import type { Clock, Notifier, NotificationSettingsStore } from '../domain/ports.ts';
+
+export interface DigestDeps {
+  readonly clock: Clock;
+  /** The schedules' time zone: quiet hours and the report time are wall-clock there. */
+  readonly timeZone: string;
+  readonly settings: NotificationSettingsStore;
+  readonly runs: () => readonly DigestRun[];
+  /** Enabled apps whose container is down right now (the driver's latest look). */
+  readonly down: () => readonly string[];
+  readonly notifier: Notifier;
+}
+
+const DAY_MS = 86_400_000;
+
+/** True while the owner's quiet hours hold pushes back. */
+export function isQuiet(deps: Pick<DigestDeps, 'clock' | 'timeZone' | 'settings'>): boolean {
+  return inQuietHours(deps.settings.get(), zonedMinute(deps.clock.now(), deps.timeZone));
+}
+
+/** Sends the morning report when it is due; true when it went out. A failed push is not recorded, so it is tried again. */
+export async function sendDigestIfDue(deps: DigestDeps): Promise<boolean> {
+  const now = deps.clock.now();
+  const at = zonedMinute(now, deps.timeZone);
+  const last = deps.settings.lastDigest();
+  if (!digestDue(deps.settings.get(), at, last?.day ?? null)) return false;
+  const day = at.key.slice(0, 10);
+  const digest = nightDigest({ runs: deps.runs(), since: last?.at ?? new Date(now.getTime() - DAY_MS).toISOString(), down: deps.down() });
+  await deps.notifier.notify({ runId: `digest-${day}`, title: digest.title, detail: digest.detail, link: '#/overview' });
+  deps.settings.recordDigest(day, now.toISOString());
+  return true;
+}
+
+/** Checks once per `intervalMs` whether the report is due, until `signal` aborts. */
+export async function runDigestLoop(deps: DigestDeps & { readonly intervalMs: number; readonly signal: AbortSignal; readonly onError: (cause: unknown) => void }): Promise<void> {
+  while (!deps.signal.aborted) {
+    try {
+      await sendDigestIfDue(deps);
+    } catch (cause) {
+      deps.onError(cause);
+    }
+    try {
+      await deps.clock.sleep(deps.intervalMs, deps.signal);
+    } catch {
+      return; // stopped
+    }
+  }
+}
@@ -0,0 +1,58 @@
+import { describe, expect, it } from 'vitest';
+import { collectHostStatus, runHostStatusLoop } from './host-status.ts';
+import type { HostStatus } from '../domain/host-status.ts';
+import { FakeCommandRunner } from '../testing/fakes.ts';
+import { FakeClock } from '../testing/fake-clock.ts';
+
+const PS = ['docker', 'ps', '-a', '--filter', 'label=com.docker.compose.project', '--format', '{{json .}}'].join(' ');
+const APPS = [{ app: 'jellyfin', project: 'jellyfin', service: 'jellyfin', enabled: true }];
+const running = JSON.stringify({ Labels: 'com.docker.compose.project=jellyfin,com.docker.compose.service=jellyfin', State: 'running', Status: 'Up 1 hour (healthy)' });
+
+function deps(runner: FakeCommandRunner, clock: FakeClock, backup: string | null) {
+  return { runner, clock, apps: () => APPS, readBackup: () => Promise.resolve(backup), backupVmid: 103 };
+}
+
+describe('collectHostStatus', () => {
+  it('lists every app with its container and the newest VM backup', async () => {
+    const clock = new FakeClock('2026-09-30T06:00:00.000Z');
+    const runner = new FakeCommandRunner().on(PS, { exitCode: 0, stdout: running, stderr: '' });
+    const record = JSON.stringify({ vmid: 103, storage: 'pbs', latest: { volid: 'pbs:backup/vm/103/2026-09-30T00:00:00Z', ctime: Date.parse('2026-09-30T00:00:00Z') / 1000 }, checked_at: '2026-09-30T05:00:00Z' });
+    expect(await collectHostStatus(deps(runner, clock, record))).toEqual({
+      checkedAt: '2026-09-30T06:00:00.000Z',
+      apps: [{ app: 'jellyfin', enabled: true, state: 'running', health: 'healthy' }],
+      backup: { ok: true, createdAt: '2026-09-30T00:00:00.000Z', ageHours: 6, volid: 'pbs:backup/vm/103/2026-09-30T00:00:00Z' },
+      error: null,
+    });
+  });
+
+  it('says why the containers are unknown and keeps a bad backup record as a finding', async () => {
+    const clock = new FakeClock();
+    const runner = new FakeCommandRunner().on(PS, { exitCode: 1, stdout: '', stderr: 'proxy down' });
+    const status = await collectHostStatus(deps(runner, clock, '{"vmid": "x"}'));
+    expect(status.apps).toEqual([]);
+    expect(status.error).toContain('docker ps');
+    expect(status.backup?.ok).toBe(false);
+  });
+
+  it('has no backup entry without a record', async () => {
+    const runner = new FakeCommandRunner().on(PS, { exitCode: 0, stdout: '', stderr: '' });
+    expect((await collectHostStatus(deps(runner, new FakeClock(), null))).backup).toBeNull();
+  });
+});
+
+describe('runHostStatusLoop', () => {
+  it('stores a fresh status every interval until stopped', async () => {
+    const clock = new FakeClock();
+    const runner = new FakeCommandRunner().on(PS, { exitCode: 0, stdout: running, stderr: '' });
+    const stored: HostStatus[] = [];
+    const stop = new AbortController();
+    const loop = runHostStatusLoop({ ...deps(runner, clock, null), store: { put: (status) => stored.push(status) }, intervalMs: 60_000, signal: stop.signal, onError: () => undefined });
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    expect(stored).toHaveLength(1);
+    await clock.advance(60_000);
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    expect(stored).toHaveLength(2);
+    stop.abort();
+    await loop;
+  });
+});
@@ -0,0 +1,66 @@
+import { backupVerdict, HostBackupRecord } from '../domain/backup-check.ts';
+import { appHealth, parseLabeledDockerPs } from '../domain/host-status.ts';
+import type { BackupStatus, HostStatus } from '../domain/host-status.ts';
+import type { Clock, CommandRunner } from '../domain/ports.ts';
+import { describeError } from '../domain/mask.ts';
+
+export interface HostStatusDeps {
+  /** Commands see only a read-only socket proxy: `docker ps` is a GET. */
+  readonly runner: CommandRunner;
+  readonly clock: Clock;
+  readonly apps: () => readonly { readonly app: string; readonly project: string; readonly service: string; readonly enabled: boolean }[];
+  /** The Proxmox timer's record of the newest vzdump; null when there is none. */
+  readonly readBackup: () => Promise<string | null>;
+  readonly backupVmid: number;
+}
+
+const PS_ARGS = ['ps', '-a', '--filter', 'label=com.docker.compose.project', '--format', '{{json .}}'];
+
+async function backupStatus(deps: HostStatusDeps): Promise<BackupStatus | null> {
+  try {
+    const raw = await deps.readBackup();
+    if (raw === null) return null;
+    const record = HostBackupRecord.safeParse(JSON.parse(raw));
+    if (!record.success) return { ok: false, detail: 'the host backup record is not readable' };
+    const verdict = backupVerdict(record.data, { vmid: deps.backupVmid, now: deps.clock.now() });
+    return verdict.ok ? { ok: true, createdAt: verdict.result.created_at, ageHours: verdict.result.age_hours, volid: verdict.result.volid } : { ok: false, detail: verdict.detail };
+  } catch (cause) {
+    return { ok: false, detail: `the host backup record is not readable: ${describeError(cause)}` };
+  }
+}
+
+/** One look at VM103: the containers of every configured app and the newest VM backup. Never throws. */
+export async function collectHostStatus(deps: HostStatusDeps, signal?: AbortSignal): Promise<HostStatus> {
+  const checkedAt = deps.clock.now().toISOString();
+  const backup = await backupStatus(deps);
+  try {
+    const ps = await deps.runner.run({ command: 'docker', args: PS_ARGS, ...(signal === undefined ? {} : { signal }) });
+    if (ps.exitCode !== 0) return { checkedAt, apps: [], backup, error: `docker ps exited with ${String(ps.exitCode)}: ${ps.stderr.trim().slice(0, 200)}` };
+    return { checkedAt, apps: appHealth(parseLabeledDockerPs(ps.stdout), deps.apps()), backup, error: null };
+  } catch (cause) {
+    return { checkedAt, apps: [], backup, error: `docker ps failed: ${describeError(cause)}` };
+  }
+}
+
+/** Looks again every `intervalMs` and stores what it saw, until `signal` aborts. */
+export async function runHostStatusLoop(
+  deps: HostStatusDeps & {
+    readonly store: { put(status: HostStatus): void };
+    readonly intervalMs: number;
+    readonly signal: AbortSignal;
+    readonly onError: (cause: unknown) => void;
+  },
+): Promise<void> {
+  while (!deps.signal.aborted) {
+    try {
+      deps.store.put(await collectHostStatus(deps, deps.signal));
+    } catch (cause) {
+      deps.onError(cause);
+    }
+    try {
+      await deps.clock.sleep(deps.intervalMs, deps.signal);
+    } catch {
+      return; // stopped
+    }
+  }
+}
@@ -82,4 +82,11 @@ describe('notifyRun', () => {
    expect(await notifyRun(deps, 'nope')).toBe(false);
    expect(notifier.sent).toHaveLength(1);
  });
+
+  it('holds the push in quiet hours', async () => {
+    const notifier = new RecordingNotifier();
+    const deps = { get: () => instance('failed'), report: () => report({}), notifier, quiet: () => true };
+    expect(await notifyRun(deps, 'run-1')).toBe(false);
+    expect(notifier.sent).toHaveLength(0);
+  });
 });
@@ -61,15 +61,21 @@ export function runNotification(instance: WorkflowInstance, report: RunReport):
  }
 }

