diff --git a/.agents/skills/release/SKILL.md b/.agents/skills/release/SKILL.md
index 57b2e89..37619a2 100644
--- a/.agents/skills/release/SKILL.md
+++ b/.agents/skills/release/SKILL.md
@@ -159,6 +159,23 @@ node -e 'const f="package.json",fs=require("fs");const j=JSON.parse(fs.readFileS
 sed -i '' 's/^version = ".*"/version = "X.Y.Z"/' herdr-plugin.toml
 ```
 
+### Refresh the harness catalog
+
+```bash
+npm run catalog                # --check: boots one throwaway box per template, ~1 min, exit 2 on drift
+npm run catalog -- --write     # accept what the templates' CLIs now say; commit the result
+```
+
+The effort words and model ids each template accepts are read off the CLI IN the template
+(`docs/adr/0016`), and templates get rebuilt with newer CLIs between releases. A release
+should ship the catalog of the images it will boot, so run the check here; if it exits 2,
+run `--write`, read the diff of `src/harness-catalog.generated.js` and the `<catalog>`
+block in `config/config.example.toml` (a word gained or lost, a model added or retired,
+a version bump), and commit it with the version bump. Needs the E2B key and the agent
+credentials your `config.toml` already holds; the output names variables, never values,
+so it is safe to paste into the release notes. Exit 1 means a probe could not be trusted:
+the committed row is kept and marked stale, so it is not a blocker, but say so.
+
 ### Preflight, then tag
 
 ```bash
diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index c67c45b..e5447ab 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -70,12 +70,23 @@ Same base ref, N worktrees, N boxes — one per template on the **roster**. `fle
 never touches the E2B SDK; it drives **herdr** and then reuses `open` per member.
 
 1. **herdr** invokes the `fleet` action → `bin/e2b-fleet-open` → the pickers run in
-   a new, focused pane below the invoking pane (`bin/e2b-fleet`, no flags), because an action has no terminal.
+   the **popup** (`bin/e2b-popup --render` in `pick-fleet` mode, `bin/e2b-fleet` with
+   no flags inside it), because an action has no terminal; once the roster is
+   answered the same popup becomes the dashboard while the members provision. A
+   herdr that cannot open a popup gets the pickers in a pane below the invoking pane.
 2. Two screens (`lib/chooser.sh`): the **task slug** plus the optional **fleet
    task** (`ask_slug_tty`, which also carries the dirty-tree warning) and the
    **roster** (`ask_roster_tty`, the same menu `open` offers, `[fleet]
    default_roster` pre-ticked). Aborting either one creates nothing. With
    `--slug`, `-t` and `--task` given, both screens are skipped.
+   `--file PATH` (or stdin with `-`) and `--preset NAME` resolve a JSON fleet
+   specification through `src/fleet-spec.js` into those same arguments. Presets
+   live under the config directory's `presets/`; p / Shift+P fills the roster's
+   editable cells from a selected file. Filenames are listed with Bash so cached
+   paint stays immediate, and the selected JSON is read and validated on demand.
+   An optional preset task applies when no task was entered. CLI fields override
+   saved values. A preset describes a future launch, never a running fleet
+   (ADR 0018); the existing member naming and creation paths remain authoritative.
 3. `src/fleet-name.js` turns the slug + roster into one branch and label per member
    (`<prefix>/<slug>-<template>-<rand4>`). Bash never builds a ref name.
 4. Any member whose box will boot with no credential in it is named once, before
@@ -87,6 +98,13 @@ never touches the E2B SDK; it drives **herdr** and then reuses `open` per member
    does **not** move for fleet), then every member is spawned **concurrently** —
    `herdr worktree create` (unfocused, no `--path`, so the user's `[worktrees]`
    directory decides layout), then `herdr pane run <root pane> e2b-box open -t <t>`.
+6b. Before any member is spawned, one **pending placeholder** record per member is
+   written to the boxes dir (`<label>-pending`, status `pending`, the step it is
+   at), so the board that the pickers turn into shows the fleet while worktrees
+   and panes come up. Each placeholder is rewritten with the checkout path once
+   the worktree exists, and removed when the member's own record lands (a 60s
+   waiter), or when the member fails. The dashboard refuses every verb but kill on
+   a `pending` row.
 7. Per member, once its box's sandbox shell appears: `src/fleet-seed.js` hands over
    one shell command that writes the agent's **first-run state** inside the box
    (`~/.claude.json`, `~/.codex/auth.json`) so it comes up at a prompt rather than a
@@ -194,15 +212,17 @@ guide, with a CI example, is [docs/headless-run.md](docs/headless-run.md).
 | File | Responsibility |
 | --- | --- |
 | `e2b-box` | The CLI. Subcommands `open/up/shell/status/list/url/logs/sync/pull/exec/run/pause/resume/kill/doctor/auth`, plus `--template` on the creating verbs. Key derivation, optimistic connect, `spin_until_ready`, `connect_shell`, template selection (`pick_template`; the chooser itself lives in `lib/chooser.sh`), disconnect + on-close prompts, `pull` safety gate. The `run` verb (headless, #47) composes the others in order, `provision_from_cwd … sync`, `exec` for the task file and then the agent, `pull` via a child `e2b-box pull`, `sdk_kill`, and owns nothing new but the order, the `status` vocabulary and the exit code. |
-| `e2b-box-open` | The `open` keybinding/action: opens the template picker and sandbox shell in a new, focused pane below the invoking pane. A herdr action has no terminal of its own, so it can host neither the shell nor the chooser. |
+| `e2b-box-open` | The `open` keybinding/action, and the hand-off every picker makes. As the action: opens the **popup** immediately in `pick-box` mode (template · model · effort, centered); the popup resolves whether to ask or hand off to a focused pane below the invoking pane. With flags (`--target-pane`, `--placement`, `--cwd`, `--box`, `--template`, `--reasoning`, `--model`) it is the hand-off: the popup dashboard and the popup picker call it to open the box in a regular pane under the pane the popup floats over, the picks travelling as `E2B_TEMPLATE` / `E2B_REASONING` / `E2B_MODEL`. A herdr action has no terminal of its own, so it can host neither the shell nor the chooser; the overlay is for choosing, never for running. |
 | `e2b-fleet` | The fleet verb: one base ref → N members, one per roster template. Two ways in — bare (two picker screens, then the board) and `create <slug>` (flags only; `-s`, `--agents a,b,c` / `all`, `--task`) — dedupe, the roster spell-check against `resolve-template.js --known` (`--force` overrides), the `--dry-run` plan, the herdr-version probe, concurrent spawn (background jobs + per-member result files), the per-member first-run seeding + agent auto-start + fleet-task delivery (`set_seed_argv` / `set_agent_argv` / `set_rename_argv` / `set_prompt_argv` — the plan and the real call share every builder, so they cannot drift), the `N/M up` summary. Also the `kill` verb: the branch glob, the conservative teardown, the kept-branch report. Drives herdr's socket API only — never the E2B SDK. |
-| `e2b-fleet-open` | The `fleet` keybinding/action: opens the fleet pickers and subsequent dashboard in a new, focused pane below the invoking pane. |
+| `e2b-fleet-open` | The `fleet` keybinding/action: opens the fleet pickers in the popup (`pick-fleet` mode), which becomes the dashboard once the roster is answered; falls back to a pane below the invoking pane when no popup can be opened. |
 | `e2b-dash` | Launcher for the Rust dashboard: resolves the prebuilt/built binary, guards on a TTY, execs it immediately. Its `--settings` helper supplies theme, opener, and region to a background TUI task. |
-| `e2b-popup` | Opens the titled `popup` entrypoint with Herdr's `popup` placement, leaving the underlying pane layout intact. The entrypoint uses `--render` to exec the dashboard with plugin config/credential precedence. The project name and GitHub icon live in the popup border, and its dashboard header shows only the count and region. Both launch paths mark the disposable popup PTY with `E2B_DASH_POPUP=1`; the TUI consumes that marker and on a clean exit leaves its last screen/cursor intact until Herdr removes the popup. Ordinary panes and inline shell handoffs still restore their terminals. |
+| `e2b-popup` | Opens the titled `popup` entrypoint with Herdr's `popup` placement, leaving the underlying pane layout intact (`pane_open_popup` in `lib/pane.sh`, which also carries the origin pane and the worktree). `--render` runs inside it and dispatches on `E2B_POPUP_MODE`: `dashboard` execs the board; `pick-box` paints cached chooser arguments centered (`CHOOSER_CENTER=1`) before starting a background `e2b-box pick` refresh, then hands the fresh answer to `e2b-box-open` for a pane under the origin and exits, which closes the popup; `pick-fleet` paints the cached slug screen immediately while `e2b-box fleet` refreshes both screens, then passes the slug, task and roster through the normal fleet flags to the board. Missing or malformed caches use the original CLI picker path. A settled box or `E2B_TEMPLATE` skips the cached picker; other settled decisions close it when the resolver answers. The dashboard mode keeps plugin config/credential precedence. The project name and GitHub icon live in the popup border, and its dashboard header shows only the count and region. Both launch paths mark the disposable popup PTY with `E2B_DASH_POPUP=1`; the TUI consumes that marker and on a clean exit leaves its last screen/cursor intact until Herdr removes the popup. Ordinary panes and inline shell handoffs still restore their terminals. |
 | `e2b-bench` | Launcher for the grader, thin on purpose: finds the binary and resolves the credentials the same way every other verb does, then execs it. No TTY guard — a grade is a report meant to be piped and run from CI. |
 | `teardown-worktree` | `worktree.removed` handler — kills the box for the removed path (matched by stored `worktreePath`). |
 | `lib/paths.sh` | Shared helpers: state-dir resolution, `e2b_node` (find Node ≥22), `ensure_e2b_path`/`ensure_e2b_key`, `sdk_kill`, `box_key`. |
-| `lib/chooser.sh` | The full-screen pickers. `ask_template_tty` — one template for one box: arrows/`j`/`k`, number-jump, enter, `q` takes the default; an optional fifth argument carries one **auth mark** per row (what `e2b-box auth` discovered, drawn dimmed beside the name), which annotates and never filters — no row is hidden or reordered by it. `ask_slug_tty` — one line of text, with a caller-supplied validator function (so ref rules stay in `src/fleet-name.js`), esc aborts; asked for a third argument it also draws the optional **fleet task** field (tab/arrows switch, enter always launches) and prints slug and task as two lines.  `ask_roster_tty` — the multi-select roster: space toggles, number toggles, enter launches, an empty roster can't, `q`/esc abort. Self-contained bash — no state dir, no node — so any verb can source it. Finds the human in two steps: `/dev/tty`, else duplicated stdin (a herdr pane may run on a pty that isn't the controlling terminal). |
+| `e2b-picker-warm` | Resolves both picker inputs for each restored pane cwd through the existing CLIs, with inherited box pins cleared. Herdr runs it asynchronously on startup (0.7.5+) and workspace creation; installation also starts it detached because enabling or linking a plugin does not rerun startup hooks. It opens no panes and provisions nothing. |
+| `lib/picker-cache.sh` | One NUL-delimited argument snapshot per absolute worktree cwd under `$STATE_DIR/pickers`, shared by the box and fleet pickers. The owners write it atomically; popup refresh results use a private temporary directory. Every cached opening recomputes through the existing CLI, so config/catalog edits, branch rules, auth results and live records are re-read before confirmation. No cached answer is stored or launched (ADR 0017). |
+| `lib/chooser.sh` | The full-screen pickers, still independent of Node and state paths. An optional caller-owned callback first runs after painting, then is polled every 50 ms while refreshing (one second on Bash 3.2). Changed arguments redraw in place and require a fresh confirmation; slug edits survive a note refresh. Confirmation stays pending during refresh so Escape can always cancel it. Popup Escape consumes only queued sequence bytes, avoiding a timer while preserving arrows and Shift-Tab; ordinary terminals use a short escape window. Without a callback the existing keys and idle timeouts remain unchanged. `ask_template_tty` — one template for one box: arrows/`j`/`k`, number-jump, enter, `q` aborts; an optional fifth argument carries one **auth mark** per row (what `e2b-box auth` discovered, drawn dimmed beside the name), which annotates and never filters — no row is hidden or reordered by it; an optional sixth carries the **effort rows** `src/effort.js` prints (`template|kind|values|configured|via`, `|`-separated because bash's `read` folds an empty tab field into its neighbour), which add an effort cell per row, and, from fields six and seven (`models|configured model`, the harness catalog in `src/harness-catalog.generated.js` where the pin has a route), a model cell between the template and the effort; a cell is plain text, reverse video alone marks the focused one. Focus is a CELL: →/tab and ←/shift-tab move columns (a column no row has is skipped, `col_step`; off a row's last cell →/tab lands on the next row's first column, and off a row's first column ←/shift-tab lands on the row above's last cell, `col_last`, both wrapping), ↑/↓ rows; enter on a cell unfolds that row's list as a DROPDOWN right under the row, starting at the cell's column and pushing the rows below down (↑/↓, enter takes, esc keeps, a number picks; a model list is windowed to 14 rows since prime lists 104), and taking or leaving a value keeps the focus on that cell. The answer is `<template>[\t<effort>[\t<model>]]`, tabs only as far as something was chosen (the effort field `-` when only a model was, since bash's `read` folds an empty tab field), so callers without the columns read what they always did. Frames are built in one string and written with one `printf` (home + erase-to-eol per line + erase-below), never a clear, so nothing flashes. `ask_slug_tty` — one line of text, with a caller-supplied validator function (so ref rules stay in `src/fleet-name.js`), esc aborts; asked for a third argument it also draws the optional **fleet task** field (tab/arrows switch, enter always launches) and prints slug and task as two lines.  `ask_roster_tty` — the roster TABLE with four columns (template · model · effort · count): space toggles, number toggles, `+`/`-` the member count, `s` ticks, grows to two if needed and unfolds one nested row per instance with its own model and effort cells (cursor on #1's first cell; `s` again folds); enter on the template or count column launches, on a model or effort cell opens its list; prints one line per MEMBER in the same `<template>[\t<effort>[\t<model>]]` shape, an empty roster can't launch, `q`/esc abort. Same optional effort-rows argument as the single picker. Self-contained bash — no state dir, no node — so any verb can source it. Finds the human in two steps: `/dev/tty`, else duplicated stdin (a herdr pane may run on a pty that isn't the controlling terminal). |
 | `lib/pane.sh` | Pane plumbing shared by the action launchers: `pane_open_below` anchors box/fleet splits to the invocation context, plus `pane_herdr`, `pane_node`, `pane_query`, `pane_procs`, `pane_is_idle` (fails safe — unknown counts as busy). |
 
 ### Data plane — `src/` (ESM, uses `e2b` + `@iarna/toml`)
@@ -227,6 +247,9 @@ guide, with a CI example, is [docs/headless-run.md](docs/headless-run.md).
 | `harness-probe.js` | The impure half of the above: spawns the probes for all eight harnesses concurrently with a 5s ceiling, `shell: false` (so a shell function cannot answer for the binary) and stdin on `/dev/null` (one harness with no key opens a browser and blocks forever), then formats one row per harness. Read-only — it never writes. |
 | `harness-auth.js` | `e2b-box auth` itself: probe, show, ask **once** for the whole batch, write. `buildPlan` turns probe rows into what will be kept and is pure given its file reader; `renderAuthToml` and `formatPlan` are pure; only `writeAuthFile` touches disk. It writes a GENERATED `auth.toml` beside `config.toml` at mode `0600`, regenerated whole on every run, and never touches `config.toml` — one writer each is what makes "hand-written always wins" true. ADR 0009's split lives here: a value read out of a **file** is stored, a value seen only in the **shell** records the variable's NAME and nothing else. Missing credentials are reported and never prompted for; `--yes` skips the question, and no terminal plus no flag writes nothing. It also warns when a variable it recorded by NAME is invisible to a login shell (`invisibleToLoginShell`, one `bash -lc` for the whole batch, names only in both directions) — herdr launches plugin commands from one, so a key exported from a zsh rc is found here and absent at create time. Two entry points, one implementation: the verb a user types, and `install.sh`'s `harness_discovery` on first run — the installer shells out to the very same subcommand with `--yes` (a build step has no TTY), indents its report, and treats any failure as a report rather than a failed install. |
 | `run-agent.js` | The headless agent table `e2b-box run` drives a box with: `DEFAULT_RUN_AGENTS` (template → that vendor's verified **non-interactive** command, `claude -p`, `codex exec`, `opencode run`, `amp -x`, each with its skip-approvals flag, each reading the task from `TASK_FILE` inside the box, never from argv) and `runCommand` (`[run.agents]` over those, by key presence, so `""` means "no headless agent"). Kept apart from `fleetAgents` on purpose: the interactive command for a template is not a flag away from its headless one. All eight shipped agent templates have one; `base` and a user's own template have no default and `run` refuses them by name. Also the CLI bash calls (`<template>`, `--task-path`, `--shipped`). |
+| `effort.js` | Which words each harness accepts for "how hard to think" and which models it lists, DERIVED from `harness-catalog.generated.js` plus a hand-written overlay: `kind` (native / generic), `via` (how the pin travels), the words the picker declines to offer (droid's `none`/`dynamic`), amp's scale being its `--mode` list, and a GENERIC scale for opencode, whose reasoning is a per-model UI variant. `harnessHint` resolves a template to its harness by name or by the binary its `[fleet.agents]` command runs, so a custom template gets its harness's scale and variables. `effortRows` is what the pickers draw; `validEffort` is what `provision.js` checks a `--reasoning` against before a box is created; `modelCatalog` and `effortsForModel` are the per-model answers (droid coerces an effort its model lacks to the default at exit 0, so the plugin-side check is the only one). The CLI (`node src/effort-cli.js --fleet`) is how bash reads the rows. |
+| `catalog.js` | How each harness's CLI is asked what it accepts: `CATALOG_PROBES` (per harness, the shell lines or URL to run in its template and the pure rule that reads their output: the rejection message that lists effort words, the command, cache or handshake that lists models) and `interpretCatalog`, which reads probe RESULTS and never spawns or fetches, so every rule is testable from `test/fixtures/catalog/` with no CLI installed. `mergeCatalog` keeps a committed row when its probe fails (marked `stale`), `diffRow` says what moved, `renderGeneratedModule` / `renderTomlBlock` / `spliceTomlBlock` write the two generated artifacts as text. Bounded by ADR 0016: the box's binary is the oracle, a laptop's is not. |
+| `harness-catalog.generated.js` | GENERATED, committed, never hand-edited: per harness the CLI version that answered, the template build it was read from, its effort words (amp: modes), and its model ids with each model's own efforts and default where the CLI says so. Written by `scripts/harness-catalog.mjs` (`npm run catalog -- --write`, one throwaway sandbox per template; `--from=fixture` replays the captured output; `--check`, the default, exits 2 on drift). `test/catalog.test.js` proves the fixtures still produce this exact file and that `config.example.toml` carries the rendered `<catalog>` block. |
 | `model-pin.js` | `[templates.<name>] model` / `reasoning`, delivered the way each harness reads its defaults: `modelEnv` (the variables for the env-route harnesses, claude and opencode, plus `HERDR_E2B_MODEL` / `HERDR_E2B_REASONING` on every pinned box) and `pinCommand` (one-line commands that write the file-route harnesses' own config: codex `config.toml`, grok `[models]`, droid and prime `settings.json`, muse `reasoning_effort`). Same rules as the seeds: one line, variable names never values, never overwrite a key that is set. `resolveEnv` merges the env below the user's own table; `provision.js` runs the command right after the seed. Pure, and the commands are executed by `test/model-pin.test.js` against fake homes. |
 | `fleet-seed.js` | The first-run state a member's agent needs before it will work instead of asking questions: `DEFAULT_SEEDS` (the verified `~/.claude.json` / `~/.codex/auth.json` shapes, as one-line POSIX sh) and `seedCommand` (`[fleet.seed]` over those, by key presence, so `""` means "seed nothing"). The shell lives here rather than in bash so `node --test` can execute it. Every command names the credential's **variable**, computes what it needs (Claude approves a key by its last 20 characters) inside the box, and refuses to overwrite a file that already exists. |
 
@@ -253,11 +276,29 @@ dashboard, and has **no prebuilt** — it needs the Rust toolchain.
 
 ## State model — one JSON record per box
 
+### Fleet specifications and presets
+
+Fleet specifications are parsed by `src/fleet-spec.js`: strict JSON fields become
+member specs, model and reasoning pins are checked against the current catalog,
+and preset names resolve only beneath `$CONFIG_DIR/presets`. `bin/e2b-fleet`
+applies explicit CLI overrides before its normal plan. The chooser takes preset
+names and a caller-owned loader returning display task text and member rows,
+then emits the selected preset name alongside the edited members. It reads no
+config itself. Preset files are user configuration, separate from box records.
+
 ### Named coding-agent connections
 
 `src/auth-cli.js` handles `auth connect/list/explain/check/reconnect/disconnect`.
 `src/connections.js` owns metadata, private credential storage, account classification,
-selection, and the two delivery adapters. `src/config-paths.js` shares config locations
+selection, and the delivery adapters (`setup-token`, `borrowed-session`, `oauth`).
+`src/oauth.js` is the plugin's OWN sign-in (ADR 0015): muse's Meta device flow,
+codex's PKCE flow with its own client id, the refresh grant only `auth reconnect`
+uses, and amp's open-the-page-and-paste (its token is gated behind a browser
+re-check, measured there). What it stores is what the vendor mints — a Muse API key,
+an amp access token, a plugin-owned codex `auth.json` — never a session a box would
+have to keep alive. Written against injectable `fetch`/`open`/`sleep`, so
+`test/oauth.test.js` drives every flow against a scripted server; no test signs in
+anywhere. `src/config-paths.js` shares config locations
 with discovery without introducing an import cycle. `bin/lib/capture-setup-token.py`
 is the optional Python PTY bridge to the first-party Claude CLI; it returns the token
 on a private pipe and redacts it from displayed output.
@@ -296,7 +337,13 @@ idle timeout, which the close-time messages read instead of the current config),
 drawn size, written by `attach.js`; what `attach-plan.js` decides reattach from).
 Writes are atomic so a concurrent poll never reads a half-written file.
 
-Grading adds the one other thing on disk: `$STATE_DIR/bench/<slug>/` with a
+Picker inputs also live under `$STATE_DIR/pickers`: a `d-`-prefixed directory per
+absolute cwd component ending in `input`, so lookup needs only bash and a checkout
+named `input` cannot collide with its parent. The header carries the normal box key;
+the remaining fields are the two pickers' arguments, including auth marks and fleet
+default roster. This is disposable appearance, never a box record or fleet membership.
+
+Grading adds another artifact on disk: `$STATE_DIR/bench/<slug>/` with a
 `run.json` (task, grade command, base ref, start) and one `<box-key>.json` per
 member (verdict, exit code, duration, output tails). Same one-file-per-member
 shape and the same reasons as the box records. A verdict is *history* — it is not
@@ -342,6 +389,11 @@ fleet still isn't (`docs/adr/0005`). The member list is never stored.
   credential found only in the shell is recorded by NAME and forwarded at create
   time, so no new plaintext copy of it exists (ADR 0009). Covered by
   `test/config.test.js`.
+- **Cached picker input is appearance, never launch authority.** Every cached
+  opening re-resolves, including changes to config/catalog mtimes, branch rules and
+  auth results. An early confirmation waits for that result; changed rows require
+  confirmation again. The normal handoff still validates model and effort pins
+  against the current catalog before creating a sandbox. See ADR 0017.
 - **The picker annotates, never filters.** An auth mark changes what a template row
   *says* and never whether it is offered, where it sits, or what the picker returns
   — hiding a template with no credential would remove one the user may intend to
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6b12086..1e86b23 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,120 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+### Fleet presets
+
+- Launch a generated JSON fleet with `fleet create --file PATH` (or `-` for stdin).
+  Named recipes in `presets/` beside config.toml work with `--preset NAME` and are
+  listed by `fleet presets`. Each saves templates, models, reasoning, counts and
+  an optional slug/task. CLI flags override saved values; `--dry-run` validates.
+- In the fleet roster, p / Shift+P applies saved presets to editable cells before
+  launch. Cached startup and existing navigation remain unchanged. ADR 0018.
+
+### Performance
+
+- Warm both picker caches in the background at startup, after installation and
+  when a workspace opens, so the first opening can use the cached frame too.
+- Escape closes picker popups immediately and still dismisses a dropdown in
+  place. An Enter pressed during refresh can be cancelled with Escape; it no
+  longer blocks on the resolver. Shift+Tab moves backward through cells and
+  fleet text fields without closing the popup.
+- Box and fleet popup pickers paint their cached input before starting Node, then
+  refresh the rows in place. Every reopen resolves current config, catalog, branch
+  and auth input before accepting a choice. Cold openings keep the existing picker
+  path, with the cache write running alongside the first frame. ADR 0017.
+
+### Added
+
+- **The harness catalog is generated, not typed.** `npm run catalog -- --write` boots
+  one throwaway sandbox per shipped agent template, asks the CLI in it which effort
+  words it accepts (its own rejection message, fed a sentinel) and which models it
+  lists (`codex debug models --bundled`, droid's `initialize_session` handshake,
+  grok's cache, amp's agent options, `prime-agent model list`; models.dev for
+  claude), and writes what it read into `src/harness-catalog.generated.js`, the
+  `<catalog>` block in `config/config.example.toml`, and `test/fixtures/catalog/`.
+  `src/effort.js` now derives every scale from that module instead of holding
+  literals: the two hand-kept copies had already drifted from each other (codex
+  `minimal` in one, `max` in the other; droid seven words against nine) and from
+  the boxes, which ship different CLI versions than a laptop. Per-model efforts and
+  defaults are carried too (`modelCatalog`, `effortsForModel`), which is the only
+  check that exists for droid, whose CLI accepts any of its words and silently runs
+  the model's default. `--check` (the default) exits 2 on drift; a failed probe keeps
+  the committed row and marks it stale, never blanks it; no credential is ever on a
+  command line. The release skill runs it before tagging. ADR 0016.
+- **A model cell in both pickers.** `e2b-box open`'s template list and the fleet's
+  roster table gain a model cell between the template and the effort, listing
+  the catalog for every harness the plugin can pin a model on (claude, codex, grok,
+  droid, prime); a long list scrolls, `s` in the roster gives each instance its own
+  model, and the cell opens on `[templates.<name>] model`. The same choice from a
+  script: `e2b-box open --model claude-opus-5` and the fleet spec
+  `NAME[:MODEL][*N][@EFFORT]` (`claude:claude-opus-5*2`). A per-box model is checked
+  against the catalog before anything is created, and a per-box effort against
+  that model's own list, which is the only check that exists for droid.
+- **The pickers live in the popup.** The `open` and `fleet` actions put their
+  questions in the same floating overlay the dashboard uses, centered: template,
+  model and effort for one box; slug, task and roster for a fleet. The overlay is
+  for choosing, never for running: `open` closes it and boots the box in a pane
+  below the pane you pressed the key in (`e2b-box pick`, `e2b-box-open`'s
+  `--template/--reasoning/--model` hand-off, `E2B_TEMPLATE` / `E2B_REASONING` /
+  `E2B_MODEL`), and `fleet` turns it into the dashboard while the members
+  provision. Tab now walks every cell and then on to the next row, and shift-tab
+  (or ←) walks the same path backwards, off a row's first column onto the last cell
+  of the row above; taking or leaving a cell's list keeps the focus on that cell,
+  so what just changed is what is highlighted (←/shift-tab back to the template
+  column, then enter). Cells are plain text, reverse video alone marks the focused
+  one (the ‹ › chevrons are gone), the roster's column titles sit over their cells
+  and the member count's title is `count`, and a cell's list unfolds as a dropdown
+  right under its row at the cell's column, pushing the rows below down, instead
+  of at the foot of the table. Like the dashboard, the overlay's first frame is the
+  screen itself: nothing is drawn ahead of the picker, the frame's centering is
+  sticky so an opened list never shifts the table, and a box whose template is
+  already settled hands off without drawing a picker.
+- **A fleet shows on the board before its boxes exist.** e2b-fleet writes a
+  `pending` placeholder record per member the moment the plan is final (creating
+  its worktree, then starting its box), so the dashboard the fleet pickers turn
+  into is never empty while worktrees and panes come up. The placeholder leaves
+  when the member's own record lands, when the member fails, or after 60s at most;
+  the dashboard refuses every verb on it but kill.
+
+### Fixed
+
+- `src/harnesses.js` cited ADR 0006 (region is sugar over domain) for the
+  spawn-the-binary rule; that rule is ADR 0009.
+
+- A fleet of all eight shipped agents came up with five members broken (observed
+  live, fleet `test`, 2026-09-08); each fix is the one its harness asked for:
+  - **opencode** opened on an image model with no tool use even though
+    `[templates.opencode] model` was set: the TUI only picks a model it can find in
+    the provider's list, and on a fresh box that list is the snapshot bundled into
+    the binary until models.dev is fetched, so a model newer than the template was
+    unknown at the first launch. The pin now also declares the model under its
+    provider in `OPENCODE_CONFIG_CONTENT`, so it exists fetch or no fetch.
+  - **amp** borrowed the OAuth session `amp login` leaves in `secrets.json` and
+    booted a member amp refuses ("holds an OAuth session token, which is
+    short-lived"). A JWT under `apiKey@…` is no longer read as a key; the member is
+    named before the fleet is created, with the remedy: an access token from
+    ampcode.com/settings/security in `AMP_API_KEY`. Not borrowed the way grok's
+    session is, on purpose: amp's bearer lives five minutes and its refresh token
+    rotates-invalidates, measured in ADR 0014.
+  - **droid** opened on "Auto (Off) · all actions require approval": the
+    interactive `droid` takes its Autonomy Level from settings.json, not from a
+    flag (`--auto` belongs to `droid exec`). The droid seed now also writes
+    `sessionDefaultSettings.autonomyLevel = "high"` when nothing set it, the
+    unattended default claude and codex members already get.
+  - A fleet named an **opencode** member as "will start unauthenticated" and then
+    booted it signed in: opencode forwards a whole auth.json under its box variable
+    and has no host variable, so the pre-flight check never looked at the one
+    variable it actually had.
+  - **grok** rejected `reasoning = "max"` ("Invalid reasoning effort"): grok 1.0.13
+    accepts `low | medium | high | xhigh`. The example config says so; `max` was
+    never on its scale.
+  - **claude** and **codex** failed on their pinned models ("does not support this
+    model; version 2.1.251 or newer is required", "requires a newer version of
+    Codex"): not this plugin, stale EU template images. Rebuilt on juliett with
+    Claude Code 2.1.265 and codex 0.153.4. Worth knowing: the public agent
+    templates go stale on a cluster, and a model pin is the first thing that
+    notices.
+
 ### Changed
 
 - The shipped default template is `muse` (Meta's Muse Code), not `base`: a new box
@@ -18,6 +132,32 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Added
 
+- The pickers choose **effort** and **how many**. `e2b-box open`'s template list
+  grew a ‹ effort › cell per row (→/tab focuses it, enter opens the harness's own
+  words as a list from `src/effort.js`; it opens on the `[templates.<name>]
+  reasoning` pin), and the fleet's roster is now a table: in or out, effort, count,
+  with `s` unfolding one row per instance so members of one template can think
+  differently. Both pickers redraw in place instead of clearing the screen, so
+  moving the cursor no longer flashes. From a
+  script: `e2b-box open -t grok --reasoning xhigh`, and fleet member specs
+  `NAME[*N][@EFFORT]` (`-t 'codex*3@ultra'`, `--agents codex*3@ultra,grok@xhigh`).
+  A repeated `-t codex` is two members now, not one: instances get numbered labels
+  and branches (`t-21-codex-2`). An effort the harness does not accept fails the
+  box before it is created, naming the accepted words. opencode gets a generic
+  scale that only reaches the box as `HERDR_E2B_REASONING` (its reasoning is a
+  per-model UI variant); amp's picked effort becomes its `--mode`.
+
+- `e2b-box auth connect muse | amp`, and `auth connect codex --oauth`: the plugin
+  signs in with the vendor's own OAuth flow (the public client its CLI ships) and
+  stores what the vendor mints as a connection under `connections/` (ADR 0015).
+  muse keeps the Muse API key Meta mints; codex keeps a second, plugin-owned
+  ChatGPT login whose refresh token only `auth reconnect` ever uses, so boxes still
+  get the placeholder copy and `~/.codex` is never touched. amp has no OAuth route
+  (its access token sits behind a recent-sign-in gate in the browser, measured), so
+  `auth connect amp` opens ampcode.com/settings/security and stores the token you
+  paste (`--token-stdin` for scripts). Flows in `src/oauth.js`, tested against a
+  scripted server; nothing in the suite signs in anywhere.
+
 - `[templates.<name>] model = "…"` and `reasoning = "…"`: pin which model a
   template's agent uses and how hard it thinks, for every box booted from it
   (`open`, `fleet`, `run`). Delivered the way each harness reads its defaults
diff --git a/CONTEXT.md b/CONTEXT.md
index 91cfab8..9f36636 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -49,6 +49,16 @@ box booted from the matching template comes up authenticated instead of on a sig
 screen. A harness is local and yours; a template is remote and E2B's.
 _Avoid_: Local agent, toolchain, credential source
 
+**Catalog**:
+What a harness's CLI accepts, read off the binary shipped in its template: the effort
+words a pin may say (its **scale**), and the model ids it lists, each with the efforts
+it takes and the one it starts at. Generated by asking the CLI in a box and committed
+(`src/harness-catalog.generated.js`); never typed from a laptop, whose CLI is a
+different version. The plugin's **overlay** on top of it (how a pin travels, which words
+the picker declines to offer) is hand-written and stays in `src/effort.js`.
+_Avoid_: Model list, registry (models.dev is one; the catalog is what the CLI says),
+supported models (implies the plugin decided)
+
 **Discovered value**:
 A credential `e2b-box auth` found on this machine and wrote to the generated
 `auth.toml`. It is merged *under* everything in `config.toml`, so it is a default
@@ -58,13 +68,15 @@ _Avoid_: Detected key, auto-config, inherited credential
 
 **Discovered session**:
 A subscription login the plugin borrowed out of a harness's own config file rather
-than a pasted key — today only Codex's `~/.codex/auth.json` under
-`auth_mode = "chatgpt"`. Unlike a *discovered value* it **expires**, and unlike every
-other discovered thing it outranks the user's own `[templates.<name>.env]`
-(ADR 0010), because the machine's live session beats a key typed months ago. Its
-single-use refresh token is never copied — a visible placeholder goes in its place, so
-a borrowed copy can never revoke the login it came from. A session held in the OS
-credential store is not borrowable at all.
+than a pasted key — Codex's `~/.codex/auth.json` under `auth_mode = "chatgpt"` and
+grok's `~/.grok/auth.json` (ADR 0011). Unlike a *discovered value* it **expires**,
+and unlike every other discovered thing it outranks the user's own
+`[templates.<name>.env]` (ADR 0010), because the machine's live session beats a key
+typed months ago. A single-use refresh token is never copied — a visible placeholder
+goes in its place, so a borrowed copy can never revoke the login it came from; only a
+refresh token measured multi-use travels whole (grok). A session held in the OS
+credential store is not borrowable at all, and neither is one whose bearer is too
+short to outlive a task and whose refresh token rotates (amp, ADR 0014).
 _Avoid_: OAuth key, subscription token, borrowed login
 
 **Forwarded variable**:
@@ -159,12 +171,21 @@ The short human-written name that identifies a fleet — the part of a member's
 name that says what the fleet is *for*, shared by every member.
 