-/** Pushes the run's news, if any; true when a push went out. A failed push is the caller's to log. */
+/** Pushes the run's news, if any, outside quiet hours; true when a push went out. A failed push is the caller's to log. */
 export async function notifyRun(
-  deps: { readonly get: (instanceId: string) => WorkflowInstance | null; readonly report: (instance: WorkflowInstance) => RunReport; readonly notifier: Notifier },
+  deps: {
+    readonly get: (instanceId: string) => WorkflowInstance | null;
+    readonly report: (instance: WorkflowInstance) => RunReport;
+    readonly notifier: Notifier;
+    /** True in the owner's quiet hours: nothing rings, the morning report covers the run (app/digest.ts). */
+    readonly quiet?: () => boolean;
+  },
  instanceId: string,
 ): Promise<boolean> {
  const instance = deps.get(instanceId);
  if (instance === null) return false;
  const notification = runNotification(instance, deps.report(instance));
-  if (notification === null) return false;
+  if (notification === null || deps.quiet?.() === true) return false;
  await deps.notifier.notify(notification);
  return true;
 }
@@ -0,0 +1,64 @@
+import { describe, expect, it } from 'vitest';
+import { appHealth, downApps, parseLabeledDockerPs, worstHealth } from './host-status.ts';
+import type { LabeledContainer } from './host-status.ts';
+
+const row = (project: string, service: string, state: string, status: string) =>
+  JSON.stringify({ Labels: `com.docker.compose.project=${project},traefik.rule=Host(\`a,b\`),com.docker.compose.service=${service}`, State: state, Status: status, Image: 'img' });
+
+describe('parseLabeledDockerPs', () => {
+  it('reads the compose project and service from the labels, and health from the status', () => {
+    const rows = parseLabeledDockerPs([row('grafana', 'grafana', 'running', 'Up 2 days (healthy)'), row('grafana', 'influxdb', 'restarting', 'Restarting (1) 3 seconds ago')].join('\n'));
+    expect(rows).toEqual([
+      { project: 'grafana', service: 'grafana', state: 'running', health: 'healthy' },
+      { project: 'grafana', service: 'influxdb', state: 'restarting', health: null },
+    ]);
+  });
+
+  it('skips containers that compose did not start', () => {
+    expect(parseLabeledDockerPs(JSON.stringify({ Labels: 'other=1', State: 'running', Status: 'Up' }))).toEqual([]);
+  });
+});
+
+describe('appHealth', () => {
+  const apps = [
+    { app: 'grafana', project: 'grafana', service: 'grafana', enabled: true },
+    { app: 'grafana-influxdb', project: 'grafana', service: 'influxdb', enabled: false },
+    { app: 'jellyfin', project: 'jellyfin', service: 'jellyfin', enabled: true },
+    { app: 'ombi', project: 'ombi', service: 'ombi', enabled: true },
+  ];
+
+  it('gives every app the state of its service: missing when no container, restarting before running, the worst health', () => {
+    const rows: LabeledContainer[] = [
+      { project: 'grafana', service: 'grafana', state: 'running', health: 'healthy' },
+      { project: 'grafana', service: 'influxdb', state: 'exited', health: null },
+      { project: 'ombi', service: 'ombi', state: 'running', health: 'healthy' },
+      { project: 'ombi', service: 'ombi', state: 'restarting', health: null },
+    ];
+    expect(appHealth(rows, apps)).toEqual([
+      { app: 'grafana', enabled: true, state: 'running', health: 'healthy' },
+      { app: 'grafana-influxdb', enabled: false, state: 'exited', health: null },
+      { app: 'jellyfin', enabled: true, state: 'missing', health: null },
+      { app: 'ombi', enabled: true, state: 'restarting', health: 'healthy' },
+    ]);
+  });
+});
+
+describe('downApps', () => {
+  it('names enabled apps that do not run or run unhealthy', () => {
+    const apps = [
+      { app: 'a', enabled: true, state: 'running', health: null },
+      { app: 'b', enabled: true, state: 'running', health: 'unhealthy' as const },
+      { app: 'c', enabled: true, state: 'missing', health: null },
+      { app: 'd', enabled: false, state: 'exited', health: null },
+    ];
+    expect(downApps({ apps })).toEqual(['b', 'c']);
+  });
+});
+
+describe('worstHealth', () => {
+  it('orders unhealthy over starting over healthy over no check', () => {
+    expect(worstHealth([null, 'healthy', 'starting'])).toBe('starting');
+    expect(worstHealth(['healthy', 'unhealthy'])).toBe('unhealthy');
+    expect(worstHealth([null])).toBeNull();
+  });
+});
@@ -0,0 +1,93 @@
+import { z } from 'zod';
+import { healthFromStatus } from './compose.ts';
+
+// What runs on VM103 right now, as the driver last saw it: the containers of every configured app and the age of the
+// newest VM backup. The driver writes it, the server shows it; nothing decides on it.
+
+export const ContainerHealth = z.enum(['healthy', 'unhealthy', 'starting']);
+export type ContainerHealth = z.infer<typeof ContainerHealth>;
+
+export const AppHealth = z.object({
+  app: z.string(),
+  enabled: z.boolean(),
+  /** Docker's state of the service's container (`running`, `restarting`, `exited`…), or `missing` when there is none. */
+  state: z.string(),
+  health: ContainerHealth.nullable(),
+});
+export type AppHealth = z.infer<typeof AppHealth>;
+
+export const BackupStatus = z.discriminatedUnion('ok', [
+  z.object({ ok: z.literal(true), createdAt: z.string(), ageHours: z.number(), volid: z.string() }),
+  z.object({ ok: z.literal(false), detail: z.string() }),
+]);
+export type BackupStatus = z.infer<typeof BackupStatus>;
+
+export const HostStatus = z.object({
+  checkedAt: z.string(),
+  apps: z.array(AppHealth),
+  /** Null when the driver has no backup record to read. */
+  backup: BackupStatus.nullable(),
+  /** Why the containers could not be listed; the apps list is then empty. */
+  error: z.string().nullable(),
+});
+export type HostStatus = z.infer<typeof HostStatus>;
+
+export interface LabeledContainer {
+  readonly project: string;
+  readonly service: string;
+  readonly state: string;
+  readonly health: ContainerHealth | null;
+}
+
+// Label values may contain commas (traefik rules), so each compose label is matched by its full name at an entry start.
+const PROJECT_LABEL = /(?:^|,)com\.docker\.compose\.project=([^,]*)/;
+const SERVICE_LABEL = /(?:^|,)com\.docker\.compose\.service=([^,]*)/;
+
+const PsRow = z.object({ Labels: z.string().default(''), State: z.string().default('unknown'), Status: z.string().default('') });
+
+/** Rows of `docker ps -a --format '{{json .}}'`, one JSON object per line; containers without compose labels are left out. */
+export function parseLabeledDockerPs(raw: string): LabeledContainer[] {
+  const out: LabeledContainer[] = [];
+  for (const line of raw.split('\n')) {
+    if (line.trim() === '') continue;
+    const row = PsRow.parse(JSON.parse(line));
+    const project = PROJECT_LABEL.exec(row.Labels)?.[1];
+    const service = SERVICE_LABEL.exec(row.Labels)?.[1];
+    if (project === undefined || service === undefined) continue;
+    out.push({ project, service, state: row.State, health: healthFromStatus(row.Status) });
+  }
+  return out;
+}
+
+const HEALTH_RANK: Readonly<Record<ContainerHealth, number>> = { healthy: 1, starting: 2, unhealthy: 3 };
+
+export function worstHealth(values: readonly (ContainerHealth | null)[]): ContainerHealth | null {
+  let worst: ContainerHealth | null = null;
+  for (const value of values) {
+    if (value !== null && (worst === null || HEALTH_RANK[value] > HEALTH_RANK[worst])) worst = value;
+  }
+  return worst;
+}
+
+// A restarting container outweighs a running one of the same service; otherwise the first container's state stands.
+function worstState(states: readonly string[]): string {
+  if (states.length === 0) return 'missing';
+  if (states.includes('restarting')) return 'restarting';
+  return states.every((state) => state === 'running') ? 'running' : (states.find((state) => state !== 'running') ?? 'unknown');
+}
+
+/** Enabled apps whose container is not running, or runs unhealthy. */
+export function downApps(status: Pick<HostStatus, 'apps'>): string[] {
+  return status.apps.filter((app) => app.enabled && (app.state !== 'running' || app.health === 'unhealthy')).map((app) => app.app);
+}
+
+/** Every configured app with the state of its compose service's containers, in the apps' order. */
+export function appHealth(
+  containers: readonly LabeledContainer[],
+  apps: readonly { readonly app: string; readonly project: string; readonly service: string; readonly enabled: boolean }[],
+): AppHealth[] {
+  return apps.map((app) => {
+    const own = containers.filter((container) => container.project === app.project && container.service === app.service);
+    return { app: app.app, enabled: app.enabled, state: worstState(own.map((container) => container.state)), health: worstHealth(own.map((container) => container.health)) };
+  });
+}
@@ -0,0 +1,68 @@
+import { describe, expect, it } from 'vitest';
+import { DEFAULT_NOTIFICATION_SETTINGS, digestDue, inQuietHours, nightDigest } from './notification-settings.ts';
+
+const at = (time: string, day = '2026-09-30') => ({ hour: Number(time.slice(0, 2)), minute: Number(time.slice(3)), key: `${day}T${time}` });
+
+describe('inQuietHours', () => {
+  it('holds pushes from 01:00 to 07:30 by default, and not on the evening before', () => {
+    const s = DEFAULT_NOTIFICATION_SETTINGS;
+    expect(inQuietHours(s, at('00:59'))).toBe(false);
+    expect(inQuietHours(s, at('01:00'))).toBe(true);
+    expect(inQuietHours(s, at('07:29'))).toBe(true);
+    expect(inQuietHours(s, at('07:30'))).toBe(false);
+    expect(inQuietHours(s, at('22:00'))).toBe(false);
+  });
+
+  it('wraps over midnight and is off when both ends are equal', () => {
+    const late = { ...DEFAULT_NOTIFICATION_SETTINGS, quietFrom: '22:00', quietUntil: '06:00' };
+    expect(inQuietHours(late, at('23:15'))).toBe(true);
+    expect(inQuietHours(late, at('05:59'))).toBe(true);
+    expect(inQuietHours(late, at('12:00'))).toBe(false);
+    expect(inQuietHours({ ...late, quietUntil: '22:00' }, at('23:00'))).toBe(false);
+  });
+});
+
+describe('digestDue', () => {
+  it('is due once a day from the report time on', () => {
+    const s = DEFAULT_NOTIFICATION_SETTINGS;
+    expect(digestDue(s, at('07:29'), null)).toBe(false);
+    expect(digestDue(s, at('07:30'), null)).toBe(true);
+    expect(digestDue(s, at('09:00'), '2026-09-29')).toBe(true);
+    expect(digestDue(s, at('09:00'), '2026-09-30')).toBe(false);
+    expect(digestDue({ ...s, digestEnabled: false }, at('09:00'), null)).toBe(false);
+  });
+});
+
+describe('nightDigest', () => {
+  const run = (overrides: Record<string, unknown>) => ({
+    app: 'sonarr', workflowId: 'update-sonarr', status: 'succeeded', mode: 'real' as const, current: '4.0.1', candidate: '4.0.2', running: '4.0.2', outcome: 'Updated', step: null, updatedAt: '2026-09-30T02:00:00.000Z',
+    ...overrides,
+  });
+
+  it('lists what needs the owner first, then what changed since the last report', () => {
+    const digest = nightDigest({
+      since: '2026-09-29T05:30:00.000Z',
+      runs: [
+        run({}),
+        run({ app: 'radarr', running: '5.1', current: '5.1', candidate: '5.2', outcome: 'Rolled back' }),
+        run({ app: 'bazarr', status: 'failed', outcome: 'Verify failed', running: '1.0', current: '1.0' }),
+        run({ app: 'jellyfin', status: 'waiting', step: 'Owner decides', updatedAt: '2026-09-28T00:00:00.000Z' }),
+        run({ app: 'ombi', mode: 'shadow' as const }),
+        run({ app: 'old', updatedAt: '2026-09-20T00:00:00.000Z' }),
+      ],
+      down: ['grafana'],
+    });
+    expect(digest.title).toBe('Night report: 3 need you');
+    expect(digest.detail.split('\n')).toEqual([
+      'Waiting for you: jellyfin (Owner decides)',
+      'Failed: bazarr (Verify failed)',
+      'Down now: grafana',
+      'Updated: sonarr 4.0.1 → 4.0.2',
+      'Not updated: radarr (Rolled back)',
+    ]);
+  });
+
+  it('says all is well when nothing happened', () => {
+    expect(nightDigest({ since: '2026-09-29T05:30:00.000Z', runs: [], down: [] })).toEqual({ title: 'Night report: all good', detail: 'No real update, nothing failed, nothing waits for you.', needsYou: 0 });
+  });
+});
@@ -0,0 +1,87 @@
+import { z } from 'zod';
+
+// When the owner's phone may ring and what the morning report says. Quiet hours hold every push (the report covers what
+// happened in them); the evening before is not quiet, so a failure then still rings. Times are wall-clock in the
+// schedules' time zone.
+
+const Time = z.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/, 'must be HH:MM');
+
+export const NotificationSettings = z.object({
+  quietFrom: Time,
+  quietUntil: Time,
+  digestAt: Time,
+  digestEnabled: z.boolean(),
+});
+export type NotificationSettings = z.infer<typeof NotificationSettings>;
+
+export const DEFAULT_NOTIFICATION_SETTINGS: NotificationSettings = { quietFrom: '01:00', quietUntil: '07:30', digestAt: '07:30', digestEnabled: true };
+
+interface WallClock {
+  readonly hour: number;
+  readonly minute: number;
+  /** `YYYY-MM-DDTHH:MM` (domain/cron.ts zonedMinute): its day names the report. */
+  readonly key: string;
+}
+
+const minutes = (time: string): number => Number(time.slice(0, 2)) * 60 + Number(time.slice(3, 5));
+
+export function inQuietHours(settings: NotificationSettings, at: WallClock): boolean {
+  const from = minutes(settings.quietFrom);
+  const until = minutes(settings.quietUntil);
+  const now = at.hour * 60 + at.minute;
+  if (from === until) return false;
+  return from < until ? now >= from && now < until : now >= from || now < until;
+}
+
+/** The report goes out once a day, at its time or at the first look after it (the driver may have been down). */
+export function digestDue(settings: NotificationSettings, at: WallClock, lastDay: string | null): boolean {
+  return settings.digestEnabled && at.hour * 60 + at.minute >= minutes(settings.digestAt) && lastDay !== at.key.slice(0, 10);
+}
+
+export interface DigestRun {
+  readonly app: string | null;
+  readonly workflowId: string;
+  readonly status: string;
+  readonly mode: 'shadow' | 'real';
+  readonly current: string | null;
+  readonly candidate: string | null;
+  readonly running: string | null;
+  readonly outcome: string | null;
+  readonly step: string | null;
+  readonly updatedAt: string;
+}
+
+export interface Digest {
+  readonly title: string;
+  readonly detail: string;
+  /** Runs waiting at a gate, failures and apps down: what the owner should look at. */
+  readonly needsYou: number;
+}
+
+/**
+ * The morning report: what waits for the owner and what is broken first, then what changed since the last report.
+ * A run still waiting counts whenever it started; the rest only when it ended after `since`. Dry runs change nothing.
+ */
+export function nightDigest(input: { readonly runs: readonly DigestRun[]; readonly since: string; readonly down: readonly string[] }): Digest {
+  const since = Date.parse(input.since);
+  const name = (run: DigestRun) => run.app ?? run.workflowId;
+  const recent = input.runs.filter((run) => Date.parse(run.updatedAt) > since);
+  const waiting = input.runs.filter((run) => run.status === 'waiting').map((run) => `${name(run)} (${run.step ?? 'decision'})`);
+  const failed = recent.filter((run) => run.status === 'failed').map((run) => `${name(run)} (${run.outcome ?? 'failed'})`);
+  const real = recent.filter((run) => run.mode === 'real' && run.status === 'succeeded');
+  const updated = real.filter((run) => run.running !== null && run.running !== run.current).map((run) => `${name(run)} ${run.current ?? '?'} → ${run.running ?? '?'}`);
+  const kept = real.filter((run) => run.running === null || run.running === run.current).map((run) => `${name(run)} (${run.outcome ?? 'not updated'})`);
+  const lines = [
+    waiting.length > 0 ? `Waiting for you: ${waiting.join(', ')}` : null,
+    failed.length > 0 ? `Failed: ${failed.join(', ')}` : null,
+    input.down.length > 0 ? `Down now: ${input.down.join(', ')}` : null,
+    updated.length > 0 ? `Updated: ${updated.join(', ')}` : null,
+    kept.length > 0 ? `Not updated: ${kept.join(', ')}` : null,
+  ].filter((line): line is string => line !== null);
+  const needsYou = waiting.length + failed.length + input.down.length;
+  return {
+    title: needsYou > 0 ? `Night report: ${String(needsYou)} need you` : 'Night report: all good',
+    detail: lines.length > 0 ? lines.join('\n') : 'No real update, nothing failed, nothing waits for you.',
+    needsYou,
+  };
+}
@@ -26,6 +26,8 @@ import type { PreflightReport } from './preflight.ts';
 import type { Skill, SkillVersion } from './skill.ts';
 import type { AppConfigRevision } from './app-config.ts';
 import type { AppConfig, Executor, JsonValue } from './steps.ts';
+import type { HostStatus } from './host-status.ts';
+import type { NotificationSettings } from './notification-settings.ts';
 import type { AppendableWorkflowInstanceEventInput, PublishedWorkflowVersion, WorkflowDraft, WorkflowDocument, WorkflowInstance, WorkflowInstanceCreateInput, WorkflowInstanceEvent, WorkflowInstanceStatus, WorkflowValidation } from './workflow.ts';
 import type { ExecutionCommand, NodeAttempt, ReplayStatus, WorkflowExecutionProjection } from './workflow-execution.ts';
 import type { ExecutionFinalizeOutcome } from './workflow-execution-ledger.ts';
@@ -433,6 +435,20 @@ export interface ModelResult {
 export type ModelFailure = 'rate_limited' | 'auth_failed' | 'invalid_output' | 'unavailable' | 'busy';

 /** The owner's trusted release notes sources, one list for all apps (http(s) pages or `github:owner/repo`). */
+/** The driver's latest look at VM103 (domain/host-status.ts); null before its first look. */
+export interface HostStatusStore {
+  get(): HostStatus | null;
+  put(status: HostStatus): void;
+}
+
+/** The owner's quiet hours and morning report (domain/notification-settings.ts), and when the last report went out. */
+export interface NotificationSettingsStore {
+  get(): NotificationSettings;
+  put(settings: NotificationSettings, now: string): void;
+  lastDigest(): { readonly day: string; readonly at: string } | null;
+  recordDigest(day: string, at: string): void;
+}
+
 export interface ReleaseNotesSourcesStore {
  get(): string[];
  put(sources: readonly string[], now: string): void;
@@ -1,3 +1,5 @@
+import { HostStatus } from '../domain/host-status.ts';
+import { NotificationSettings } from '../domain/notification-settings.ts';
 import { z } from 'zod';
 import { SkillContent } from '../domain/skill.ts';
 import { AutoLevel, Executor, Json } from '../domain/steps.ts';
@@ -383,3 +385,7 @@ export type ModelProfilePublishRequest = z.infer<typeof ModelProfilePublishReque

 /** GET/PUT /api/release-notes-sources: the owner's trusted release notes sources for all apps. */
 export const ReleaseNotesSourcesResponse = z.object({ sources: z.array(z.string()) });
+/** GET /api/host-status: the driver's latest look at VM103, null before its first. */
+export const HostStatusResponse = z.object({ status: HostStatus.nullable() });
+/** GET/PUT /api/notification-settings: quiet hours and the morning report, in the schedules' time zone. */
+export const NotificationSettingsResponse = z.object({ settings: NotificationSettings, timeZone: z.string(), lastDigestAt: z.string().nullable() });
@@ -24,7 +24,7 @@ import type {
  WorkflowRunInputStore,
  ModelActivityStore,
  WorkflowScheduleStore,
-  ReleaseNotesSourcesStore,
+  HostStatusStore, NotificationSettingsStore, ReleaseNotesSourcesStore,
 } from '../domain/ports.ts';
 import { compileTagPattern, tagShapePattern } from '../domain/tags.ts';
 import { buildAppOverview } from '../domain/overview.ts';
@@ -71,6 +71,7 @@ import {
 import { buildWorkflowTimeline, decisionContext } from '../domain/workflow-timeline.ts';
 import { saveSchedule, scheduleNextRuns } from '../app/workflow-schedules.ts';
 import type { MigrationDecisionContext } from '../domain/workflow-timeline.ts';
+import { NotificationSettings } from '../domain/notification-settings.ts';
 import { totalCostUsd, workflowModelCalls } from '../domain/workflow-model-calls.ts';
 import { createWorkflowExtensions } from '../domain/workflow-extensions.ts';

@@ -99,6 +100,10 @@ export interface ServerDeps {
  readonly modelProfiles: ModelProfileStore;
  /** The owner's trusted release notes sources for all apps. */
  readonly releaseNotesSources: ReleaseNotesSourcesStore;
+  /** The driver's latest look at VM103's containers and backup; unset: the overview shows none. */
+  readonly hostStatus?: Pick<HostStatusStore, 'get'>;
+  /** Quiet hours and the morning report; the driver reads them. */
+  readonly notificationSettings: NotificationSettingsStore;
  /** What the owner typed into a migration form. */
  readonly workflowRunInputs: WorkflowRunInputStore;
  /** The models' executor session logs per node attempt (written by the driver); unset: the run page shows none. */
@@ -913,6 +918,21 @@ export async function buildServer(deps: ServerDeps): Promise<FastifyInstance> {
  });

  app.get('/api/release-notes-sources', (_request, reply) => reply.send({ sources: deps.releaseNotesSources.get() }));
+  app.get('/api/host-status', (_request, reply) => reply.send({ status: deps.hostStatus?.get() ?? null }));
+
+  const notificationSettings = () => ({
+    settings: deps.notificationSettings.get(),
+    timeZone: deps.schedules.timeZone,
+    lastDigestAt: deps.notificationSettings.lastDigest()?.at ?? null,
+  });
+  app.get('/api/notification-settings', (_request, reply) => reply.send(notificationSettings()));
+  app.put('/api/notification-settings', (request, reply) => {
+    const body = NotificationSettings.strict().safeParse(request.body);
+    if (!body.success) return fail(reply, 400, 'invalid_request', issues(body.error));
+    deps.notificationSettings.put(body.data, clock.now().toISOString());
+    hub.notify();
+    return reply.send(notificationSettings());
+  });

  app.put('/api/release-notes-sources', (request, reply) => {
    const body = z.strictObject({ sources: ReleaseNotesSources }).safeParse(request.body);
@@ -0,0 +1,15 @@
+import { describe, expect, it } from 'vitest';
+import { openDatabase } from './open.ts';
+import { createSqliteHostStatusStore } from './host-status-store.ts';
+
+describe('host status store', () => {
+  it('keeps only the latest look', () => {
+    const store = createSqliteHostStatusStore(openDatabase(':memory:'));
+    expect(store.get()).toBeNull();
+    const first = { checkedAt: '2026-09-30T06:00:00.000Z', apps: [], backup: null, error: 'docker ps failed' };
+    const second = { checkedAt: '2026-09-30T06:01:00.000Z', apps: [{ app: 'a', enabled: true, state: 'running', health: null }], backup: { ok: false as const, detail: 'none' }, error: null };
+    store.put(first);
+    store.put(second);
+    expect(store.get()).toEqual(second);
+  });
+});
@@ -0,0 +1,20 @@
+import type { DatabaseSync } from 'node:sqlite';
+import { HostStatus } from '../../domain/host-status.ts';
+import type { HostStatusStore } from '../../domain/ports.ts';
+
+const KEY = 'hostStatus';
+
+export function createSqliteHostStatusStore(db: DatabaseSync): HostStatusStore {
+  return {
+    get() {
+      const row = db.prepare('SELECT value FROM settings WHERE key = :key').get({ key: KEY });
+      // A value an older or newer driver wrote in another shape shows as "not looked yet" until the next look.
+      return row === undefined ? null : (HostStatus.safeParse(JSON.parse(String(row['value']))).data ?? null);
+    },
+    put(status) {
+      db.prepare(`INSERT INTO settings (key, value, updated_at) VALUES (:key, :value, :now)
+        ON CONFLICT (key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`)
+        .run({ key: KEY, value: JSON.stringify(HostStatus.parse(status)), now: status.checkedAt });
+    },
+  };
+}
@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest';
+import { openDatabase } from './open.ts';
+import { createSqliteNotificationSettingsStore } from './notification-settings-store.ts';
+import { DEFAULT_NOTIFICATION_SETTINGS } from '../../domain/notification-settings.ts';
+
+describe('notification settings store', () => {
+  it('starts from the defaults, keeps the owner’s settings and the last report', () => {
+    const store = createSqliteNotificationSettingsStore(openDatabase(':memory:'));
+    expect(store.get()).toEqual(DEFAULT_NOTIFICATION_SETTINGS);
+    expect(store.lastDigest()).toBeNull();
+    store.put({ ...DEFAULT_NOTIFICATION_SETTINGS, quietFrom: '00:30' }, '2026-09-30T08:00:00.000Z');
+    store.recordDigest('2026-09-30', '2026-09-30T05:30:00.000Z');
+    expect(store.get().quietFrom).toBe('00:30');
+    expect(store.lastDigest()).toEqual({ day: '2026-09-30', at: '2026-09-30T05:30:00.000Z' });
+    expect(() => store.put({ ...DEFAULT_NOTIFICATION_SETTINGS, digestAt: '7:30' }, '2026-09-30T08:00:00.000Z')).toThrow();
+  });
+});
@@ -0,0 +1,27 @@
+import type { DatabaseSync } from 'node:sqlite';
+import { z } from 'zod';
+import { DEFAULT_NOTIFICATION_SETTINGS, NotificationSettings } from '../../domain/notification-settings.ts';
+import type { NotificationSettingsStore } from '../../domain/ports.ts';
+
+const SETTINGS = 'notificationSettings';
+const LAST_DIGEST = 'lastDigest';
+const LastDigest = z.object({ day: z.string(), at: z.string() });
+
+export function createSqliteNotificationSettingsStore(db: DatabaseSync): NotificationSettingsStore {
+  const read = (key: string): unknown => {
+    const row = db.prepare('SELECT value FROM settings WHERE key = :key').get({ key });
+    return row === undefined ? undefined : JSON.parse(String(row['value']));
+  };
+  const write = (key: string, value: unknown, now: string) => {
+    db.prepare(`INSERT INTO settings (key, value, updated_at) VALUES (:key, :value, :now)
+      ON CONFLICT (key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`)
+      .run({ key, value: JSON.stringify(value), now });
+  };
+  return {
+    // Until the owner saves their own, the defaults apply.
+    get: () => NotificationSettings.safeParse(read(SETTINGS)).data ?? DEFAULT_NOTIFICATION_SETTINGS,
+    put: (settings, now) => write(SETTINGS, NotificationSettings.parse(settings), now),
+    lastDigest: () => LastDigest.safeParse(read(LAST_DIGEST)).data ?? null,
+    recordDigest: (day, at) => write(LAST_DIGEST, { day, at }, at),
+  };
+}
@@ -14,6 +14,11 @@ import { openDatabase } from '../infra/sqlite/open.ts';
 import { createSqliteAppConfigStore } from '../infra/sqlite/app-config-store.ts';
 import { createSqliteSkillStore } from '../infra/sqlite/skill-store.ts';
 import { createSqliteReleaseNotesSourcesStore } from '../infra/sqlite/release-notes-sources-store.ts';
+import { createSqliteHostStatusStore } from '../infra/sqlite/host-status-store.ts';
+import { runHostStatusLoop } from '../app/host-status.ts';
+import { isQuiet, runDigestLoop } from '../app/digest.ts';
+import { downApps } from '../domain/host-status.ts';
+import { createSqliteNotificationSettingsStore } from '../infra/sqlite/notification-settings-store.ts';
 import { systemClock } from '../infra/system-clock.ts';
 import { createComponentOperationExecutor } from '../app/component-operation-executor.ts';
 import { groupMembers } from '../app/ops/group.ts';
@@ -147,7 +152,38 @@ const runner = createWorkflowRunner({
  runInputs,
 });

-const notifyDeps = { get: (id: string) => instanceStore.get(id), report: (instance: WorkflowInstance) => reportRun(instanceStore, instance), notifier };
+const notificationSettings = createSqliteNotificationSettingsStore(db);
+const hostStatusStore = createSqliteHostStatusStore(db);
+const quietDeps = { clock: systemClock, timeZone: config.scheduleTimeZone, settings: notificationSettings };
+// In the owner's quiet hours nothing rings; the morning report covers those runs.
+const notifyDeps = { get: (id: string) => instanceStore.get(id), report: (instance: WorkflowInstance) => reportRun(instanceStore, instance), notifier, quiet: () => isQuiet(quietDeps) };
+
+// The morning report: what waits for the owner, what failed or is down, what changed since the last report.
+const digestLoop = runDigestLoop({
+  ...quietDeps,
+  notifier,
+  runs: () => instanceStore.listInstances({}).map((instance) => ({ ...reportRun(instanceStore, instance), workflowId: instance.workflowId, status: instance.projection.status, updatedAt: instance.updatedAt })),
+  down: () => {
+    const status = hostStatusStore.get();
+    return status === null ? [] : downApps(status);
+  },
+  intervalMs: 60_000,
+  signal: shutdown.signal,
+  onError: (cause) => logger.error('digest.failed', { error: cause instanceof Error ? cause.message : String(cause) }),
+});
+
+// Once a minute: what runs on VM103 and how old the newest VM backup is, for the overview (read-only, through the proxy).
+const hostStatusLoop = runHostStatusLoop({
+  runner: processRunner,
+  clock: systemClock,
+  apps: () => appConfig.list(),
+  readBackup: hostBackup.read,
+  backupVmid: config.backupVmid,
+  store: hostStatusStore,
+  intervalMs: 60_000,
+  signal: shutdown.signal,
+  onError: (cause) => logger.error('host_status.failed', { error: cause instanceof Error ? cause.message : String(cause) }),
+});

 await runWorkflowLoop(runner, {
  signal: shutdown.signal,
@@ -164,6 +200,7 @@ await runWorkflowLoop(runner, {
    if (result.kind === 'finalized' || result.kind === 'cancelled') removeFinishedInputs(runInputs);
  },
 });
+await Promise.all([hostStatusLoop, digestLoop]);
 db.close();

 /** Never lets a cleanup failure stop the loop: the inputs are only sensitive, not load-bearing. */
@@ -6,6 +6,8 @@ import { buildServer } from '../http/server.ts';
 import { dataVersion, openDatabase } from '../infra/sqlite/open.ts';
 import { createSqliteAppConfigStore } from '../infra/sqlite/app-config-store.ts';
 import { createSqliteSkillStore } from '../infra/sqlite/skill-store.ts';
+import { createSqliteNotificationSettingsStore } from '../infra/sqlite/notification-settings-store.ts';
+import { createSqliteHostStatusStore } from '../infra/sqlite/host-status-store.ts';
 import { createSqliteReleaseNotesSourcesStore } from '../infra/sqlite/release-notes-sources-store.ts';
 import { createSqliteWorkflowCatalogStore } from '../infra/sqlite/workflow-catalog-store.ts';
 import { createSqliteWorkflowLayoutStore } from '../infra/sqlite/workflow-layout-store.ts';
@@ -76,6 +78,8 @@ const app = await buildServer({
  privilegedActionStore,
  modelProfiles,
  releaseNotesSources: createSqliteReleaseNotesSourcesStore(db),
+  hostStatus: createSqliteHostStatusStore(db),
+  notificationSettings: createSqliteNotificationSettingsStore(db),
  workflowRunInputs: createSqliteWorkflowRunInputStore(db),
  modelActivity: createSqliteModelActivityStore(db),
  startWorkflowRun: (name, mode) => startWorkflowRun(runDeps, name, mode),
@@ -5,6 +5,8 @@ import { createIsolatedFunctionRuntime } from '../infra/runtime/isolated-functio
 import { openDatabase } from '../infra/sqlite/open.ts';
 import { createSqliteAppConfigStore } from '../infra/sqlite/app-config-store.ts';
 import { createSqliteModelProfileStore } from '../infra/sqlite/model-profile-store.ts';
+import { createSqliteNotificationSettingsStore } from '../infra/sqlite/notification-settings-store.ts';
+import { createSqliteHostStatusStore } from '../infra/sqlite/host-status-store.ts';
 import { createSqliteReleaseNotesSourcesStore } from '../infra/sqlite/release-notes-sources-store.ts';
 import { createSqlitePrivilegedActionStore } from '../infra/sqlite/privileged-action-store.ts';
 import { createSqliteSkillStore } from '../infra/sqlite/skill-store.ts';
@@ -34,6 +36,8 @@ export function sqliteServerDeps(db: DatabaseSync = openDatabase(':memory:')) {
    privilegedActionStore: createSqlitePrivilegedActionStore(db),
    modelProfiles: createSqliteModelProfileStore(db),
    releaseNotesSources: createSqliteReleaseNotesSourcesStore(db),
+    hostStatus: createSqliteHostStatusStore(db),
+    notificationSettings: createSqliteNotificationSettingsStore(db),
    workflowRunInputs: createSqliteWorkflowRunInputStore(db),
    modelActivity: createSqliteModelActivityStore(db),
    schedules: { store: createSqliteWorkflowScheduleStore(db), timeZone: 'Europe/Warsaw' },
@@ -18,11 +18,15 @@ import {
  ModelCallsResponse,
  ModelProfileListResponse,
  ReleaseNotesSourcesResponse,
+  HostStatusResponse,
+  NotificationSettingsResponse,
  ModelProfileSummaryResponse,
  TagPreviewResponse,
 } from '../http/contract.ts';
 import type { AppConfigPatch, ModelProfilePublishRequest } from '../http/contract.ts';