 **Roster**:
-The templates chosen for one fleet, one member each. Picked per fleet; a template
-appears in a roster at most once, and no two of them may name the same member — a
-member is named after its template's last segment, so `ondrejs-project/amp` and
-`mpp/amp` would both claim one name.
+The members chosen for one fleet, with their templates, model and reasoning pins.
+A template may supply several members, numbered in their labels. Distinct templates
+must not claim the same label: `ondrejs-project/amp` and `mpp/amp` would both claim
+`amp`, because labels use the template's last segment.
 
 **Fleet task**:
 The instruction handed to every member's agent at launch, identical for all of them.
 Optional — a fleet with no task is just several ready boxes.
 _Avoid_: Prompt, brief, job
+
+**Fleet specification**:
+A JSON description of a future launch: members with template, model, reasoning
+and count, plus an optional task slug and fleet task. It becomes the same launch
+arguments as the CLI flags and is never a record of a running fleet.
+
+**Fleet preset**:
+A named fleet specification saved under the plugin config directory's `presets/`.
+Reusable from the CLI or applied to the roster picker for review and editing.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 01eba50..cc62ab0 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -28,6 +28,17 @@ layers, the data flow, the state model, and the invariants worth checking).
   `auth.toml` reader and the loader test that proves a box boots from it, which
   writes a fixture under the OS temp dir and spawns one child `node` — never the
   developer's own config.
+- `test/catalog.test.js`: the harness catalog (`interpretCatalog`) from
+  `test/fixtures/catalog/`, output captured off the CLI in each E2B template, and the
+  guard that `src/harness-catalog.generated.js` and the `<catalog>` block in
+  `config/config.example.toml` are exactly what those fixtures render to. When it
+  fails after a parse-rule change, rerun
+  `node scripts/harness-catalog.mjs --from=fixture --write`; when the WORLD changed
+  (a template rebuilt with a newer CLI, a new model), `npm run catalog -- --write`
+  boots one throwaway sandbox per template, re-reads every row and refreshes all three
+  (see `docs/adr/0016`). `--check` (the default) exits 2 on drift and writes nothing;
+  a probe that fails keeps the committed row and marks it stale rather than blanking
+  it. Run it before a release; `.claude/skills/release` does.
 - `test/cli.test.sh` — `bash -n` / `node --check` lint across the scripts, plus
   offline `e2b-box` behavior (the `no sandbox tracked` messages and the
   non-interactive `pull` abort-without-clobber path). The template picker's auth
diff --git a/README.md b/README.md
index 5ba51ed..8089274 100644
--- a/README.md
+++ b/README.md
@@ -72,6 +72,9 @@ For a named connection you explicitly choose for new boxes:
 ```sh
 e2b-box auth connect claude --name work     # browser approval, token captured privately
 e2b-box auth connect codex                  # borrow your local subscription session
+e2b-box auth connect muse                   # sign in with Meta; the Muse API key it mints is stored
+e2b-box auth connect amp                    # opens amp's Security page; paste its access token, stored privately
+e2b-box auth connect codex --oauth          # a second ChatGPT login owned by the plugin (ADR 0015)
 e2b-box auth list
 e2b-box auth explain --template claude
 e2b-box up -t claude --connection work
@@ -230,7 +233,7 @@ Three things follow from a fleet member being unattended:
   `[fleet.agents]`; `""` means "plain shell, start nothing".
 - **First-run state is seeded** just before the agent is typed, so a member
   arrives at a prompt instead of a welcome wizard — `~/.claude.json`,
-  `~/.codex/auth.json`, droid's trusted folders, opencode's autoupdate. The
+  `~/.codex/auth.json`, droid's trusted folders and default autonomy, opencode's autoupdate. The
   command sent to the pane names the **variable**, never its value, so nothing
   secret lands in the scrollback. Shipped for `claude`, `codex`, `droid` and
   `opencode`; add your own with `[fleet.seed]`.
@@ -245,19 +248,44 @@ either, you get the chooser:
 ```
   E2B template for my-worktree
 
-   ▸ [1] muse                     default
-     [2] claude
-     [3] codex
-     [4] opencode
-     [5] amp
-     [6] grok
-     [7] droid
-     [8] prime
+   ▸ [1] muse                      high         default
+     [2] claude                    high
+     [3] codex                     ultra
+     [4] opencode                  default      (pick in opencode's UI)
+     [5] amp                       ultra
+     [6] grok                      xhigh
+     [7] droid                     max
+     [8] prime                     max
      [9] base
 
-  ↑/↓ · j/k move   enter confirm   number jumps   t type a name   q default
+  ↑/↓ move   →/tab effort column   enter confirm (on the effort cell: its list)   number jumps   t type a name   q/esc abort
 ```
 
+The next two cells are **which model that box's agent runs** and **how hard it
+thinks**, both in the harness's own words: `src/effort.js` reads the model list and
+the effort scale off `src/harness-catalog.generated.js`, which
+`npm run catalog -- --write` reads off the CLI in each template. Focus is a cell:
+→/tab moves it onto the model column, then the effort column; enter on a cell opens
+the row's list (↑/↓ choose, enter takes, esc keeps; a long model list scrolls), and
+the focus stays on the cell you just set, so what changed is what is highlighted;
+←/shift-tab back to the template column and enter confirms. `default`
+leaves the `[templates.<name>] model` / `reasoning` pin or the harness default
+alone; a cell opens on its pin when there is one. A model cell appears only where
+the plugin can deliver the pick (claude, codex, grok, droid, prime); amp has no model
+setting and opencode's universe is all of models.dev, so those rows have none.
+The screen redraws in place, never clears, so moving around does not flash. From
+the `open` keybinding the picker appears in the popup, centered; enter closes it and
+boots the box in a pane below the one you pressed the key in. Tab walks every cell
+and then the next row, and shift-tab walks the same path backwards (off a row's
+first column onto the last cell of the row above), so one key visits the whole
+table in either direction. The same choice from a
+script is `e2b-box open -t grok --model grok-4.6 --reasoning xhigh`; a model the harness
+does not list, or an effort that model does not take (grok-4.5 has no `xhigh`,
+droid's `minimax-m3` takes `high` alone), fails the box before anything is created,
+naming what it does accept. opencode's reasoning
+is a per-model variant chosen in its UI, so its cell is a generic scale that only
+reaches the box as `HERDR_E2B_REASONING`; amp's is its `--mode`.
+
 `t` takes any name, so the menu is a shortcut and not a whitelist. `muse` (Meta's
 Muse Code) is the shipped default; `base` is E2B's minimal image, fine for trying
 the flow or a plain shell, tight on disk for real work. For that, [build a custom template](https://e2b.dev/docs/sandbox-template) with your
@@ -386,18 +414,52 @@ The full contract, the box lifecycle and a GitHub Actions example live in
 ### `e2b-fleet` — one base ref, one box per template
 