+type NotificationSettingsResponse = z.infer<typeof NotificationSettingsResponse>;
+
 export class ApiError extends Error {
  status: number;

@@ -115,6 +119,9 @@ export const api = {
  modelCalls: (limit = 50) => call(ModelCallsResponse, `/api/model-calls?limit=${String(limit)}`),
  modelProfiles: () => call(ModelProfileListResponse, '/api/model-profiles'),
  releaseNotesSources: () => call(ReleaseNotesSourcesResponse, '/api/release-notes-sources'),
+  hostStatus: () => call(HostStatusResponse, '/api/host-status'),
+  notificationSettings: () => call(NotificationSettingsResponse, '/api/notification-settings'),
+  saveNotificationSettings: (settings: NotificationSettingsResponse['settings']) => call(NotificationSettingsResponse, '/api/notification-settings', settings, 'PUT'),
  saveReleaseNotesSources: (sources: readonly string[]) => call(ReleaseNotesSourcesResponse, '/api/release-notes-sources', { sources }, 'PUT'),
  modelProfileVersions: (id: string) => call(z.array(ModelProfileSummaryResponse), `/api/model-profiles/${encodeURIComponent(id)}/versions`),
  modelProfileVersion: (id: string, version: number) => call(ModelProfileSummaryResponse, `/api/model-profiles/${encodeURIComponent(id)}/versions/${String(version)}`),
@@ -35,6 +35,7 @@ class FakeEventSource {
 let server: FastifyInstance;
 let appConfig: AppConfigStore;
 let schedules: ReturnType<typeof sqliteServerDeps>['schedules'];
+let hostStatus: ReturnType<typeof sqliteServerDeps>['hostStatus'];
 let requests: { method: string; url: string; body?: unknown }[];
 let container: HTMLElement;

@@ -42,7 +43,7 @@ beforeEach(async () => {
  FakeEventSource.instances = [];
  requests = [];
  const deps = sqliteServerDeps();
-  ({ appConfig, schedules } = deps);
+  ({ appConfig, schedules, hostStatus } = deps);
  seedTestApps(appConfig);
  const registry = new FakeRegistryClient({ 'demo/bazarr': ['1.0.0', '1.1.0', '1.2.0'] });
  server = await buildServer({ ...deps, registry, build: { branch: 'foundations', number: 6, revision: 'de5ee92a1b2c3d4e5f60718293a4b5c6d7e8f901' } });
@@ -327,6 +328,57 @@ describe('other views', () => {
    await eventually(() => expect(container.querySelectorAll('tbody tr')).toHaveLength(5));
  });

+  it('shows on the overview which apps are down and how old the VM backup is', async () => {
+    const now = Date.now();
+    hostStatus.put({
+      checkedAt: new Date(now).toISOString(),
+      apps: [
+        { app: 'grafana', enabled: true, state: 'exited', health: null },
+        { app: 'bazarr', enabled: true, state: 'running', health: 'healthy' },
+      ],
+      backup: { ok: true, createdAt: new Date(now - 5 * 3_600_000).toISOString(), ageHours: 5, volid: 'pbs:vm/103' },
+      error: null,
+    });
+    window.location.hash = '#/overview';
+    await eventually(() => expect(text()).toContain('1/2'));
+    expect(text()).toContain('grafana exited');
+    expect(text()).toContain('5 h ago');
+    window.location.hash = '#/apps';
+    await eventually(() => expect(container.querySelector('.health-down')?.getAttribute('title')).toBe('down: exited'));
+  });
+
+  it('saves the quiet hours and shows the morning report on the overview', async () => {
+    window.location.hash = '#/settings';
+    const from = await eventually(() => {
+      const found = container.querySelectorAll<HTMLInputElement>('input[type="time"]')[0];
+      if (found === undefined) throw new Error('no time field');
+      return found;
+    });
+    expect(from.value).toBe('01:00');
+    await type(from, '00:30');
+    button(container, 'Save').click();
+    await eventually(() => expect(text()).toContain('Notification settings saved.'));
+    expect((await server.inject('/api/notification-settings')).json()).toMatchObject({ settings: { quietFrom: '00:30', quietUntil: '07:30' }, timeZone: 'Europe/Warsaw' });
+
+    window.location.hash = '#/overview';
+    await eventually(() => expect(text()).toContain('All good'));
+    expect(text()).toContain('No real update, nothing failed, nothing waits for you.');
+  });
+
+  it('jumps to an app from the palette opened with Ctrl+K', async () => {
+    window.dispatchEvent(new KeyboardEvent('keydown', { key: 'k', ctrlKey: true }));
+    const input = await eventually(() => {
+      const found = container.querySelector<HTMLInputElement>('.palette input');
+      if (found === null) throw new Error('no palette');
+      return found;
+    });
+    await eventually(() => expect(container.querySelector('.palette-list')?.textContent).toContain('bazarr'));
+    await type(input, 'bazarr app');
+    input.dispatchEvent(new KeyboardEvent('keydown', { key: 'Enter', bubbles: true }));
+    await eventually(() => expect(window.location.hash).toBe('#/apps/bazarr'));
+    expect(container.querySelector('.palette')).toBeNull();
+  });
+
  it('says so for an unknown page', async () => {
    window.location.hash = '#/nowhere';
    await eventually(() => expect(text()).toContain('Page not found'));
@@ -10,6 +10,7 @@ import { hrefFor, parseRoute } from './route.ts';
 import { useTheme } from './theme.ts';
 import { Icon } from './components/ui.tsx';
 import { DialogProvider } from './components/dialogs.tsx';
+import { CommandPalette, useCommandPalette } from './components/command-palette.tsx';
 import type { IconName } from './components/ui.tsx';
 import type { Route } from './route.ts';
 import { AppDetailView, AppsView } from './views/apps.tsx';
@@ -21,6 +22,7 @@ import { FunctionEditorView } from './views/function-editor.tsx';
 import { WorkflowInstancesView } from './views/instances.tsx';
 import { InstanceTimelineView } from './views/instance-timeline.tsx';
 import { ModelsView } from './views/models.tsx';
+import { SettingsView } from './views/settings.tsx';

 function useRoute(): Route {
  const [route, setRoute] = useState(() => parseRoute(window.location.hash));
@@ -35,7 +37,7 @@ function useRoute(): Route {

 const LIVE_LABEL: Record<LiveStatus, string> = { connecting: 'connecting…', live: 'live', offline: 'offline — retrying' };

-function Sidebar({ route, status }: { route: Route; status: LiveStatus }) {
+function Sidebar({ route, status, onSearch }: { route: Route; status: LiveStatus; onSearch: () => void }) {
  const gates = useResource(() => api.workflowInstances({ status: 'waiting' }), []);
  const { theme, toggle } = useTheme();
  const waiting = gates.data?.length ?? 0;
@@ -63,6 +65,11 @@ function Sidebar({ route, status }: { route: Route; status: LiveStatus }) {
        <span class="brand-mark" aria-hidden="true" />
        Homelab upgrade
      </span>
+      <button type="button" class="search-button" onClick={onSearch} title="Search (Ctrl+K)">
+        <Icon name="search" size={16} />
+        <span class="nav-label">Search</span>
+        <kbd>Ctrl K</kbd>
+      </button>
      <nav>
        {link('overview', 'Overview', 'overview', { view: 'overview' }, waiting)}
        {link('apps', 'Apps', 'apps', { view: 'apps' })}
@@ -70,6 +77,7 @@ function Sidebar({ route, status }: { route: Route; status: LiveStatus }) {
        {link('workflows', 'Workflows', 'workflows', { view: 'workflows' })}
        {link('functions', 'Functions', 'functions', { view: 'functions' })}
        {link('models', 'Models', 'models', { view: 'models' })}
+        {link('settings', 'Settings', 'settings', { view: 'settings' })}
      </nav>
      <div class="sidebar-foot">
        <span class={`live live-${status}`} title="Live updates from the server">
@@ -109,6 +117,8 @@ function View({ route }: { route: Route }): ComponentChildren {
      return <FunctionEditorView functionId={route.functionId} version={route.version} />;
    case 'models':
      return <ModelsView />;
+    case 'settings':
+      return <SettingsView />;
    case 'not_found':
      return (
        <section>
@@ -147,11 +157,12 @@ function Footer() {
 export function App() {
  const route = useRoute();
  const { revision, status, refresh } = useLive();
+  const [paletteOpen, setPaletteOpen] = useCommandPalette();
  return (
    <LiveContext.Provider value={{ revision, refresh }}>
      <DialogProvider>
      <div class="shell">
-        <Sidebar route={route} status={status} />
+        <Sidebar route={route} status={status} onSearch={() => setPaletteOpen(true)} />
        <div class="content">
          <main>
            <View route={route} />
@@ -159,6 +170,7 @@ export function App() {
          <Footer />
        </div>
      </div>
+      {paletteOpen ? <CommandPalette onClose={() => setPaletteOpen(false)} /> : null}
      </DialogProvider>
    </LiveContext.Provider>
  );
@@ -1,5 +1,7 @@
 import type { ComponentChildren } from 'preact';
 import { runModeLabel, runStatusLabel } from './labels.ts';
+import { formatInstant, formatRelative } from './format.ts';
+import { useNow } from './hooks.ts';

 /** A workflow run's status in words, colored by status. */
 export function RunBadge({ status }: { status: string }) {
@@ -26,3 +28,13 @@ export function ErrorNote({ message }: { message: string }) {
 export function Empty({ children }: { children: ComponentChildren }) {
  return <p class="empty">{children}</p>;
 }
+
+/** An instant as "5 min ago" or "in 3 h", with the full time on hover. */
+export function When({ iso }: { readonly iso: string | null }) {
+  const now = useNow();
+  return (
+    <time dateTime={iso ?? undefined} title={formatInstant(iso)}>
+      {formatRelative(iso, now)}
+    </time>
+  );
+}
@@ -0,0 +1,16 @@
+import { describe, expect, it } from 'vitest';
+import { filterItems } from './command-palette.tsx';
+
+describe('filterItems', () => {
+  const items = [
+    { label: 'Overview', hint: 'page', href: '#/overview', icon: 'overview' as const },
+    { label: 'bazarr', hint: 'app · bazarr', href: '#/apps/bazarr', icon: 'apps' as const },
+    { label: 'bazarr: Failed', hint: 'run · Verify failed', href: '#/runs/r1', icon: 'runs' as const },
+  ];
+
+  it('keeps items with every word of the query, case aside, in their order', () => {
+    expect(filterItems(items, 'BAZ').map((item) => item.href)).toEqual(['#/apps/bazarr', '#/runs/r1']);
+    expect(filterItems(items, 'baz run').map((item) => item.href)).toEqual(['#/runs/r1']);
+    expect(filterItems(items, '  ')).toHaveLength(3);
+  });
+});
@@ -0,0 +1,146 @@
+import { useEffect, useLayoutEffect, useRef, useState } from 'preact/hooks';
+import { api } from '../api.ts';
+import { runStatusLabel } from '../labels.ts';
+import { hrefFor } from '../route.ts';
+import { Icon } from './ui.tsx';
+import type { IconName } from './ui.tsx';
+
+export interface PaletteItem {
+  readonly label: string;
+  readonly hint: string;
+  readonly href: string;
+  readonly icon: IconName;
+}
+
+const PAGES: readonly PaletteItem[] = [
+  { label: 'Overview', hint: 'page', href: hrefFor({ view: 'overview' }), icon: 'overview' },
+  { label: 'Apps', hint: 'page', href: hrefFor({ view: 'apps' }), icon: 'apps' },
+  { label: 'Runs', hint: 'page', href: hrefFor({ view: 'runs' }), icon: 'runs' },
+  { label: 'Workflows', hint: 'page', href: hrefFor({ view: 'workflows' }), icon: 'workflows' },
+  { label: 'Functions', hint: 'page', href: hrefFor({ view: 'functions' }), icon: 'functions' },
+  { label: 'Models', hint: 'page', href: hrefFor({ view: 'models' }), icon: 'models' },
+  { label: 'Settings', hint: 'page', href: hrefFor({ view: 'settings' }), icon: 'settings' },
+];
+
+const RECENT_RUNS = 15;
+const SHOWN = 12;
+
+/** Every word of the query must appear in the item's label or hint; the order of the items stays. */
+export function filterItems(items: readonly PaletteItem[], query: string): PaletteItem[] {
+  const words = query.toLowerCase().split(/\s+/).filter((word) => word !== '');
+  return items.filter((item) => {
+    const text = `${item.label} ${item.hint}`.toLowerCase();
+    return words.every((word) => text.includes(word));
+  });
+}
+
+/** Everything the palette can jump to; a list that fails to load is left out rather than failing the palette. */
+async function loadItems(): Promise<PaletteItem[]> {
+  const [apps, runs, workflows, functions] = await Promise.allSettled([api.apps(), api.workflowInstances(), api.workflows(), api.functions()]);
+  return [
+    ...PAGES,
+    ...(apps.status === 'fulfilled' ? apps.value.map((app) => ({ label: app.app, hint: `app · ${app.project}`, href: hrefFor({ view: 'app', app: app.app }), icon: 'apps' as const })) : []),
+    ...(runs.status === 'fulfilled'
+      ? runs.value.slice(0, RECENT_RUNS).map((run) => ({
+          label: `${run.app ?? run.workflowId}: ${runStatusLabel(run.status)}`,
+          hint: `run · ${run.outcome ?? run.step ?? run.id}`,
+          href: hrefFor({ view: 'run', runId: run.id }),
+          icon: 'runs' as const,
+        }))
+      : []),
+    ...(workflows.status === 'fulfilled' ? workflows.value.map((wf) => ({ label: wf.workflowId, hint: `workflow · ${wf.name}`, href: hrefFor({ view: 'workflow', workflowId: wf.workflowId }), icon: 'workflows' as const })) : []),
+    ...(functions.status === 'fulfilled' ? functions.value.map((fn) => ({ label: fn.functionId, hint: `function · ${fn.name}`, href: hrefFor({ view: 'function', functionId: fn.functionId }), icon: 'functions' as const })) : []),
+  ];
+}
+
+/** Opens on Ctrl+K (⌘K) anywhere, or `/` outside a text field; the sidebar's search button opens it too. */
+export function useCommandPalette(): [boolean, (open: boolean) => void] {
+  const [open, setOpen] = useState(false);
+  useLayoutEffect(() => {
+    const onKey = (event: KeyboardEvent) => {
+      const typing = event.target instanceof HTMLElement && (event.target.isContentEditable || ['INPUT', 'TEXTAREA', 'SELECT'].includes(event.target.tagName));
+      if ((event.ctrlKey || event.metaKey) && event.key.toLowerCase() === 'k') {
+        event.preventDefault();
+        setOpen((current) => !current);
+      } else if (event.key === '/' && !typing) {
+        event.preventDefault();
+        setOpen(true);
+      }
+    };
+    window.addEventListener('keydown', onKey);
+    return () => window.removeEventListener('keydown', onKey);
+  }, []);
+  return [open, setOpen];
+}
+
+export function CommandPalette({ onClose }: { readonly onClose: () => void }) {
+  const [items, setItems] = useState<readonly PaletteItem[]>(PAGES);
+  const [query, setQuery] = useState('');
+  const [active, setActive] = useState(0);
+  const input = useRef<HTMLInputElement>(null);
+  useLayoutEffect(() => input.current?.focus(), []);
+  useEffect(() => {
+    let current = true;
+    void loadItems().then((loaded) => {
+      if (current) setItems(loaded);
+    });
+    return () => {
+      current = false;
+    };
+  }, []);
+  const shown = filterItems(items, query).slice(0, SHOWN);
+  const go = (item: PaletteItem | undefined) => {
+    if (item === undefined) return;
+    window.location.hash = item.href;
+    onClose();
+  };
+  const onKey = (event: KeyboardEvent) => {
+    if (event.key === 'ArrowDown') {
+      event.preventDefault();
+      setActive((index) => Math.min(index + 1, shown.length - 1));
+    } else if (event.key === 'ArrowUp') {
+      event.preventDefault();
+      setActive((index) => Math.max(index - 1, 0));
+    } else if (event.key === 'Enter') {
+      event.preventDefault();
+      go(shown[active]);
+    } else if (event.key === 'Escape') {
+      onClose();
+    }
+  };
+  return (
+    <div class="modal-backdrop palette-backdrop" onClick={(event) => event.target === event.currentTarget && onClose()}>
+      <div class="palette" role="dialog" aria-modal="true" aria-label="Go to">
+        <div class="palette-input">
+          <Icon name="search" />
+          <input
+            ref={input}
+            type="text"
+            placeholder="Go to an app, a run, a workflow or a page…"
+            value={query}
+            onInput={(event) => {
+              setQuery((event.target as HTMLInputElement).value);
+              setActive(0);
+            }}
+            onKeyDown={onKey}
+            aria-label="Search"
+          />
+          <kbd>Esc</kbd>
+        </div>
+        {shown.length === 0 ? (
+          <p class="palette-empty">Nothing matches.</p>
+        ) : (
+          <ul class="palette-list" role="listbox">
+            {shown.map((item, index) => (
+              <li key={item.href} role="option" aria-selected={index === active} class={index === active ? 'active' : undefined} onMouseEnter={() => setActive(index)} onClick={() => go(item)}>
+                <Icon name={item.icon} size={16} />
+                <span class="palette-label">{item.label}</span>
+                <span class="palette-hint">{item.hint}</span>
+              </li>
+            ))}
+          </ul>
+        )}
+      </div>
+    </div>
+  );
+}
@@ -19,6 +19,9 @@ const ICONS = {
  upgrade: 'M12 19V5M5 12l7-7 7 7',
  grid: 'M3 3h7v7H3zM14 3h7v7h-7zM14 14h7v7h-7zM3 14h7v7H3z',
  list: 'M8 6h13M8 12h13M8 18h13M3 6h.01M3 12h.01M3 18h.01',
+  settings: 'M4 21v-7M4 10V3M12 21v-9M12 8V3M20 21v-5M20 12V3M1 14h6M9 8h6M17 16h6',
+  bell: 'M18 8a6 6 0 0 0-12 0c0 7-3 9-3 9h18s-3-2-3-9M13.7 21a2 2 0 0 1-3.4 0',
+  search: 'M11 19a8 8 0 1 0 0-16 8 8 0 0 0 0 16zM21 21l-4.3-4.3',
 } as const;

 export type IconName = keyof typeof ICONS;
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { formatBuild, formatCost, formatDuration, formatInstant, humanizeCode, nodeRunStates, runVersions, traversedEdges } from './format.ts';
+import { formatBuild, formatCost, formatDuration, formatInstant, formatRelative, humanizeCode, nodeRunStates, runVersions, traversedEdges } from './format.ts';

 describe('formatInstant', () => {
  it('shows date and time in the given zone', () => {
@@ -122,3 +122,23 @@ describe('traversedEdges', () => {
    expect(traversedEdges({ a: 'done', b: 'done', c: 'current' }, edges)).toEqual([true, true, false, false]);
  });
 });
+
+describe('formatRelative', () => {
+  const now = Date.parse('2026-09-30T12:00:00.000Z');
+  it.each([
+    ['2026-09-30T11:59:40.000Z', 'just now'],
+    ['2026-09-30T11:55:00.000Z', '5 min ago'],
+    ['2026-09-30T09:00:00.000Z', '3 h ago'],
+    ['2026-09-29T10:00:00.000Z', 'yesterday'],
+    ['2026-09-27T12:00:00.000Z', '3 days ago'],
+    ['2026-09-30T14:30:00.000Z', 'in 3 h'],
+    ['2026-10-01T12:00:00.000Z', 'tomorrow'],
+    ['2026-09-10T12:00:00.000Z', '2026-09-10'],
+  ])('%s -> %s', (iso, text) => {
+    expect(formatRelative(iso, now, 'UTC')).toBe(text);
+  });
+
+  it('shows a dash for nothing', () => {
+    expect(formatRelative(null, now)).toBe('—');
+  });
+});
@@ -100,3 +100,24 @@ export function runVersions(run: { readonly running: string | null; readonly can
  if (run === null) return { running: null, available: null };
  return { running: run.running, available: run.candidate !== null && run.candidate !== run.running ? run.candidate : null };
 }
+
+/**
+ * `5 min ago`, `in 3 h`, `yesterday`: how far an instant is from now, for lists read at a glance. Past a week it is the
+ * date (`2026-09-18`). The full time belongs in the element's title.
+ */
+export function formatRelative(iso: string | null, now: number, timeZone?: string): string {
+  if (iso === null) return DASH;
+  const time = Date.parse(iso);
+  if (Number.isNaN(time)) return DASH;
+  const diff = time - now;
+  const minutes = Math.round(Math.abs(diff) / 60_000);
+  const say = (amount: string) => (diff < 0 ? `${amount} ago` : `in ${amount}`);
+  if (minutes < 1) return diff < 0 ? 'just now' : 'in a moment';
+  if (minutes < 60) return say(`${String(minutes)} min`);
+  const hours = Math.round(minutes / 60);
+  if (hours < 24) return say(`${String(hours)} h`);
+  const days = Math.round(hours / 24);
+  if (days === 1) return diff < 0 ? 'yesterday' : 'tomorrow';
+  if (days < 7) return say(`${String(days)} days`);
+  return new Intl.DateTimeFormat('sv-SE', { dateStyle: 'short', ...(timeZone === undefined ? {} : { timeZone }) }).format(time);
+}
@@ -38,3 +38,13 @@ export function useResource<T>(load: () => Promise<T>, deps: readonly unknown[])

  return state;
 }
+
+/** The current time, refreshed every `everyMs`, so relative times ("5 min ago") keep up without a reload. */
+export function useNow(everyMs = 60_000): number {
+  const [now, setNow] = useState(() => Date.now());
+  useEffect(() => {
+    const timer = setInterval(() => setNow(Date.now()), everyMs);
+    return () => clearInterval(timer);
+  }, [everyMs]);
+  return now;
+}
@@ -2,8 +2,15 @@
 <html lang="en">
  <head>
    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
    <title>Homelab upgrade</title>
+    <meta name="theme-color" content="#0d1117" />
+    <meta name="mobile-web-app-capable" content="yes" />
+    <meta name="apple-mobile-web-app-capable" content="yes" />
+    <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
+    <link rel="icon" href="/icon.svg" type="image/svg+xml" />
+    <link rel="apple-touch-icon" href="/icon.svg" />
+    <link rel="manifest" href="/manifest.webmanifest" />
  </head>
  <body>
    <div id="app"></div>
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><defs><linearGradient id="g" x1="0" y1="0" x2="1" y2="1"><stop offset="0" stop-color="#7c9cff"/><stop offset="1" stop-color="#2dd4bf"/></linearGradient></defs><rect width="64" height="64" rx="14" fill="#0d1117"/><rect x="8" y="8" width="48" height="48" rx="12" fill="url(#g)"/><path d="M32 44V20M22 30l10-10 10 10" fill="none" stroke="#0d1117" stroke-width="5" stroke-linecap="round" stroke-linejoin="round"/></svg>
@@ -0,0 +1,9 @@
+{
+  "name": "Homelab upgrade",
+  "short_name": "Upgrade",
+  "start_url": "./#/overview",
+  "display": "standalone",
+  "background_color": "#0d1117",
+  "theme_color": "#0d1117",
+  "icons": [{ "src": "icon.svg", "sizes": "any", "type": "image/svg+xml", "purpose": "any" }]
+}
@@ -23,6 +23,8 @@ describe('parseRoute', () => {
    ['#/instances', { view: 'runs' }],
    ['#/instances/inst-123', { view: 'run', runId: 'inst-123' }],
    ['#/models', { view: 'models' }],
+    ['#/settings', { view: 'settings' }],
+    ['#/settings/x', { view: 'not_found' }],
    ['#/nope', { view: 'not_found' }],
    ['#/runs/a/b', { view: 'not_found' }],
  ])('%j -> %j', (hash, route) => {
@@ -11,6 +11,7 @@ export type Route =
  | { readonly view: 'function'; readonly functionId: string }
  | { readonly view: 'function_version'; readonly functionId: string; readonly version: number }
  | { readonly view: 'models' }
+  | { readonly view: 'settings' }
  | { readonly view: 'not_found' };

 const NOT_FOUND: Route = { view: 'not_found' };
@@ -58,6 +59,7 @@ export function parseRoute(hash: string): Route {
  if (head === 'models' && arg === undefined) {
    return { view: 'models' };
  }
+  if (head === 'settings' && arg === undefined) return { view: 'settings' };
  return NOT_FOUND;
 }

@@ -87,5 +89,7 @@ export function hrefFor(route: Exclude<Route, { view: 'not_found' }>): string {
      return `#/functions/${encodeURIComponent(route.functionId)}/v/${String(route.version)}`;
    case 'models':
      return '#/models';
+    case 'settings':
+      return '#/settings';
  }
 }
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { appsWithUpdate, costPerDay, ganttBars, lastDays, recentAppRuns, runDurationMs, runDurations, runsPerDay, successRate } from './stats.ts';
+import { appCondition, appsWithUpdate, costPerDay, ganttBars, hostSummary, lastDays, recentAppRuns, runDurationMs, runDurations, runsPerDay, successRate, troubleCount, versionHistory } from './stats.ts';
 import type { WorkflowInstanceSummaryResponse, WorkflowModelCallResponse } from '../http/contract.ts';