 ```bash
-e2b-fleet                                          # two screens: slug + task, then the roster
+e2b-fleet                                          # two screens: slug + task, then the roster table
 e2b-fleet login-fix --agents claude,codex          # …or say it outright
 e2b-fleet login-fix --all --task "fix the login redirect loop"
+e2b-fleet login-fix -t 'codex*3@ultra' -t grok@xhigh   # three codex at ultra, one grok at xhigh
 e2b-fleet login-fix --agents claude -n             # --dry-run: print the plan, create nothing
 e2b-fleet kill login-fix [--prune-branches]        # boxes and worktrees gone, branches kept
 ```
 
-Per template and all at once: a worktree on a fresh branch
+Per member and all at once: a worktree on a fresh branch
 `e2b/<slug>-<template>-<rand4>` off your current HEAD, opened as an ordinary
 herdr workspace, with its own box booted from its own template, its agent started
 inside it, and the task handed over the moment *that* agent settles.
 
+The roster screen is a table, one row per template and three cells: in or out,
+the effort, how many of it.
+
+```
+  Roster for fleet login-fix
+
+         template                  effort       count
+   ▸ [✓] codex                     ultra        3     same effort [✓]
+     [✓] opencode                  default      1     (pick in opencode's UI)
+     [ ] claude                    high         1
+     [✓] grok                      each own     2     same effort [ ]
+              ├ #1                 xhigh
+              └ #2                 high
+     [ ] muse                      high         1
+
+  6 members
+  space tick   ↑/↓ move   →/tab column   +/- count   s per-instance effort   enter launch (on an effort cell: its list)   q abort
+```
+
+`+`/`-` set how many members a template gets; they share the row's effort until
+`s` unfolds one row per instance, each with its own cell. `s` also ticks the
+template and grows it to two if it had one, and lands on instance #1 with its cell
+focused, so one key gets you to the first thing to change; `s` again folds. The
+model column works the same way, and `s` gives each instance its own model too, so
+one fleet can race a template across models. From the command line the same roster
+is a **member spec** per `-t` (or comma-separated in `--agents`):
+`NAME[:MODEL][*N][@EFFORT]`, so `codex*3@ultra` is three codex members at ultra,
+`claude:claude-opus-5*2` two claudes on Opus 5, and a repeated `-t codex` is two of
+them. Instances are numbered in their labels and
+branches (`login-fix-codex`, `login-fix-codex-2`). An effort travels to the member
+as `e2b-box open -t codex --reasoning ultra` and overrides the template's pin for
+that box only.
+
 - **A terminal is what asks for the board.** With a tty the pane you launched
   from becomes a live board of the roster while it provisions (the per-member
   report goes to `$STATE_DIR/fleets/<slug>.log`); `--no-dashboard` keeps the
@@ -418,6 +480,12 @@ inside it, and the task handed over the moment *that* agent settles.
 `[fleet]` sets `base`, `prefix` and `default_roster`; `[fleet.agents]` maps a
 template to the command that starts its agent.
 
+Save counts, models and reasoning in a [JSON fleet specification](docs/fleet-presets.md):
+`e2b-box fleet login-fix --file compare.json --task "Fix the login loop"`.
+Put that file in `presets/` beside `config.toml` to use `--preset compare` or select
+it with **p / Shift+P** in the roster picker. `fleet presets` lists names, and
+`--dry-run` validates and previews a generated file without creating anything.
+
 ### `e2b-bench` — grade the fleet
 
 Three agents worked the same task; now decide which one did it. One held-out
diff --git a/bin/e2b-box b/bin/e2b-box
index 5e6d259..f85b168 100755
--- a/bin/e2b-box
+++ b/bin/e2b-box
@@ -33,6 +33,7 @@ while [ -h "$SOURCE" ]; do
 done
 DIR="$(CDPATH= cd -P "$(dirname "$SOURCE")" && pwd)"
 source "$DIR/lib/paths.sh"
+source "$DIR/lib/picker-cache.sh"
 source "$DIR/lib/chooser.sh"   # ask_template_tty — shared with the other verbs
 
 need() { command -v "$1" >/dev/null 2>&1 || { echo "e2b-box: '$1' not found on PATH" >&2; exit 1; }; }
@@ -108,7 +109,7 @@ miss() {
 # Marks the record "provisioning" but PRESERVES a known sandboxId so the worker
 # can reconnect to (and resume) an existing sandbox instead of always creating fresh.
 provision_from_cwd() {
-  local k="$1" op="${2:-ensure}" want="${3:-}" b h p l sid tpl tpid tcols trows payload node_bin auth_record
+  local k="$1" op="${2:-ensure}" want="${3:-}" effort="${4:-}" model="${5:-}" b h p l sid tpl tpid tcols trows payload node_bin auth_record
   local -a auth_args
   b=""; h=""; at_repo_root && { b=$(git_branch); h=$(git_head); }; [ "$b" = "HEAD" ] && b=""
   p=$(box_root)
@@ -158,9 +159,11 @@ provision_from_cwd() {
        + (if ($tcols | test("^[0-9]+$")) then {terminalCols: ($tcols | tonumber)} else {} end)
        + (if ($trows | test("^[0-9]+$")) then {terminalRows: ($trows | tonumber)} else {} end)' \
     > "$BOXES_DIR/$k.json"
-  payload=$(jq -cn --arg k "$k" --arg b "$b" --arg h "$h" --arg p "$p" --arg l "$l" --arg op "$op" --arg t "$want" --arg connection "${connection:-}" \
+  payload=$(jq -cn --arg k "$k" --arg b "$b" --arg h "$h" --arg p "$p" --arg l "$l" --arg op "$op" --arg t "$want" --arg r "$effort" --arg m "$model" --arg connection "${connection:-}" \
     '{key:$k, label:$l, branch:$b, head:$h, worktreePath:$p, workspaceId:"", op:$op}
        + (if $t != "" then {template:$t} else {} end)
+       + (if $r != "" then {reasoning:$r} else {} end)
+       + (if $m != "" then {model:$m} else {} end)
        + (if $connection != "" then {connection:$connection} else {} end)')
   nohup "$node_bin" "$PLUGIN_DIR/src/provision.js" "$payload" >>"$BOXES_DIR/$k.log" 2>&1 &
   # Remembered so an interrupt can stop the worker, not just the spinner in front
@@ -265,8 +268,23 @@ pick_template() {
   : "${lbl:=$k}"
   # 2 (aborted) is passed straight through; 1 (no terminal to draw on) is not an
   # answer and not a refusal, so it becomes "let the config decide" as before.
-  local rc
-  ask_template_tty "$lbl" "$resolved" "$choices" "$n" "$marks"; rc=$?
+  # Beside each row, a model cell and an effort cell to cycle (src/effort.js): the
+  # answer comes back as `<template>[\t<effort>[\t<model>]]`, tabs only as far as
+  # something was chosen, bare otherwise.
+  local rc efforts
+  # `pick --needed` asks only whether this point is reached: 3 says "there is a
+  # question", so the action knows to open the popup before anything is drawn.
+  [ "${PICK_PROBE:-0}" = 1 ] && return 3
+  efforts=$("$node_bin" "$PLUGIN_DIR/src/effort-cli.js" $choices 2>/dev/null) || efforts=""
+  if [ -n "${E2B_PICKER_INPUT:-}" ]; then
+    PICKER_BOX_KEY="$k" picker_cache_write box "$lbl" "$resolved" "$choices" "$n" "$marks" "$efforts"
+    return 0
+  fi
+  # Writing the next opening's frame must not delay this opening's first paint.
+  PICKER_BOX_KEY="$k" picker_cache_write box "$lbl" "$resolved" "$choices" "$n" "$marks" "$efforts" >/dev/null 2>&1 &
+  local cache_job=$!
+  ask_template_tty "$lbl" "$resolved" "$choices" "$n" "$marks" "$efforts"; rc=$?
+  wait "$cache_job" || true
   [ "$rc" -eq 2 ] && return 2
   return 0
 }
@@ -651,15 +669,22 @@ boot_and_connect() {
     # answer is "don't", stop here: nothing has been created yet, so nothing has to
     # be cleaned up. Exit 130 is the same abort code the fleet pickers use.
     if [ -z "$want" ]; then
-      want=$(pick_template "$key") || {
+      # The picker answers `<template>[\t<effort>[\t<model>]]`; an effort typed as
+      # --reasoning or a model as --model still wins, the way -t beats the picker
+      # for the template itself.
+      picked=$(pick_template "$key") || {
         echo "e2b-box: no template chosen — nothing was created." >&2
         exit 130
       }
+      IFS=$'\t' read -r want picked_effort picked_model <<<"$picked"
+      [ "$picked_effort" = "-" ] && picked_effort=""   # the picker's "default" in front of a model
+      [ -z "$reasoning" ] && reasoning="$picked_effort"
+      [ -z "$model" ] && model="$picked_model"
     fi
     # From here a sandbox is about to exist, so this run owns it: an interrupt
     # before it is handed over has to take it with it (see arm_boot_abort).
     arm_boot_abort "$key"
-    provision_from_cwd "$key" ensure "$want" || return 1
+    provision_from_cwd "$key" ensure "$want" "$reasoning" "$model" || return 1
   fi
   # Spin until ready (bounded so a hung provision can't loop forever), then attach.
   spin_until_ready "$key" "booting" || exit 1
@@ -739,6 +764,10 @@ fleet                         several boxes off one checkout, one per template
 
 options                       (before the verb or after it — same thing)
   -t, --template NAME         template a NEW box boots from (open, up)
+  -r, --reasoning LEVEL       how hard its agent thinks, in the harness's own words
+                              (e.g. xhigh); overrides [templates.NAME] reasoning
+      --model ID              which model its agent runs, as the harness spells it
+                              (e.g. claude-opus-5); overrides [templates.NAME] model
   --template-any              accept a template name the config doesn't know
   --connection ID             choose a connection for a NEW box (open, up)
   -b, --box KEY               act on that box instead of this worktree's
@@ -759,6 +788,8 @@ also spelled                  ls=list · rm,destroy=kill · unpause=resume
 environment
   KEY                         box key to act on (what --box sets)
   E2B_TEMPLATE                template for a new box, ahead of any branch rule
+  E2B_REASONING, E2B_MODEL    its effort and model, as --reasoning / --model would
+                              (how the popup picker hands its answer to the box pane)
   HERDR_E2B_NODE              path to a Node >= 22, if yours isn't found
   HERDR_PLUGIN_STATE_DIR      where box records live
 
@@ -780,10 +811,10 @@ USAGE
 pre_args=()
 while [ $# -gt 0 ]; do
   case "$1" in
-    --box|-b|--template|-t|--connection)
+    --box|-b|--template|-t|--reasoning|-r|--model|--connection)
       [ $# -ge 2 ] || { echo "e2b-box: $1 needs a value" >&2; exit 2; }
       pre_args+=("$1" "$2"); shift 2 ;;
-    --box=*|--template=*|--connection=*|--template-any|--json) pre_args+=("$1"); shift ;;
+    --box=*|--template=*|--reasoning=*|--model=*|--connection=*|--template-any|--json) pre_args+=("$1"); shift ;;
     *) break ;;
   esac
 done
@@ -881,6 +912,10 @@ done
 # Everything else is left in "$@" for the verb to read (e.g. pull --force).
 template=""
 template_any=0
+# The popup picker hands its answer to the box pane as E2B_TEMPLATE (read by
+# pick_template) and these two; a flag typed here still wins.
+reasoning="${E2B_REASONING:-}"
+model="${E2B_MODEL:-}"
 connection=""
 box_flag=""
 json=0
@@ -891,6 +926,19 @@ while [ $# -gt 0 ]; do
       [ $# -ge 2 ] || { echo "e2b-box: $1 needs a template name" >&2; exit 2; }
       template="$2"; shift 2 ;;
     --template=*) template="${1#*=}"; shift ;;
+    # How hard THIS box's agent thinks, in its harness's own words (src/effort.js).
+    # Overrides `[templates.<name>] reasoning` for one box; a NEW box only, like -t.
+    --reasoning|-r)
+      [ $# -ge 2 ] && [ -n "$2" ] || { echo "e2b-box: $1 needs an effort level, e.g. --reasoning xhigh" >&2; exit 2; }
+      reasoning="$2"; shift 2 ;;
+    --reasoning=*) reasoning="${1#*=}"; [ -n "$reasoning" ] || { echo "e2b-box: --reasoning needs an effort level" >&2; exit 2; }; shift ;;
+    # Which model THIS box's agent runs, as its harness spells it (the catalog in
+    # src/harness-catalog.generated.js). Overrides `[templates.<name>] model` for one
+    # box; a NEW box only, like -t. No short flag: `-m` is `push`'s commit message.
+    --model)
+      [ $# -ge 2 ] && [ -n "$2" ] || { echo "e2b-box: --model needs a model id, e.g. --model claude-opus-5" >&2; exit 2; }
+      model="$2"; shift 2 ;;
+    --model=*) model="${1#*=}"; [ -n "$model" ] || { echo "e2b-box: --model needs a model id" >&2; exit 2; }; shift ;;
     --template-any) template_any=1; shift ;;
     --connection)
       [ $# -ge 2 ] && [ -n "$2" ] || { echo "e2b-box: --connection needs a connection name" >&2; exit 2; }
@@ -970,6 +1018,27 @@ if [ -n "$template" ] && [ "$template_any" -eq 0 ]; then
 fi
 
 case "$cmd" in
+  # The `open` picker on its own, for the popup (bin/e2b-popup, pick-box mode): the
+  # question is asked in the overlay and the boot happens in a regular pane, so the
+  # two halves of `open` are split here. `pick --needed` is the action's probe: exit
+  # 0 when the picker would open, 1 when the template is already settled (a live box
+  # to reattach, E2B_TEMPLATE, a branch rule, a single candidate), so the popup is
+  # only drawn when there is something to choose. Without it: draws the picker and
+  # prints two lines, the box key and the answer (`<template>[\t<effort>[\t<model>]]`,
+  # `-` for an effort left at default), exit 2 when aborted.
+  pick)
+    if [ "${1:-}" = "--needed" ]; then
+      PICK_PROBE=1 pick_template "$key" >/dev/null; [ $? -eq 3 ] && exit 0
+      exit 1
+    fi
+    picked=$(pick_template "$key"); rc=$?
+    [ "$rc" -eq 2 ] && exit 2
+    if [ -n "${E2B_PICKER_INPUT:-}" ] && [ ! -f "$E2B_PICKER_INPUT" ]; then
+      # A settled decision also invalidates the previous menu for the next popup.
+      PICKER_BOX_KEY="$key" picker_cache_write box "" "" "" "" "" ""
+    fi
+    printf '%s\n%s\n' "$key" "$picked"
+    ;;
   status)
     r=$(rec "$key")
     if [ -n "$r" ]; then
@@ -1448,9 +1517,15 @@ case "$cmd" in
       ready) echo "sandbox for '$key' already ready — 'e2b-box open' to attach" ;;
       provisioning) echo "sandbox for '$key' already provisioning ($(field "$key" step)) — e2b-box logs" ;;
       *)
-        [ -z "$template" ] && template=$(pick_template "$key")
-        echo "provisioning E2B sandbox for '$key'${template:+ ($template)} in the background…"
-        provision_from_cwd "$key" ensure "$template" || exit 1
+        if [ -z "$template" ]; then
+          picked=$(pick_template "$key")
+          IFS=$'\t' read -r template picked_effort picked_model <<<"$picked"
+          [ "$picked_effort" = "-" ] && picked_effort=""
+          [ -z "$reasoning" ] && reasoning="$picked_effort"
+          [ -z "$model" ] && model="$picked_model"
+        fi
+        echo "provisioning E2B sandbox for '$key'${template:+ ($template)}${model:+ on $model}${reasoning:+ at $reasoning effort} in the background…"
+        provision_from_cwd "$key" ensure "$template" "$reasoning" "$model" || exit 1
         echo "watch: e2b-box logs   ·   attach when ready: e2b-box open"
         ;;
     esac
diff --git a/bin/e2b-box-open b/bin/e2b-box-open
index 95cadda..97f1574 100755
--- a/bin/e2b-box-open
+++ b/bin/e2b-box-open
@@ -1,10 +1,23 @@
 #!/usr/bin/env bash
-# Open the template picker and sandbox shell in a focused pane below the invoking
-# pane. No flags is the `open` action. The popup dashboard says where and which:
-# `--target-pane` (the pane it floats over, not the popup), `--placement`
-# (below, right, above, left or tab; `[dashboard].popup_open`), `--cwd` (the box's worktree)
-# and `--box` (its key, exported as KEY so `e2b-box open` never re-derives one
-# from the cwd).
+# The `open` action, and the hand-off every picker makes when it has an answer.
+#
+# No flags is the action (a keybinding, herdr's action menu): the POPUP opens at
+# once (bin/e2b-popup in `pick-box` mode) and asks template, model and effort;
+# then the popup closes and the box opens in a pane below the pane the popup
+# floated over. When there is nothing to ask (a live box to reattach, E2B_TEMPLATE,
+# a branch rule, a single candidate) the popup hands off without drawing a picker,
+# so it is on screen for a blink. Deciding that BEFORE opening the popup would cost
+# a whole e2b-box start (a cold Node import runs to a second) in front of a blank
+# screen, which is worse than the blink. The overlay is for configuring, never for
+# running: herdr discards its terminal the moment it closes.
+#
+# With flags it is the hand-off itself, as the popup dashboard and the popup picker
+# call it: `--target-pane` (the pane the popup floats over, not the popup),
+# `--placement` (below, right, above, left or tab; `[dashboard].popup_open`),
+# `--cwd` (the box's worktree), `--box` (its key, exported as KEY so `e2b-box open`
+# never re-derives one from the cwd), and what was picked: `--template`,
+# `--reasoning`, `--model`, which reach `e2b-box open` in the new pane as
+# E2B_TEMPLATE, E2B_REASONING and E2B_MODEL, ahead of its own picker.
 set -uo pipefail
 SOURCE="${BASH_SOURCE[0]}"
 while [ -h "$SOURCE" ]; do
@@ -16,19 +29,32 @@ DIR="$(CDPATH= cd -P "$(dirname "$SOURCE")" && pwd)"
 source "$DIR/lib/paths.sh"
 source "$DIR/lib/pane.sh"
 
-target= ; where=below ; extra=()
+target= ; where=below ; extra=() ; explicit=0
 while [ $# -gt 0 ]; do
   case "$1" in
-    --target-pane|--placement|--cwd|--box)
+    --target-pane|--placement|--cwd|--box|--template|--reasoning|--model)
       [ $# -ge 2 ] || { echo "e2b-box-open: $1 needs a value" >&2; exit 2; } ;;
     *) echo "e2b-box-open: unknown argument '$1'" >&2; exit 2 ;;
   esac
+  explicit=1
   case "$1" in
     --target-pane) target="$2" ;;
     --placement) where="$2" ;;
     --cwd) extra+=(--cwd "$2") ;;
     --box) extra+=(--env "KEY=$2") ;;
+    --template) [ -z "$2" ] || extra+=(--env "E2B_TEMPLATE=$2") ;;
+    --reasoning) [ -z "$2" ] || extra+=(--env "E2B_REASONING=$2") ;;
+    --model) [ -z "$2" ] || extra+=(--env "E2B_MODEL=$2") ;;
   esac
   shift 2
 done
-pane_open_from box "$where" "$target" ${extra[@]+"${extra[@]}"}
+
+if [ "$explicit" -eq 1 ]; then
+  pane_open_from box "$where" "$target" ${extra[@]+"${extra[@]}"}
+  exit
+fi
+
+# The action. No popup to be had (an older herdr): the pane below asks for itself.
+pane_open_popup pick-box "$(pane_context_cwd)" && exit 0
+echo "e2b-box-open: couldn't open the popup, asking in the pane instead" >&2
+pane_open_below box
diff --git a/bin/e2b-fleet b/bin/e2b-fleet
index 9944a98..a08d2d4 100755
--- a/bin/e2b-fleet
+++ b/bin/e2b-fleet
@@ -69,6 +69,7 @@ done
 DIR="$(CDPATH= cd -P "$(dirname "$SOURCE")" && pwd)"
 source "$DIR/lib/paths.sh"
 source "$DIR/lib/pane.sh"     # pane_herdr / pane_node — the herdr binary and a node
+source "$DIR/lib/picker-cache.sh"
 source "$DIR/lib/chooser.sh"  # ask_slug_tty / ask_roster_tty — the two picker screens
 
 # The herdr release that added `herdr worktree list/create/open/remove` and the
@@ -121,12 +122,22 @@ $FLEET_CLI — fan this checkout out into a fleet of boxes
 create
   $FLEET_CLI t-21 --agents claude,codex --task "fix the login redirect loop"
   $FLEET_CLI t-21 --all --task "…"        every agent your config knows
+  $FLEET_CLI create --file fleet.json     a generated or saved JSON fleet
+  $FLEET_CLI t-21 --preset compare        reuse presets/compare.json
+  $FLEET_CLI presets                     list names beside config.toml
 
   -a, --agents LIST           the roster: comma-separated, or 'all'
       --all                   the whole roster; same as --agents all
-  -t, --template NAME         one member; repeat the flag for more
+  -t, --template SPEC         one member; repeat the flag for more. A SPEC is
+                              NAME[:MODEL][*N][@EFFORT]: 'codex*3@ultra' is three
+                              codex members thinking at ultra, 'grok@xhigh' one
+                              grok, 'claude:claude-opus-5*2' two claudes on Opus 5
   -s, --slug NAME             the slug, as a flag instead of the first word
       --task TEXT             one instruction, handed to every member's agent
+      --file PATH             JSON {slug?, task?, members: [{template, model?,
+                              reasoning?, count?}]}; '-' reads stdin
+      --preset NAME           read presets/NAME.json beside config.toml
+                              CLI slug/task/roster override the saved values
   -n, --dry-run               print every call this would make, create nothing
   -f, --force                 allow a roster name your config never mentions
       --no-dashboard          stay here with an exit code instead of becoming
@@ -159,7 +170,7 @@ USAGE
 # where it lives is the whole answer, and saves reading anything else.
 fleet_flag_home() {
   case "$1" in
-    --agents|-a|--all|--task|--slug|-s|--template|--no-dashboard) echo create ;;
+    --agents|-a|--all|--task|--slug|-s|--template|--no-dashboard|--file|--preset) echo create ;;
     --prune-branches) echo kill ;;
     *) echo "" ;;
   esac
@@ -489,6 +500,11 @@ fi
 # the pair someone reaches for is boot-and-teardown, and having only one half
 # spelled the familiar way is what sends people to --help for a verb they had
 # already guessed correctly.
+if [ "${1:-}" = presets ]; then
+  [ $# -eq 1 ] || { echo "$FLEET_CLI presets takes no arguments" >&2; exit 2; }
+  NODE=$(pane_node) || exit 1
+  exec "$NODE" "$PLUGIN_DIR/src/fleet-spec.js" --list
+fi
 if [ "${1:-}" = create ] || [ "${1:-}" = up ]; then fleet_verb=create; shift; fi
 # Bare `fleet --help` was not asked about a subcommand, so it gets both halves;
 # `fleet create --help` gets the half it named.
@@ -498,6 +514,8 @@ if [ "${1:-}" = create ] || [ "${1:-}" = up ]; then fleet_verb=create; shift; fi
 slug=""
 templates=()
 fleet_task=""
+task_given=0
+spec_mode=""; spec_source=""
 dry=0
 dash=0
 no_dash=0
@@ -544,8 +562,17 @@ while [ $# -gt 0 ]; do
     # it are the shell's problem at the call site and nobody's after that.
     --task)
       [ $# -ge 2 ] || { echo "$FLEET_CLI: $1 needs the task text" >&2; exit 2; }
-      fleet_task="$2"; shift 2 ;;
-    --task=*) fleet_task="${1#*=}"; shift ;;
+      fleet_task="$2"; task_given=1; shift 2 ;;
+    --task=*) fleet_task="${1#*=}"; task_given=1; shift ;;
+    --file|--preset|--file=*|--preset=*)
+      [ -z "$spec_mode" ] || { echo "$FLEET_CLI: use one --file or --preset" >&2; exit 2; }
+      spec_mode="${1%%=*}"
+      case "$1" in
+        *=*) spec_source="${1#*=}"; shift ;;
+        *) [ $# -ge 2 ] || { echo "$FLEET_CLI: $1 needs a value" >&2; exit 2; }
+           spec_source="$2"; shift 2 ;;
+      esac
+      [ -n "$spec_source" ] || { echo "$FLEET_CLI: $spec_mode needs a value" >&2; exit 2; } ;;
     --agents|-a)
       [ $# -ge 2 ] || { echo "$FLEET_CLI: $1 needs a comma-separated list of agents, or 'all'" >&2; exit 2; }
       # A flag where the list should be means the list was left out — and getopt
@@ -625,6 +652,15 @@ dirty_note=""
 # a repo" is the more useful thing to hear first.
 NODE=$(pane_node) || { echo "$FLEET_CLI: can't find node — set HERDR_E2B_NODE=/path/to/node" >&2; exit 1; }
 
+if [ -n "$spec_mode" ]; then
+  saved=$("$NODE" "$PLUGIN_DIR/src/fleet-spec.js" "$spec_mode" "$spec_source") || exit 2
+  [ -n "$slug" ] || slug=$(printf '%s' "$saved" | jq -r '.slug')
+  if [ "$task_given" -eq 0 ]; then fleet_task=$(printf '%s' "$saved" | jq -r '.task'); fi
+  if [ ${#templates[@]} -eq 0 ] && [ "$want_all" -eq 0 ]; then
+    while IFS= read -r t; do templates+=("$t"); done < <(printf '%s' "$saved" | jq -r '.specs[]')
+  fi
+fi
+
 # Does this text survive ref sanitizing? src/fleet-name.js owns that rule and
 # ADR-0001 makes it load-bearing, so ask IT rather than re-deriving the regex in
 # bash. The template argument is a throwaway — only the exit code is read.
@@ -717,6 +753,24 @@ EOF
   }
 fi
 
+# Both the cold picker and the popup refresh use these same resolved arguments.
+fleet_picker_input() {
+  choices=$(fleet_template_choices) || {
+    echo "$FLEET_CLI: couldn't read the template list: is the plugin installed (npm deps)?" >&2; return 1
+  }
+  n_choices=$(printf '%s\n' "$choices" | grep -c '[^[:space:]]' || true)
+  [ "$n_choices" -gt 0 ] || { echo "$FLEET_CLI: no templates configured: set [sandbox] templates and try again." >&2; return 1; }
+  default_roster=$(fleet_default_roster)
+  efforts=$("$NODE" "$PLUGIN_DIR/src/effort-cli.js" --fleet 2>/dev/null) || efforts=""
+  if [ -n "${E2B_PICKER_INPUT:-}" ]; then
+    picker_cache_write fleet "$dirty_note" "$choices" "$n_choices" "$default_roster" "$efforts"
+  else
+    picker_cache_write fleet "$dirty_note" "$choices" "$n_choices" "$default_roster" "$efforts" >/dev/null 2>&1 &
+    picker_cache_job=$!
+  fi
+}
+if [ -n "${E2B_PICKER_INPUT:-}" ]; then fleet_picker_input; exit $?; fi
+
 # --- the two picker screens --------------------------------------------------
 # Only with a human present. Scripts, CI and the dashboard get the refusals they
 # have always got — a verb that blocks on a menu when nobody is looking is worse
@@ -724,6 +778,7 @@ fi
 interactive=0
 { [ -t 0 ] && [ -t 1 ]; } && interactive=1
 dirty_shown=0
+[ "${E2B_PICKER_DIRTY_NOTE:-}" != "$dirty_note" ] || dirty_shown=1
 
 if [ -z "$slug" ] || [ ${#templates[@]} -eq 0 ]; then
   if [ "$interactive" -eq 0 ]; then
@@ -756,20 +811,25 @@ if [ -z "$slug" ] || [ ${#templates[@]} -eq 0 ]; then
 
   # Screen two: the roster, with `[fleet] default_roster` pre-ticked.
   if [ ${#templates[@]} -eq 0 ]; then
-    choices=$(fleet_template_choices) || {
-      echo "$FLEET_CLI: couldn't read the template list — is the plugin installed (npm deps)?" >&2; exit 1
-    }
-    n_choices=$(printf '%s\n' "$choices" | grep -c '[^[:space:]]' || true)
-    [ "$n_choices" -gt 0 ] || {
-      echo "$FLEET_CLI: no templates configured — set [sandbox] templates and try again." >&2; exit 1
-    }
-    picked=$(ask_roster_tty "$slug" "$choices" "$n_choices" "$(fleet_default_roster)"); rc=$?
+    fleet_picker_input || exit 1
+    picked=$(ask_roster_tty "$slug" "$choices" "$n_choices" "$default_roster" "$efforts" "" "$(picker_preset_names)" picker_preset_rows); rc=$?
+    wait "$picker_cache_job" || true
     case "$rc" in
       0) ;;
       2) echo "$FLEET_CLI: aborted at the roster — nothing was created." >&2; exit 130 ;;
       *) echo "$FLEET_CLI: no terminal to ask on — use: $FLEET_CLI create <slug> -t <template>" >&2; exit 2 ;;
     esac
-    while IFS= read -r t; do [ -n "$t" ] && templates+=("$t"); done <<EOF
+    # The table answers one `<template>[\t<effort>[\t<model>]]` line per member;
+    # each becomes a spec, so the picker and `-t codex:gpt-5.5@ultra` meet in
+    # src/fleet-name.js.
+    while IFS=$'\t' read -r t e m; do
+      if [ "$t" = @preset ]; then
+        saved=$("$NODE" "$PLUGIN_DIR/src/fleet-spec.js" --preset "$e") || exit 2
+        if [ "$task_given" -eq 0 ] && [ -z "$fleet_task" ]; then fleet_task=$(printf '%s' "$saved" | jq -r '.task'); fi
+        continue
+      fi
+      [ "$e" = "-" ] && e=""; [ -n "$t" ] && templates+=("$t${m:+:$m}${e:+@$e}")
+    done <<EOF
 $picked
 EOF
     # ask_roster_tty cannot return an empty roster, but a launch off an empty one
@@ -796,17 +856,9 @@ if [ "$interactive" -eq 1 ] && [ "$no_dash" -eq 0 ]; then dash=1; fi
 # --- the roster --------------------------------------------------------------
 # A template appears in a roster at most once (CONTEXT.md): repeated -t collapses
 # to one member, keeping first-seen order so the plan is stable to assert against.
-uniq_templates=()
-seen=$'\n'
-for t in "${templates[@]}"; do
-  case "$seen" in *$'\n'"$t"$'\n'*) continue ;; esac
-  seen="$seen$t"$'\n'
-  uniq_templates+=("$t")
-done
-dropped=$(( ${#templates[@]} - ${#uniq_templates[@]} ))
-[ "$dropped" -gt 0 ] && \
-  echo "$FLEET_CLI: a template gets at most one member — collapsed $dropped duplicate(s)." >&2
-templates=("${uniq_templates[@]}")
+# A repeated template is MORE MEMBERS of it: `-t codex -t codex` and `-t codex*2`
+# are the same roster. src/fleet-name.js numbers the labels (t-21-codex-2) and
+# gives every instance its own branch.
 
 # --- the roster is spell-checked ---------------------------------------------
 # A name nobody configured used to plan perfectly and fail minutes later, when its
@@ -823,7 +875,8 @@ if [ "$force" -eq 0 ]; then
   if [ -n "$known" ]; then
     unknown=()
     for t in "${templates[@]}"; do
-      case $'\n'"$known"$'\n' in *$'\n'"$t"$'\n'*) ;; *) unknown+=("$t") ;; esac
+      name="${t%%[:*@]*}"   # the template half of a NAME[:MODEL][*N][@EFFORT] spec
+      case $'\n'"$known"$'\n' in *$'\n'"$name"$'\n'*) ;; *) unknown+=("$name") ;; esac
     done
     if [ ${#unknown[@]} -gt 0 ]; then
       for t in "${unknown[@]}"; do echo "$FLEET_CLI: no template named '$t'" >&2; done
@@ -1115,12 +1168,14 @@ if [ "$dry" -eq 1 ]; then
   # Print the exact orchestration, then stop. This is the seam the CLI tests
   # assert against: no herdr, no E2B, nothing created. The pane id is the one
   # thing that can't be known in advance — it comes from herdr's own response.
-  while IFS=$'\t' read -r template branch label; do
+  while IFS=$'\t' read -r template branch label effort model; do
     [ -n "$template" ] || continue
+    # `-` is the plan's spelling of "none" (an empty tab field would fold away)
+    [ "$effort" = "-" ] && effort=""; [ "$model" = "-" ] && model=""
     printf '  member %s\n' "$label"
     set_wt_argv "$branch" "$label"
     printf '    herdr %s\n' "${wt_argv[*]}"
-    printf '    herdr pane run <root pane of the new workspace> %s open -t %s\n' "$BOX_CLI" "$template"
+    printf '    herdr pane run <root pane of the new workspace> %s open -t %s%s%s\n' "$BOX_CLI" "$template" "${effort:+ --reasoning $effort}" "${model:+ --model $model}"
     # The auto-start, built from the same two builders the spawn uses, so the
     # plan can only ever be wrong about the pane id — which nothing can know yet.
     agent_cmd=$(fleet_agent_cmd "$template")
@@ -1373,10 +1428,49 @@ task_undelivered() { # $1 = why, $2 = where the task can still be typed
 # --- spawn -------------------------------------------------------------------
 # One member: herdr creates the worktree (unfocused, no --path so the user's
 # [worktrees] directory decides where it lands), and the box boots in the pane
+# --- pending rows on the board ------------------------------------------------------
+# The board reads $BOXES_DIR/*.json and nothing else, and a member has no record
+# until `e2b-box open` runs in its pane, which is after its worktree and workspace
+# exist: for those seconds a fleet that is very much happening shows an empty board.
+# So every member gets a PLACEHOLDER record the moment the plan is final: status
+# `pending`, the step it is at, keyed `<label>-pending` because there is no worktree
+# yet to key it by. The dashboard draws it and refuses every verb on it but kill.
+# It goes when the member's own record lands (a waiter watches for it), when the
+# member fails (its report says why), and no later than 60s after its pane was asked
+# to boot, so a placeholder cannot outlive the fleet that made it.
+pending_key() { printf '%s-pending' "$1"; }
+pending_write() { # $1 label, $2 template, $3 branch, $4 step, [$5 worktree path]
+  mkdir -p "$BOXES_DIR" 2>/dev/null || return 0
+  jq -cn --arg k "$(pending_key "$1")" --arg l "$1" --arg t "$2" --arg b "$3" --arg s "$4" --arg w "${5:-}" --arg f "${fleet_slug:-}" \
+    '{key:$k, label:$l, template:$t, branch:$b, status:"pending", step:$s, worktreePath:$w, fleet:$f}' \
+    > "$BOXES_DIR/$(pending_key "$1").json" 2>/dev/null || true
+}
+pending_clear() { rm -f "$BOXES_DIR/$(pending_key "$1").json"; }
+pending_retire() { # $1 label, $2 worktree path: clear once the real record exists, 60s at most
+  local real; real=$(box_key "$2")