 const NOW = Date.parse('2026-09-30T12:00:00.000Z');
@@ -187,3 +187,61 @@ describe('ganttBars', () => {
    ]);
  });
 });
+
+describe('appCondition and hostSummary', () => {
+  const app = (name: string, state: string, health: string | null, enabled = true) => ({ app: name, enabled, state, health });
+
+  it('calls an app down when its container restarts, stopped, is missing or unhealthy; a disabled one is off', () => {
+    expect(appCondition(app('a', 'running', null))).toBe('ok');
+    expect(appCondition(app('a', 'running', 'healthy'))).toBe('ok');
+    expect(appCondition(app('a', 'running', 'starting'))).toBe('starting');
+    expect(appCondition(app('a', 'running', 'unhealthy'))).toBe('down');
+    expect(appCondition(app('a', 'restarting', null))).toBe('down');
+    expect(appCondition(app('a', 'missing', null))).toBe('down');
+    expect(appCondition(app('a', 'exited', null, false))).toBe('off');
+  });
+
+  it('counts enabled apps that run well and lists the others, down first', () => {
+    const summary = hostSummary(
+      {
+        checkedAt: '2026-09-30T11:57:30.000Z',
+        apps: [app('ombi', 'running', 'starting'), app('jellyfin', 'running', 'healthy'), app('bazarr', 'exited', null), app('old', 'exited', null, false)],
+      },
+      NOW,
+    );
+    expect(summary).toEqual({
+      up: 1,
+      total: 3,
+      problems: [
+        { app: 'bazarr', condition: 'down', state: 'exited' },
+        { app: 'ombi', condition: 'starting', state: 'running' },
+      ],
+      ageMinutes: 2,
+    });
+  });
+});
+
+describe('versionHistory', () => {
+  it('keeps real ended runs as updates, runs that left the app as it was, and failures, with repairs and release notes', () => {
+    const runs = [
+      run({ id: 'dry', mode: 'shadow', status: 'succeeded', current: '1.2', candidate: '1.3' }),
+      run({ id: 'live', mode: 'real', status: 'running', current: '1.2', candidate: '1.3' }),
+      run({ id: 'up', mode: 'real', status: 'succeeded', current: '1.1', candidate: '1.2', running: '1.2', outcome: 'Updated' }),
+      run({ id: 'back', mode: 'real', status: 'succeeded', current: '1.1', candidate: '1.2', running: '1.1', outcome: 'Rolled back' }),
+      run({ id: 'bad', mode: 'real', status: 'failed', current: '1.0', candidate: '1.1', running: '1.0', outcome: 'Verify failed' }),
+    ];
+    const calls = [
+      call({ instanceId: 'up', kind: 'releaseNotes', outcome: 'clear', summary: 'Bug fixes.' }),
+      call({ instanceId: 'up', kind: 'repair', outcome: 'fixed', summary: '' }),
+    ];
+    const history = versionHistory(runs, calls);
+    expect(history.map((entry) => [entry.runId, entry.kind, entry.from, entry.to, entry.repaired])).toEqual([
+      ['up', 'updated', '1.1', '1.2', true],
+      ['back', 'kept', '1.1', '1.2', false],
+      ['bad', 'failed', '1.0', '1.1', false],
+    ]);
+    expect(history[0]?.releaseNotes).toEqual({ verdict: 'clear', summary: 'Bug fixes.' });
+    expect(troubleCount(history)).toBe(3);
+    expect(troubleCount(history, 1)).toBe(1);
+  });
+});
@@ -164,3 +164,80 @@ export function ganttBars(items: readonly Pick<WorkflowTimelineItem, 'type' | 'n
  }
  return bars;
 }
+
+export type AppCondition = 'ok' | 'starting' | 'down' | 'off';
+
+/** How an app is doing right now, from its container: down covers restarting, stopped, missing and unhealthy. */
+export function appCondition(health: { readonly enabled: boolean; readonly state: string; readonly health: string | null }): AppCondition {
+  if (health.state === 'running') return health.health === 'unhealthy' ? 'down' : health.health === 'starting' ? 'starting' : 'ok';
+  return health.enabled ? 'down' : 'off';
+}
+
+export interface HostSummary {
+  /** Enabled apps whose container runs well, of all enabled apps. */
+  readonly up: number;
+  readonly total: number;
+  /** Enabled apps that are down or still starting, worst first. */
+  readonly problems: readonly { readonly app: string; readonly condition: AppCondition; readonly state: string }[];
+  /** Minutes since the driver last looked: an old look means the driver is not looking. */
+  readonly ageMinutes: number;
+}
+
+export function hostSummary(status: { readonly checkedAt: string; readonly apps: readonly { readonly app: string; readonly enabled: boolean; readonly state: string; readonly health: string | null }[] }, now: number): HostSummary {
+  const enabled = status.apps.filter((app) => app.enabled);
+  const problems = enabled
+    .map((app) => ({ app: app.app, condition: appCondition(app), state: app.health === 'unhealthy' ? 'unhealthy' : app.state }))
+    .filter((app) => app.condition !== 'ok')
+    .sort((a, b) => (a.condition === b.condition ? a.app.localeCompare(b.app) : a.condition === 'down' ? -1 : 1));
+  return { up: enabled.length - problems.length, total: enabled.length, problems, ageMinutes: Math.max(0, Math.floor((now - Date.parse(status.checkedAt)) / 60_000)) };
+}
+
+export type HistoryKind = 'updated' | 'kept' | 'failed';
+
+export interface HistoryEntry {
+  readonly runId: string;
+  readonly at: string;
+  readonly kind: HistoryKind;
+  readonly from: string | null;
+  readonly to: string | null;
+  readonly outcome: string | null;
+  /** The model repaired the app during this run. */
+  readonly repaired: boolean;
+  /** What the model read in the release notes before the update, when it was asked. */
+  readonly releaseNotes: { readonly verdict: string; readonly summary: string } | null;
+}
+
+type HistoryCall = Pick<WorkflowModelCallResponse, 'instanceId' | 'kind' | 'outcome' | 'summary'>;
+
+/**
+ * An app's real runs as its version history, newest first: an update (from → to), a run that ended but left the app as
+ * it was (skipped, rolled back), or a failure. Dry runs and runs in progress change nothing and are left out.
+ */
+export function versionHistory(runs: readonly WorkflowInstanceSummaryResponse[], calls: readonly HistoryCall[]): HistoryEntry[] {
+  const out: HistoryEntry[] = [];
+  for (const run of runs) {
+    if (run.mode !== 'real' || !ENDED.has(run.status)) continue;
+    const kind: HistoryKind = run.status === 'failed' ? 'failed' : run.status === 'succeeded' && run.running !== null && run.running !== run.current ? 'updated' : 'kept';
+    const own = calls.filter((call) => call.instanceId === run.id);
+    const notes = own.find((call) => call.kind === 'releaseNotes');
+    out.push({
+      runId: run.id,
+      at: run.updatedAt,
+      kind,
+      from: run.current,
+      to: kind === 'updated' ? run.running : run.candidate,
+      outcome: run.outcome,
+      repaired: own.some((call) => call.kind === 'repair'),
+      releaseNotes: notes === undefined ? null : { verdict: notes.outcome, summary: notes.summary },
+    });
+  }
+  return out;
+}
+
+/** How many of the app's last `window` real runs did not simply update it: failed, left as it was, or needed a repair. */
+export function troubleCount(history: readonly HistoryEntry[], window = 10): number {
+  return history.slice(0, window).filter((entry) => entry.kind !== 'updated' || entry.repaired).length;
+}
+
+/** Two troubled runs among the last ten make an app worth a closer look. */
+export const TROUBLE_THRESHOLD = 2;
@@ -1140,12 +1140,17 @@ h2 {

 .decision-card-interactive {
  background: var(--surface);
-  border: 2px solid var(--stop);
-  border-radius: var(--radius);
+  border: 1px solid color-mix(in srgb, var(--stop) 55%, var(--line));
+  border-radius: var(--radius-lg);
+  box-shadow: var(--shadow-md), 0 0 0 3px var(--stop-bg);
  padding: 16px;
  margin-bottom: 20px;
 }

+.decision-card-interactive h3 {
+  margin-top: 0;
+}
+
 .timeline-header {
  display: flex;
  flex-wrap: wrap;
@@ -1162,9 +1167,31 @@ h2 {
 }

@media (max-width: 719px) {
+  /* On a phone the decision stays one tap away while the owner reads the gate: the buttons stick to the bottom. */
+  .decision-actions {
+    position: sticky;
+    bottom: 0;
+    z-index: 5;
+    margin: 12px -16px -16px;
+    padding: 10px 16px calc(10px + env(safe-area-inset-bottom));
+    background: color-mix(in srgb, var(--surface) 92%, transparent);
+    backdrop-filter: blur(8px);
+    border-top: 1px solid var(--line);
+    border-radius: 0 0 var(--radius-lg) var(--radius-lg);
+  }
+
  .decision-actions button {
-    flex: 1 1 100%;
-    min-height: 44px;
+    flex: 1 1 40%;
+    min-height: 48px;
+    font-size: 1rem;
+  }
+
+  .timeline-header h1 {
+    font-size: 1.3rem;
+  }
+
+  .overview-waiting .btn-link {
+    padding: 8px 12px;
  }

  .graph-canvas {
@@ -2023,3 +2050,267 @@ a.button-link.primary {
  text-align: center;
  color: var(--muted);
 }
+
+/* how an app's container runs right now */
+.health-dot {
+  display: inline-block;
+  width: 9px;
+  height: 9px;
+  border-radius: 50%;
+  vertical-align: middle;
+  background: var(--queued);
+}
+
+.health-ok { background: var(--ok); box-shadow: 0 0 0 3px var(--ok-bg); }
+.health-starting { background: var(--running); box-shadow: 0 0 0 3px var(--running-bg); }
+.health-down { background: var(--error); box-shadow: 0 0 0 3px var(--error-bg); animation: pulse 1.6s ease-in-out infinite; }
+.health-off { background: var(--queued); opacity: 0.6; }
+
+@keyframes pulse {
+  50% { box-shadow: 0 0 0 6px transparent; }
+}
+
+/* an app's version history */
+.history {
+  margin: 0;
+  padding: 0;
+  list-style: none;
+}
+
+.history li {
+  position: relative;
+  display: flex;
+  gap: 12px;
+  padding-bottom: 14px;
+}
+
+.history li:not(:last-child)::before {
+  content: '';
+  position: absolute;
+  top: 14px;
+  bottom: 0;
+  left: 5px;
+  width: 2px;
+  background: var(--line);
+}
+
+.history-mark {
+  flex: none;
+  width: 12px;
+  height: 12px;
+  margin-top: 5px;
+  border-radius: 50%;
+  background: var(--queued);
+}
+
+.history-updated .history-mark { background: var(--ok); }
+.history-kept .history-mark { background: var(--stop); }
+.history-failed .history-mark { background: var(--error); }
+
+.history-body {
+  flex: 1;
+  min-width: 0;
+}
+
+.history-head {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 6px 10px;
+}
+
+.history-when {
+  margin-left: auto;
+  font-size: 0.85em;
+}
+
+.history-body p,
+.history-body details {
+  margin: 4px 0 0;
+  font-size: 0.9em;
+}
+
+/* the report on top of the overview */
+.report .panel-body {
+  padding-top: 10px;
+  padding-bottom: 10px;
+}
+
+.report-lines {
+  display: grid;
+  gap: 4px;
+  margin: 0;
+  padding-left: 18px;
+}
+
+/* settings */
+.settings-form {
+  display: grid;
+  gap: 16px;
+  max-width: 560px;
+}
+
+.settings-form fieldset {
+  margin: 0;
+  padding: 12px 16px;
+  border: 1px solid var(--line);
+  border-radius: var(--radius);
+}
+
+.settings-form legend {
+  padding: 0 6px;
+  font-weight: 600;
+}
+
+.settings-form p {
+  margin: 0 0 8px;
+}
+
+.settings-row {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: end;
+  gap: 12px 20px;
+}
+
+.settings-row label {
+  display: grid;
+  gap: 4px;
+}
+
+.settings-row label.check {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+
+input[type='time'] {
+  padding: 5px 8px;
+  border: 1px solid var(--line);
+  border-radius: var(--radius);
+  background: var(--surface);
+  font: inherit;
+  color: inherit;
+}
+
+/* go-to palette (Ctrl+K) */
+.search-button {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  padding: 7px 10px;
+  color: var(--muted);
+  background: var(--surface-2);
+  text-align: left;
+}
+
+.search-button .nav-label {
+  flex: 1;
+}
+
+kbd {
+  padding: 1px 6px;
+  border: 1px solid var(--line);
+  border-bottom-width: 2px;
+  border-radius: 5px;
+  font: 0.75rem var(--mono);
+  color: var(--muted);
+  background: var(--surface);
+}
+
+.palette-backdrop {
+  align-items: flex-start;
+  padding-top: 12vh;
+}
+
+.palette {
+  width: min(620px, calc(100% - 32px));
+  background: var(--surface);
+  border: 1px solid var(--line);
+  border-radius: var(--radius-lg);
+  box-shadow: var(--shadow-lg);
+  overflow: hidden;
+  animation: pop-in 0.15s ease-out;
+}
+
+.palette-input {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  padding: 12px 16px;
+  border-bottom: 1px solid var(--line);
+  color: var(--muted);
+}
+
+.palette-input input {
+  flex: 1;
+  padding: 4px 0;
+  border: 0;
+  outline: none;
+  background: transparent;
+  font-size: 1.05rem;
+}
+
+.palette-list {
+  max-height: 50vh;
+  margin: 0;
+  padding: 6px;
+  overflow-y: auto;
+  list-style: none;
+}
+
+.palette-list li {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  padding: 8px 10px;
+  border-radius: var(--radius);
+  cursor: pointer;
+}
+
+.palette-list li.active {
+  background: var(--accent-soft);
+}
+
+.palette-list li.active .icon {
+  color: var(--accent);
+}
+
+.palette-label {
+  font-weight: 600;
+  white-space: nowrap;
+}
+
+.palette-hint {
+  overflow: hidden;
+  color: var(--muted);
+  font-size: 0.85em;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.palette-empty {
+  margin: 0;
+  padding: 16px;
+  color: var(--muted);
+  text-align: center;
+}
+
+@media (max-width: 719px) {
+  .search-button kbd {
+    display: none;
+  }
+}
+
+.page-actions {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 10px;
+}
+
+.page-actions > button {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+}
@@ -1,19 +1,23 @@
-import { useState } from 'preact/hooks';
-import { Empty, ErrorNote, Loading, ModeTag, RunBadge } from '../components.tsx';
+import { useContext, useState } from 'preact/hooks';
+import { useConfirm, useToast } from '../components/dialogs.tsx';
+import { Empty, ErrorNote, Loading, ModeTag, RunBadge, When } from '../components.tsx';
 import { Card, Icon } from '../components/ui.tsx';
 import { Chart } from '../components/chart.tsx';
 import { durationOption } from '../charts/options.ts';
 import { runStatusLabel } from '../labels.ts';
-import { recentAppRuns, runDurations } from '../stats.ts';
+import { appCondition, appsWithUpdate, recentAppRuns, runDurations, troubleCount, TROUBLE_THRESHOLD, versionHistory } from '../stats.ts';
+import type { AppCondition, HistoryKind } from '../stats.ts';
 import { api } from '../api.ts';
 import { formatCost, formatInstant, runVersions } from '../format.ts';
-import { useResource } from '../hooks.ts';
+import { LiveContext, useResource } from '../hooks.ts';
 import { hrefFor } from '../route.ts';
 import { AppConfigPanel } from './app-config.tsx';
 import { SkillPanel } from './skill.tsx';
 import { RunButton, ScheduleCell } from './workflows.tsx';
 import { appWorkflowId } from '../../domain/workflow-run-summary.ts';
-import type { AppOverview, WorkflowInstanceSummaryResponse } from '../../http/contract.ts';
+import type { AppOverview, WorkflowInstanceSummaryResponse, WorkflowModelCallResponse } from '../../http/contract.ts';
+
+type HistoryCall = Pick<WorkflowModelCallResponse, 'instanceId' | 'kind' | 'outcome' | 'summary'>;

 /** A workflow run's status and where it is or ended (terminal_updated, terminal_dry_run, a gate…). */
 function RunStatus({ run }: { readonly run: WorkflowInstanceSummaryResponse }) {
@@ -53,10 +57,32 @@ function useLayout(): [AppsLayout, (layout: AppsLayout) => void] {
  return [layout, choose];
 }