+  # An exec'd child, not a `( … ) &` subshell: this runs inside spawn_member, itself
+  # inside a `$(…)` in run_members, and a forked subshell keeps bash's saved copies
+  # of those pipes open for its whole life, so every caller up the chain would sit
+  # through the full 60s. exec closes them (they are close-on-exec); a fleet of ten
+  # in the test suite went from ten minutes to seconds on this line.
+  nohup bash -c 'for _ in $(seq 1 60); do [ -f "$1" ] && break; sleep 1; done; rm -f "$2"' _ \
+    "$BOXES_DIR/$real.json" "$BOXES_DIR/$(pending_key "$1").json" </dev/null >/dev/null 2>&1 &
+  disown 2>/dev/null || true
+}
+pending_all() { # one placeholder per member of the plan, before anything is created
+  local t br l e m
+  while IFS=$'\t' read -r t br l e m; do
+    [ -n "$t" ] || continue
+    pending_write "$l" "$t" "$br" "creating worktree on $br"
+  done <<EOF
+$members
+EOF
+}
+
 # that new workspace was born with. Ids are READ from herdr's responses, never
 # predicted.
 spawn_member() {
-  local template="$1" branch="$2" label="$3" resp err ws pane first_err
+  local template="$1" branch="$2" label="$3" effort="${4:-}" model="${5:-}" resp err ws pane first_err
   # Our own workspace as the source, then the repo-key form once if herdr would
   # not take it — a pane inside a linked worktree is the case it rejects. The
   # FIRST reason is the one reported: if the retry also fails it is usually
@@ -1386,6 +1480,7 @@ spawn_member() {
     first_err="$wt_create_err"
     if [ -z "${HERDR_WORKSPACE_ID:-}" ] || ! wt_create_try "$branch" "$label" cwd; then
       printf '  ✗ %s — %s\n' "$label" "$first_err" >&2
+      pending_clear "$label"
       return 1
     fi
   fi
@@ -1404,6 +1499,7 @@ spawn_member() {
   # Before anything opens a shell in it — the box's own pane is the first one, and
   # an untrusted mise config greets it there.
   mise_trust "$wt_path"
+  pending_write "$label" "$template" "$branch" "worktree ready, starting its box" "$wt_path"
 
   # The create response carries the root pane; asking the new workspace for its
   # panes is the fallback for a herdr that answers without one.
@@ -1412,14 +1508,16 @@ spawn_member() {
   fi
   [ -n "$pane" ] || {
     printf '  ✗ %s — worktree created on %s, but herdr reported no pane to boot its box in\n' "$label" "$branch" >&2
+    pending_clear "$label"
     return 1
   }
 
   # The box goes in that ordinary pane — not the plugin's zoomed entrypoint — so
   # exiting the sandbox shell drops you at a prompt in the member's checkout
   # rather than in plugin-owned furniture.
-  resp=$("$HERDR" pane run "$pane" "$BOX_CLI" open -t "$template" 2>/dev/null) || {
+  resp=$("$HERDR" pane run "$pane" "$BOX_CLI" open -t "$template" ${effort:+--reasoning "$effort"} ${model:+--model "$model"} 2>/dev/null) || {
     printf '  ✗ %s — worktree created on %s, but the box did not start in pane %s\n' "$label" "$branch" "$pane" >&2
+    pending_clear "$label"
     return 1
   }
   # Same check as the worktree call: herdr can report a refusal in the response
@@ -1427,8 +1525,12 @@ spawn_member() {
   err=$(printf '%s' "$resp" | jq -r '.error.message // empty' 2>/dev/null)
   [ -z "$err" ] || {
     printf '  ✗ %s — worktree created on %s, but herdr refused to run the box: %s\n' "$label" "$branch" "$err" >&2
+    pending_clear "$label"
     return 1
   }
+  # The pane's own `e2b-box open` writes the real record within seconds; the
+  # placeholder leaves when it does.
+  pending_retire "$label" "$wt_path"
   printf '  ✓ %s — %s → pane %s, box booting from %s\n' "$label" "$branch" "$pane" "$template"
 
   # --- the member's agent ------------------------------------------------------
@@ -1565,11 +1667,13 @@ run_members() {
   trap 'rm -rf "$resdir"' EXIT
 
   idx=0
-  while IFS=$'\t' read -r template branch label; do
+  while IFS=$'\t' read -r template branch label effort model; do
     [ -n "$template" ] || continue
+    # `-` is the plan's spelling of "none" (an empty tab field would fold away)
+    [ "$effort" = "-" ] && effort=""; [ "$model" = "-" ] && model=""
     idx=$((idx + 1))
     (
-      out=$(spawn_member "$template" "$branch" "$label" 2>&1); mrc=$?
+      out=$(spawn_member "$template" "$branch" "$label" "$effort" "$model" 2>&1); mrc=$?
       printf '%s\n%s\n' "$mrc" "$out" >"$resdir/$idx"
     ) &
   done <<EOF
@@ -1624,6 +1728,7 @@ if [ "$dash" -eq 1 ]; then
   # Detached from this shell's terminal, and deaf to the HUP that arrives when the
   # board is closed: killing the board must not orphan a half-created member.
   # Nothing here writes to the pane — the board owns it from the exec below.
+  pending_all
   (
     trap '' HUP
     printf -- '--- %s: fleet %s ---\n' "$(date '+%Y-%m-%d %H:%M:%S')" "$fleet_slug"
@@ -1640,5 +1745,6 @@ if [ "$dash" -eq 1 ]; then
   exec "$DASH_CLI"
 fi
 
+pending_all
 run_members
 exit "$?"
diff --git a/bin/e2b-fleet-open b/bin/e2b-fleet-open
index 7186464..c58174c 100755
--- a/bin/e2b-fleet-open
+++ b/bin/e2b-fleet-open
@@ -1,5 +1,11 @@
 #!/usr/bin/env bash
-# Open the interactive fleet flow in a focused pane below the invoking pane.
+# The `fleet` action. The two picker screens (slug and task, then the roster with
+# its model and effort cells) run in the POPUP (bin/e2b-popup in `pick-fleet`
+# mode), and once the roster is answered the popup becomes the dashboard while the
+# members provision behind it, each appearing on the board as its box lands. The
+# members' own workspaces and panes are created by e2b-fleet as always; nothing
+# that outlives the answers runs in the overlay. Enter on the board then opens a
+# member's box in a pane below the pane the popup floated over.
 set -uo pipefail
 SOURCE="${BASH_SOURCE[0]}"
 while [ -h "$SOURCE" ]; do
@@ -10,4 +16,7 @@ done
 DIR="$(CDPATH= cd -P "$(dirname "$SOURCE")" && pwd)"
 source "$DIR/lib/paths.sh"
 source "$DIR/lib/pane.sh"
+pane_open_popup pick-fleet "$(pane_context_cwd)" && exit 0
+# No popup (an older herdr, no herdr at all): the pickers in a pane below, as before.
+echo "e2b-fleet-open: couldn't open the popup, asking in a pane below instead" >&2
 pane_open_below fleet
diff --git a/bin/e2b-picker-warm b/bin/e2b-picker-warm
new file mode 100755
index 0000000..35aaf7a
--- /dev/null
+++ b/bin/e2b-picker-warm
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Herdr runs startup and event hooks asynchronously. Resolve only picker inputs;
+# opening panes or provisioning here would turn initialization into a user action.
+set -uo pipefail
+DIR="$(CDPATH= cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$DIR/lib/paths.sh"
+source "$DIR/lib/pane.sh"
+command -v jq >/dev/null 2>&1 || exit 0
+
+paths=$(
+  printf '%s' "${HERDR_PLUGIN_CONTEXT_JSON:-}" | jq -r '
+    [.focused_pane_cwd, .workspace_cwd] | .[] | select(type == "string" and length > 0)' 2>/dev/null
+  if [ "${1:-}" = --all ] && HERDR=$(pane_herdr); then
+    "$HERDR" pane list 2>/dev/null | jq -r '
+      (.result.panes // .panes // [])[] | [.foreground_cwd, .cwd][] | select(type == "string" and length > 0)' 2>/dev/null
+  fi
+)
+[ -n "$paths" ] || paths="$PWD"
+
+warm_cwd() (
+  cd "$1" 2>/dev/null || exit 0
+  mkdir -p "$PICKERS_DIR" || exit 0
+  work=$(mktemp -d "$PICKERS_DIR/warm.XXXXXX") || exit 0
+  trap 'rm -rf "$work"' EXIT
+  # A pane's pins and box key belong to that pane, not every restored workspace.
+  unset KEY E2B_TEMPLATE E2B_MODEL E2B_REASONING
+  export HERDR_PLUGIN_CONTEXT_JSON= E2B_PICKER_INPUT="$work/input"
+  "$DIR/e2b-box" pick >/dev/null 2>&1
+  "$DIR/e2b-box" fleet >/dev/null 2>&1
+  exit 0
+)
+seen=""
+while IFS= read -r cwd; do
+  [ -d "$cwd" ] || continue
+  case $'\n'"$seen"$'\n' in *$'\n'"$cwd"$'\n'*) continue ;; esac
+  seen="$seen"$'\n'"$cwd"
+  warm_cwd "$cwd"
+done <<< "$paths"
+exit 0
diff --git a/bin/e2b-popup b/bin/e2b-popup
index b357c06..a858324 100755
--- a/bin/e2b-popup
+++ b/bin/e2b-popup
@@ -1,5 +1,9 @@
 #!/usr/bin/env bash
-# Run the existing dashboard in Herdr's floating terminal, preserving the layout.
+# Herdr's floating terminal as this plugin's surface: the dashboard, and the two
+# configuration screens (`e2b-box open`'s picker, the fleet's pickers). The overlay
+# is for looking and choosing, never for running (herdr discards its terminal
+# when it closes), so every mode ends by handing the work to a regular pane
+# (the popup is closed) or by becoming the board.
 set -uo pipefail
 SOURCE="${BASH_SOURCE[0]}"
 while [ -h "$SOURCE" ]; do
@@ -21,7 +25,62 @@ case "${1:-}" in
     export HERDR_PLUGIN_CONFIG_DIR="$CONFIG_DIR"
     export HERDR_PLUGIN_STATE_DIR="$STATE_DIR"
     export E2B_DASH_POPUP=1
-    exec "$DIR/e2b-dash" ;;
+    case "${E2B_POPUP_MODE:-dashboard}" in
+      pick-box|pick-fleet)
+        # A disposable popup can keep input unbuffered between reads. Otherwise
+        # a readiness check hides an arrow's trailing bytes until Enter arrives.
+        if [ -t 0 ]; then stty -icanon min 1 time 0 <&0 2>/dev/null || true; fi ;;
+    esac
+    # Which screen: bin/lib/pane.sh `pane_open_popup` set the mode and the worktree.
+    # e2b-box would cd to the plugin CONTEXT, which inside the popup is the popup's
+    # own pane, so the context is blanked and the cwd (already the worktree) rules.
+    case "${E2B_POPUP_MODE:-dashboard}" in
+      pick-box)
+        cd "${E2B_PICK_CWD:-$PWD}" 2>/dev/null || { echo "e2b-popup: no such worktree: ${E2B_PICK_CWD:-$PWD}" >&2; sleep 2; exit 1; }
+        export CHOOSER_CENTER=1 CHOOSER_ESCAPE_WAIT=0
+        source "$DIR/lib/picker-cache.sh"
+        picker_file=$(picker_cache_path)
+        # Known handoffs need no cached frame. Other decisions stay with pick_template.
+        if [ -z "${E2B_TEMPLATE:-}" ] && picker_cache_read "$picker_file" &&
+           [ ! -f "$BOXES_DIR/${PICKER_CACHE[2]}.json" ] && [ -n "${PICKER_CACHE[5]}" ] && [ -t 0 ]; then
+          source "$DIR/lib/chooser.sh"
+          out=$(picker_popup_box); rc=$?
+        else
+          out=$(HERDR_PLUGIN_CONTEXT_JSON= "$DIR/e2b-box" pick); rc=$?
+        fi
+        [ "$rc" -eq 2 ] && exit 0            # aborted: the popup closes, nothing was created
+        [ "$rc" -eq 0 ] || { echo "e2b-popup: e2b-box pick exited $rc" >&2; sleep 2; exit "$rc"; }
+        { IFS= read -r key; IFS= read -r answer; } <<EOF
+$out
+EOF
+        # `<template>[\t<effort>[\t<model>]]`, `-` for an effort left at default
+        IFS=$'\t' read -r tpl eff mdl <<EOF
+$answer
+EOF
+        [ "$eff" = "-" ] && eff=""
+        where=$(NODE=$(pane_node) && "$NODE" "$PLUGIN_DIR/src/resolve-dashboard.js" 2>/dev/null | jq -r '.popup_open // "below"' 2>/dev/null)
+        : "${where:=below}"
+        # The box opens in a regular pane under the pane the popup floats over; this
+        # process ending is what closes the popup.
+        exec "$DIR/e2b-box-open" ${E2B_DASH_ORIGIN_PANE:+--target-pane "$E2B_DASH_ORIGIN_PANE"} --placement "$where" \
+          --cwd "$PWD" --box "$key" ${tpl:+--template "$tpl"} ${eff:+--reasoning "$eff"} ${mdl:+--model "$mdl"} ;;
+      pick-fleet)
+        cd "${E2B_PICK_CWD:-$PWD}" 2>/dev/null || { echo "e2b-popup: no such worktree: ${E2B_PICK_CWD:-$PWD}" >&2; sleep 2; exit 1; }
+        export CHOOSER_CENTER=1 CHOOSER_ESCAPE_WAIT=0
+        # The pickers, then e2b-fleet execs the dashboard in this same terminal
+        # (E2B_DASH_POPUP is set, so it is the popup board, and E2B_DASH_ORIGIN_PANE
+        # says where Enter opens a member). Aborting a picker exits, closing the popup.
+        source "$DIR/lib/picker-cache.sh"
+        picker_file=$(picker_cache_path)
+        if picker_cache_read "$picker_file" && [ -n "${PICKER_CACHE[10]}" ] && [ -t 0 ]; then
+          source "$DIR/lib/chooser.sh"
+          picker_popup_fleet; rc=$?
+          [ "$rc" -ne 2 ] || exit 0
+          exit "$rc"
+        fi
+        exec "$DIR/e2b-box" fleet ;;
+      *) exec "$DIR/e2b-dash" ;;
+    esac ;;
   -h|--help|help)
     cat <<'USAGE'
 e2b-popup — the E2B dashboard floating over your Herdr panes
@@ -29,7 +88,11 @@ e2b-popup — the E2B dashboard floating over your Herdr panes
 usage
   e2b-popup                  open the dashboard popup
   e2b-box popup              the same popup through the main CLI
-  e2b-popup --render         draw inside an existing popup terminal
+  e2b-popup --render         draw inside an existing popup terminal; E2B_POPUP_MODE
+                             picks the screen: dashboard (default), pick-box (the
+                             `open` action's template · model · effort picker, then
+                             the box opens in a pane below and the popup closes),
+                             pick-fleet (the fleet pickers, then the board)
 
 The same UI and controls as e2b-dash, at 90% width and 85% height.
 Enter opens the selected box in a regular pane and closes the popup: a split
@@ -62,7 +125,4 @@ if [ "${origin:--}" = "-" ]; then
 $(pane_query "$HERDR" "$NODE" "")
 EOF
 fi
-env_args=(--env E2B_DASH_POPUP=1)
-[ "${origin:--}" = "-" ] || env_args+=(--env "E2B_DASH_ORIGIN_PANE=$origin")
-"$HERDR" plugin pane open --plugin e2b-dev.herdr-e2b --entrypoint popup \
-  --placement popup --width 90% --height 85% "${env_args[@]}" >/dev/null
+pane_open_popup dashboard "" "$origin"
diff --git a/bin/lib/chooser.sh b/bin/lib/chooser.sh
index 29fd911..f42d1c1 100644
--- a/bin/lib/chooser.sh
+++ b/bin/lib/chooser.sh
@@ -11,8 +11,8 @@
 #   ask_roster_tty    several templates at once      (`e2b-fleet`, screen two)
 #   ask_action_tty    one verb from a short list     (the on-close prompt)
 #
-# Self-contained on purpose: bash builtins only, no lib/paths.sh, no node, no
-# state dir. Source it from anywhere, in any order. That is also why neither
+# Self-contained on purpose: bash and standard terminal utilities, no lib/paths.sh,
+# no node or state dir. Source it from anywhere, in any order. That is also why neither
 # picker validates anything itself — `ask_slug_tty` takes the name of a
 # validator function so the rule can live where it belongs (src/fleet-name.js
 # owns ref sanitizing) without dragging node in here.
@@ -41,8 +41,260 @@
 # terminal, so /dev/tty is the pane. A herdr pane program may run on a pty WITHOUT
 # it being our controlling terminal — /dev/tty fails there while fd 0 is the very
 # pane you're looking at — so fall back to duplicating stdin.
+
+# ── drawing without flicker ─────────────────────────────────────────────────────
+#
+# A frame is built in one string and written with ONE printf: home the cursor,
+# every line ends with erase-to-end-of-line, the frame ends with erase-to-end-of-
+# screen. Nothing is cleared before it is redrawn, so moving the cursor repaints
+# the two rows that changed and the rest of the screen never blinks.
+#
+# CHOOSER_CENTER=1 (set by bin/e2b-popup for the pickers it hosts) draws the frame
+# in the MIDDLE of the terminal instead of its top-left: the popup is a floating
+# 90%×85% overlay and a menu hugging its corner reads as a mistake. The frame is
+# measured (visible width, line count) and padded on the left and the top; nothing
+# about its content changes, so the same keys give the same answers either way.
+#
+# The padding is STICKY within one picker: the widest frame and the tallest frame
+# seen so far decide it, so opening a row's list (more lines) or moving onto a
+# wider row never shifts the table sideways or up and back. `center_reset` at each
+# picker's start lets the next one measure afresh.
+F="" CENTER_W=0 CENTER_N=0
+center_reset() { CENTER_W=0; CENTER_N=0; }
+f_line() { F="$F$1"$'\033[K\n'; }
+f_flush() {
+  [ "${CHOOSER_CENTER:-0}" = 1 ] && F=$(center_frame "$F")$'\n'
+  printf '\033[H%s\033[J' "$F" >&3; F=""
+}
+center_frame() {
+  local f="${1%$'\n'}" size rows cols l v maxw=0 n=0 top left pad="" out=""
+  size=$(stty size <&4 2>/dev/null) || size=""
+  rows="${size%% *}"; cols="${size##* }"
+  [[ "$rows" =~ ^[0-9]+$ && "$cols" =~ ^[0-9]+$ ]] || { printf '%s' "$f"; return; }
+  while IFS= read -r l; do
+    # Forking once per line made centering alone consume the cached-frame budget.
+    v="$l"
+    while [[ "$v" =~ $'\033''\[[0-9;?]*[A-Za-z]' ]]; do v="${v/"${BASH_REMATCH[0]}"/}"; done
+    [ "${#v}" -gt "$maxw" ] && maxw=${#v}; n=$((n + 1))
+  done <<EOF
+$f
+EOF
+  [ "$maxw" -gt "$CENTER_W" ] && CENTER_W=$maxw; maxw=$CENTER_W
+  [ "$n" -gt "$CENTER_N" ] && CENTER_N=$n; n=$CENTER_N
+  left=$(( (cols - maxw) / 2 )); [ "$left" -gt 0 ] || left=0
+  top=$(( (rows - n) / 2 )); [ "$top" -gt 0 ] || top=0
+  pad=$(printf '%*s' "$left" "")
+  while [ "$top" -gt 0 ]; do out="$out"$'\033[K\n'; top=$((top - 1)); done
+  while IFS= read -r l; do out="$out$pad$l"$'\n'; done <<EOF
+$f
+EOF
+  printf '%s' "${out%$'\n'}"
+}
+
+# ── effort cells, shared by both pickers ─────────────────────────────────────────
+#
+# `effort_rows` is what `node src/effort-cli.js` prints: one `<template>|<kind>|
+# <v1,v2,…>|<configured>|<via>` per template (src/effort.js owns the words each
+# harness accepts). The pickers only ever choose from that list; they never invent
+# a level. An empty effort ("") means "leave the pin / the harness default alone",
+# and it is one entry in the list, drawn as `default`, so a human can get back to
+# it. Missing rows (old callers, tests) mean no effort column at all.
+#
+# COLUMNS. Both pickers are tables with a focused CELL, not just a focused row:
+# →/tab and ←/shift-tab move the focus across columns, ↑/↓ move across rows in
+# whichever column you are in. The template column is where enter means "go";
+# the effort column is where enter opens that row's list (↑/↓ choose, enter takes,
+# esc leaves it as it was). The model column sits between them and works the same
+# way: its list is the harness's catalog (src/harness-catalog.generated.js), read
+# off the same rows as fields six and seven. Column INDICES are fixed (0 template,
+# 1 model, 2 effort, 3 count) and a column no row has is skipped when the focus
+# moves (`col_step`), so a table with efforts and no models feels exactly as it did
+# before models existed. Widths are fixed so the columns line up:
+#   template 24 · model 24 · effort 11 · count 5
+EFF_KIND=() EFF_VALS=() EFF_VIA=() EFF_INIT=() MOD_VALS=() MOD_INIT=()
+effort_load() { # $1 = template list (newline), $2 = effort rows (newline) → fills EFF_* and MOD_* by index
+  local i=0 t k v c via mv mc row
+  EFF_KIND=(); EFF_VALS=(); EFF_VIA=(); EFF_INIT=(); MOD_VALS=(); MOD_INIT=()
+  while IFS= read -r t; do
+    [ -n "$t" ] || continue
+    EFF_KIND[$i]="none"; EFF_VALS[$i]=""; EFF_VIA[$i]=""; EFF_INIT[$i]=""; MOD_VALS[$i]=""; MOD_INIT[$i]=""
+    while IFS='|' read -r row k v c via mv mc; do
+      [ "$row" = "$t" ] || continue
+      EFF_KIND[$i]="$k"; EFF_VALS[$i]="$v"; EFF_VIA[$i]="$via"; EFF_INIT[$i]="$c"; MOD_VALS[$i]="$mv"; MOD_INIT[$i]="$mc"
+    done <<EOF
+$2
+EOF
+    i=$((i + 1))
+  done <<EOF
+$1
+EOF
+}
+# The next column the focus can land on: $1 = current, $2 = +1 or -1, $3 = the last
+# index this table has, $4/$5 = whether any row has a model / an effort cell.
+# Stays put at either edge. Columns 0 and 3 always exist when the table has them.
+col_step() {
+  local c="$1"
+  while :; do
+    c=$((c + $2))
+    if [ "$c" -lt 0 ] || [ "$c" -gt "$3" ]; then printf '%s' "$1"; return; fi
+    case "$c" in 0|3) break ;; 1) [ "${4:-0}" -eq 1 ] && break ;; 2) [ "${5:-0}" -eq 1 ] && break ;; esac
+  done
+  printf '%s' "$c"
+}
+# The last column a row has: $1 = the table's last index, $2/$3 = has model / effort.
+# Where ←/shift-tab land when they step back off a row's first column onto the row
+# above, the mirror of →/tab walking off a row's last cell onto the next row.
+col_last() { col_step "$(($1 + 1))" -1 "$1" "$2" "$3"; }
+# One model cell: the id, `default` for none chosen, a long id cut with `…`; blank
+# when the row lists no models. $3 = 1 draws it as the focused cell. Reverse video
+# is the only thing that marks a cell: no brackets, no chevrons, so an unfocused
+# table reads as plain columns of text under the header.
+# CELL avoids a subshell for each cell in the first frame.
+CELL=""
+model_cell() { # $1 = models csv, $2 = value, $3 = focused
+  local shown body
+  [ -n "$1" ] || { printf -v CELL '%-24s' ""; return; }
+  shown="${2:-default}"
+  [ "${#shown}" -gt 23 ] && shown="${shown:0:22}…"
+  printf -v body '%-24s' "$shown"
+  if [ "${3:-0}" -eq 1 ]; then printf -v CELL '\033[7m%s\033[0m' "$body"; else printf -v CELL '%s' "$body"; fi
+}
+# One effort cell: the value, `default` for none chosen; blank when the row has no
+# scale. $3 = 1 draws it as the focused cell.
+effort_cell() { # $1 = kind, $2 = value, $3 = focused
+  local body
+  case "$1" in
+    none) printf -v CELL '%-11s' ""; return ;;
+    *)    printf -v body '%-11s' "${2:-default}" ;;
+  esac
+  if [ "${3:-0}" -eq 1 ]; then printf -v CELL '\033[7m%s\033[0m' "$body"; else printf -v CELL '%s' "$body"; fi
+}
+# The list a focused effort cell opens: the values of one row, `default` first.
+# Draws below the table; ↑/↓ move, enter takes, esc/q leave it unchanged.
+# Sets POP_PICK to the chosen value ("" for default) and returns 0, or returns 1
+# when it was left. The caller redraws the frame each keystroke around it, so this
+# only draws the list itself (via f_line) and reads keys.
+POP_PICK=""
+# The list a cell opens is a DROPDOWN: drawn right under the row it belongs to,
+# starting at that cell's column, pushing the rows below it down, the way a select
+# unfolds where it was clicked. No title (the position says which cell), and its
+# key hint takes the footer's place while it is open (`list_hint`). A catalog can
+# run to a hundred ids (prime lists 104), so $4 > 0 draws a WINDOW of that many
+# rows around the cursor with a count of what lies above and below; 0 draws all.
+list_lines() { # $1 = values csv, $2 = current, $3 = cursor index (-1 = default), $4 = window rows, $5 = indent, $6 = width
+  local IFS=, list=() i cnt first=-1 last win="${4:-0}" pad w="${6:-9}"
+  read -ra list <<<"$1"
+  cnt=${#list[@]}; last=$((cnt - 1))
+  if [ "$win" -gt 0 ] && [ $((cnt + 1)) -gt "$win" ]; then
+    first=$(($3 - win / 2)); [ "$first" -lt -1 ] && first=-1
+    last=$((first + win - 1))
+    [ "$last" -gt $((cnt - 1)) ] && { last=$((cnt - 1)); first=$((last - win + 1)); }
+  fi
+  pad=$(printf '%*s' "${5:-2}" "")
+  [ "$first" -gt -1 ] && f_line "$pad$(printf '\033[2m  … %s more above\033[0m' "$((first + 1))")"
+  i=$first
+  while [ "$i" -le "$last" ]; do
+    local v; [ "$i" -lt 0 ] && v="" || v="${list[$i]}"
+    local shown="${v:-default}" mark="  "
+    [ "$v" = "$2" ] && mark="• "
+    if [ "$i" -eq "$3" ]; then f_line "$pad$(printf '\033[7m▸ %s%-*s\033[0m' "$mark" "$w" "$shown")"
+    else f_line "$pad  $mark$shown"; fi
+    i=$((i + 1))
+  done
+  [ "$last" -lt $((cnt - 1)) ] && f_line "$pad$(printf '\033[2m  … %s more below\033[0m' "$((cnt - 1 - last))")"
+}
+list_hint() { f_line "  $(printf '\033[2m↑/↓ choose   enter take   esc keep %s\033[0m' "${1:-default}")"; }
+# Where the two cells start on a row, as columns: the row prefix, the 24-wide
+# template name, its trailing space, and the space before the cell. $1 = prefix
+# width (single picker 9, roster 13), $2 = has_mod; effort sits one 24-wide cell
+# and a space further right when a model cell is drawn.
+model_col() { printf '%s' "$(($1 + 26))"; }
+effort_col() { printf '%s' "$(($1 + 26 + (${2:-0} == 1 ? 25 : 0)))"; }
+MODEL_WINDOW=14
+effort_index() { # $1 = values csv, $2 = value → index or -1
+  local IFS=, list=() i=0
+  read -ra list <<<"$1"
+  while [ "$i" -lt "${#list[@]}" ]; do [ "${list[$i]}" = "$2" ] && { printf '%s' "$i"; return; }; i=$((i + 1)); done
+  printf '%s' -1
+}
+effort_at() { # $1 = values csv, $2 = index → value ("" for -1)
+  local IFS=, list=(); read -ra list <<<"$1"
+  [ "$2" -lt 0 ] && printf '' || printf '%s' "${list[$2]}"
+}
+effort_count() { local IFS=, list=(); read -ra list <<<"$1"; printf '%s' "${#list[@]}"; }
+
+# A picker for one box: template rows, each with a model cell and an effort cell.
+# →/tab focuses the next cell, enter there opens the row's list; enter on the
+# template column answers `<template>`, `<template>\t<effort>` or
+# `<template>\t<effort>\t<model>` (the effort field `-` when only a model was
+# chosen): tabs only as far as something was chosen, so old callers see exactly
+# what they always did.
+# An optional caller-owned refresh callback returns 1 while pending, 3 with new
+# arguments in CHOOSER_INPUT, 4 when settled, or 5 on failure. It first runs after
+# paint. Keys wait for fresh rows; replacing a menu requires a fresh confirmation.
+chooser_read_key() {
+  local timeout="$1" refresh="$2" deadline=$((SECONDS + $1)) rc interval="$1"
+  if [ -n "$refresh" ]; then
+    # macOS system bash accepts only whole seconds for read's timeout.
+    interval=1; [ "${BASH_VERSINFO[0]}" -lt 4 ] || interval=0.05
+  fi
+  while :; do
+    if [ -n "$refresh" ]; then
+      "$refresh"; rc=$?
+      case "$rc" in 3|4|5) return "$rc" ;; esac
+      [ "$rc" -ne 0 ] || interval="$timeout"
+    else rc=0; fi
+    if [ "$rc" -eq 0 ] && [ "${CHOOSER_KEY+x}" ]; then
+      key="$CHOOSER_KEY"; unset CHOOSER_KEY; return 0
+    fi
+    if IFS= read -rsn1 -t "$interval" key <&4; then
+      # Aborting must work even if the caller's resolver has stalled. Escape
+      # sequences are still decoded by the existing key handlers.
+      if [ "$key" = $'\e' ] || { [ "${3:-}" = q ] && [[ "$key" = [qQ] ]]; }; then return 0; fi
+      # Defer confirmation while resolving, but keep reading so Escape can
+      # cancel it. A blocking wait here made a quick Enter trap the popup.
+      if [ "$rc" -eq 1 ] && { [ -z "$key" ] || { [ "${3:-}" = q ] && [[ "$key" = [1-9tT] ]]; }; }; then
+        CHOOSER_KEY="$key"
+        continue
+      fi
+      unset CHOOSER_KEY
+      return 0
+    fi
+    [ "$SECONDS" -lt "$deadline" ] || return 2
+    [ -n "$refresh" ] || return 2
+  done
+}
+
+# Escape shares its leading byte with arrows and Shift-Tab. A short window is
+# enough for a local popup's key sequence; a full second made "back" feel stuck.
+chooser_escape_tail() {
+  rest=""
+  if [ "${CHOOSER_ESCAPE_WAIT:-}" = 0 ]; then
+    # The popup caller keeps input unbuffered, so complete arrow sequences are
+    # visible here without a timer. Bash 3.2's read -t 0 always times out, so
+    # use a bounded, nonblocking terminal read there instead.
+    if [ "${BASH_VERSINFO[0]}" -lt 4 ]; then
+      stty min 0 time 0 <&4
+      rest=$(dd bs=1 count=2 <&4 2>/dev/null)
+      stty min 1 time 0 <&4
+    else
+      local byte
+      while [ "${#rest}" -lt 2 ] && read -t 0 <&4; do
+        IFS= read -rsn1 byte <&4 || break
+        rest="$rest$byte"
+      done
+    fi
+  else
+    local delay="${CHOOSER_ESCAPE_WAIT:-0.02}"
+    [ "${BASH_VERSINFO[0]}" -ge 4 ] || delay=1
+    IFS= read -rsn2 -t "$delay" rest <&4 || true
+  fi
+}
+
 ask_template_tty() {
-  local lbl="$1" resolved="$2" choices="$3" n="$4" marks="${5:-}" sel=0 i key rest hit typed
+  local lbl="$1" resolved="$2" choices="$3" n="$4" marks="${5:-}" efforts="${6:-}" sel=0 i key rest hit typed col=0 pop=0 pidx=-1 pk="" nc
+  local refresh="${7:-}" refresh_rc
+  # `pk` names the open list: "eff" or "mod".
   if { : >/dev/tty; } 2>/dev/null; then
     exec 3>/dev/tty 4</dev/tty
   elif [ -t 0 ] && { exec 3>&0; } 2>/dev/null; then
@@ -50,17 +302,11 @@ ask_template_tty() {
   else
     return 1
   fi
+  center_reset
   local items=()
   while IFS= read -r t; do [ -n "$t" ] && items+=("$t"); done <<EOF
 $choices
 EOF
-  # Marks are indexed positionally, not compacted like <choices>: an interior blank
-  # line means "this row has nothing to say", and dropping it would slide every
-  # annotation below it onto the wrong template. TRAILING blanks are a different
-  # story — the caller's own $(…) already stripped them, so this array is routinely
-  # SHORTER than <choices> and the `:-` below is load-bearing rather than defensive.
-  # `wide` is the longest mark, so the column fits whatever it is handed and 0 means
-  # there is no column to draw at all.
   local notes=() wide=0
   i=0
   while IFS= read -r t; do
@@ -70,64 +316,166 @@ EOF
   done <<EOF
 $marks
 EOF
-  # Open on the default row wherever it sits in the list — the menu keeps its
-  # configured order (base last), so row 1 is not the one Enter should take.
+  effort_load "$choices" "$efforts"
+  local eff=() mod=() has_eff=0 has_mod=0
   i=0
   while [ "$i" -lt "$n" ]; do
-    [ "${items[$i]}" = "$resolved" ] && { sel=$i; break; }
+    eff[$i]="${EFF_INIT[$i]:-}"; mod[$i]="${MOD_INIT[$i]:-}"
+    [ "${EFF_KIND[$i]:-none}" != none ] && has_eff=1
+    [ -n "${MOD_VALS[$i]:-}" ] && has_mod=1
+    [ "${items[$i]}" = "$resolved" ] && sel=$i
     i=$((i + 1))
   done
-  # Draw on the alternate screen so the pane's scrollback survives — the sandbox
-  # shell takes this pane over the moment we're done.
-  printf '\033[?1049h\033[?25l' >&3
+  local has_cells=0; { [ "$has_eff" -eq 1 ] || [ "$has_mod" -eq 1 ]; } && has_cells=1
+  # ←/h/shift-tab: the previous cell of this row, or from its first column the LAST
+  # cell of the row above (wrapping to the bottom), the mirror of →/tab. Reads and
+  # sets the loop's sel/col/rm/re.
+  pick_back() {
+    local nc prm=0 pre=0
+    nc=$(col_step "$col" -1 2 "$rm" "$re")
+    if [ "$nc" != "$col" ]; then col=$nc; return; fi
+    sel=$(((sel - 1 + n) % n))
+    [ -n "${MOD_VALS[$sel]:-}" ] && prm=1; [ "${EFF_KIND[$sel]:-none}" != none ] && pre=1
+    col=$(col_last 2 "$prm" "$pre")
+  }
+  [ "${CHOOSER_REPAINT:-0}" = 1 ] || printf '\033[?1049h\033[?25l\033[2J' >&3
   while :; do
-    printf '\033[2J\033[H' >&3
-    printf '\n  \033[1mE2B template\033[0m \033[2mfor\033[0m \033[1m%s\033[0m\n\n' "$lbl" >&3
+    f_line ""
+    f_line "  $(printf '\033[1mE2B template\033[0m \033[2mfor\033[0m \033[1m%s\033[0m' "$lbl")"
+    f_line ""
     i=0
     while [ "$i" -lt "$n" ]; do
-      if [ "$i" -eq "$sel" ]; then
-        printf '  \033[7m ▸ [%s] %-24s \033[0m' "$((i + 1))" "${items[$i]}" >&3
+      local line
+      if [ "$i" -eq "$sel" ] && [ "$col" -eq 0 ]; then
+        printf -v line '  \033[7m ▸ [%s] %-24s \033[0m' "$((i + 1))" "${items[$i]}"
+      elif [ "$i" -eq "$sel" ]; then
+        printf -v line '   ▸ [%s] %-24s ' "$((i + 1))" "${items[$i]}"
       else
-        printf '     [%s] %-24s ' "$((i + 1))" "${items[$i]}" >&3
+        printf -v line '     [%s] %-24s ' "$((i + 1))" "${items[$i]}"
+      fi
+      if [ "$has_mod" -eq 1 ]; then
+        local fm=0; [ "$i" -eq "$sel" ] && [ "$col" -eq 1 ] && fm=1
+        model_cell "${MOD_VALS[$i]:-}" "${mod[$i]}" "$fm"; line="$line $CELL"
+      fi
+      if [ "$has_eff" -eq 1 ]; then
+        local foc=0; [ "$i" -eq "$sel" ] && [ "$col" -eq 2 ] && foc=1
+        effort_cell "${EFF_KIND[$i]:-none}" "${eff[$i]}" "$foc"; line="$line $CELL"
+        [ "${EFF_KIND[$i]:-none}" = generic ] && line="$line $(printf '\033[2m(%s)\033[0m' "${EFF_VIA[$i]}")"
+      fi
+      [ "$wide" -gt 0 ] && line="$line $(printf '\033[2m%-*s\033[0m' "$wide" "${notes[$i]:-}")"
+      [ "${items[$i]}" = "$resolved" ] && line="$line $(printf '\033[2mdefault\033[0m')"
+      f_line "$line"
+      # The open list unfolds right under its row, at its cell's column.
+      if [ "$pop" -eq 1 ] && [ "$i" -eq "$sel" ]; then
+        if [ "$pk" = mod ]; then list_lines "${MOD_VALS[$sel]}" "${mod[$sel]}" "$pidx" "$MODEL_WINDOW" "$(model_col 9)" 22
+        else list_lines "${EFF_VALS[$sel]}" "${eff[$sel]}" "$pidx" 0 "$(effort_col 9 "$has_mod")" 9; fi
       fi