+type AppHealthData = NonNullable<Awaited<ReturnType<typeof api.hostStatus>>['status']>['apps'][number];
+
 interface AppsData {
  readonly apps: readonly AppOverview[];
  readonly runs: readonly WorkflowInstanceSummaryResponse[] | null;
  readonly nextRun: (app: string) => string | null;
+  /** The app's container as the driver last saw it; null when unknown. */
+  readonly health: (app: string) => AppHealthData | null;
+  /** Real runs among the app's last ten that failed, left it as it was or needed a repair. */
+  readonly trouble: (app: string) => number;
+}
+
+const CONDITION_LABEL: Readonly<Record<AppCondition, string>> = { ok: 'running', starting: 'starting', down: 'down', off: 'off' };
+
+/** A dot for how the app's container runs right now. */
+function HealthDot({ health }: { readonly health: AppHealthData | null }) {
+  if (health === null) return null;
+  const condition = appCondition(health);
+  const title = `${CONDITION_LABEL[condition]}: ${health.state}${health.health === null ? '' : `, ${health.health}`}`;
+  return (
+    <>
+      <span class={`health-dot health-${condition}`} title={title}>
+        <span class="sr-only">{title}</span>
+      </span>{' '}
+    </>
+  );
 }

 /** The last runs of an app as dots, oldest on the left, each a link to its run. */
@@ -104,7 +130,9 @@ function AppCard({ group, data }: { readonly group: readonly AppOverview[]; read
      <header class="app-card-head">
        <span class="app-avatar" aria-hidden="true">{first.app.slice(0, 2)}</span>
        <div class="app-card-title">
-          <a href={hrefFor({ view: 'app', app: first.app })}>{first.app}</a>
+          <span>
+            <HealthDot health={data.health(first.app)} /><a href={hrefFor({ view: 'app', app: first.app })}>{first.app}</a>
+          </span>
          <span class="muted">
            {first.enabled ? `auto: ${first.auto ?? '—'}` : first.configured ? 'disabled' : 'not configured'}
          </span>
@@ -112,9 +140,16 @@ function AppCard({ group, data }: { readonly group: readonly AppOverview[]; read
        <ModeTag mode={first.apply ? 'real' : 'shadow'} />
      </header>
      <Versions run={run} />
+      {data.trouble(first.app) >= TROUBLE_THRESHOLD ? (
+        <span class="badge badge-warning" title="Failed, not updated or repaired by the model in several of the last ten real runs">
+          often needs care
+        </span>
+      ) : null}
      {members.map((member) => (
        <div key={member.app} class="app-member">
-          <a href={hrefFor({ view: 'app', app: member.app })}>└ {member.service ?? member.app}</a>
+          <span>
+            <HealthDot health={data.health(member.app)} /><a href={hrefFor({ view: 'app', app: member.app })}>└ {member.service ?? member.app}</a>
+          </span>
          <Versions run={latest(member.app)} />
        </div>
      ))}
@@ -124,7 +159,7 @@ function AppCard({ group, data }: { readonly group: readonly AppOverview[]; read
      </div>
      <footer class="app-card-foot">
        <span class="muted">
-          <Icon name="clock" size={14} /> {formatInstant(data.nextRun(first.app))}
+          <Icon name="clock" size={14} /> <When iso={data.nextRun(first.app)} />
        </span>
        {first.enabled ? <RunButton app={first.app} mode="shadow" /> : null}
      </footer>
@@ -179,6 +214,7 @@ function AppsTable({ data }: { readonly data: AppsData }) {
            return (
              <tr key={entry.app} class={[entry.enabled ? '' : 'row-off', member ? 'row-member' : ''].join(' ').trim()}>
                <td>
+                  <HealthDot health={data.health(entry.app)} />
                  <a href={hrefFor({ view: 'app', app: entry.app })}>{member ? `└ ${entry.service ?? entry.app}` : entry.app}</a>
                  {entry.enabled ? null : <span class="muted"> · {entry.configured ? 'disabled' : 'not configured'}</span>}
                </td>
@@ -199,11 +235,55 @@ function AppsTable({ data }: { readonly data: AppsData }) {
  );
 }

+/**
+ * Starts a dry run of every enabled app whose latest run found a newer image, one after another. A dry run changes
+ * nothing; an app with a run still active is skipped and counted.
+ */
+function DryRunUpdates({ apps, runs }: { readonly apps: readonly AppOverview[]; readonly runs: readonly WorkflowInstanceSummaryResponse[] }) {
+  const confirm = useConfirm();
+  const toast = useToast();
+  const { refresh } = useContext(LiveContext);
+  const [busy, setBusy] = useState(false);
+  const targets = appsWithUpdate(apps, runs);
+  if (targets.length === 0) return null;
+  const start = async () => {
+    const ok = await confirm({
+      title: `Dry run ${String(targets.length)} ${targets.length === 1 ? 'app' : 'apps'} with an update?`,
+      message: `${targets.join(', ')}. A dry run checks the new version and the release notes and changes nothing.`,
+      confirmLabel: 'Start dry runs',
+    });
+    if (!ok) return;
+    setBusy(true);
+    let started = 0;
+    const skipped: string[] = [];
+    for (const app of targets) {
+      try {
+        await api.startWorkflowRun(app, 'shadow');
+        started += 1;
+      } catch {
+        skipped.push(app);
+      }
+    }
+    setBusy(false);
+    refresh();
+    toast(skipped.length === 0 ? `Started ${String(started)} dry runs.` : `Started ${String(started)} dry runs; skipped ${skipped.join(', ')} (a run is still active).`, skipped.length === 0 ? 'ok' : 'error');
+  };
+  return (
+    <button type="button" disabled={busy} onClick={() => void start()}>
+      <Icon name="upgrade" size={16} /> {busy ? 'Starting…' : `Dry run ${String(targets.length)} with updates`}
+    </button>
+  );
+}
+
 export function AppsView() {
  const { data, error } = useResource(() => api.apps(), []);
  const runs = useResource(() => api.workflowInstances(), []);
  const schedules = useResource(() => api.workflowSchedules(), []);
+  const host = useResource(() => api.hostStatus(), []);
  const [layout, setLayout] = useLayout();
+  const health = (app: string) => host.data?.status?.apps.find((entry) => entry.app === app) ?? null;
+  const calls = useResource(() => api.modelCalls(500), []);
+  const trouble = (app: string) => troubleCount(versionHistory((runs.data ?? []).filter((run) => run.app === app), calls.data?.calls ?? []));
  const nextRun = (app: string) => schedules.data?.find((entry) => entry.workflowId === appWorkflowId(app))?.next[0] ?? null;
  return (
    <section>
@@ -212,6 +292,8 @@ export function AppsView() {
          <h1>Apps</h1>
          <p>What each app runs, what is available and how its updates went.</p>
        </div>
+        <div class="page-actions">
+        {data === null || runs.data === null ? null : <DryRunUpdates apps={data} runs={runs.data} />}
        <div class="segmented" role="group" aria-label="Layout">
          <button type="button" aria-pressed={layout === 'cards'} onClick={() => setLayout('cards')}>
            <Icon name="grid" size={16} /> Cards
@@ -220,6 +302,7 @@ export function AppsView() {
            <Icon name="list" size={16} /> Table
          </button>
        </div>
+        </div>
      </div>
      {error === null ? null : <ErrorNote message={error} />}
      {data === null ? (
@@ -227,9 +310,9 @@ export function AppsView() {
      ) : data.length === 0 ? (
        <Empty>No apps configured yet.</Empty>
      ) : layout === 'cards' ? (
-        <AppCards data={{ apps: data, runs: runs.data, nextRun }} />
+        <AppCards data={{ apps: data, runs: runs.data, nextRun, health, trouble }} />
      ) : (
-        <AppsTable data={{ apps: data, runs: runs.data, nextRun }} />
+        <AppsTable data={{ apps: data, runs: runs.data, nextRun, health, trouble }} />
      )}
    </section>
  );
@@ -237,6 +320,51 @@ export function AppsView() {

 const DURATION_RUNS = 20;

+const HISTORY_LABEL: Readonly<Record<HistoryKind, string>> = { updated: 'Updated', kept: 'Not updated', failed: 'Failed' };
+const HISTORY_SHOWN = 15;
+
+/** The app's real runs as a version history: what it ran before and after, and what the release notes said. */
+function VersionHistory({ runs, calls }: { readonly runs: readonly WorkflowInstanceSummaryResponse[]; readonly calls: readonly HistoryCall[] }) {
+  const history = versionHistory(runs, calls);
+  const trouble = troubleCount(history);
+  return (
+    <Card title="Version history" icon="upgrade" actions={trouble >= TROUBLE_THRESHOLD ? <span class="badge badge-warning">{trouble} of the last {Math.min(history.length, 10)} real runs needed care</span> : undefined}>
+      {history.length === 0 ? (
+        <p class="muted">No real update yet: dry runs do not change the app.</p>
+      ) : (
+        <ol class="history">
+          {history.slice(0, HISTORY_SHOWN).map((entry) => (
+            <li key={entry.runId} class={`history-${entry.kind}`}>
+              <span class="history-mark" aria-hidden="true" />
+              <div class="history-body">
+                <div class="history-head">
+                  <strong>{HISTORY_LABEL[entry.kind]}</strong>
+                  <span class="versions">
+                    <code class="version">{entry.from ?? '?'}</code>
+                    <Icon name="arrow" size={14} />
+                    <code class={`version${entry.kind === 'updated' ? ' version-new' : ''}`}>{entry.to ?? '?'}</code>
+                  </span>
+                  {entry.repaired ? <span class="badge badge-warning">repaired by the model</span> : null}
+                  <a class="muted history-when" href={hrefFor({ view: 'run', runId: entry.runId })}>
+                    <When iso={entry.at} />
+                  </a>
+                </div>
+                {entry.kind === 'updated' || entry.outcome === null ? null : <p class="muted">{entry.outcome}</p>}
+                {entry.releaseNotes === null ? null : (
+                  <details>
+                    <summary>Release notes: {entry.releaseNotes.verdict}</summary>
+                    <p>{entry.releaseNotes.summary}</p>
+                  </details>
+                )}
+              </div>
+            </li>
+          ))}
+        </ol>
+      )}
+    </Card>
+  );
+}
+
 /** How long the app's last runs took: a run that suddenly takes much longer is worth a look. */
 function DurationChart({ runs }: { readonly runs: readonly WorkflowInstanceSummaryResponse[] }) {
  const durations = runDurations(runs, DURATION_RUNS);
@@ -262,6 +390,7 @@ export function AppDetailView({ app }: { app: string }) {
  const runs = useResource(() => api.workflowInstances({ app }), [app]);
  const schedules = useResource(() => api.workflowSchedules(), []);
  const schedule = schedules.data?.find((entry) => entry.workflowId === appWorkflowId(app));
+  const calls = useResource(() => api.modelCalls(500), []);
  return (
    <section>
      <p class="crumbs">
@@ -319,6 +448,7 @@ export function AppDetailView({ app }: { app: string }) {
        </>
      )}
      </Card>
+      {runs.data === null ? null : <VersionHistory runs={runs.data} calls={calls.data?.calls ?? []} />}
      <Card title="Configuration" icon="workflows">
        <AppConfigPanel app={app} />
      </Card>
@@ -1,12 +1,14 @@
 import { api } from '../api.ts';
-import { Empty, ErrorNote, Loading, ModeTag, RunBadge } from '../components.tsx';
+import { Empty, ErrorNote, Loading, ModeTag, RunBadge, When } from '../components.tsx';
 import { formatInstant } from '../format.ts';
 import { useResource } from '../hooks.ts';
 import { hrefFor } from '../route.ts';
 import { Card, StatTile } from '../components/ui.tsx';
 import { Chart } from '../components/chart.tsx';
 import { activityOption, formatUsd, scheduleOption, sparklineOption } from '../charts/options.ts';
-import { appsWithUpdate, costPerDay, RUN_BUCKETS, runsPerDay, successRate } from '../stats.ts';
+import { appsWithUpdate, costPerDay, hostSummary, RUN_BUCKETS, runsPerDay, successRate } from '../stats.ts';
+import { downApps } from '../../domain/host-status.ts';
+import { nightDigest } from '../../domain/notification-settings.ts';
 import type { SuccessRate } from '../stats.ts';
 import type { AppOverview, WorkflowInstanceSummaryResponse, WorkflowScheduleResponse } from '../../http/contract.ts';

@@ -32,7 +34,7 @@ function Waiting({ runs }: { readonly runs: readonly WorkflowInstanceSummaryResp
          <strong><RunName run={run} /></strong>
          <span>{run.step ?? 'Owner decides'}</span>
          <ModeTag mode={run.mode} />
-          <span class="muted">since {formatInstant(run.updatedAt)}</span>
+          <span class="muted">since <When iso={run.updatedAt} /></span>
          <OpenRun run={run} label="Decide →" />
        </li>
      ))}
@@ -67,7 +69,7 @@ function Recent({ runs }: { readonly runs: readonly WorkflowInstanceSummaryRespo
          <RunBadge status={run.status} />
          <span>{run.outcome ?? ''}</span>
          <ModeTag mode={run.mode} />
-          <span class="muted">{formatInstant(run.updatedAt)}</span>
+          <span class="muted"><When iso={run.updatedAt} /></span>
          <OpenRun run={run} label="Open" />
        </li>
      ))}
@@ -85,7 +87,7 @@ function Scheduled({ schedules }: { readonly schedules: readonly WorkflowSchedul
      {upcoming.map((schedule) => (
        <li key={schedule.workflowId} class="overview-item">
          <strong><a href={hrefFor({ view: 'workflow', workflowId: schedule.workflowId })}>{schedule.workflowId}</a></strong>
-          <span>{formatInstant(schedule.next[0] ?? null)}</span>
+          <span><When iso={schedule.next[0] ?? null} /></span>
          <ModeTag mode={schedule.mode} />
          {schedule.lastResult === null ? null : <span class="muted">last: {schedule.lastResult}</span>}
        </li>
@@ -117,7 +119,49 @@ function RateTrend({ rate }: { readonly rate: SuccessRate }) {
  );
 }