-      # Reserve the column only when something is annotated, so a machine that has
-      # never run `e2b-box auth` sees exactly the menu it always saw.
-      [ "$wide" -gt 0 ] && printf ' \033[2m%-*s\033[0m' "$wide" "${notes[$i]:-}" >&3
-      [ "${items[$i]}" = "$resolved" ] && printf ' \033[2mdefault\033[0m' >&3
-      printf '\n' >&3
       i=$((i + 1))
     done
-    printf '\n  \033[2m↑/↓ · j/k move   enter confirm   number jumps   t type a name   q/esc abort\033[0m\n' >&3
-    # Bounded: a pane nobody is watching must not wedge provisioning forever. A
-    # timeout is not a choice either — nobody is there to make one.
-    IFS= read -rsn1 -t 120 key <&4 || { chooser_close_tty; return 2; }
+    f_line ""
+    if [ "$pop" -eq 1 ]; then
+      [ "$pk" = mod ] && list_hint "${mod[$sel]}" || list_hint "${eff[$sel]}"
+    else
+      if [ "$has_cells" -eq 1 ]; then
+        local cells="effort"; [ "$has_mod" -eq 1 ] && { [ "$has_eff" -eq 1 ] && cells="model/effort" || cells="model"; }
+        f_line "  $(printf '\033[2m↑/↓ move   →/tab %s column   enter confirm (on a cell: its list)   number jumps   t type a name   q/esc abort\033[0m' "$cells")"
+      else
+        f_line "  $(printf '\033[2m↑/↓ · j/k move   enter confirm   number jumps   t type a name   q/esc abort\033[0m')"
+      fi
+    fi
+    f_flush
+    chooser_read_key 120 "$refresh" q; refresh_rc=$?
+    case "$refresh_rc" in
+      3) unset CHOOSER_KEY; CHOOSER_REPAINT=1 ask_template_tty "${CHOOSER_INPUT[@]}" "$refresh"; return $? ;;
+      0) ;;
+      *) chooser_close_tty; return "$refresh_rc" ;;
+    esac
     hit=""
+    # which cells THIS row has, for the column walk
+    local rm=0 re=0; [ -n "${MOD_VALS[$sel]:-}" ] && rm=1; [ "${EFF_KIND[$sel]:-none}" != none ] && re=1
+    if [ "$pop" -eq 1 ]; then
+      # inside a list: ↑/↓ (j/k) move, enter takes, esc/q keep, number picks
+      local vals cnt take=0
+      [ "$pk" = mod ] && vals="${MOD_VALS[$sel]}" || vals="${EFF_VALS[$sel]}"
+      cnt=$(effort_count "$vals")
+      case "$key" in
+        j|J) pidx=$(( (pidx + 2) % (cnt + 1) - 1 )) ;;
+        k|K) pidx=$(( (pidx + cnt + 1) % (cnt + 1) - 1 )) ;;
+        [0-9]) [ "$key" -le "$cnt" ] && { pidx=$((key - 1)); take=1; } ;;
+        ''|$'\n'|$'\r') take=1 ;;
+        q|Q) pop=0 ;;
+        $'\e')
+          chooser_escape_tail
+          case "$rest" in
+            '[A'|'OA') pidx=$(( (pidx + cnt + 1) % (cnt + 1) - 1 )) ;;
+            '[B'|'OB') pidx=$(( (pidx + 2) % (cnt + 1) - 1 )) ;;
+            '') pop=0 ;;
+          esac ;;
+      esac
+      # Taking a value (or leaving the list) keeps the focus on the cell it belongs
+      # to, so what just changed is what is highlighted; ←/shift-tab back to the
+      # template column and enter confirms the box.
+      if [ "$take" -eq 1 ]; then
+        if [ "$pk" = mod ]; then mod[$sel]=$(effort_at "$vals" "$pidx"); else eff[$sel]=$(effort_at "$vals" "$pidx"); fi
+        pop=0
+      fi
+      continue
+    fi
     case "$key" in
       [1-9]) [ "$key" -le "$n" ] && hit="${items[$((key - 1))]}" ;;
       j|J)   sel=$(((sel + 1) % n)) ;;
       k|K)   sel=$(((sel - 1 + n) % n)) ;;
+      # → and tab walk THIS row's cells (a row with no model or no effort has no
+      # such column to land on) and then on to the next row's first column, so one
+      # key visits everything; ← and shift-tab walk the same path backwards.
+      l|L|$'\t') nc=$(col_step "$col" 1 2 "$rm" "$re"); if [ "$nc" = "$col" ]; then sel=$(((sel + 1) % n)); col=0; else col=$nc; fi ;;
+      h|H)   pick_back ;;
       t|T)   printf '\033[?25h\n  template name: ' >&3
              IFS= read -r -t 120 typed <&4 || typed=""
-             [ -n "$typed" ] && hit="$typed" || printf '\033[?25l' >&3 ;;
-      ''|$'\n'|$'\r') hit="${items[$sel]}" ;;
-      # q and bare Esc ABORT — they used to take the default, which meant leaving
-      # the menu booted a sandbox you never picked (a `base` box, billing, from a
-      # keypress that means "get me out of here"). Both other pickers already read
-      # these as an abort; this one was the outlier. Enter is how you take a row.
+             if [ -n "$typed" ]; then chooser_close_tty; printf '%s' "$typed"; return 0; fi
+             printf '\033[?25l' >&3 ;;
+      ''|$'\n'|$'\r')
+        if [ "$col" -eq 1 ] && [ -n "${MOD_VALS[$sel]:-}" ]; then
+          pop=1; pk=mod; pidx=$(effort_index "${MOD_VALS[$sel]}" "${mod[$sel]}")
+        elif [ "$col" -eq 2 ] && [ "${EFF_KIND[$sel]:-none}" != none ]; then
+          pop=1; pk=eff; pidx=$(effort_index "${EFF_VALS[$sel]}" "${eff[$sel]}")
+        else
+          hit="${items[$sel]}"
+        fi ;;
       q|Q)   chooser_close_tty; return 2 ;;
       $'\e')
-        IFS= read -rsn2 -t 1 rest <&4
+        chooser_escape_tail
         case "$rest" in
           '[A'|'OA') sel=$(((sel - 1 + n) % n)) ;;
           '[B'|'OB') sel=$(((sel + 1) % n)) ;;
+          '[C'|'OC') nc=$(col_step "$col" 1 2 "$rm" "$re"); if [ "$nc" = "$col" ]; then sel=$(((sel + 1) % n)); col=0; else col=$nc; fi ;;
+          '[D'|'OD') pick_back ;;
+          '[Z')      pick_back ;;   # shift-tab
           '')        chooser_close_tty; return 2 ;;
         esac ;;
     esac
     [ -n "$hit" ] && break
   done
   chooser_close_tty
-  printf '%s' "$hit"
+  # A number key answers with that row's own cells, not the highlighted row's.
+  i=0; while [ "$i" -lt "$n" ]; do [ "${items[$i]}" = "$hit" ] && break; i=$((i + 1)); done
+  member_line "$hit" "${eff[$i]:-}" "${mod[$i]:-}"
 }
+# One answer line: `<template>[\t<effort>[\t<model>]]`, tabs only as far as
+# something was chosen. An effort left at default in front of a chosen model is
+# written `-`, never empty: bash's `read` with a tab IFS folds an empty middle field
+# into its neighbour, and the model would come back AS the effort. $4 = 1 ends the
+# line with a newline (the roster's per-member rows).
+member_line() { # $1 = template, $2 = effort, $3 = model, $4 = newline
+  if [ -n "$3" ]; then printf '%s\t%s\t%s' "$1" "${2:--}" "$3"
+  elif [ -n "$2" ]; then printf '%s\t%s' "$1" "$2"
+  else printf '%s' "$1"; fi
+  # Explicit, because this is the picker's last statement and its exit code: a
+  # false `[ … ] &&` here made every single-picker answer return 1.
+  [ "${4:-0}" -eq 1 ] && printf '\n'
+  return 0
+}
+
 
 # --- shared plumbing for the pickers added after the extraction ---------------
 # The same two-step "find the human" dance ask_template_tty does inline. The
@@ -174,40 +522,55 @@ chooser_close_tty() {
 # Returns 1 when there is no terminal, 2 when the user aborted (bare Esc, or the
 # read timing out — an unwatched pane must not launch a fleet by itself).
 ask_slug_tty() {
+  local refresh="${4:-}" refresh_rc
   local note="$1" validate="${2:-}" want_task="${3:-}" buf="" task="" field=0 key rest err=""
   chooser_open_tty || return 1
+  center_reset
   printf '\033[?1049h' >&3
+  # Built as a frame like the other pickers (f_line / f_flush), so the popup can
+  # center it the same way.
   while :; do
-    printf '\033[2J\033[H' >&3
-    printf '\n  \033[1mNew E2B fleet\033[0m\n\n' >&3
-    printf '  \033[2mA short name for what this fleet is for. Every member'\''s branch\n' >&3
-    printf '  carries it, so it is sanitized into a legal git ref.\033[0m\n\n' >&3
-    [ -n "$note" ] && printf '  \033[33m%s\033[0m\n\n' "$note" >&3
+    f_line ""
+    f_line "  $(printf '\033[1mNew E2B fleet\033[0m')"
+    f_line ""
+    f_line "  $(printf '\033[2mA short name for what this fleet is for. Every member'\''s branch')"
+    f_line "  $(printf 'carries it, so it is sanitized into a legal git ref.\033[0m')"
+    f_line ""
+    [ -n "$note" ] && { f_line "  $(printf '\033[33m%s\033[0m' "$note")"; f_line ""; }
     # The block cursor marks the field being typed into; with no task field
     # there is only ever one, so this draws exactly what it always drew.
     if [ "$field" -eq 0 ]; then
-      printf '  task slug: %s\033[7m \033[0m\n' "$buf" >&3
+      f_line "  $(printf 'task slug: %s\033[7m \033[0m' "$buf")"
     else
-      printf '  task slug: %s\n' "$buf" >&3
+      f_line "  task slug: $buf"
     fi
     if [ -n "$want_task" ]; then
-      printf '\n  \033[2mOptional. The fleet task: one instruction, handed to every member'\''s\n' >&3
-      printf '  agent as it comes up. Leave it empty to just get the boxes.\033[0m\n\n' >&3
+      f_line ""
+      f_line "  $(printf '\033[2mOptional. The fleet task: one instruction, handed to every member'\''s')"
+      f_line "  $(printf 'agent as it comes up. Leave it empty to just get the boxes.\033[0m')"
+      f_line ""
       if [ "$field" -eq 1 ]; then
-        printf '  fleet task: %s\033[7m \033[0m\n' "$task" >&3
+        f_line "  $(printf 'fleet task: %s\033[7m \033[0m' "$task")"
       else
-        printf '  fleet task: %s\n' "$task" >&3
+        f_line "  fleet task: $task"
       fi
     fi
-    [ -n "$err" ] && printf '\n  \033[31m%s\033[0m\n' "$err" >&3
+    [ -n "$err" ] && { f_line ""; f_line "  $(printf '\033[31m%s\033[0m' "$err")"; }
+    f_line ""
     if [ -n "$want_task" ]; then
-      printf '\n  \033[2mtab · ↑/↓ switch field   backspace deletes   enter launches   esc aborts\033[0m\n' >&3
+      f_line "  $(printf '\033[2mtab · ↑/↓ switch field   backspace deletes   enter launches   esc aborts\033[0m')"
     else
-      printf '\n  \033[2mtype to edit   backspace deletes   enter continues   esc aborts\033[0m\n' >&3
+      f_line "  $(printf '\033[2mtype to edit   backspace deletes   enter continues   esc aborts\033[0m')"
     fi
+    f_flush
     # Bounded like the template chooser: a pane nobody is watching must not sit
     # here forever holding a keybinding hostage.
-    IFS= read -rsn1 -t 300 key <&4 || { chooser_close_tty; return 2; }
+    chooser_read_key 300 "$refresh"; refresh_rc=$?
+    case "$refresh_rc" in
+      3) note="${CHOOSER_INPUT[0]}"; continue ;;
+      0) ;;
+      *) chooser_close_tty; return "$refresh_rc" ;;
+    esac
     case "$key" in
       ''|$'\n'|$'\r')
         # Enter always means "go", from either field — so the slug-only flow is
@@ -227,10 +590,10 @@ ask_slug_tty() {
       $'\t') [ -n "$want_task" ] && field=$((1 - field)) ;;
       $'\e')
         # An arrow key is Esc + 2 more bytes; a bare Esc is the abort. Same
-        # discrimination as the template chooser, and the same 1s window.
-        IFS= read -rsn2 -t 1 rest <&4
+        # short discrimination window as the template chooser.
+        chooser_escape_tail
         case "$rest" in
-          '[A'|'OA'|'[B'|'OB') [ -n "$want_task" ] && field=$((1 - field)) ;;
+          '[A'|'OA'|'[B'|'OB'|'[Z') [ -n "$want_task" ] && field=$((1 - field)) ;;
           '') chooser_close_tty; return 2 ;;
         esac ;;
       [[:print:]])
@@ -254,73 +617,326 @@ ask_slug_tty() {
 # Prints the chosen templates on stdout, one per line, in menu order. Returns 1
 # when there is no terminal and 2 when the user aborted — and an abort here has
 # to mean "created nothing", so it is checked before anything is spawned.
+# The roster TABLE: one row per template with three cells — in the fleet or not,
+# how hard it thinks, how many of it — plus, when a template's instances are NOT
+# all to think alike (`s`), one nested row per instance with its own effort cell.
+#
+#   ask_roster_tty <label> <choices> <n> <pre-ticked> [effort-rows]
+#
+# Focus is a CELL: ↑/↓ move rows, →/tab and ←/shift-tab move columns. Enter on the
+# template or count column launches; enter on an effort cell opens that row's list.
+# Prints one line per MEMBER (a template with count 3 is three lines):
+# `<template>` or `<template>\t<effort>` — the tab only when an effort was chosen,
+# so a caller that knows nothing about efforts still reads what it always did.
+# Returns 1 with no terminal, 2 on q/Esc/timeout.
+# Optional arguments after the refresh callback are preset names (one per line)
+# and a loader callback. The loader returns a one-line task preview, then
+# template|model|effort rows, one per member. Applying one adds an @preset<TAB>name
+# line before the answer so the caller can resolve its optional task at handoff.
 ask_roster_tty() {
-  local lbl="$1" choices="$2" n="$3" pre="$4" sel=-1 i key rest err="" picked=0 mark
+  local refresh="${6:-}" refresh_rc
+  local presets="${7:-}" load_preset="${8:-}" preset_names=() preset_index=-1 preset="" preset_task="" name
+  while IFS= read -r name; do [ -z "$name" ] || preset_names+=("$name"); done <<< "$presets"
+  local lbl="$1" choices="$2" n="$3" pre="$4" efforts="${5:-}" sel=-1 i j key rest err="" picked=0 mark col=0 pop=0 pidx=-1 pk="" nc maxc
   chooser_open_tty || return 1
-  local items=() on=()
+  center_reset
+  local items=() on=() cnt=() same=() eff=() inst=() mod=() instm=()
   while IFS= read -r t; do [ -n "$t" ] && items+=("$t"); done <<EOF
 $choices
 EOF
+  effort_load "$choices" "$efforts"
+  local has_eff=0 has_mod=0
   i=0
   while [ "$i" -lt "$n" ]; do
     case $'\n'"$pre"$'\n' in
       *$'\n'"${items[$i]}"$'\n'*) on[$i]=1; [ "$sel" -lt 0 ] && sel=$i ;;
       *) on[$i]=0 ;;
     esac
+    cnt[$i]=1; same[$i]=1; eff[$i]="${EFF_INIT[$i]:-}"; inst[$i]=""; mod[$i]="${MOD_INIT[$i]:-}"; instm[$i]=""
+    [ "${EFF_KIND[$i]:-none}" != none ] && has_eff=1
+    [ -n "${MOD_VALS[$i]:-}" ] && has_mod=1
     i=$((i + 1))
   done
-  # Open on the first pre-ticked row, so the common case ("my usual roster") is
-  # enter and nothing else; no default roster means start at the top.
   [ "$sel" -lt 0 ] && sel=0
-  printf '\033[?1049h\033[?25l' >&3
+  # The count column exists as soon as the table has any cell at all.
+  local maxcol=0 has_cells=0
+  { [ "$has_eff" -eq 1 ] || [ "$has_mod" -eq 1 ]; } && { maxcol=3; has_cells=1; }
+  # Does this row have a cell to open? $1 = row, $2 = "mod" or "eff".
+  row_has() { if [ "$2" = mod ]; then [ -n "${MOD_VALS[$1]:-}" ]; else [ "${EFF_KIND[$1]:-none}" != none ]; fi; }
+  # The cursor walks VISIBLE rows: `T<i>` for a template, `I<i>:<j>` for instance j
+  # of template i (drawn while that template is in, has several instances, and is
+  # not thinking alike). Rebuilt every frame from the state above.
+  local rows=() cur="T$sel" r
+  # instance efforts live in inst[i] as a space list, "-" standing for "" (a space
+  # list cannot hold an empty word); get/set by 1-based j
+  inst_get() { local IFS=' ' a=(${inst[$1]}); printf '%s' "${a[$(($2 - 1))]:-}"; }
+  inst_set() { local IFS=' ' a=(${inst[$1]}) k=0 out=""; a[$(($2 - 1))]="$3"; while [ "$k" -lt "${cnt[$1]}" ]; do out="$out${a[$k]:--} "; k=$((k + 1)); done; inst[$1]="$out"; }
+  inst_val() { local v; v=$(inst_get "$1" "$2"); [ "$v" = "-" ] && v=""; printf '%s' "$v"; }
+  # the same three for instance MODELS, in instm[i]
+  instm_get() { local IFS=' ' a=(${instm[$1]}); printf '%s' "${a[$(($2 - 1))]:-}"; }
+  instm_set() { local IFS=' ' a=(${instm[$1]}) k=0 out=""; a[$(($2 - 1))]="$3"; while [ "$k" -lt "${cnt[$1]}" ]; do out="$out${a[$k]:--} "; k=$((k + 1)); done; instm[$1]="$out"; }
+  instm_val() { local v; v=$(instm_get "$1" "$2"); [ "$v" = "-" ] && v=""; printf '%s' "$v"; }
+  # `s` on a row: make its instances differ (their model, their effort), which only
+  # means anything for a ticked template with at least two members, so it ticks and
+  # grows the row as needed and unfolds it, with the cursor on instance #1's first
+  # cell. `s` again folds.
+  unfold() {
+    local t="$1"
+    if [ "${same[$t]}" -eq 1 ]; then
+      on[$t]=1
+      [ "${cnt[$t]}" -lt 2 ] && cnt[$t]=2
+      same[$t]=0
+      j=1; while [ "$j" -le "${cnt[$t]}" ]; do inst_set "$t" "$j" "${eff[$t]:--}"; instm_set "$t" "$j" "${mod[$t]:--}"; j=$((j + 1)); done
+      cur="I$t:1"; col=$(col_step 0 1 2 "$has_mod" "$has_eff")
+    else
+      same[$t]=1; cur="T$t"; col=0
+    fi
+  }
+  # ←/h/shift-tab: the previous cell of this row, or from its first column the LAST
+  # cell of the row above (a template row's count, an instance row's effort or
+  # model), wrapping to the bottom: the mirror of →/tab. Reads and sets the loop's
+  # cur/col/at/rm/re.
+  roster_back() {
+    local nc pti pmax="$maxcol" prm=0 pre=0
+    nc=$(col_step "$col" -1 "$maxcol" "$rm" "$re")
+    if [ "$nc" != "$col" ]; then col=$nc; return; fi
+    cur="${rows[$(((at - 1 + ${#rows[@]}) % ${#rows[@]}))]}"
+    pti="${cur#[TI]}"; pti="${pti%%:*}"
+    case "$cur" in I*) pmax=2 ;; esac
+    row_has "$pti" mod && prm=1; row_has "$pti" eff && pre=1
+    col=$(col_last "$pmax" "$prm" "$pre")
+  }
+  # Presets fill the existing editable cells. The caller owns file access and
+  # validation; a bad recipe must leave the current roster intact.
+  roster_preset() {
+    local data task_preview t m e idx k first=-1 counts=()
+    [ -n "$load_preset" ] && [ ${#preset_names[@]} -gt 0 ] || return 0
+    if [ "$preset_index" -lt 0 ] && [ "$1" -lt 0 ]; then preset_index=0; fi
+    preset_index=$(((preset_index + $1 + ${#preset_names[@]}) % ${#preset_names[@]}))
+    name="${preset_names[$preset_index]}"
+    data=$("$load_preset" "$name" 2>&1) || { err="$data"; return; }
+    task_preview="${data%%$'\n'*}"; data="${data#*$'\n'}"
+    while IFS='|' read -r t m e; do
+      idx=-1
+      for k in "${!items[@]}"; do [ "${items[$k]}" != "$t" ] || idx=$k; done
+      [ "$idx" -ge 0 ] || { err="preset '$name': '$t' is not in this roster menu"; return; }
+      counts[$idx]=$((${counts[$idx]:-0} + 1))
+      [ "${counts[$idx]}" -le 20 ] || { err="preset '$name': a template can have at most 20 members in the picker"; return; }
+    done <<< "$data"
+    for k in "${!items[@]}"; do on[$k]=0; cnt[$k]=0; same[$k]=1; inst[$k]=""; instm[$k]=""; done
+    while IFS='|' read -r t m e; do
+      for k in "${!items[@]}"; do [ "${items[$k]}" != "$t" ] || idx=$k; done
+      [ "$first" -ge 0 ] || first=$idx
+      on[$idx]=1; cnt[$idx]=$((cnt[idx] + 1))
+      m="${m:-${MOD_INIT[$idx]:-}}"; e="${e:-${EFF_INIT[$idx]:-}}"
+      if [ "${cnt[$idx]}" -eq 1 ]; then mod[$idx]="$m"; eff[$idx]="$e"
+      elif [ "${mod[$idx]}" != "$m" ] || [ "${eff[$idx]}" != "$e" ]; then same[$idx]=0; fi
+      inst_set "$idx" "${cnt[$idx]}" "${e:--}"
+      instm_set "$idx" "${cnt[$idx]}" "${m:--}"
+    done <<< "$data"
+    for k in "${!items[@]}"; do [ "${cnt[$k]}" -gt 0 ] || cnt[$k]=1; done
+    preset="$name"; preset_task="$task_preview"; cur="T$first"; col=0; pop=0
+  }
+  [ "${CHOOSER_REPAINT:-0}" = 1 ] || printf '\033[?1049h\033[?25l\033[2J' >&3
   while :; do
-    picked=0
-    i=0; while [ "$i" -lt "$n" ]; do [ "${on[$i]}" -eq 1 ] && picked=$((picked + 1)); i=$((i + 1)); done
-    printf '\033[2J\033[H' >&3
-    printf '\n  \033[1mRoster\033[0m \033[2mfor fleet\033[0m \033[1m%s\033[0m \033[2m— one member per template\033[0m\n\n' "$lbl" >&3
+    rows=(); picked=0
     i=0
     while [ "$i" -lt "$n" ]; do
-      mark="[ ]"; [ "${on[$i]}" -eq 1 ] && mark="[✓]"
-      if [ "$i" -eq "$sel" ]; then
-        printf '  \033[7m ▸ %s [%s] %-24s \033[0m\n' "$mark" "$((i + 1))" "${items[$i]}" >&3
-      else
-        printf '     %s [%s] %-24s \n' "$mark" "$((i + 1))" "${items[$i]}" >&3
+      rows+=("T$i")
+      if [ "${on[$i]}" -eq 1 ]; then
+        picked=$((picked + cnt[i]))
+        if [ "${same[$i]}" -eq 0 ] && [ "${cnt[$i]}" -gt 1 ]; then
+          j=1; while [ "$j" -le "${cnt[$i]}" ]; do rows+=("I$i:$j"); j=$((j + 1)); done
+        fi
       fi
       i=$((i + 1))
     done
-    printf '\n  \033[2m%s selected\033[0m\n' "$picked" >&3
-    [ -n "$err" ] && printf '\n  \033[31m%s\033[0m\n' "$err" >&3
-    printf '\n  \033[2mspace toggles   ↑/↓ · j/k move   number toggles   enter launches   q aborts\033[0m\n' >&3
-    IFS= read -rsn1 -t 300 key <&4 || { chooser_close_tty; return 2; }
+    local found=0; for r in "${rows[@]}"; do [ "$r" = "$cur" ] && found=1; done
+    if [ "$found" -eq 0 ]; then cur="${cur#[TI]}"; cur="T${cur%%:*}"; fi
+    f_line ""
+    f_line "  $(printf '\033[1mRoster\033[0m \033[2mfor fleet\033[0m \033[1m%s\033[0m' "$lbl")"
+    [ ${#preset_names[@]} -eq 0 ] || f_line "  preset: ${preset:-custom}   p next preset · P previous (then edit any cell)"
+    [ -z "$preset_task" ] || f_line "  preset task (if you left task empty): $preset_task"
+    f_line ""
+    if [ "$has_cells" -eq 1 ]; then
+      # Same widths as a template row below: `     [✓] [1] ` is 13 columns, then
+      # the 24-wide name and a space, then one space before each 24 / 11 cell,
+      # then two before the 5-wide count (as wide as its title).
+      local head; head=$(printf '             %-24s ' "template")
+      [ "$has_mod" -eq 1 ] && head="$head $(printf '%-24s' "model")"
+      [ "$has_eff" -eq 1 ] && head="$head $(printf '%-11s' "effort")"
+      f_line "$(printf '\033[2m%s  %s\033[0m' "$head" "count")"
+    fi
+    for r in "${rows[@]}"; do
+      local line
+      case "$r" in
+        T*) i="${r#T}"
+            mark="[ ]"; [ "${on[$i]}" -eq 1 ] && mark="[✓]"
+            if [ "$r" = "$cur" ] && [ "$col" -eq 0 ]; then printf -v line '  \033[7m ▸ %s [%s] %-24s \033[0m' "$mark" "$((i + 1))" "${items[$i]}"
+            elif [ "$r" = "$cur" ]; then printf -v line '   ▸ %s [%s] %-24s ' "$mark" "$((i + 1))" "${items[$i]}"
+            else printf -v line '     %s [%s] %-24s ' "$mark" "$((i + 1))" "${items[$i]}"; fi
+            if [ "$has_cells" -eq 1 ]; then
+              local fm=0 fe=0 fc=0 folded=1
+              [ "$r" = "$cur" ] && [ "$col" -eq 1 ] && fm=1
+              [ "$r" = "$cur" ] && [ "$col" -eq 2 ] && fe=1
+              [ "$r" = "$cur" ] && [ "$col" -eq 3 ] && fc=1
+              { [ "${same[$i]}" -eq 0 ] && [ "${cnt[$i]}" -gt 1 ]; } && folded=0
+              if [ "$has_mod" -eq 1 ]; then
+                if [ "$folded" -eq 1 ] || [ -z "${MOD_VALS[$i]:-}" ]; then model_cell "${MOD_VALS[$i]:-}" "${mod[$i]}" "$fm"; line="$line $CELL"
+                elif [ "$fm" -eq 1 ]; then line="$line $(printf '\033[7m%-24s\033[0m' "each own")"
+                else line="$line $(printf '%-24s' "each own")"; fi
+              fi
+              if [ "$has_eff" -eq 1 ]; then
+                if [ "$folded" -eq 1 ] || [ "${EFF_KIND[$i]:-none}" = none ]; then effort_cell "${EFF_KIND[$i]:-none}" "${eff[$i]}" "$fe"; line="$line $CELL"
+                elif [ "$fe" -eq 1 ]; then line="$line $(printf '\033[7m%-11s\033[0m' "each own")"
+                else line="$line $(printf '%-11s' "each own")"; fi
+              fi
+              if [ "$fc" -eq 1 ]; then line="$line  $(printf '\033[7m%-5s\033[0m' "${cnt[$i]}")"; else line="$line  $(printf '%-5s' "${cnt[$i]}")"; fi
+              if [ "${cnt[$i]}" -gt 1 ]; then
+                [ "${same[$i]}" -eq 1 ] && line="$line $(printf '\033[2msame [✓]\033[0m')" || line="$line $(printf '\033[2msame [ ]\033[0m')"
+              fi
+              [ "${EFF_KIND[$i]:-none}" = generic ] && line="$line $(printf '\033[2m(%s)\033[0m' "${EFF_VIA[$i]}")"
+            fi
+            f_line "$line" ;;
+        I*) i="${r#I}"; j="${i#*:}"; i="${i%%:*}"
+            local glyph; [ "$j" -eq "${cnt[$i]}" ] && glyph="└ #$j" || glyph="├ #$j"
+            local fm=0 fe=0 rowfoc=0
+            [ "$r" = "$cur" ] && [ "$col" -eq 1 ] && fm=1
+            [ "$r" = "$cur" ] && [ "$col" -ge 2 ] && fe=1
+            [ "$r" = "$cur" ] && [ "$col" -eq 0 ] && rowfoc=1
+            if [ "$rowfoc" -eq 1 ]; then printf -v line '  \033[7m ▸          %-24s \033[0m' "$glyph"
+            elif [ "$fm" -eq 1 ] || [ "$fe" -eq 1 ]; then printf -v line '   ▸          %-24s ' "$glyph"
+            else printf -v line '              %-24s ' "$glyph"; fi
+            [ "$has_mod" -eq 1 ] && { model_cell "${MOD_VALS[$i]:-}" "$(instm_val "$i" "$j")" "$fm"; line="$line $CELL"; }
+            [ "$has_eff" -eq 1 ] && { effort_cell "${EFF_KIND[$i]:-none}" "$(inst_val "$i" "$j")" "$fe"; line="$line $CELL"; }
+            f_line "$line" ;;
+      esac
+      # The open list unfolds right under its row, at its cell's column.
+      if [ "$pop" -eq 1 ] && [ "$r" = "$cur" ]; then
+        local pti="${cur#[TI]}"; pti="${pti%%:*}"; local pij=""; case "$cur" in I*) pij="${cur#*:}" ;; esac
+        if [ "$pk" = mod ]; then
+          local curm="${mod[$pti]}"; [ -n "$pij" ] && curm=$(instm_val "$pti" "$pij")
+          list_lines "${MOD_VALS[$pti]}" "$curm" "$pidx" "$MODEL_WINDOW" "$(model_col 13)" 22
+        else
+          local cure="${eff[$pti]}"; [ -n "$pij" ] && cure=$(inst_val "$pti" "$pij")
+          list_lines "${EFF_VALS[$pti]}" "$cure" "$pidx" 0 "$(effort_col 13 "$has_mod")" 9
+        fi
+      fi
+    done
+    f_line ""
+    f_line "  $(printf '\033[2m%s member%s\033[0m' "$picked" "$([ "$picked" -eq 1 ] || printf s)")"
+    [ -n "$err" ] && { f_line ""; f_line "  $(printf '\033[31m%s\033[0m' "$err")"; }
+    local ti="${cur#[TI]}"; ti="${ti%%:*}"; local ij=""; case "$cur" in I*) ij="${cur#*:}" ;; esac
+    f_line ""
+    if [ "$pop" -eq 1 ]; then
+      local curv; if [ "$pk" = mod ]; then curv="${mod[$ti]}"; [ -n "$ij" ] && curv=$(instm_val "$ti" "$ij"); else curv="${eff[$ti]}"; [ -n "$ij" ] && curv=$(inst_val "$ti" "$ij"); fi
+      list_hint "$curv"
+    else
+      if [ "$has_cells" -eq 1 ]; then
+        f_line "  $(printf '\033[2mspace tick   ↑/↓ move   →/tab column   +/- count   s per-instance cells   enter launch (on a cell: its list)   q abort\033[0m')"
+      else
+        f_line "  $(printf '\033[2mspace toggles   ↑/↓ · j/k move   number toggles   enter launches   q aborts\033[0m')"
+      fi
+    fi
+    f_flush
+    chooser_read_key 300 "$refresh" q; refresh_rc=$?
+    case "$refresh_rc" in
+      3) unset CHOOSER_KEY; CHOOSER_REPAINT=1 ask_roster_tty "${CHOOSER_INPUT[@]}" "$refresh" "$presets" "$load_preset"; return $? ;;
+      0) ;;
+      *) chooser_close_tty; return "$refresh_rc" ;;
+    esac
     err=""
+    local at=0; for r in "${!rows[@]}"; do [ "${rows[$r]}" = "$cur" ] && at=$r; done
+    # which cells the row under the cursor has, for the column walk
+    local rm=0 re=0; row_has "$ti" mod && rm=1; row_has "$ti" eff && re=1
+    if [ "$pop" -eq 1 ]; then
+      local vals cnt_v take=0
+      [ "$pk" = mod ] && vals="${MOD_VALS[$ti]}" || vals="${EFF_VALS[$ti]}"
+      cnt_v=$(effort_count "$vals")
+      case "$key" in
+        j|J) pidx=$(( (pidx + 2) % (cnt_v + 1) - 1 )) ;;
+        k|K) pidx=$(( (pidx + cnt_v + 1) % (cnt_v + 1) - 1 )) ;;
+        [0-9]) [ "$key" -le "$cnt_v" ] && { pidx=$((key - 1)); take=1; } ;;
+        ''|$'\n'|$'\r') take=1 ;;
+        q|Q) pop=0 ;;
+        $'\e')
+          chooser_escape_tail
+          case "$rest" in
+            '[A'|'OA') pidx=$(( (pidx + cnt_v + 1) % (cnt_v + 1) - 1 )) ;;
+            '[B'|'OB') pidx=$(( (pidx + 2) % (cnt_v + 1) - 1 )) ;;
+            '') pop=0 ;;
+          esac ;;
+      esac
+      if [ "$take" -eq 1 ]; then
+        local v; v=$(effort_at "$vals" "$pidx")
+        if [ "$pk" = mod ]; then
+          if [ -n "$ij" ]; then instm_set "$ti" "$ij" "${v:--}"; else mod[$ti]="$v"; fi
+        elif [ -n "$ij" ]; then inst_set "$ti" "$ij" "${v:--}"; else eff[$ti]="$v"; fi
+        # The list closes and the focus stays on the cell just set; ←/shift-tab to
+        # the template column (or → to the count) and enter launches.
+        pop=0
+      fi
+      continue
+    fi
     case "$key" in
-      ' ')   on[$sel]=$((1 - on[sel])) ;;
-      [1-9]) [ "$key" -le "$n" ] && { sel=$((key - 1)); on[$sel]=$((1 - on[sel])); } ;;
-      j|J)   sel=$(((sel + 1) % n)) ;;
-      k|K)   sel=$(((sel - 1 + n) % n)) ;;
+      ' ')   on[$ti]=$((1 - on[ti])) ;;
+      [1-9]) [ "$key" -le "$n" ] && { cur="T$((key - 1))"; on[$((key - 1))]=$((1 - on[key - 1])); } ;;
+      j|J)   cur="${rows[$(((at + 1) % ${#rows[@]}))]}" ;;
+      k|K)   cur="${rows[$(((at - 1 + ${#rows[@]}) % ${#rows[@]}))]}" ;;
+      # → and tab walk the row's cells and then on to the NEXT row's first column;
+      # ← and shift-tab walk the same path backwards.
+      l|L|$'\t') maxc="$maxcol"; [ -n "$ij" ] && maxc=2; nc=$(col_step "$col" 1 "$maxc" "$rm" "$re")
+             if [ "$nc" = "$col" ]; then cur="${rows[$(((at + 1) % ${#rows[@]}))]}"; col=0; else col=$nc; fi ;;
+      h|H)   roster_back ;;
+      p)     roster_preset 1 ;;
+      P)     roster_preset -1 ;;
+      '+'|'=') [ "${cnt[$ti]}" -lt 20 ] && { cnt[$ti]=$((cnt[ti] + 1)); inst_set "$ti" "${cnt[$ti]}" "${eff[$ti]:--}"; instm_set "$ti" "${cnt[$ti]}" "${mod[$ti]:--}"; } ;;
+      '-'|'_') [ "${cnt[$ti]}" -gt 1 ] && cnt[$ti]=$((cnt[ti] - 1)) ;;
+      s|S)   { row_has "$ti" eff || row_has "$ti" mod; } && unfold "$ti" ;;
       ''|$'\n'|$'\r')
-        # An empty roster is not a fleet — say so and stay put rather than
-        # launching nothing and calling it a success.
-        if [ "$picked" -gt 0 ]; then break; fi
-        err="pick at least one template — a fleet with no members is nothing" ;;
+        # On a template row: the model cell (1) or the effort cell (2) opens its
+        # list, the count cell (3) launches. On an instance row: col 1 is its model
+        # cell, anything to the right its effort cell.
+        if [ "$col" -eq 1 ] && row_has "$ti" mod; then
+          local curv="${mod[$ti]}"; [ -n "$ij" ] && curv=$(instm_val "$ti" "$ij")
+          pop=1; pk=mod; pidx=$(effort_index "${MOD_VALS[$ti]}" "$curv")
+        elif row_has "$ti" eff && { { [ -n "$ij" ] && [ "$col" -ge 1 ]; } || [ "$col" -eq 2 ]; }; then
+          local curv="${eff[$ti]}"; [ -n "$ij" ] && curv=$(inst_val "$ti" "$ij")
+          pop=1; pk=eff; pidx=$(effort_index "${EFF_VALS[$ti]}" "$curv")
+        elif [ "$picked" -gt 0 ]; then break
+        else err="pick at least one template — a fleet with no members is nothing"; fi ;;
       q|Q)   chooser_close_tty; return 2 ;;
       $'\e')
-        IFS= read -rsn2 -t 1 rest <&4
+        chooser_escape_tail
         case "$rest" in
-          '[A'|'OA') sel=$(((sel - 1 + n) % n)) ;;
-          '[B'|'OB') sel=$(((sel + 1) % n)) ;;
+          '[A'|'OA') cur="${rows[$(((at - 1 + ${#rows[@]}) % ${#rows[@]}))]}" ;;
+          '[B'|'OB') cur="${rows[$(((at + 1) % ${#rows[@]}))]}" ;;
+          '[C'|'OC') maxc="$maxcol"; [ -n "$ij" ] && maxc=2; nc=$(col_step "$col" 1 "$maxc" "$rm" "$re")
+                     if [ "$nc" = "$col" ]; then cur="${rows[$(((at + 1) % ${#rows[@]}))]}"; col=0; else col=$nc; fi ;;
+          '[D'|'OD') roster_back ;;
+          '[Z')      roster_back ;;   # shift-tab
           '')        chooser_close_tty; return 2 ;;   # bare Esc = abort, like q
         esac ;;
     esac
   done
   chooser_close_tty
+  [ -z "$preset" ] || printf '@preset\t%s\n' "$preset"
   i=0
   while [ "$i" -lt "$n" ]; do
-    [ "${on[$i]}" -eq 1 ] && printf '%s\n' "${items[$i]}"
+    if [ "${on[$i]}" -eq 1 ]; then
+      j=1
+      while [ "$j" -le "${cnt[$i]}" ]; do
+        local e="${eff[$i]}" m="${mod[$i]}"
+        [ "${same[$i]}" -eq 0 ] && [ "${cnt[$i]}" -gt 1 ] && { e=$(inst_val "$i" "$j"); m=$(instm_val "$i" "$j"); }
+        member_line "${items[$i]}" "$e" "$m" 1
+        j=$((j + 1))
+      done
+    fi
     i=$((i + 1))
   done
 }
 
+
 # One verb from a short list, drawn like the template chooser so leaving a box
 # feels like booting one. Rows are `id|hotkey|label|note`, one per line:
 #
@@ -351,7 +967,7 @@ EOF
   chooser_open_tty || return 1
   printf '\033[?1049h\033[?25l' >&3
   while :; do
-    printf '\033[2J\033[H' >&3
+    printf '\033[H' >&3
     printf '\n  \033[1m%s\033[0m\n\n' "$title" >&3
     i=0
     while [ "$i" -lt "$n" ]; do
@@ -362,17 +978,18 @@ EOF
       fi
       [ "$wide" -gt 0 ] && printf ' \033[2m%-*s\033[0m' "$wide" "${notes[$i]}" >&3
       [ "${ids[$i]}" = "$resolved" ] && printf ' \033[2mdefault\033[0m' >&3