-function Stats({ runs, apps, calls }: { readonly runs: readonly WorkflowInstanceSummaryResponse[]; readonly apps: readonly AppOverview[] | null; readonly calls: ModelCallsResponse | null }) {
+type HostStatusData = Awaited<ReturnType<typeof api.hostStatus>>['status'];
+
+/** Minutes after which the driver's look counts as old: it looks once a minute. */
+const STALE_MINUTES = 5;
+
+function AppsUp({ status }: { readonly status: HostStatusData | undefined }) {
+  if (status === undefined) return <StatTile label="Apps running" value="…" icon="apps" />;
+  if (status === null) return <StatTile label="Apps running" value="—" icon="apps" hint="the driver has not looked yet" />;
+  if (status.error !== null) return <StatTile label="Apps running" value="?" icon="apps" tone="error" hint={status.error} />;
+  const summary = hostSummary(status, Date.now());
+  const stale = summary.ageMinutes >= STALE_MINUTES;
+  const hint = stale
+    ? `last look ${String(summary.ageMinutes)} min ago`
+    : summary.problems.length === 0
+      ? 'all up'
+      : summary.problems.slice(0, 3).map((item) => `${item.app} ${item.state}`).join(', ') + (summary.problems.length > 3 ? '…' : '');
+  const down = summary.problems.some((item) => item.condition === 'down');
+  return (
+    <StatTile
+      label="Apps running"
+      value={`${String(summary.up)}/${String(summary.total)}`}
+      icon="apps"
+      tone={stale ? 'stop' : down ? 'error' : summary.problems.length > 0 ? 'running' : 'ok'}
+      hint={hint}
+      href={hrefFor({ view: 'apps' })}
+    />
+  );
+}
+
+function hoursAgo(hours: number): string {
+  return hours < 1 ? 'under 1 h ago' : hours < 48 ? `${String(Math.round(hours))} h ago` : `${String(Math.round(hours / 24))} days ago`;
+}
+
+function VmBackup({ status }: { readonly status: HostStatusData | undefined }) {
+  const backup = status?.backup;
+  if (backup === undefined) return <StatTile label="VM backup" value="…" icon="clock" />;
+  if (backup === null) return <StatTile label="VM backup" value="—" icon="clock" hint="no record from the Proxmox timer" />;
+  if (!backup.ok) return <StatTile label="VM backup" value="!" icon="clock" tone="error" hint={backup.detail} />;
+  // A nightly backup: older than a day means last night's did not happen; real updates refuse past 48 h.
+  return <StatTile label="VM backup" value={hoursAgo(backup.ageHours)} icon="clock" tone={backup.ageHours > 26 ? 'stop' : 'ok'} hint={formatInstant(backup.createdAt)} />;
+}
+
+function Stats({ runs, apps, calls, host }: { readonly runs: readonly WorkflowInstanceSummaryResponse[]; readonly apps: readonly AppOverview[] | null; readonly calls: ModelCallsResponse | null; readonly host: HostStatusData | undefined }) {
  const now = Date.now();
  const waiting = runs.filter((run) => run.status === 'waiting').length;
  const live = runs.filter((run) => LIVE.has(run.status)).length;
@@ -143,6 +187,8 @@ function Stats({ runs, apps, calls }: { readonly runs: readonly WorkflowInstance
        hint={updates === null || updates.length === 0 ? 'every app is current' : updates.slice(0, 3).join(', ') + (updates.length > 3 ? '…' : '')}
        href={hrefFor({ view: 'apps' })}
      />
+      <AppsUp status={host} />
+      <VmBackup status={host} />
    </div>
  );
 }
@@ -179,12 +225,37 @@ function Upcoming({ schedules }: { readonly schedules: readonly WorkflowSchedule
  );
 }

+const DAY_MS = 24 * 60 * 60 * 1000;
+
+/** The morning report as a card: what needs the owner and what changed since the last report went out. */
+function SinceLastReport({ runs, host, lastDigestAt }: { readonly runs: readonly WorkflowInstanceSummaryResponse[]; readonly host: HostStatusData | undefined; readonly lastDigestAt: string | null }) {
+  const since = lastDigestAt ?? new Date(Date.now() - DAY_MS).toISOString();
+  const digest = nightDigest({ runs, since, down: host === undefined || host === null ? [] : downApps(host) });
+  return (
+    <Card
+      title={digest.needsYou > 0 ? `${String(digest.needsYou)} ${digest.needsYou === 1 ? 'thing needs' : 'things need'} you` : 'All good'}
+      icon={digest.needsYou > 0 ? 'alert' : 'check'}
+      tone={digest.needsYou > 0 ? 'attention' : undefined}
+      actions={<span class="muted">since {lastDigestAt === null ? 'yesterday' : `the report of ${formatInstant(lastDigestAt)}`}</span>}
+      class="report"
+    >
+      <ul class="report-lines">
+        {digest.detail.split('\n').map((line) => (
+          <li key={line}>{line}</li>
+        ))}
+      </ul>
+    </Card>
+  );
+}
+
 /** The home page: what waits for the owner, how runs went lately, what they cost and what runs next. */
 export function OverviewView() {
  const runs = useResource(() => api.workflowInstances(), []);
  const schedules = useResource(() => api.workflowSchedules(), []);
  const apps = useResource(() => api.apps(), []);
  const calls = useResource(() => api.modelCalls(500), []);
+  const host = useResource(() => api.hostStatus(), []);
+  const notifications = useResource(() => api.notificationSettings(), []);
  const all = runs.data ?? [];
  const since = Date.now() - RECENT_DAYS * 24 * 60 * 60 * 1000;
  const recent = all.filter((run) => ENDED.has(run.status) && Date.parse(run.updatedAt) >= since).slice(0, RECENT_LIMIT);
@@ -202,7 +273,8 @@ export function OverviewView() {
        runs.error === null ? <Loading /> : null
      ) : (
        <>
-          <Stats runs={all} apps={apps.data} calls={calls.data} />
+          <SinceLastReport runs={all} host={host.data?.status ?? undefined} lastDigestAt={notifications.data?.lastDigestAt ?? null} />
+          <Stats runs={all} apps={apps.data} calls={calls.data} host={host.data === null ? (host.error === null ? undefined : null) : host.data.status} />
          <div class="panel-grid">
            <Card title="Needs your decision" icon="alert" tone={waiting.length > 0 ? 'attention' : undefined}>
              <Waiting runs={waiting} />
@@ -0,0 +1,88 @@
+import { useState } from 'preact/hooks';
+import { api } from '../api.ts';
+import { ErrorNote, Loading } from '../components.tsx';
+import { Card } from '../components/ui.tsx';
+import { useToast } from '../components/dialogs.tsx';
+import { formatInstant } from '../format.ts';
+import { useResource } from '../hooks.ts';
+
+type Settings = Awaited<ReturnType<typeof api.notificationSettings>>['settings'];
+
+function TimeField({ label, value, onChange }: { readonly label: string; readonly value: string; readonly onChange: (value: string) => void }) {
+  return (
+    <label>
+      {label}
+      <input type="time" value={value} required onInput={(event) => onChange((event.target as HTMLInputElement).value)} />
+    </label>
+  );
+}
+
+/** When the phone may ring, and when the morning report goes out. Remounted (by key) when the saved settings change. */
+function NotificationsForm({ initial, timeZone, lastDigestAt }: { readonly initial: Settings; readonly timeZone: string; readonly lastDigestAt: string | null }) {
+  const [settings, setSettings] = useState(initial);
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const toast = useToast();
+  const set = (patch: Partial<Settings>) => setSettings((current) => ({ ...current, ...patch }));
+  const save = async (event: Event) => {
+    event.preventDefault();
+    setSaving(true);
+    setError(null);
+    try {
+      await api.saveNotificationSettings(settings);
+      toast('Notification settings saved.');
+    } catch (cause) {
+      setError(cause instanceof Error ? cause.message : 'Cannot save the settings');
+    } finally {
+      setSaving(false);
+    }
+  };
+  return (
+    <form class="settings-form" onSubmit={(event) => void save(event)}>
+      <fieldset>
+        <legend>Quiet hours</legend>
+        <p class="muted">Nothing rings in these hours: gates and failures wait for the morning report. A failure in the evening before still rings.</p>
+        <div class="settings-row">
+          <TimeField label="From" value={settings.quietFrom} onChange={(quietFrom) => set({ quietFrom })} />
+          <TimeField label="Until" value={settings.quietUntil} onChange={(quietUntil) => set({ quietUntil })} />
+        </div>
+      </fieldset>
+      <fieldset>
+        <legend>Morning report</legend>
+        <p class="muted">One push a day: what waits for you, what failed or is down, what was updated since the last report.</p>
+        <div class="settings-row">
+          <label class="check">
+            <input type="checkbox" checked={settings.digestEnabled} onChange={(event) => set({ digestEnabled: (event.target as HTMLInputElement).checked })} /> Send the report
+          </label>
+          <TimeField label="At" value={settings.digestAt} onChange={(digestAt) => set({ digestAt })} />
+        </div>
+        <p class="muted">Last report: {lastDigestAt === null ? 'none yet' : formatInstant(lastDigestAt)}</p>
+      </fieldset>
+      <p class="muted">Times are in {timeZone}, like the schedules.</p>
+      {error === null ? null : <ErrorNote message={error} />}
+      <div class="actions">
+        <button type="submit" class="primary" disabled={saving}>
+          {saving ? 'Saving…' : 'Save'}
+        </button>
+      </div>
+    </form>
+  );
+}
+
+export function SettingsView() {
+  const { data, error } = useResource(() => api.notificationSettings(), []);
+  return (
+    <section>
+      <div class="page-head">
+        <div>
+          <h1>Settings</h1>
+          <p>How and when the app tells you what happened.</p>
+        </div>
+      </div>
+      <Card title="Notifications" icon="bell">
+        {error === null ? null : <ErrorNote message={error} />}
+        {data === null ? (error === null ? <Loading /> : null) : <NotificationsForm key={JSON.stringify(data.settings)} initial={data.settings} timeZone={data.timeZone} lastDigestAt={data.lastDigestAt} />}
+      </Card>
+    </section>
+  );
+}
Author	SHA1	Message	Date
homelab-updaterandClaude Opus 5.5	9045ee0b25	fix(deploy): keep VM103's disk from filling with images and build cache ci / check (push) Successful in 1m37s Details ci / publish (push) Skipped Details Every CI build and deploy left a 1.2 GB image of this app on the VM and the build cache kept growing, until the root disk was full and apt in CI failed. After a good deploy update.sh keeps the running image, the previous one and the three newest; the publish job prunes build cache older than two days. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-30 13:07:45 +02:00
homelab-updaterandClaude Opus 5.5	a2f289b4fb	feat(deploy): Keycloak login in front of the app, open beyond the LAN ci / check (push) Successful in 2m48s Details ci / publish (push) Successful in 2m46s Details An auth service (oauth2-proxy v7.15.4, pinned) answers Traefik's forwardAuth for every request: without a session the browser goes to Keycloak (realm home) and only the addresses in AUTH_ALLOWED_EMAILS get in; the LAN-only ipwhitelist goes. Secrets stay in .env on VM103 and compose refuses without them. update.sh now checks every service of the compose file after a deploy instead of a fixed list. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-30 12:31:29 +02:00
homelab-updaterandClaude Opus 5.5	fc68d30734	feat(web): relative times, a go-to palette and dry runs of all updates ci / check (push) Successful in 1m35s Details ci / publish (push) Successful in 1m22s Details Lists say "5 min ago" or "in 3 h" (full time on hover, refreshed each minute). Ctrl+K (or /, or the sidebar's Search) opens a palette that jumps to pages, apps, recent runs, workflows and functions. The apps page starts a dry run of every enabled app with an available update, after one confirmation, and says which were skipped. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-30 12:27:24 +02:00
homelab-updaterandClaude Opus 5.5	280d9dc0c9	feat(web): decide from the phone ci / check (push) Successful in 1m32s Details ci / publish (push) Skipped Details On a narrow screen the gate's decision buttons stick to the bottom while the owner reads the gate, larger and two per row; the decision card gets the window look. A web app manifest, icon and theme color let the app sit on the phone's home screen and open like an app. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-30 12:23:14 +02:00
homelab-updaterandClaude Opus 5.5	dbe9abeebf	feat: quiet hours and a morning report ci / check (push) Successful in 1m32s Details ci / publish (push) Successful in 1m25s Details Owner settings (quiet hours 01:00-07:30, report at 07:30, schedules' time zone) live in settings, with GET/PUT /api/notification-settings and a Settings page. In quiet hours the driver holds every push; once a day from the report time it pushes what waits for the owner, what failed or is down and what changed since the last report. The overview shows the same report on top. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-30 12:21:17 +02:00
homelab-updaterandClaude Opus 5.5	055e892f92	feat(web): an app's version history and apps that often need care ci / check (push) Successful in 1m30s Details ci / publish (push) Successful in 1m33s Details Real runs of an app become its history, newest first: updated from what to what, not updated (skipped, rolled back) or failed, with a repair by the model and the release notes verdict and summary of that run. An app with two or more such runs among its last ten gets a mark on its card. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-30 12:15:18 +02:00
homelab-updaterandClaude Opus 5.5	3798b8950d	feat: what runs on VM103 right now and the age of the VM backup ci / check (push) Successful in 1m31s Details ci / publish (push) Successful in 1m25s Details The driver looks once a minute: one docker ps of the compose containers (a GET through the read-only proxy) and the Proxmox timer's vzdump record. It keeps the latest look in settings; GET /api/host-status serves it. The overview shows how many enabled apps run well (which do not) and how old the newest VM backup is; app cards and the table get a dot for each app's container. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-30 12:12:53 +02:00
homelab-updaterandClaude Opus 5.5	dbb17ea5b9	feat(config): manage Trilium (TriliumNext) with a Sunday schedule ci / check (push) Successful in 1m40s Details ci / publish (push) Successful in 1m27s Details Auto stays at patch: on 0.x every minor migrates the database one way. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-30 12:01:54 +02:00
				`@@ -0,0 +1 @@`
				`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><defs><linearGradient id="g" x1="0" y1="0" x2="1" y2="1"><stop offset="0" stop-color="#7c9cff"/><stop offset="1" stop-color="#2dd4bf"/></linearGradient></defs><rect width="64" height="64" rx="14" fill="#0d1117"/><rect x="8" y="8" width="48" height="48" rx="12" fill="url(#g)"/><path d="M32 44V20M22 30l10-10 10 10" fill="none" stroke="#0d1117" stroke-width="5" stroke-linecap="round" stroke-linejoin="round"/></svg>`