-      printf '\n' >&3
+      printf '\033[K\n' >&3
       i=$((i + 1))
     done
     printf '\n  \033[2m↑/↓ move   enter confirm   letter picks   number jumps   q/esc %s\033[0m\n' "$resolved" >&3
+    printf '\033[J' >&3
     IFS= read -rsn1 -t 120 key <&4 || { chooser_close_tty; return 2; }
     case "$key" in
       ''|$'\n'|$'\r') hit="${ids[$sel]}" ;;
       [1-9]) [ "$key" -le "$n" ] && hit="${ids[$((key - 1))]}" ;;
       q|Q)   chooser_close_tty; return 2 ;;
       $'\e')
-        IFS= read -rsn2 -t 1 rest <&4
+        chooser_escape_tail
         case "$rest" in
           '[A'|'OA') sel=$(((sel - 1 + n) % n)) ;;
           '[B'|'OB') sel=$(((sel + 1) % n)) ;;
diff --git a/bin/lib/pane.sh b/bin/lib/pane.sh
index d067002..8ba00b5 100644
--- a/bin/lib/pane.sh
+++ b/bin/lib/pane.sh
@@ -110,3 +110,50 @@ pane_open_below() {
   shift
   pane_open_from "$entrypoint" below ${1+"$@"}
 }
+
+# The worktree an action was invoked from. herdr runs an action with the NEW
+# pane's cwd (often the plugin root), and hands the real one in the plugin
+# context; a plain shell has neither and is where it stands.
+pane_context_cwd() {
+  local node c=""
+  if [ -n "${HERDR_PLUGIN_CONTEXT_JSON:-}" ] && node=$(pane_node); then
+    c=$(printf '%s' "$HERDR_PLUGIN_CONTEXT_JSON" | "$node" "$PLUGIN_DIR/src/pane-parse.js" cwd)
+  fi
+  if [ "${c:--}" != "-" ] && [ -d "$c" ]; then printf '%s' "$c"; else printf '%s' "$PWD"; fi
+}
+
+# The popup as a CONFIG surface. Opens the titled popup entrypoint (bin/e2b-popup
+# --render) in one of its modes over the invoking pane:
+#
+#   pane_open_popup <mode> [cwd] [origin-pane]
+#
+# `dashboard` is the board itself; `pick-box` asks which template, model and
+# effort a box should boot with and then opens that box in a regular pane under
+# the origin pane; `pick-fleet` asks the fleet's slug, task and roster and then
+# becomes the board while the members provision. The popup's own terminal is
+# discarded when it closes, so nothing that has to outlive the answer runs in it.
+# `origin` is the pane the popup floats over (inside the popup, context and focus
+# both name the popup, so it can only be read here, before it opens) and travels
+# as E2B_DASH_ORIGIN_PANE; `cwd` is the worktree the question is about and
+# travels as the pane's cwd AND as E2B_PICK_CWD.
+pane_open_popup() {
+  local mode="$1" cwd="${2:-}" origin="${3:-}" herdr node
+  herdr=$(pane_herdr) || { echo "e2b: can't find the herdr binary" >&2; return 1; }
+  node=$(pane_node) || { echo "e2b: can't find node, set HERDR_E2B_NODE=/path/to/node" >&2; return 1; }
+  if [ -z "$origin" ]; then
+    origin=$(printf '%s' "${HERDR_PLUGIN_CONTEXT_JSON:-}" | "$node" "$PLUGIN_DIR/src/pane-parse.js" origin)
+  fi
+  if [ "${origin:--}" = "-" ]; then
+    read -r origin _ _ <<EOF
+$(pane_query "$herdr" "$node" "")
+EOF
+  fi
+  # The dashboard is the mode --render assumes, so it travels unnamed: the call
+  # e2b-popup has always made stays exactly what it was.
+  local args=(--env E2B_DASH_POPUP=1)
+  [ "$mode" = dashboard ] || args+=(--env "E2B_POPUP_MODE=$mode")
+  [ "${origin:--}" = "-" ] || args+=(--env "E2B_DASH_ORIGIN_PANE=$origin")
+  [ -z "$cwd" ] || args+=(--cwd "$cwd" --env "E2B_PICK_CWD=$cwd")
+  "$herdr" plugin pane open --plugin e2b-dev.herdr-e2b --entrypoint popup \
+    --placement popup --width 90% --height 85% "${args[@]}" >/dev/null
+}
diff --git a/bin/lib/paths.sh b/bin/lib/paths.sh
index 1c7be94..04ffbf9 100644
--- a/bin/lib/paths.sh
+++ b/bin/lib/paths.sh
@@ -9,6 +9,11 @@ STATE_DIR="${HERDR_PLUGIN_STATE_DIR:-${HERDR_E2B_STATE_DIR:-${XDG_STATE_HOME:-$H
 # Keep IN SYNC with src/config.js and install.sh.
 CONFIG_DIR="${HERDR_PLUGIN_CONFIG_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/herdr/plugins/config/e2b-dev.herdr-e2b}"
 BOXES_DIR="$STATE_DIR/boxes"
+PICKERS_DIR="$STATE_DIR/pickers"
+# Cwd is the identity, as for box records. Prefixing each component keeps a
+# checkout named "input" from colliding with its parent's cache file, and lets
+# the popup locate its input with bash alone, before hashing or starting Node.
+picker_cache_path() { local prefix="/d-"; printf '%s%s/input' "$PICKERS_DIR" "${PWD//\//$prefix}"; }
 mkdir -p "$BOXES_DIR" 2>/dev/null || true
 
 # The plugin's version, read from the manifest so `--version` on any binary and
diff --git a/bin/lib/picker-cache.sh b/bin/lib/picker-cache.sh
new file mode 100644
index 0000000..f3f0de4
--- /dev/null
+++ b/bin/lib/picker-cache.sh
@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# Cache only chooser arguments, never answers or credentials. NUL fields are data,
+# not shell source, so a worktree or model name cannot become executable code.
+picker_preset_names() {
+  local file name
+  for file in "$CONFIG_DIR"/presets/*.json; do
+    [ -f "$file" ] || continue
+    name="${file##*/}"; name="${name%.json}"
+    [[ "$name" =~ ^[A-Za-z0-9][A-Za-z0-9_-]*$ ]] && printf '%s\n' "$name"
+  done
+  return 0
+}
+
+picker_preset_rows() {
+  local node
+  node=$(pane_node) || return 1
+  "$node" "$PLUGIN_DIR/src/fleet-spec.js" --rows "$1"
+}
+
+picker_cache_read() {
+  local value
+  PICKER_CACHE=()
+  [ -r "$1" ] || return 1
+  while IFS= read -r -d '' value; do PICKER_CACHE+=("$value"); done < "$1"
+  [ "${#PICKER_CACHE[@]}" -eq 14 ] && [ "${PICKER_CACHE[0]}" = 1 ] && [ "${PICKER_CACHE[1]}" = "$PWD" ] || return 1
+  [[ "${PICKER_CACHE[6]}" =~ ^[0-9]*$ && "${PICKER_CACHE[11]}" =~ ^[0-9]*$ ]]
+}
+
+picker_cache_write() {
+  local mode="$1" file tmp i offset=3; shift
+  file=$(picker_cache_path)
+  picker_cache_read "$file" || PICKER_CACHE=(1 "$PWD" "${PICKER_BOX_KEY:-$(box_key "$PWD")}" '' '' '' '' '' '' '' '' '' '' '')
+  [ "$mode" = fleet ] && offset=9
+  for i in "$@"; do PICKER_CACHE[$offset]="$i"; offset=$((offset + 1)); done
+  if mkdir -p "${file%/*}" && tmp=$(mktemp "$file.XXXXXX"); then
+    printf '%s\0' "${PICKER_CACHE[@]}" > "$tmp" && mv -f "$tmp" "$file"
+  fi
+  # Each popup receives its own result, so another popup cannot settle its read.
+  [ -z "${E2B_PICKER_INPUT:-}" ] || printf '%s\0' "${PICKER_CACHE[@]}" > "$E2B_PICKER_INPUT"
+  return 0
+}
+
+# Called by the chooser only AFTER its frame is flushed. Every reopen resolves
+# again, including config/catalog edits, branch rules, auth and live box records.
+# This deliberately has no dependency fingerprint that could miss an input.
+picker_refresh() {
+  local rc old new
+  [ "${picker_fresh_screen:-}" != "$picker_screen" ] || return 0
+  if [ -z "${picker_job:-}" ]; then
+    (
+      HERDR_PLUGIN_CONTEXT_JSON= E2B_PICKER_INPUT="$picker_work/input" "$DIR/e2b-box" "$picker_command" > "$picker_work/out" 2> "$picker_work/error"
+      printf '%s\n' "$?" > "$picker_work/done"
+    ) &
+    picker_job=$!
+  fi
+  [ -f "$picker_work/done" ] || return 1
+  IFS= read -r rc < "$picker_work/done"
+  if [ "$rc" != 0 ]; then cat "$picker_work/error" >&2; return 5; fi
+  old=$(printf '%s\034' "${CHOOSER_INPUT[@]}")
+  picker_cache_read "$picker_work/input" || return 5
+  [ "$picker_screen" != box ] || [ -n "${PICKER_CACHE[5]}" ] || return 4
+  case "$picker_screen" in
+    box) CHOOSER_INPUT=("${PICKER_CACHE[@]:3:6}") ;;
+    slug) CHOOSER_INPUT=("${PICKER_CACHE[9]}" picker_slug_valid task) ;;
+    roster) CHOOSER_INPUT=("$picker_slug" "${PICKER_CACHE[@]:10:4}") ;;
+  esac
+  new=$(printf '%s\034' "${CHOOSER_INPUT[@]}")
+  picker_fresh_screen="$picker_screen"
+  [ "$old" = "$new" ] || return 3
+  return 0
+}
+
+picker_slug_valid() {
+  local node
+  node=$(pane_node) || return 1
+  "$node" "$PLUGIN_DIR/src/fleet-name.js" "$1" base >/dev/null 2>&1
+}
+
+picker_popup_prepare() {
+  picker_work=$(mktemp -d "$STATE_DIR/pickers/refresh.XXXXXX") || return 1
+  picker_job=""; picker_fresh_screen=""
+  trap '[ -z "$picker_job" ] || kill "$picker_job" 2>/dev/null; rm -rf "$picker_work"' EXIT
+}
+
+picker_popup_box() {
+  local rc
+  picker_popup_prepare || return 1
+  picker_command=pick; picker_screen=box
+  CHOOSER_INPUT=("${PICKER_CACHE[@]:3:6}")
+  ask_template_tty "${CHOOSER_INPUT[@]}" picker_refresh > "$picker_work/answer"; rc=$?
+  if [ "$rc" -eq 4 ]; then cat "$picker_work/out"; return 0; fi
+  [ "$rc" -eq 0 ] || return "$rc"
+  printf '%s\n' "${PICKER_CACHE[2]}"
+  cat "$picker_work/answer"
+}
+
+picker_popup_fleet() {
+  local rc task t e m args=()
+  picker_popup_prepare || return 1
+  picker_command=fleet; picker_screen=slug
+  CHOOSER_INPUT=("${PICKER_CACHE[9]}" picker_slug_valid task)
+  ask_slug_tty "${CHOOSER_INPUT[@]}" picker_refresh > "$picker_work/answer"; rc=$?
+  [ "$rc" -eq 0 ] || return "$rc"
+  { IFS= read -r picker_slug; IFS= read -r task || true; } < "$picker_work/answer"
+  picker_screen=roster
+  CHOOSER_INPUT=("$picker_slug" "${PICKER_CACHE[@]:10:4}")
+  ask_roster_tty "${CHOOSER_INPUT[@]}" picker_refresh "$(picker_preset_names)" picker_preset_rows > "$picker_work/answer"; rc=$?
+  [ "$rc" -eq 0 ] || return "$rc"
+  while IFS=$'\t' read -r t e m; do
+    if [ "$t" = @preset ]; then args+=(--preset "$e"); continue; fi
+    [ "$e" != - ] || e=""
+    [ -z "$t" ] || args+=(-t "$t${m:+:$m}${e:+@$e}")
+  done < "$picker_work/answer"
+  rm -rf "$picker_work"; trap - EXIT
+  HERDR_PLUGIN_CONTEXT_JSON= E2B_PICKER_DIRTY_NOTE="${PICKER_CACHE[9]}" exec "$DIR/e2b-box" fleet --slug "$picker_slug" ${task:+--task "$task"} "${args[@]}"
+}
diff --git a/config/config.example.toml b/config/config.example.toml
index 1edad3f..cb16531 100644
--- a/config/config.example.toml
+++ b/config/config.example.toml
@@ -222,21 +222,34 @@ server_port  = 3000
 # on an image model with no tool use). Set here once instead of `-m` in every launch
 # command.
 #
-# Both keys are optional, free strings, each harness's own vocabulary:
-#
-#   template  model                                   reasoning
-#   claude    a Claude model id or alias              low | medium | high | xhigh
-#   codex     an OpenAI model id                      minimal | low | medium | high | xhigh
-#   grok      a grok model id (grok-build, grok-4.5)  none … max
-#   droid     a Factory model id (glm-5.2, kimi-k3)   off | low | medium | high | max, per model
-#   prime     "<provider>/<model>", split at the      prime's thinking levels (off … max)
-#             first slash (openai-codex/gpt-6-astra,
-#             prime-inference/z-ai/glm-5.2)
-#   opencode  "<provider>/<model>" as `opencode        (not pinned: opencode does reasoning as
-#             models` prints it                        per-model variants)
-#   muse      (not pinned: no verified settings key,   none … ultra
-#             use --model in your agent command)
-#   amp       (nothing: amp has no model setting, `--mode low|medium|high|ultra` is its knob)
+# The pickers (`e2b-box open`'s template list, the fleet's roster table) show
+# `model` and `reasoning` as cells that open on these pins and can be cycled per box
+# or per member, from the catalog below; `e2b-box open --model gpt-5.5 --reasoning
+# xhigh` and `e2b-fleet -t codex:gpt-5.5*3@ultra` say the same from a script. Those
+# override the pin for THAT box only, and are checked against the catalog first.
+#
+# Both keys are optional, free strings, each harness's own vocabulary. How a model is
+# SPELLED is the plugin's business: bare ids for claude, codex, grok and droid (as the
+# CLI prints them); "<provider>/<model>" for prime and opencode, split at the FIRST
+# slash (openai-codex/gpt-6-astra, prime-inference/z-ai/glm-5.2); muse has no
+# verified settings key for a model and amp no model setting at all, so for those
+# two `model` is reported and not written. What each CLI ACCEPTS is read off the CLI
+# in its template and lives in the block below:
+#
+# <catalog>
+# Generated by `npm run catalog -- --write` from the CLI shipped in each template.
+# Do not edit this block: rerun the script. Per-model detail is in
+# src/harness-catalog.generated.js.
+#   template  cli                     model                                                   reasoning
+#   claude    2.1.265                 14: claude-fable-5, claude-fable-5-1, …                 low | medium | high | xhigh | max (per model)
+#   codex     0.153.4                 6: gpt-6-astra, gpt-5.6-sol, …                          low | medium | high | xhigh | max | ultra (per model)
+#   grok      1.0.5                   2: grok-4.6, grok-4.5                                   low | medium | high | xhigh (per model)
+#   droid     0.213.0                 50: auto, claude-fable-5.1, …                           none | off | minimal | low | medium | high | xhigh | max (per model)
+#   amp       0.0.1788926461-g32d216  42 listed, no pin route: alibaba/qwen3.8-max, …         --mode low | medium | high | ultra (amp's knob is the mode)
+#   prime     0.7.0                   104: prime-inference/anthropic/claude-fable-5, …        off | minimal | low | medium | high | xhigh | max
+#   muse      0.2.1                   (no pinnable model: use --model in your agent command)  none | minimal | low | medium | high | xhigh | ultra
+#   opencode  1.18.18                 any models.dev "<provider>/<model>"                     (not pinned: opencode does reasoning as per-model variants in its UI)
+# </catalog>
 #
 # How it reaches the agent is the harness's own way (src/model-pin.js): claude and
 # opencode read it from the environment (ANTHROPIC_MODEL, CLAUDE_CODE_EFFORT_LEVEL,
@@ -305,6 +318,12 @@ ignore = [".git", "node_modules", ".next", "dist", "build", ".turbo", ".cache",
 # already selected when the picker opens.
 # default_roster = ["claude", "codex", "grok"]
 
+# Reusable counts, models and reasoning live in JSON files under presets/ beside
+# this config. Select with p / Shift+P in the roster, or run headlessly:
+#   e2b-box fleet login-fix --preset compare --task "Fix the login loop"
+#   e2b-box fleet create --file fleet.json --dry-run
+# See docs/fleet-presets.md for the JSON format; `fleet presets` lists names.
+
 # Which command starts a member's agent once its box is ready, per template.
 #
 # The shipped defaults start each agent UNATTENDED — with that vendor's own
diff --git a/config/presets/compare.json b/config/presets/compare.json
new file mode 100644
index 0000000..62b036f
--- /dev/null
+++ b/config/presets/compare.json
@@ -0,0 +1,6 @@
+{
+  "members": [
+    { "template": "codex", "model": "gpt-6-astra", "reasoning": "high", "count": 2 },
+    { "template": "claude", "model": "claude-fable-5", "reasoning": "max" }
+  ]
+}
diff --git a/docs/adr/0014-amps-refresh-token-rotates-so-its-session-is-not-borrowable.md b/docs/adr/0014-amps-refresh-token-rotates-so-its-session-is-not-borrowable.md
new file mode 100644
index 0000000..bf165e3
--- /dev/null
+++ b/docs/adr/0014-amps-refresh-token-rotates-so-its-session-is-not-borrowable.md
@@ -0,0 +1,62 @@
+# Amp's refresh token rotates, so its session is not borrowable (applies 0010, contrasts 0011)
+
+**Applies:** [0010 — a session in a file is borrowable](0010-a-session-in-a-file-is-borrowable-amending-0009.md)
+**Contrasts:** [0011 — grok's refresh token is multi-use](0011-groks-refresh-token-is-multi-use-so-its-session-ships-whole.md)
+
+`amp login` stores its browser session in `~/.local/share/amp/secrets.json`: an
+access token under `apiKey@https://ampcode.com/` and a refresh token under
+`oauth-refresh-token@https://ampcode.com/`. A plain file, mode 600, inside 0009's
+read boundary. The question 0010 and 0011 ask of such a file is whether a box can
+hold a copy without either dying early or logging the laptop out. For amp the
+answer to both halves is no, and this ADR records the measurements so nobody
+re-derives them.
+
+## The measurements
+
+Decoded from a live login (2026-09-09), the access token is a WorkOS AuthKit JWT
+(`iss` `https://authapi.ampcode.com`, WorkOS `user_…` / `client_…` ids) with
+`exp - iat` = **300 seconds**. Five minutes. 0010's bearer-lifetime test is not
+close: a box handed the bearer alone is signed out before its first task finishes.
+Amp itself says as much when the bearer is offered as `AMP_API_KEY`: "holds an
+OAuth session token, which is short-lived".
+
+So borrowing would rest entirely on the refresh half, exactly 0011's argument for
+grok. Against `POST https://authapi.ampcode.com/user_management/authenticate`
+(`grant_type=refresh_token`, `client_id`, `refresh_token`; live account,
+2026-09-09):
+
+- refresh grant with the laptop's token R0 → **200**, new bearer, a **new** refresh
+  token R1;
+- R0 again, two seconds later → **200** (a reuse grace window);
+- R0 again, thirty seconds later → **400**;
+- R1 → 200 and R2, R1 not tested further; every grant that succeeded rotated.
+
+Amp's refresh tokens **rotate and invalidate**, with a grace window of seconds.
+That is codex's shape (0010), not grok's (0011): two holders refreshing every five
+minutes are two rotators, and the second one to refresh finds its token dead. With
+the laptop and one box that is a coin toss per interval over who gets signed out;
+with a fleet it is a certainty.
+
+## Decision
+
+Amp's session is **not borrowed**. `readHarnessFile` for amp (`HARNESSES.amp.valueFile`)
+reads the `apiKey@…` entry as a key only when it is not a JWT; a JWT-shaped value
+resolves to "signed in, nothing to borrow", and the remedy names the credential
+that does work: an **access token** minted at
+https://ampcode.com/settings/security#access-token and set as `AMP_API_KEY`
+(`[templates.amp.env]`, or found by `e2b-box auth` once it is in the environment).
+That token is long-lived, per-user, revocable, and refreshes nothing, so N boxes and
+the laptop can hold it at once. `amp login`'s file is left exactly as it is.
+
+The 0010 placeholder trick (ship the bearer, replace the refresh token) is not
+taken either: it would produce a five-minute member, which is worse than a named
+gap. 0011's verbatim rule stays reserved for a harness whose refresh grant has been
+measured multi-use, and amp measured the opposite.
+
+## Consequences
+
+An amp fleet member needs one manual step per user, once. The plugin's job is to
+say so precisely and early (the fleet pre-flight names the member, the template and
+the variable before anything boots), never to reach for the session file and hope.
+If amp ever ships long-lived bearers or non-rotating refresh tokens, this ADR is
+what to re-measure against; until then the JWT check is the boundary.
diff --git a/docs/adr/0015-the-plugin-signs-in-itself-and-stores-what-the-vendor-mints.md b/docs/adr/0015-the-plugin-signs-in-itself-and-stores-what-the-vendor-mints.md
new file mode 100644
index 0000000..0129833
--- /dev/null
+++ b/docs/adr/0015-the-plugin-signs-in-itself-and-stores-what-the-vendor-mints.md
@@ -0,0 +1,60 @@
+# The plugin signs in itself and stores what the vendor mints (extends 0013)
+
+**Extends:** [0013 — connections select one credential before a box is created](0013-connections-select-one-credential-before-a-box-is-created.md)
+**Informed by:** [0010](0010-a-session-in-a-file-is-borrowable-amending-0009.md), [0011](0011-groks-refresh-token-is-multi-use-so-its-session-ships-whole.md), [0014](0014-amps-refresh-token-rotates-so-its-session-is-not-borrowable.md)
+
+Every credential this plugin has handled so far is one it **found**: a variable in
+the shell, a key in a harness's config file, a session a harness left on disk. That
+is the right default, and it has a ceiling. A found session belongs to the laptop's
+own CLI, so the plugin may only copy it under rules that keep the two from rotating
+each other out (0010's placeholder, 0011's measured multi-use), and a harness whose
+session is short-lived and rotating (amp, 0014) offers nothing to copy at all.
+
+replicas-cli takes the other road for the same problem: it runs each vendor's OAuth
+flow **itself**, with the public client id that vendor's CLI ships, and keeps the
+result on its own server. This ADR takes the first half of that and drops the
+server: `e2b-box auth connect <harness>` signs in as the plugin and stores what
+comes back as a connection (0013), under `connections/`, mode 600, one file per
+revision.
+
+## What is stored is what the vendor mints, not the session
+
+The session that a sign-in yields is not the artifact. What each vendor hands out
+*after* the sign-in is:
+
+| harness | sign-in | stored | why |
+|---|---|---|---|
+| muse | Meta device flow (`auth.meta.com/oidc/device`) | the **Muse API key** Meta mints for the account (`api.meta.ai/muse-code/key`) | a key: no refresh, no expiry to track, N boxes at once. It is what `muse login` stores for itself. |
+| amp | none: the plugin opens `ampcode.com/settings/security` and takes the **access token** (`sgamp_…`) the human pastes | that token | 0014: amp's OAuth session is a five-minute bearer with a rotating refresh token, and the page that shows the access token reads it through a remote function that accepts only the browser's cookie session and demands a *recent* sign-in (`REAUTH_REQUIRED`), measured 2026-09-09. No CLI-held credential passes that gate, by design, so the plugin's own device sign-in would buy nothing. One paste, once. |
+| codex | Codex CLI's PKCE flow against `auth.openai.com`, client `app_EMoamEEZ73f0CkXaXp7hrann` | the **auth.json** of a second, plugin-owned ChatGPT login, real refresh token included | the plugin is that chain's *only* custodian: boxes get 0010's placeholder copy, `~/.codex` is never read or written, and `auth reconnect` refreshes without a browser while the chain is alive. |
+
+claude keeps `setup-token` (0013): a one-year token beats anything an OAuth bearer
+offers. grok keeps its borrowed session (0011). droid, prime and opencode have API
+keys and no OAuth to run.
+
+## Custody, in one sentence per harness
+
+A rotating refresh token has exactly one legitimate holder. For muse and amp the
+answer is "nobody": what is stored refreshes nothing. For codex the holder is the
+plugin, and only two verbs ever touch it, `auth reconnect` (refresh, then browser if
+the grant fails) and `auth connect --oauth` (a new chain). Provisioning reads the
+stored bearer synchronously and, when it has expired, says *reconnect* rather than
+refreshing behind the user's back: a box create must stay a pure read of config and
+connections, which is what keeps `explain`, `preflight` and the fleet's pre-flight
+honest about what a box will get.
+
+## Consequences
+
+- One browser approval per harness per machine, once. Nothing is scraped from the
+  laptop's own logins, so signing out of a vendor's CLI locally does not affect a
+  connection, and vice versa.
+- Client ids are public clients copied from shipped CLIs. A vendor that rotates
+  its client id, changes a redirect, or gates its device flow breaks `connect`
+  loudly and nothing else; existing connections keep working until their material
+  expires.
+- amp is the honest exception: `auth connect amp` is a paste, because the token
+  lives behind an identity re-check in the browser. The measurements that rule out
+  every automated route are recorded in `src/oauth.js` so the question is not
+  reopened by the next reader.
+- The flows are exercised by `test/oauth.test.js` against a scripted server; the
+  connections by `test/connections.test.js`. No test signs in anywhere.
diff --git a/docs/adr/0016-the-catalog-is-read-off-the-box-never-typed.md b/docs/adr/0016-the-catalog-is-read-off-the-box-never-typed.md
new file mode 100644
index 0000000..d7ed1c2
--- /dev/null
+++ b/docs/adr/0016-the-catalog-is-read-off-the-box-never-typed.md
@@ -0,0 +1,68 @@
+# The catalog is read off the box, never typed
+
+Which effort words a harness accepts and which models it lists are facts about the
+binary shipped in that harness's E2B template. The plugin does not write them down; it
+asks that binary and commits the answer. `scripts/harness-catalog.mjs` boots one
+throwaway sandbox per shipped template, runs each harness's own catalog probes inside it
+(src/catalog.js), and writes what came back into `src/harness-catalog.generated.js`, the
+`<catalog>` block in `config/config.example.toml`, and `test/fixtures/catalog/`.
+`src/effort.js` derives every scale from the generated module and keeps only the plugin's
+overlay by hand: how a pin travels, and which words the picker declines to offer.
+
+The tables this replaces were typed. `EFFORT_SCALES` in `src/effort.js` and the template
+table in `config/config.example.toml` were both "verified against the CLI in each
+template" on the same day and disagreed with each other on codex (`minimal` in one,
+`max` in the other) and on droid (seven words against nine), with a third copy pinned in
+the test and a fourth in a comment. They had been verified against a laptop. Every
+template but one ships a different CLI version than the machine that typed the row, and
+the difference changes answers in both directions: the box's `muse` had no `max` the
+laptop's had, and the box's `amp` had no per-model efforts key the laptop's did
+(docs/research/0003-model-and-effort-catalogs.md). The CLI in the box is the one that will
+accept or reject a pin, so it is the only oracle that counts.
+
+No registry answers this question. models.dev knows every model id and, for a few
+providers, each model's effort values; OpenRouter, LiteLLM and the AI Gateway know
+subsets. All of them are keyed by inference provider, and this table is keyed by
+coding-agent CLI: `ultra`, `dynamic`, `off` and `none` are words the CLIs invented and
+appear in no registry at all. So model ids come from the CLI where it enumerates them and
+from models.dev where it does not (claude), and effort words always come from the CLI.
+Five of eight CLIs print their whole vocabulary when fed a sentinel value, which is ADR
+0009's spawn-the-binary probe applied to a different question, and the same shape as
+`interpretProbe`: a shipped table beside a pure function that reads results and never
+spawns, so every parse rule runs in CI from captured output.
+
+## Consequences
+
+The generated module is regenerated, never edited. A row changes when the script is
+rerun and the world moved: a template rebuilt with a newer CLI, a model added or retired,
+a word gained or lost. `--check` exits 2 on such drift and writes nothing; `--write`
+accepts it. The release skill runs the check before tagging, so a release ships the
+catalog of the templates it will boot, and a user can run the same command whenever
+their templates were rebuilt.
+
+A failed probe never blanks a row. An unauthenticated or offline run keeps the committed
+row and marks it `stale: { since, reason }`, which the report and the rendered table
+say out loud; otherwise one bad run would empty every scale and invalidate every user's
+pin at once. And a credential is never printed and never on a command line: every probe
+runs unauthenticated, or reads a variable the box already holds by name, so the
+script's output is safe to paste into a PR.
+
+The catalog is per model, not per harness, because the CLIs are: `grok-4.6` takes
+`xhigh` and `grok-4.5` does not, droid's `minimax-m3` takes `high` alone, and droid
+accepts any of its words at the flag and then silently runs the model's default at exit
+0. Each model row carries its own efforts and default where the CLI says so, and
+`effortsForModel` is the check the plugin can make that the CLI will not.
+
+The catalog is account-scoped, and says so. droid filters its bundled models by feature
+flags, codex by plan, grok by team, and the boxes the script boots are the ones THIS
+config resolves (`ondrejs-project/claude` behind the alias `claude`, not E2B's public
+image). Each row records the template build it was read from, so a reader can tell
+which image answered and whether it has since been rebuilt.
+
+What stays hand-written: `kind` and `via` (plugin facts about the pin route, not
+harness facts), the words the picker omits (droid's `none` and `dynamic` mean "let the
+model decide"), amp's scale being its `--mode` list rather than its `--reasoning-effort`
+vocabulary (two vocabularies that share three words with different meanings, recorded
+apart and never unioned), and opencode's generic scale (its reasoning is a per-model
+variant in its own UI, and its model universe is all of models.dev, so its `models`
+command, which lists only configured providers, is not consulted).
diff --git a/docs/adr/0017-cached-picker-input-is-appearance-never-launch-authority.md b/docs/adr/0017-cached-picker-input-is-appearance-never-launch-authority.md
new file mode 100644
index 0000000..fe685e7
--- /dev/null
+++ b/docs/adr/0017-cached-picker-input-is-appearance-never-launch-authority.md
@@ -0,0 +1,59 @@
+# Cached picker input is appearance, never launch authority
+
+A picker popup paints its previous input before starting the CLI or Node, following
+the dashboard's cached-appearance startup. `pick_template` and `e2b-fleet` still
+own the resolved arguments. They write one atomic NUL-delimited file per absolute
+worktree cwd under the plugin state directory. It holds a version, cwd and box key,
+then the box's label, resolved default, choices, count, marks and effort rows, plus
+the fleet's dirty-tree note, choices, count, default roster and effort rows. It holds
+neither credentials nor a previous answer. Bash reads data fields, never shell source.
+
+The lookup mirrors cwd components with a `d-` prefix and ends in `input`. Cwd has the
+same identity semantics as a box key, while direct lookup avoids running the hash
+utility before painting. Prefixes prevent a child checkout named `input` from
+colliding with its parent's file. Box and fleet inputs share the file; a private
+refresh reply keeps concurrent popups from consuming one another's result.
+
+`e2b-picker-warm` also resolves both inputs before the first opening. Herdr's
+asynchronous startup hook (0.7.5+) visits restored pane directories, and its
+workspace-created hook warms new ones. Installation launches the same warmup
+detached after configuration and auth discovery, because linking or enabling a
+plugin does not run startup hooks. The warmup clears inherited per-box pins and
+only calls the existing input producers; it never asks, opens panes or provisions.
+Older hosts retain installation/event warming and the cold picker fallback.
+
+Every cached opening starts the existing resolver path after its first frame.
+There is no reusable freshness verdict: config.toml and catalog mtime changes,
+git branch rules, auth results, connection marks and live box records are all
+re-read on every opening. A stale auth mark can annotate the first frame, as in
+the existing annotate-never-filter invariant. A cached choice cannot launch a box.
+The chooser checks for completion every 50 ms while waiting for input
+(one second on Bash 3.2, whose `read -t` requires whole seconds). Early
+confirmation stays pending while Escape remains readable; changed arguments
+repaint without clearing the screen and require confirmation again. A settled
+template hands off as before.
+
+The chooser owns no paths or resolver logic. Its optional refresh callback follows
+the existing slug-validator pattern: callers supply the behavior and arguments.
+Unchanged input preserves the selection; changed menu input resets the cells to the
+fresh defaults. A changed fleet note preserves the slug and task being typed.
+Normal key handlers and idle timeouts remain in place. Missing or malformed cache
+files take the existing cold path, whose cache write runs alongside the picker.
+
+The popup keeps terminal input unbuffered between reads. Escape checks the
+remaining bytes already queued for the encoded key, without waiting for a timeout.
+Arrow sequences keep their meanings, and Shift-Tab reverses Tab through cells and
+fleet text fields. Escape in a dropdown closes only that dropdown. Ordinary
+terminals retain a short sequence window (20 ms on modern Bash, the original
+second on Bash 3.2).
+
+The normal handoff remains authoritative: `e2b-box-open` carries explicit picks to
+`e2b-box open`, and `provision.js` checks model and per-model effort against the
+current catalog before creation. Fleet answers pass through the existing spec
+parser, roster spelling check and per-member open path.
+
+Calling the two Node scripts directly from the popup would duplicate the CLI's
+settled-template rules, so the CLI stays the refresh owner. Combining those scripts
+would save one import but would still delay the first frame. Precomputing before
+opening the popup would put that delay back in front of the overlay, the reason
+`e2b-box-open` already opens the popup first.
diff --git a/docs/adr/0018-a-fleet-preset-is-a-launch-recipe-not-a-record.md b/docs/adr/0018-a-fleet-preset-is-a-launch-recipe-not-a-record.md
new file mode 100644
index 0000000..66c21cd
--- /dev/null
+++ b/docs/adr/0018-a-fleet-preset-is-a-launch-recipe-not-a-record.md
@@ -0,0 +1,22 @@
+# A fleet preset is a launch recipe, not a record
+
+A JSON fleet specification supplies a slug, task and members with template,
+model, reasoning and count. Only the members are required. A named preset is that
+same file under the plugin config directory's `presets/`, selected by filename.
+There is one format for an agent-generated file, a saved preset and the picker.
+
+The specification becomes existing member specs before the fleet launch path.
+Explicit CLI fields override saved fields. It cannot configure teardown, execute
+host commands or record a running fleet. ADR 0001 still applies: branches and box
+records describe what was actually created; a preset describes a future launch.
+
+JSON was chosen for agent generation and portability. A second TOML preset format
+would add conversion and precedence rules without adding a capability. Keeping
+files beside config allows reuse across worktrees without mixing recipes into
+runtime state or credentials into a shareable recipe.
+
+The parser rejects unknown fields and invalid counts, models and reasoning before
+creation. It uses the same catalog as box creation. Popup selection reads the
+current file and fills editable cells; a failed selection leaves the current
+roster intact. Listing filenames uses only Bash, preserving cached first paint.
+The chooser receives names and a caller-owned loader, and owns no config paths.
diff --git a/docs/fleet-presets.md b/docs/fleet-presets.md
new file mode 100644
index 0000000..bd3378a
--- /dev/null
+++ b/docs/fleet-presets.md
@@ -0,0 +1,70 @@
+# Fleet JSON and presets
+
+A fleet specification saves the roster you would otherwise build in the picker.
+An agent can generate the same JSON and pass it to the CLI without a terminal.
+
+Save this as `compare.json`, or use the repository's
+[example](../config/presets/compare.json):
+
+```json
+{
+  "members": [
+    { "template": "codex", "model": "gpt-6-astra", "reasoning": "high", "count": 2 },
+    { "template": "claude", "model": "claude-fable-5", "reasoning": "max" }
+  ]
+}
+```
+
+Preview the plan, then run it:
+
+```sh
+e2b-box fleet create login-fix --file compare.json --task "Fix the login redirect loop" --dry-run
+e2b-box fleet create login-fix --file compare.json --task "Fix the login redirect loop"
+```
+
+`--file -` reads JSON from stdin. A specification may also include `"slug"` and
+`"task"`, allowing `e2b-box fleet create --file fleet.json` to supply the whole run.
+Tasks are literal text, including embedded newlines; they are never file paths or
+shell commands. Explicit CLI slug, `--task` and roster flags override their saved
+counterparts, independent of argument order. `--task ""` clears a saved task.
+`--file` and `--preset` are mutually exclusive.
+
+The `members` array is required and nonempty. Every member needs `template`.
+`model` and `reasoning` are optional and inherit that template's configured defaults
+when omitted. `count` defaults to 1 and accepts integers from 1 to 20. Repeat a
+template in separate entries to give its members different models or reasoning.
+Unknown fields and invalid types are errors. Model and reasoning pins are checked
+against the current catalog before any member is created; `--dry-run` performs
+the same checks. Template names use the existing roster check and `--force` escape.
+
+For named presets, put JSON files in `presets/` beside your plugin `config.toml`.
+For example, `$HERDR_PLUGIN_CONFIG_DIR/presets/compare.json`; the default directory
+is `${XDG_CONFIG_HOME:-~/.config}/herdr/plugins/config/e2b-dev.herdr-e2b/presets`.
+Names use letters, digits, hyphens and underscores and start with a letter or digit.
+
+```sh
+e2b-box fleet presets
+e2b-box fleet login-fix --preset compare --task "Fix the login redirect loop"
+```
+
+In the fleet popup's roster screen, **p** selects the next preset and **Shift+P**
+the previous one. Its counts, models and reasoning fill the existing cells. Review
+them, edit any cell, then press Enter from the template or count column to launch.
+A saved task is shown and used if you left the task field empty. The slug entered
+on screen always identifies this run. Presets containing templates absent from the
+picker menu are refused there; use the CLI for a deliberately off-menu roster.
+The picker supports at most 20 members of any one template.
+
+Preset names are listed without starting Node, so they do not delay the cached
+first frame. Selecting one reads and validates its current file. A malformed
+preset leaves the current roster intact and displays the error.
+
+Without a terminal the command skips the dashboard, provisions members through
+the running Herdr instance, and returns the usual fleet summary and exit code.
+This launches the members' agents; it does not wait for their tasks to finish.
+`--no-dashboard` requests that same foreground behavior from a terminal.
+
+For an agent generating a file: use only the fields above, choose model and
+reasoning values from the plugin's current catalog, and run `--dry-run` first.
+Save a reusable roster without a slug so each invocation can name its own task.
+Presets describe future launches; they contain no box IDs, branches or live status.
diff --git a/docs/research/0003-model-and-effort-catalogs.md b/docs/research/0003-model-and-effort-catalogs.md
new file mode 100644
index 0000000..cfd395a
--- /dev/null
+++ b/docs/research/0003-model-and-effort-catalogs.md
@@ -0,0 +1,368 @@
+# Model ids and reasoning efforts, automatically
+
+Source material for automating the two hand-maintained tables this repo keeps: the
+`reasoning` column of `src/effort.js` (`EFFORT_SCALES`, line 39) and the
+`template -> model / reasoning` comment block in `config/config.example.toml`
+(lines ~227-239). Established 2026-09-09 by 24 parallel probes against live vendor
+endpoints, installed binaries on one macOS 25.5.0 machine, and one boot of all eight
+shipped agent templates.
+
+Nothing here is from a model's memory. Every enum below was read off a binary, a
+shipped artifact, or an HTTP response quoted in-line. Where a claim could not be
+reproduced it is marked UNVERIFIED at the bottom.
+
+## The question, split in two
+
+The ask reads as one problem and is two, with different answers:
+
+| | what it is | best source |
+|---|---|---|
+| **model ids** | data about an inference provider's catalog | a registry. models.dev is the best one. |
+| **reasoning efforts** | a property of the *harness CLI's* own vocabulary | the harness binary. No registry carries it. |
+
+The split is not academic. `ultra` (codex, muse, amp), `dynamic` and `off` (droid) and
+`none` (muse, droid) appear **zero times** across models.dev's whole 7,612-model
+corpus. Those tokens exist only inside the CLIs. Conversely no CLI knows the pricing
+or context window that a registry serves for free.
+
+## Verdict on a single source: no
+
+Seven candidate registries were surveyed and each one independently rechecked by an
+adversarial verifier that re-ran the fetch itself. All seven survived on the model
+column and all seven failed on the effort column, for the same structural reason:
+**registries are keyed by inference provider, and this table is keyed by coding-agent
+CLI.** Those are different objects.
+
+| source | reachable | model ids | effort enum | harness coverage |
+|---|---|---|---|---|
+| **models.dev** `GET https://models.dev/api.json` (4.5 MB, unauth, 213 providers, 7,612 models) | yes | **best available** | real, per (provider, model), at `reasoning_options[{type:"effort"}].values` | ids 8/8. efforts 3/8 (claude, codex, grok) |
+| **OpenRouter** `GET https://openrouter.ai/api/v1/models` (431 models, unauth) | yes | yes | real, at `reasoning.supported_efforts`. Three-state: array (162), `null` (143), absent (126) | 1/8 (opencode) |
+| **Vercel AI Gateway** | yes | yes | real for 95 of 373 models | 2/8 (claude, codex). grok/amp/droid/prime/muse all 404 |
+| **LiteLLM** `model_prices_and_context_window.json` (unauth, daily) | yes | yes | **none.** Only `supports_reasoning` booleans | ids 3/8 (claude 28, codex 229, grok 52 with an `xai/` prefix to strip) |
+| **Vendor native APIs** (Anthropic `/v1/models`, `chatgpt.com/backend-api/codex/models`, `api.x.ai/v1/models`) | yes | yes, authoritative | real and per-model. Anthropic ships `capabilities.effort` as first-party documented schema | 3/8, and **all three 401 without a credential** |
+| **Hugging Face router** `/v1/models` (136 models) | yes | partial | none. `effort`, `reasoning_effort`, `reasoning_options` all appear zero times | 0/8 |
+| **npm metadata packages** (`tokenlens`, `llm-info`, `@continuedev/llm-info`, `ai-model-registry`) | published | stale | n/a | 0/8. Last publishes range 2025-10-04 to 2026-05-07, so none can describe a model shipped this quarter |
+
+Two genuine near-misses found late, worth naming as prior art rather than leaving
+unexamined. Both are a coding agent shipping exactly the generated catalog this repo
+wants, and both refute the "no registry has these tokens" argument as originally
+stated (the correct argument is the keying one above):
+
+- `@oh-my-pi/pi-catalog@18.1.15` (published 2026-09-08): `src/models.json`, 68
+  providers, per-model `"thinking": {"mode":"effort","efforts":[...]}`, plus a typed
+  `src/effort.ts` enum of `minimal|low|medium|high|xhigh|max`. Counts in that file:
+  4,198 `xhigh`, 2,237 `minimal`, 90 `none`, 88 `off`, and 0 `dynamic`.
+- `@kortix/llm-catalog@0.13.12` (published 2026-09-08): the same idea for a gateway.
+
+Not a source: there is no MCP model-catalog server. `models.dev/mcp` 302s to a
+marketing page and `openrouter.ai/api/v1/mcp` is 404.
+
+## The finding that changes the design: the templates lag, badly
+
+All eight agent templates were booted and their harness versions read out of the box.
+The template ships a materially older CLI than this laptop, in every case but codex:
+
+| template | in the box | local on PATH | vendor latest |
+|---|---|---|---|
+| claude | **2.1.201** | 2.1.266 | 2.1.266 |
+| codex | 0.153.4 | 0.153.2 (PATH) | 0.153.4 |
+| grok | **1.0.5** | 1.0.24 | 1.0.24 |
+| opencode | **1.17.13** | 1.18.29 | 1.18.30 |
+| amp | **0.0.1783315410** (2026-07-06) | 0.0.1788883237 | 0.0.1788940851 |
+| droid | **0.172.0** | 0.199.0 | 0.215.1 |
+| prime | **0.7.0** | 0.9.3 | 0.9.4 |
+| muse | **0.1.0-R708.1** | 1.0.3-R2198.1 | 1.0.3-R2198.1 |
+
+This is not a fidelity nicety. It changes answers, in both directions:
+
+- **muse.** In the template, `muse --help` prints `none|minimal|low|medium|high|xhigh|ultra`.
+  `src/effort.js` is therefore *correct for the box*, and the local probe finding
+  ("1.0.3 adds `max`") would have corrupted it.
+- **amp.** In the template, `amp plugins show-agent-options --json` returns
+  `capabilities` of `reasoning,vision,tools` with **no `efforts` key at all** (20
+  models, `grep -c efforts` exits 1). The local machine's amp has it. So the obvious
+  parse rule yields nothing on the box it is meant to run on.
+- What survives the box check unchanged: claude 2.1.201 gives the same five values,
+  droid 0.172.0 the same nine, prime 0.7.0 the same seven. `node` and `jq` exist in
+  all eight templates (node v20.9.0, v22.23.1 in claude and prime).
+
+Consequence: `config/config.example.toml`'s annotation "verified against the CLI in
+each template, 2026-09-09" is **false today** for claude, grok, droid, muse and amp.
+It was verified against this laptop. A local-only probe is not a fallback transport,
+it is a different and wrong answer for 5 of 8 rows.
+
+## Per-harness mechanisms
+
+All eight yield their effort vocabulary from an artifact already on the box. Six of
+eight yield model ids the same way. Ordered by how much a script gets per call.
+
+| harness | model ids | effort enum | per-model? | auth needed |
+|---|---|---|---|---|
+| **codex** | `codex debug models --bundled`, `models[]` where `visibility=="list"`, `.slug` | same JSON: `supported_reasoning_levels[].effort` + `default_reasoning_level` | yes, with defaults | no (`--bundled`) |
+| **droid** | JSON-RPC handshake over stdio | same handshake: `availableModels[].supportedReasoningEfforts` + `defaultReasoningEffort` | yes, with defaults | no |
+| **grok** | `~/.grok/models_cache.json`, `Object.keys(models)` | same file: `models[id].info.reasoning_efforts[].value` | yes, with defaults | **yes**, file only exists after one authenticated run |
+| **amp** | `amp plugins show-agent-options --json`, `.models[].id` | `.models[].capabilities.efforts` (union for the scale) | yes | no |
+| **claude** | Anthropic `GET /v1/models?limit=100`, `capabilities.effort` keys | `claude -p --effort __probe__ ""`, then `/Valid values:\s*([^.]+)\./` | flat from CLI, per-model from API | efforts no, ids **yes** |
+| **prime** | `prime-agent model list`, or `api.pinference.ai/api/v1/models` (unauth, 116 models) | `prime-agent --help`, `/--thinking <level>\s+Set reasoning:\s*(.+)/` | via bundled `pi-ai` catalog | no |
+| **muse** | none pinnable (no verified settings key for a model) | `muse exec --help`, line after `--reasoning-effort`, split on `|` | via on-disk catalog cache | no |
+| **opencode** | models.dev (**never** `opencode models`, see below) | nothing to generate: reasoning is a per-model UI *variant*, not a setting the plugin can write | n/a | n/a |
+
+Exact commands, evidence and parse rules per harness are in the workflow transcript at
+`.claude/.../workflows/wf_8d7e9da8-0c6/journal.jsonl`.
+
+### The rejection message is an enumerating oracle
+
+Five of eight CLIs print their own valid set when fed a sentinel. This is the ADR 0009
+spawn-the-binary shape applied to efforts, and it costs no inference:
+
+```
+$ claude -p --effort __probe__ ""
+Warning: Unknown --effort value '__probe__' ... Valid values: low, medium, high, xhigh, max.
+
+$ droid exec --reasoning-effort __bogus__ "x"
+Allowed values: none, dynamic, off, minimal, low, medium, high, xhigh, max
+
+$ grok -m grok-4.6 --reasoning-effort __probe__ -p "x"
+--effort/--reasoning-effort: unknown effort level '__probe__'; use one of: xhigh, high, medium, low
+
+$ prime-agent --thinking bogus -p "say hi"
+Warning: Invalid thinking level "bogus". Valid values: off, minimal, low, medium, high, xhigh, max
+
+$ muse --reasoning-effort bogus
+invalid value 'bogus' ...: expected none|minimal|low|medium|high|xhigh|max|ultra
+
+$ amp config model-providers check-access --provider-model a/b --reasoning-effort bogus-zzz
+Error: ... Allowed choices are none, minimal, low, medium, high, xhigh, max.
+```
+
+Three cautions. `claude`'s probe needs an empty prompt so it dies before starting a
+session (exit 1, zero tokens). `grok`'s probe **requires auth**: unauthenticated it
+exits earlier on `Not signed in`. `grok`'s empty-prompt guard runs before effort
+validation, so probe with a non-empty `-p` string or every value falsely passes.
+
+### Effort is per-model, not per-harness
+
+This is the structural error in both current tables. Measured today:
+
+- `grok-4.6` accepts `xhigh`; **`grok-4.5` does not.** Byte-identical to the CLI's own
+  two rejection messages, and to the two `reasoning_efforts` arrays in its cache.
+- codex `gpt-5.5` and `gpt-5.2` cap at `xhigh`. `gpt-5.6-luna` has `max` but no
+  `ultra`. `gpt-6-astra` / `gpt-5.6-sol` / `gpt-5.6-terra` have both.
+- droid `minimax-m3` accepts `[high]` only. `kimi-k2.6` is `[off, high]`.
+  `gpt-5.5-pro` is `[medium, high, xhigh]`.
+- claude: `xhigh` is invalid on `sonnet-4-6` and `opus-4-6`, and `haiku-4-5`,
+  `sonnet-4-5` and `opus-4-5` support no effort at all.
+- muse: `max` is on `muse-spark-1.3` only, not on the `-contributor` or `1.2` rows.
+
+A flat per-template row cannot express any of this, and for droid it is actively
+misleading (next section).
+
+### Silent failure is the norm, and it is asymmetric
+
+Nothing here fails loudly. Per-harness, what a bad pin actually does:
+
+| harness | bad effort value | bad model value |
+|---|---|---|
+| claude | via `CLAUDE_CODE_EFFORT_LEVEL` (**the route this plugin uses**): silently dropped, runs the model default, no message | loud: `unrecognized_model`, turn still runs |
+| droid | **silently coerced** to that model's `defaultReasoningEffort`, exit 0. Source is in the binary: `if (R.supportedReasoningEfforts.includes(H)) return H; return R.defaultReasoningEffort` | prints `Invalid model` and **exits 0** |
+| grok | file route is unvalidated locally: box boots clean, first turn dies with API 400 `Invalid reasoning effort` | rejected at set time |
+| codex | client never validates (its own schema types it as a plain non-empty string), API rejects at first turn | boots fine, dies first turn |
+| prime | warning on stderr, **clamped** to the nearest supported level, exit 0 | n/a |
+| muse | warning on stderr, runs the default, exit 0 | boots fine, dies first turn |
+| opencode | unknown variant looked up, missed, **silently ignored**, exit 0 | opaque server error |
+| amp | commander rejects locally, exit 1 | `--mode` typo **exits 0** after a ~20s round trip |
+
+Two consequences. First, validating the pin plugin-side is the only signal that exists
+for claude, droid, prime, muse and opencode. Second, a bad pin is almost always
+create-time silent and runtime loud, which is the worst shape for a fleet: the box is
+green and the pane looks fine.
+
+## Drift already present in this repo
+
+The case for automating does not need an argument about upstream velocity. **The repo
+holds two hand-maintained copies of the same eight scales and they already disagree
+with each other.**
+
+| harness | `src/effort.js:39` | `config/config.example.toml:~228` | measured today |
+|---|---|---|---|
+| codex | `low medium high xhigh max ultra` | `minimal low medium high xhigh ultra` | no listed model offers `minimal`; every one offers `max` |
+| droid | 7 values (drops `none`, `dynamic`) | 9 values | 9 syntactic, 8 live (`dynamic` supported by no available model) |
+| muse | has `ultra`, lacks `max` | not listed | box (0.1.0) has neither `max`; laptop (1.0.3) has `max`, and `ultra` is entitlement-gated and degrades to `xhigh` |
+| grok | flat `low medium high xhigh` | flat, plus `grok-build` as an example id | per-model. `grok-4.5` has no `xhigh`. `grok-build` is **not in this account's catalog** |
+
+Same eight scales are also written down a third time in `test/effort.test.js` (as
+pinned expectations) and a fourth time in a comment block in `src/model-pin.js`. Four
+copies, drifting independently.
+
+Version annotations in `src/effort.js` are stale too: it cites grok 1.0.13 (box 1.0.5,
+laptop 1.0.24), droid 0.213.0 (box 0.172.0, laptop 0.199.0, vendor 0.215.1), prime
+0.7.0 (laptop 0.9.3), muse 0.2.1 (box 0.1.0). Its `kimi-k3: off|low|high|max` example
+does not appear in the box droid's model list at all.
+
+One unrelated one-line bug found on the way: `src/harnesses.js:12` says "Governed by
+`docs/adr/0006`", but `docs/adr/0006` is `region-is-sugar-over-domain.md`. The
+spawn-the-binary and never-read-the-credential-store rule is **ADR 0009**.
+
+## The cheap staleness key nobody was looking for
+
+A weekly cron that boots eight boxes is the obvious refresh and it is wasteful. Two
+unauthenticated-shaped signals answer "did anything actually change" first.
+
+**1. The E2B template inventory.** `GET https://api.e2b.dev/templates` with
+`X-API-KEY` (the team key already in `~/.e2b/config.json`) returns per-template
+`templateID`, `buildID`, `buildCount`, `updatedAt`, `lastSpawnedAt`. Live today:
+
+```
+opencode  2026-09-09T04:31:18Z  buildCount 78
+codex     2026-09-07T15:13:57Z  28
+claude    2026-09-07T08:12:01Z  23
+grok      2026-09-07T08:18:12Z  20
+amp       2026-09-07T08:11:18Z  19
+droid     2026-09-07T08:17:14Z  15
+prime     2026-09-07T08:25:34Z   9
+muse      2026-09-07T08:22:55Z   8
+```
+
+Store `buildID` beside each generated row and re-probe only the templates whose build
+moved. One HTTP call instead of eight sandboxes.
+
+It also answers a question the plugin cannot ask today. The same listing carries two
+public agent templates with **no row in `src/harnesses.js`**: `devin` (buildCount 21)
+and `cursor-agents` (buildCount 20), both rebuilt in the same 08:11-08:25Z batch as the
+eight known ones. So this endpoint is also the only channel that would report "there
+is a ninth agent image and the plugin has no row for it".
+
+**2. Per-vendor version feeds**, seven of eight, all unauthenticated:
+
+```
+claude    npm packument @anthropic-ai/claude-code  dist-tags.latest -> 2.1.266
+codex     npm packument @openai/codex                                 0.153.4
+opencode  npm packument opencode-ai                                   1.18.30
+amp       npm packument @sourcegraph/amp                              0.0.1788940851-g2b0940
+prime     GitHub releases/latest PrimeIntellect-ai/prime-agent        v0.9.4
+grok      GET https://x.ai/cli/stable            (bare string)        1.0.24
+droid     GET https://app.factory.ai/cli         (embeds VER="...")   0.215.1
+muse      GET https://api.meta.ai/muse-code/channels/muse-stable      1.0.3-R2198.1
+```
+
+Do not reach for a GitHub releases feed for grok or amp: `xai-org/grok-cli` and
+`sourcegraph/amp` are both 404. And `prime-agent` is **not on npmjs.org** (`npm view`
+returns E404), so GitHub is its only feed.
+
+## Recommended shape
+
+Per-harness probe of the shipped artifact, one pure parse layer, three transports, one
+committed generated data module. Deliberately the same shape as `src/harnesses.js` and
+`src/fleet-seed.js`: a shipped data table beside a pure function, because ADR 0009
+already settled this argument for credential detection and the argument is identical.
+
+1. **`src/catalog.js`** (new, pure). `CATALOG_PROBES` table plus
+   `interpretCatalog(id, probe)` which takes a probe RESULT and never spawns, mirroring
+   `interpretProbe`. Every parse reads `stdout` + `stderr` combined and ignores the exit
+   code, because two probes exit non-zero by design. All eight parse rules then test on
+   a machine with no harness installed, which is what keeps `npm test` offline.
+2. **`scripts/harness-catalog.mjs`** (new, the only impure part), beside and modelled on
+   the existing `scripts/verify-keys.mjs`:
+   `node scripts/harness-catalog.mjs [template ...] [--check|--write] [--from=box|local|fixture]`.
+   Default templates are `Object.keys(HARNESSES)` so the default set cannot drift from
+   what the plugin ships. `--check` is the default and writes nothing. Exit 0 clean, 1
+   usage or untrustworthy probe, **2 drift found** (a finding, not an error, so a
+   refresher can tell "the world moved" from "the script is broken").
+3. **`src/harness-catalog.generated.js`** (new, generated, committed). Each row carries
+   `probedFrom`, the resolved binary path and the version that answered, plus the E2B
+   `buildID`. `src/effort.js` then derives `EFFORT_SCALES` from it and keeps only the
+   hand-written `kind` and `via` overlay, which are plugin facts (how the pin reaches
+   the box), not harness facts. Four copies collapse to one.
+4. **Sentinel comments in `config/config.example.toml`.** Rewrite only between the
+   markers, as text. Never re-stringify: `@iarna/toml`'s `stringify` drops comments and
+   that file is almost entirely comments.
+
+`--from=box` is the **authoritative** transport, not an optional one, per the version
+table above. It reuses `verify-keys.mjs`'s throwaway-sandbox pattern.
+
+Zero new dependencies: `execFile` for spawning, Node 22 global `fetch` for the two
+model-column lookups, `@iarna/toml` already a dependency, `e2b` already a dependency.
+`npm test` gains `test/catalog.test.js` automatically through the existing
+`test/*.test.js` glob, and never probes.
+
+Two rules the script must keep, in its header the way `verify-keys.mjs` states its own:
+
+- **A credential is never printed and never passed on a command line.** Its output goes
+  into a PR body, so it must be safe to paste. Report the variable NAME and whether it
+  was present.
+- **A failed probe never blanks a row.** Keep the committed row, mark it
+  `stale: {since, reason}`, say so in the report. Otherwise one unauthenticated run
+  silently empties every scale and every user pin becomes invalid.
+
+### Phasing
+
+- **Phase 0, about 6 lines, no new files.** Fix the drifts that exist now: reconcile the
+  codex row (drop `minimal`, add `max`), reconcile droid's two lists, correct the stale
+  version annotations, and fix the ADR 0006 citation. Ships correctness this week and
+  makes the next phase's motivation self-evident.
+- **Phase 1, read-only.** `src/catalog.js` + `scripts/harness-catalog.mjs` with the
+  `fixture` and `box` transports, fixtures captured from the eight real template
+  binaries, `test/catalog.test.js`, two npm scripts. The manual work here is mostly the
+  work of *noticing*, and this kills that outright while changing no behavior.
+- **Phase 2, writes.** `--write`, the generated module, the sentinels, and
+  `src/effort.js` deriving instead of holding literals. Rework `test/effort.test.js`
+  from exact-value pinning to invariants.
+- **Phase 3, self-running.** Trigger off `buildID` + the version feeds rather than a
+  blind cron, open a PR when the tree changes. Last on purpose: a bot opening PRs from
+  parsers nobody has reviewed is worse than a manual run on a Friday.
+- **Phase 4, only on request.** Cross-validate model against effort in `provision.js`
+  (droid's silent coercion is invisible today) and `--fix-config` for surgical repair of
+  the user's own `config.toml`.
+
+## Traps for whoever writes this
+
+1. **`opencode models` is not the universe of valid ids.** It lists CONFIGURED
+   providers. Measured: `env -i PATH=$PATH HOME=/tmp/oc-clean opencode models` prints 7
+   lines; with real credentials it prints 439. A box probe would delete 432 valid ids.
+   Use models.dev for opencode's model column, or skip validating that row.
+2. **amp has two vocabularies. Never union them.** `ultra` is a MODE only;
+   `xhigh`/`max`/`minimal`/`none` are EFFORTS only; `low|medium|high` overlap and mean
+   different things. amp's `--mode` is also server-validated, so a typo exits 0.
+3. **Model id shapes differ per harness.** droid ids are bare single segments
+   (`claude-opus-5`). prime and opencode are `provider/model`, split at the FIRST slash
+   (`openrouter/qwen/qwen3.8-max-0902` has three segments; amp has a five-segment id).
+   `src/model-pin.js` already splits correctly; do not regress it.
+4. **`prime` is not the harness. `prime-agent` is.** Both are installed here and they
+   are different products. `src/harnesses.js:507` already gets this right.
+5. **Drew's shell shadows two of these binaries.** `droid` is a zsh function that
+   rewrites args (adding `--skip-permissions-unsafe`), and `codex` is a function with
+   five `codex` entries on PATH. A probe must call the absolute path, not trust
+   `command -v` in an interactive shell. `claude` also resolves to 2.1.266 under zsh and
+   2.1.191 under bash on this machine.
+6. **The grok pin can be silently skipped today.** `src/model-pin.js`'s guard leaves the
+   file alone if it already contains `[models]`, and grok **writes its own `[models]`
+   section on first run** (a clean `GROK_HOME` gets one immediately). That is the most
+   likely reason a grok pin appears not to apply.
+7. **`droid.initialize_session` is not read-only.** It scaffolds `~/.factory` and creates
+   a session. Point HOME at a temp dir; it still returns the full model list.
+8. **Catalogs are account-scoped.** droid filters its bundled ~81 models to 45 by
+   feature flags cached in `~/.factory/cache/feature-flags.json`; codex's catalog is
+   plan-gated; grok's is team-scoped (`grok-build` is absent from this account). A
+   generated table should record which account produced it.
+9. **`codex debug models` silently falls back to the bundled catalog when
+   unauthenticated**, returning retired models. Detect it by diffing against
+   `--bundled`, or check `~/.codex/models_cache.json`'s `fetched_at`.
+
+## Unverified
+
+- The response body of Anthropic `GET /v1/models`. Endpoint verified (401 demanding
+  `x-api-key`); the `capabilities.effort` shape is taken from first-party docs. Closes
+  with any working key.
+- Whether `api.x.ai/v1/models` (the BYOK path) carries `reasoning_efforts`. Existence
+  proven by 401; content not. The CLI entries carry `supported_in_api`, implying the two
+  catalogs are deliberately different sets.
+- `https://ampcode.com/api/models` shape (401 with and without a bearer). Do not build
+  on it; the offline CLI JSON is better anyway.
+- `https://downloads.claude.ai/model-catalog/v1/catalog.json` is baked into claude
+  2.1.266 as the default catalog URL and currently returns 404 `NoSuchKey`. If it lands
+  it supersedes both the API and the binary-extraction path. Worth re-probing.
+- Whether muse's `max` is a distinct provider tier or a client-side alias. Accepted by
+  the CLI and present in the `muse-spark-1.3` catalog row, but absent from the MSP wire
+  enum (which declares itself closed).
+- Whether droid's `availableModels` can differ from the bundled catalog because of a
+  network response rather than only cached feature flags.
diff --git a/herdr-plugin.toml b/herdr-plugin.toml
index 46c03a6..34193f0 100644
--- a/herdr-plugin.toml
+++ b/herdr-plugin.toml
@@ -10,6 +10,14 @@ platforms = ["macos", "linux"]
 [[build]]
 command = ["bash", "install.sh"]
 
+# Restored and newly opened workspaces should have their first picker frame ready.
+[[startup]]
+command = ["bash", "bin/e2b-picker-warm", "--all"]
+
+[[events]]
+on = "workspace.created"
+command = ["bash", "bin/e2b-picker-warm"]
+
 # Worktree removed -> kill the sandbox (no orphaned, billable boxes left behind).
 [[events]]
 on = "worktree.removed"
@@ -26,7 +34,9 @@ command = ["bash", "bin/teardown-worktree"]
 # print to the plugin command log (herdr plugin log list --plugin e2b-dev.herdr-e2b).
 
 # Send the current worktree to E2B and open its shell (provisions if needed).
-# The chooser and shell run in a new, focused pane below the invoking pane.
+# When there is something to ask (template, model, effort) the question is put in
+# the popup; the shell then runs in a new, focused pane below the invoking pane and
+# the popup closes. A box that is already settled opens in that pane straight away.
 [[actions]]
 id = "open"
 title = "Open E2B sandbox"
@@ -35,8 +45,9 @@ command = ["bash", "-lc", "\"$HERDR_PLUGIN_ROOT/bin/e2b-box-open\""]
 
 # Fan this checkout out into a fleet: one worktree, workspace and box per
 # template on the roster, all off the same base ref. Two picker screens (task
-# slug, then roster), then the new pane becomes the dashboard.
-# An action has no terminal; e2b-fleet-open opens and focuses a pane below the invoking pane.
+# slug, then roster) in the popup, which then becomes the dashboard while the
+# members provision; Enter there opens a member below the pane the popup floats over.
+# An action has no terminal; e2b-fleet-open opens the popup (a pane below, if it can't).
 # Suggested binding:
 #   [[keys.command]]
 #   key = "prefix+shift+f"
@@ -179,6 +190,9 @@ command = ["bash", "-c", "exec \"$HERDR_PLUGIN_ROOT/bin/e2b-dash\""]
 # terminal on close): it opens the box in a regular pane split below the pane the
 # popup floats over, then closes the popup. e2b-popup records that pane as
 # E2B_DASH_ORIGIN_PANE at launch, which is why the popup is opened through it.
+# The same entrypoint hosts the `open` and `fleet` actions' pickers (E2B_POPUP_MODE
+# = pick-box / pick-fleet, set by bin/lib/pane.sh): the overlay is where things are
+# chosen, never where they run.
 [[panes]]
 id = "popup"
 title = " herdr-e2b-sandbox"
diff --git a/install.sh b/install.sh
index 123abf8..74dec54 100755
--- a/install.sh
+++ b/install.sh
@@ -18,7 +18,7 @@ else
 fi
 
 chmod +x bin/e2b-box bin/e2b-box-open bin/e2b-box-pull bin/e2b-dash bin/e2b-dash-toggle bin/e2b-popup \
-         bin/e2b-fleet bin/e2b-fleet-open bin/e2b-bench bin/teardown-worktree 2>/dev/null || true
+         bin/e2b-fleet bin/e2b-fleet-open bin/e2b-bench bin/e2b-picker-warm bin/teardown-worktree 2>/dev/null || true
 
 BIN="${HOME}/.local/bin"
 mkdir -p "$BIN"
@@ -276,6 +276,10 @@ fi
 # why turns one problem into two.
 harness_discovery "$CONFIG_DIR" "$DIR/bin/e2b-box"
 
+# Linking/enabling a plugin does not rerun Herdr's startup hooks. Warm existing
+# workspaces after installation too, without holding the installer open.
+nohup bash "$DIR/bin/e2b-picker-warm" --all </dev/null >/dev/null 2>&1 &
+
 # Template recommendation — "base" (the default) is minimal & tight on disk.
 echo "herdr-e2b: tip — sandboxes default to the 'base' template (minimal). For real"
 echo "  work, build a bigger CUSTOM template (more disk/CPU + your toolchain) and"
diff --git a/package.json b/package.json
index 0e3bee5..b49206e 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,9 @@
     "node": ">=22"
   },
   "scripts": {
-    "test": "node --test test/*.test.js && bash test/cli.test.sh"
+    "test": "node --test test/*.test.js && bash test/cli.test.sh",
+    "catalog": "node scripts/harness-catalog.mjs",
+    "verify-keys": "node scripts/verify-keys.mjs"
   },
   "dependencies": {
     "e2b": "^2.32.0",
diff --git a/scripts/harness-catalog.mjs b/scripts/harness-catalog.mjs
new file mode 100644
index 0000000..94708fd
--- /dev/null
+++ b/scripts/harness-catalog.mjs
@@ -0,0 +1,267 @@
+// Which models and effort words does each shipped agent template ACTUALLY accept?
+//
+//   node scripts/harness-catalog.mjs [template ...] [--check|--write] [--from=box|local|fixture]
+//   npm run catalog -- --write
+//
+// One throwaway sandbox per template (the default, `--from=box`), booted with the
+// env a fleet member would get, running that harness's own catalog probes: its
+// version, the rejection message that lists its effort words, the command or file
+// that lists its models (src/catalog.js, CATALOG_PROBES). What it read is compared
+// with src/harness-catalog.generated.js and, with `--write`, written there, into the
+// table in config/config.example.toml, and into test/fixtures/catalog/ so `npm test`
+// re-derives the same rows offline.
+//
+// Why the box and not this machine: the template ships an older CLI than a laptop
+// in every case measured but one (docs/research/0003), and the CLI in the box is
+// the one that will accept or reject a pin. `--from=local` asks the binaries on
+// PATH instead: quick, and wrong for the box whenever the two differ, so rows it
+// writes are marked `probedFrom: "local"`. `--from=fixture` re-reads the captured
+// output and writes nothing new about the world; it is how a parse-rule change is
+// replayed and what test/catalog.test.js does.
+//
+// Exit codes: 0 nothing moved · 2 drift found (a finding, not an error: the world
+// changed and the committed rows have not) · 1 usage, or a probe that could not be
+// trusted. THE TWO RULES: a credential is never printed and never on a command line
+// (probes run unauthenticated or read a variable the box already holds; this output
+// is safe to paste into a PR), and a failed probe never blanks a row (the committed
+// one is kept and marked stale, since an unauthenticated run must not empty every scale).
+import { execFile } from "node:child_process"
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"
+import path from "node:path"
+import { fileURLToPath } from "node:url"
+import { promisify } from "node:util"
+
+import {
+  CATALOG_PROBES,
+  diffRow,
+  interpretCatalog,
+  mergeCatalog,
+  renderGeneratedModule,
+  renderTomlBlock,
+  spliceTomlBlock,
+} from "../src/catalog.js"
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..")
+const GENERATED = path.join(ROOT, "src", "harness-catalog.generated.js")
+const TOML = path.join(ROOT, "config", "config.example.toml")
+const FIXTURES = path.join(ROOT, "test", "fixtures", "catalog")
+const execFileP = promisify(execFile)
+
+const usage = (code, msg) => {
+  if (msg) console.error(`harness-catalog: ${msg}`)
+  console.error("usage: node scripts/harness-catalog.mjs [template ...] [--check|--write] [--from=box|local|fixture]")
+  process.exit(code)
+}
+
+let mode = "check"
+let from = "box"
+const names = []
+for (const a of process.argv.slice(2)) {
+  if (a === "--check" || a === "--write") mode = a.slice(2)
+  else if (a.startsWith("--from=")) from = a.slice("--from=".length)
+  else if (a === "-h" || a === "--help") usage(0)
+  else if (a.startsWith("-")) usage(1, `unknown flag ${a}`)
+  else names.push(a)
+}
+if (!["box", "local", "fixture"].includes(from)) usage(1, `--from must be box, local or fixture, not ${from}`)
+const templates = names.length ? names : Object.keys(CATALOG_PROBES)
+for (const t of templates) if (!CATALOG_PROBES[t]) usage(1, `no catalog probes for '${t}' (known: ${Object.keys(CATALOG_PROBES).join(", ")})`)
+
+const committed = existsSync(GENERATED) ? (await import(GENERATED)).HARNESS_CATALOG : {}
+const probedAt = new Date().toISOString()
+
+// --- transports ---------------------------------------------------------------------
+// Each returns { stdout, stderr, status }; `status` is null when the command never ran
+// or never came back. Parse rules read stdout+stderr and ignore status on purpose.
+
+const fetched = new Map()
+async function get(url) {
+  if (!fetched.has(url)) {
+    fetched.set(
+      url,
+      fetch(url)
+        .then(async (res) => ({ stdout: await res.text(), stderr: "", status: res.status }))
+        .catch((e) => ({ stdout: "", stderr: String(e?.message || e), status: null })),
+    )
+  }
+  return fetched.get(url)
+}
+
+// `/bin/sh -c`, not the user's shell: an interactive zsh here shadows two of these
+// binaries with functions that rewrite their arguments.
+async function runLocal(cmd) {
+  try {
+    const { stdout, stderr } = await execFileP("/bin/sh", ["-c", cmd], { timeout: 90000, maxBuffer: 64 << 20 })
+    return { stdout, stderr, status: 0 }
+  } catch (e) {
+    return { stdout: e?.stdout ?? "", stderr: e?.stderr ?? String(e?.message || e), status: typeof e?.code === "number" ? e.code : null }
+  }
+}
+
+async function probeLocal(spec) {
+  const out = {}
+  for (const [name, p] of Object.entries(spec.probes)) out[name] = p.url ? await get(p.url) : await runLocal(p.cmd)
+  return out
+}
+
+let box = null
+async function boxDeps() {
+  if (box) return box
+  const [{ Sandbox }, { loadConfig, resolveEnv }, { seedCommand }] = await Promise.all([
+    import("e2b"),
+    import("../src/config.js"),
+    import("../src/fleet-seed.js"),
+  ])
+  const cfg = loadConfig()
+  if (!cfg.apiKey) usage(1, "no E2B API key (E2B_API_KEY, config.toml, or `e2b auth login`), needed for --from=box")
+  const conn = { apiKey: cfg.apiKey, ...(cfg.domain ? { domain: cfg.domain } : {}) }
+  box = { Sandbox, cfg, conn, resolveEnv, seedCommand }
+  return box
+}
+
+async function runBox(sbx, cmd) {
+  // droid installs to ~/.local/bin, which a non-interactive shell does not have on
+  // PATH; harmless for the others.
+  const line = `export PATH="$HOME/.local/bin:$PATH"; ${cmd}`
+  try {
+    const r = await sbx.commands.run(line, { timeoutMs: 120000, cwd: "/home/user" })
+    return { stdout: r.stdout ?? "", stderr: r.stderr ?? "", status: r.exitCode ?? 0 }
+  } catch (e) {
+    // A non-zero exit throws, with the output on the thrown object. Expected for
+    // every rejection oracle.
+    const r = e?.result
+    return { stdout: r?.stdout ?? "", stderr: r?.stderr ?? (r ? "" : String(e?.message || e)), status: typeof r?.exitCode === "number" ? r.exitCode : null }
+  }
+}
+
+async function probeBox(template, spec) {
+  const { Sandbox, cfg, conn, resolveEnv, seedCommand } = await boxDeps()
+  const envs = resolveEnv(cfg, template) || {}
+  const sbx = await Sandbox.create(template, { ...conn, envs, timeoutMs: 600000 })
+  try {
+    // Exactly as src/provision.js seeds a member: codex reads its credential from
+    // ~/.codex/auth.json, grok's cache only exists after an authenticated command.
+    const seed = seedCommand(template, cfg.fleetSeeds)
+    if (seed) {
+      await sbx.files.write("/home/user/.herdr-e2b-seed.sh", `${seed}\n`)
+      await sbx.commands.run('bash "$HOME/.herdr-e2b-seed.sh"', { cwd: "/home/user" }).catch(() => {})
+    }
+    const out = {}
+    for (const [name, p] of Object.entries(spec.probes)) out[name] = p.url ? await get(p.url) : await runBox(sbx, p.cmd)
+    return out
+  } finally {
+    await sbx.kill().catch(() => {})
+  }
+}
+
+/**
+ * Which build of each template is live, so a row can say which image it was read
+ * from. The listing is this TEAM's templates: a name that resolves to the team's own
+ * image (`ondrejs-project/claude` behind the alias `claude`) gets its build; a public
+ * E2B template is not listed and gets none. Best-effort, never fatal.
+ */
+async function templateBuilds() {
+  if (from !== "box") return {}
+  const { cfg } = await boxDeps()
+  try {
+    const res = await fetch(`https://api.${cfg.domain || "e2b.app"}/templates`, { headers: { "X-API-KEY": cfg.apiKey } })
+    if (!res.ok) return {}
+    const list = await res.json()
+    const out = {}
+    for (const t of templates) {
+      const hit = (Array.isArray(list) ? list : []).find(
+        (x) => x?.templateID === t || (x?.aliases || []).includes(t) || (x?.names || []).includes(t),
+      )
+      if (hit) out[t] = { name: hit.names?.[0] ?? hit.aliases?.[0] ?? t, buildID: hit.buildID ?? null, updatedAt: hit.updatedAt ?? null }
+    }
+    return out
+  } catch {
+    return {}
+  }
+}
+
+// --- fixtures -------------------------------------------------------------------------
+
+const fixturePath = (id) => path.join(FIXTURES, `${id}.json`)
+function readFixture(id) {
+  const f = fixturePath(id)
+  if (!existsSync(f)) return null
+  return JSON.parse(readFileSync(f, "utf8"))
+}
+function writeFixture(id, spec, results, version) {
+  const probes = {}
+  for (const [name, r] of Object.entries(results)) {
+    const trim = spec.probes[name]?.trim
+    let stdout = r.stdout
+    if (trim && r.stdout) {
+      try {
+        stdout = trim(r.stdout)
+      } catch {}
+    }
+    probes[name] = { stdout, stderr: r.stderr, status: r.status }
+  }
+  mkdirSync(FIXTURES, { recursive: true })
+  writeFileSync(fixturePath(id), `${JSON.stringify({ harness: id, version, probedFrom: from, capturedAt: probedAt, probes }, null, 2)}\n`)
+}
+
+// --- the run --------------------------------------------------------------------------
+
+async function probe(id) {
+  const spec = CATALOG_PROBES[id]
+  try {
+    if (from === "fixture") {
+      const fx = readFixture(id)
+      if (!fx) return { id, results: null, reason: `no fixture at test/fixtures/catalog/${id}.json` }
+      // A replay says where the CAPTURE came from, not "fixture".
+      return { id, results: fx.probes, probedFrom: fx.probedFrom, probedAt: fx.capturedAt }
+    }
+    const results = from === "box" ? await probeBox(id, spec) : await probeLocal(spec)
+    return { id, results }
+  } catch (e) {
+    const body = `${e?.result?.stdout || e?.stdout || ""}${e?.result?.stderr || e?.stderr || ""}`.trim()
+    const tail = body ? body.split("\n").filter(Boolean).slice(-3).join(" / ") : String(e?.message || e)
+    return { id, results: null, reason: tail.slice(0, 240) }
+  }
+}
+
+console.log(`reading ${templates.length} harness catalog(s) from ${from}${from === "box" ? ", one sandbox each, killed on the way out" : ""}\n`)
+const [probed, builds] = await Promise.all([Promise.all(templates.map(probe)), templateBuilds()])
+
+const fresh = {}
+let failed = 0
+let drifted = 0
+const lines = []
+for (const { id, results, reason, probedFrom: rowFrom, probedAt: rowAt } of probed) {
+  const row = results ? interpretCatalog(id, results) : null
+  if (!row) {
+    failed++
+    const why = reason || `probe output did not parse (${Object.keys(results || {}).join(", ")})`
+    fresh[id] = { row: null, reason: why }
+    const kept = committed[id] ? `; row kept from ${String(committed[id].probedAt || "").slice(0, 10) || "an earlier run"}, marked stale` : "; no committed row to keep"
+    lines.push(`✗ ${id.padEnd(9)} ${why}${kept}`)
+    continue
+  }
+  fresh[id] = { row, ...(rowFrom ? { probedFrom: rowFrom } : {}), ...(rowAt ? { probedAt: rowAt } : {}) }
+  const diff = diffRow(committed[id], row)
+  if (diff.length) drifted++
+  const models = row.models ? `models ${row.models.length}` : "models -"
+  const efforts = row.modes ? `modes ${row.modes.length}` : row.efforts ? `efforts ${row.efforts.length}` : "efforts -"
+  const build = builds[id]?.buildID ? ` build ${String(builds[id].buildID).slice(0, 8)}` : ""
+  lines.push(`${diff.length ? "~" : "✓"} ${id.padEnd(9)} ${row.version.padEnd(14)} ${efforts.padEnd(10)} ${models.padEnd(11)}${build}${diff.length ? `  drift: ${diff.join("; ")}` : ""}`)
+  if (mode === "write" && from !== "fixture" && results) writeFixture(id, CATALOG_PROBES[id], results, row.version)
+}
+for (const l of lines) console.log(l)
+
+const merged = mergeCatalog(committed, fresh, { probedFrom: from, probedAt, templates: builds })
+
+if (mode === "write") {
+  writeFileSync(GENERATED, renderGeneratedModule(merged, { probedAt }))
+  const toml = readFileSync(TOML, "utf8")
+  writeFileSync(TOML, spliceTomlBlock(toml, renderTomlBlock(merged)))
+  console.log(`\nwrote ${path.relative(ROOT, GENERATED)}, the <catalog> block in ${path.relative(ROOT, TOML)}${from !== "fixture" ? `, ${path.relative(ROOT, FIXTURES)}/` : ""}`)
+  if (from === "local") console.log("note: rows read from this machine's binaries are marked probedFrom: \"local\"; the template's CLI is the one that counts; rerun with --from=box before shipping")
+} else {
+  console.log(`\n${drifted ? `${drifted} row(s) drifted, rerun with --write to accept` : "no drift"}${failed ? `, ${failed} probe(s) failed` : ""}`)
+}
+
+process.exit(failed ? 1 : drifted && mode === "check" ? 2 : 0)
diff --git a/src/auth-cli.js b/src/auth-cli.js
index b3c5ace..77025f5 100644
--- a/src/auth-cli.js
+++ b/src/auth-cli.js
@@ -10,9 +10,10 @@ import { CONFIG_PATH, AUTH_PATH, CONNECTIONS_DIR } from "./config-paths.js"
 import { runProbe } from "./harness-probe.js"
 import { HARNESSES, readHarnessFile } from "./harnesses.js"
 import {
-  classifySubscription, connectionId, connectionMaterial, localAccountLabel, readConnections,
-  removeConnection, saveConnection, selectConnection, suggestedConnectionId, validSetupToken,
+  OAUTH_HARNESSES, classifySubscription, connectionId, connectionMaterial, localAccountLabel, readConnections, readOauthSecret,
+  removeConnection, rewriteOauthSecret, saveConnection, selectConnection, suggestedConnectionId, validSetupToken,
 } from "./connections.js"
+import { OAUTH_CONNECT, codexRefresh, validAmpAccessToken } from "./oauth.js"
 
 const HELP = `e2b-box auth — coding-agent connections
 
@@ -23,6 +24,15 @@ const HELP = `e2b-box auth — coding-agent connections
   auth connect claude --token-stdin --yes
                                   accept an existing token over stdin
   auth connect codex [--user]      borrow the current local Codex session
+  auth connect muse                sign in with Meta's device flow; the Muse
+                                  API key it mints is stored privately
+  auth connect amp                 open ampcode.com/settings/security and paste
+                                  its access token; stored privately
+  auth connect codex --oauth       sign in to ChatGPT for a Codex session of the
+                                  plugin's own (refreshed by reconnect, not boxes)
+  auth connect amp --token-stdin --yes
+                                  accept an access token from
+                                  ampcode.com/settings/security over stdin
   auth connect <agent> --name ID   choose a connection name
   auth list [--json]               list connections without reading tokens
   auth explain --template NAME [--connection ID] [--json]
@@ -45,6 +55,9 @@ Claude names use the detected organization (e.g. claude-e2b), personal for Pro/M
 or local when unknown. --name overrides this; names never grant shared access.
 Check validates local material, not provider acceptance; it makes no model call.
 Codex borrowing excludes its real refresh token and lasts until bearer expiry.
+An --oauth codex connection is a second ChatGPT login owned by this plugin: it never
+touches ~/.codex, boxes still get the placeholder copy, and reconnect refreshes it
+without a browser while its refresh token is good (ADR 0015).
 Reconnect/disconnect do not change or revoke credentials already inside a box.
 `
 
@@ -80,6 +93,20 @@ async function captureToken() {
   })
 }
 
+/**
+ * What a human sees during the plugin's own sign-in: the URL, the code to compare,
+ * and the browser opened when there is one. Codes are never secrets; tokens never
+ * come through here.
+ */
+async function showSignIn({ url, userCode, expiresIn }) {
+  console.log(`\n  ${userCode || expiresIn ? "Sign in at     " : "Open           "} ${url}`)
+  if (userCode) console.log(`  Code shown      ${userCode}  (confirm it matches in the browser)`)
+  if (userCode || url.includes("auth.")) console.log(`  Waiting         up to ${Math.round(expiresIn / 60)} min for the browser...`)
+  if (process.stdout.isTTY && process.platform === "darwin") {
+    try { spawn("open", [url], { stdio: "ignore", detached: true }).unref() } catch { /* the URL is printed */ }
+  }
+}
+
 async function detectClaude() {
   const probe = await runProbe("claude", ["auth", "status"])
   try { return classifySubscription(JSON.parse(probe.stdout)) } catch { return classifySubscription() }
@@ -89,7 +116,7 @@ function parse(argv) {
   const { values, positionals } = parseArgs({ args: argv, allowPositionals: true, options: {
     help: { type: "boolean", short: "h" }, yes: { type: "boolean", short: "y" },
     user: { type: "boolean" }, org: { type: "string" }, name: { type: "string" },
-    "token-stdin": { type: "boolean" }, json: { type: "boolean" },
+    "token-stdin": { type: "boolean" }, oauth: { type: "boolean" }, json: { type: "boolean" },
     template: { type: "string", short: "t" }, connection: { type: "string" },
   } })
   return { values, positionals }
@@ -100,7 +127,7 @@ async function main() {
   if (options.help || positionals[0] === "help") { console.log(HELP); return }
   const [verb, target, ...rest] = positionals
   const allowed = {
-    connect: ["yes", "user", "org", "name", "token-stdin"],
+    connect: ["yes", "user", "org", "name", "token-stdin", "oauth"],
     reconnect: ["yes", "token-stdin"], disconnect: ["yes"],
     list: ["json"], check: ["json"], explain: ["json", "template", "connection"],
     preflight: ["template", "connection"],
@@ -115,7 +142,7 @@ async function main() {
     const rows = records.map((c) => ({ id: c.id, agent: c.harness, owner: "Only you", method: c.method,
       detectedSubscription: c.detected?.subscription || "unknown", detectedOrganization: c.detected?.organization || null,
       detectionSource: c.detected?.source || null, localAccount: localAccountLabel(c.harness, c.detected),
-      status: c.method === "setup-token" && c.expiresAt && Date.parse(c.expiresAt) <= Date.now() ? "expired" : "configured",
+      status: c.method !== "borrowed-session" && c.expiresAt && Date.parse(c.expiresAt) <= Date.now() ? "expired" : "configured",
       expiresAt: c.expiresAt || null }))
     if (options.json) console.log(JSON.stringify(rows, null, 2))
     else if (!rows.length) console.log("No connections. Run e2b-box auth connect claude or e2b-box auth discover.")
@@ -166,20 +193,55 @@ async function main() {
   }
 
   const harness = verb === "reconnect" ? existing.harness : target
-  if (!["claude", "codex"].includes(harness)) throw new Error("Managed connections currently support claude and codex. Use auth discover for other agents.")
-  if (options["token-stdin"] && harness !== "claude") throw new Error("--token-stdin is only supported for Claude setup-token.")
+  // muse and amp have exactly one managed method, the plugin's own sign-in; codex
+  // has two and picks the borrowed local session unless --oauth says otherwise.
+  const oauth = verb === "reconnect" ? existing.method === "oauth" : options.oauth === true || ["muse", "amp"].includes(harness)
+  if (options.oauth && !OAUTH_HARNESSES.includes(harness)) throw new Error("--oauth is supported for muse, amp and codex.")
+  if (!(["claude", "codex"].includes(harness) || (oauth && OAUTH_HARNESSES.includes(harness)))) throw new Error("Managed connections support claude, codex, muse and amp. Use auth discover for other agents.")
+  if (options["token-stdin"] && !(harness === "claude" || (oauth && harness === "amp"))) throw new Error("--token-stdin is supported for Claude setup-token and amp access tokens.")
+  const method = oauth ? "oauth" : harness === "claude" ? "setup-token" : "borrowed-session"
   const detected = harness === "claude" ? await detectClaude() : undefined
-  const id = connectionId(verb === "reconnect" ? existing.id : options.name ?? suggestedConnectionId(harness, detected))
+  const id = connectionId(verb === "reconnect" ? existing.id : options.name ?? (oauth ? `${harness}-personal` : suggestedConnectionId(harness, detected)))
   if (verb === "connect" && records.some((c) => c.id === id)) throw new Error(`Connection '${id}' already exists. Run e2b-box auth reconnect ${id}.`)
-  output({ Connection: id, ...(detected ? { "Local account": localAccountLabel(harness, detected) } : {}),
-    Access: "Only you", Method: harness === "claude" ? "Claude setup-token" : "Borrowed Codex session" })
+  const methodLabel = { "setup-token": "Claude setup-token", "borrowed-session": "Borrowed Codex session", oauth: `${harness} sign-in owned by this plugin` }[method]
+  output({ Connection: id, ...(detected ? { "Local account": localAccountLabel(harness, detected) } : {}), Access: "Only you", Method: methodLabel })
   if (detected) console.log("  Account check   Local login detected; connection account unverified.")
   if (verb === "connect" && !options.name && detected) console.log("  Name source     Local account suggestion; use --name to choose another.")
-  if (harness === "codex") console.log("  Refresh token   Not copied; boxes use this session only until its bearer expires.")
+  if (method === "borrowed-session") console.log("  Refresh token   Not copied; boxes use this session only until its bearer expires.")
+  if (method === "oauth" && harness === "codex") console.log("  Refresh token   Kept by this plugin only; boxes receive a copy without it.")
+  if (method === "oauth" && harness === "amp") console.log("  Stored          amp's long-lived access token, pasted from its Security page (amp reads it behind a recent-sign-in gate no CLI can pass, ADR 0015).")
+  if (method === "oauth" && harness === "muse") console.log("  Stored          the Muse API key Meta mints for the signed-in account.")
   await confirm("Save this connection as the default when it is the only one for this agent?", options.yes)
-  let record = { id, harness, detected, method: harness === "claude" ? "setup-token" : "borrowed-session" }
+  let record = { id, harness, detected, method }
   let token
-  if (harness === "claude") {
+  if (method === "oauth") {
+    if (verb === "reconnect" && harness === "codex" && !options["token-stdin"]) {
+      // The refresh token is the plugin's alone, so reconnect tries the grant first
+      // and only opens a browser when the chain is dead.
+      try {
+        const next = await codexRefresh(readOauthSecret(existing), { fetch })
+        rewriteOauthSecret(existing, next)
+        console.log(`\n✓ Refreshed ${existing.id} without a browser (bearer until ${connectionMaterial(existing).expiresAt}).`)
+        return
+      } catch (error) {
+        console.log(`  Refresh         ${error.message}. Signing in again.`)
+      }
+    }
+    if (harness === "amp" && options["token-stdin"]) {
+      const value = readFileSync(0, "utf8").trim()
+      if (!validAmpAccessToken(value)) throw new Error("Expected an amp access token (sgamp_…); nothing was saved.")
+      token = { kind: "api-key", AMP_API_KEY: value }
+    } else {
+      const prompt = async (question) => {
+        if (!process.stdin.isTTY) throw new Error("Pasting the amp access token needs a terminal. Use auth connect amp --token-stdin --yes.")
+        const rl = createInterface({ input: process.stdin, output: process.stdout })
+        try { return await rl.question(`  ${question}`) } finally { rl.close() }
+      }
+      const result = await OAUTH_CONNECT[harness]({ fetch, sleep: (ms) => new Promise((r) => setTimeout(r, ms)), onCode: showSignIn, prompt })
+      token = result.secret
+      record.expiresAt = result.expiresAt
+    }
+  } else if (harness === "claude") {
     const startedAt = Date.now()
     token = options["token-stdin"] ? readFileSync(0, "utf8").trim() : await captureToken()
     if (!validSetupToken(token)) throw new Error("Expected a Claude setup-token value; nothing was saved.")
diff --git a/src/auth-menu.js b/src/auth-menu.js
index 28c113e..940bc6c 100644
--- a/src/auth-menu.js
+++ b/src/auth-menu.js
@@ -78,6 +78,10 @@ export function authMenuActions(agent, connections) {
     id: "reconnect", label: `Reconnect ${c.id}`, connection: c.id,
   }))
   if (["claude", "codex"].includes(agent)) actions.push({ id: "connect", label: agent === "claude" ? "Connect new claude account" : "Connect local codex session" })
+  // The plugin's own sign-in (ADR 0015): the only managed method for muse and amp,
+  // the second one for codex.
+  if (agent === "codex") actions.push({ id: "connect-oauth", label: "Sign in to ChatGPT for a codex session of this plugin's own" })
+  if (["muse", "amp"].includes(agent)) actions.push({ id: "connect-oauth", label: `Sign in to ${agent} and store its credential` })
   actions.push({ id: "explain", label: "Inspect authentication" },
     { id: "config", label: "Open config.toml (templates / API keys)" },
     { id: "discovery", label: "Open auth.toml (generated sources)" },
@@ -135,8 +139,8 @@ export async function runAuthMenu({ initial, refresh, render, save }) {
       } else {
         let args
         if (action.id === "reconnect") args = ["reconnect", action.connection]
-        else if (action.id === "connect") {
-          args = ["connect", agent]
+        else if (action.id === "connect" || action.id === "connect-oauth") {
+          args = ["connect", agent, ...(action.id === "connect-oauth" && agent === "codex" ? ["--oauth"] : [])]
           if (state.cfg.connections.some((c) => c.harness === agent)) {
             const name = await question("\n  New connection name (blank cancels): ")
             if (!name) continue
diff --git a/src/catalog.js b/src/catalog.js
new file mode 100644
index 0000000..6220037
--- /dev/null
+++ b/src/catalog.js
@@ -0,0 +1,577 @@
+// What each harness's CLI offers: the model ids it knows and the words it takes for
+// "how hard to think", read off the binary shipped in that harness's TEMPLATE.
+//
+// Two tables used to be typed by hand from a laptop (`EFFORT_SCALES` in
+// src/effort.js, the template table in config/config.example.toml) and they had
+// already drifted from each other and from the boxes by the day they were compared
+// (docs/research/0003-model-and-effort-catalogs.md). The templates ship older CLIs
+// than a developer's machine, in every case measured but one, so a laptop is the
+// wrong oracle: `muse --help` on the box has no `max`, the box's `amp` has no
+// per-model efforts key, and a row "verified against the CLI" was verified against
+// the wrong CLI. What a box will accept is decided by the binary IN the box, so that
+// is what gets asked.
+//
+// No registry answers this. models.dev knows every model id and, for a few
+// providers, each model's effort values, but `ultra`, `dynamic`, `off` and `none`
+// are words the coding CLIs invented and appear in no registry at all: registries
+// are keyed by inference provider, this table by coding-agent CLI. So model ids
+// come from the CLI where the CLI enumerates them (codex, grok, droid, amp, prime)
+// and from models.dev where it does not (claude); efforts always come from the CLI.
+// Five of eight print their own vocabulary when fed a sentinel value, which is the
+// ADR 0009 spawn-the-binary shape applied to a different question.
+//
+// Same shape as src/harnesses.js and for the same reason: a shipped data table beside
+// a PURE function. `interpretCatalog` never spawns and never fetches, it reads probe
+// RESULTS, so every parse rule is testable from captured output on a machine with
+// none of these installed. The spawning lives in scripts/harness-catalog.mjs, which
+// boots the template, runs each probe, and writes what it read into
+// src/harness-catalog.generated.js (committed, never hand-edited) and the table in
+// config/config.example.toml. Two rules that script keeps and this module makes
+// possible: a failed probe never blanks a row (`mergeCatalog` keeps the committed one
+// and marks it stale), and a credential is never on a command line (every probe here
+// runs unauthenticated, or reads a variable the box already has).
+
+/**
+ * The words in the order every scale is written: nothing, then more. Every harness
+ * spells its own subset, and two print theirs descending, so a generated row would
+ * otherwise flip order with the vendor's whim. Unknown words keep their own order
+ * after these.
+ */
+export const EFFORT_ORDER = ["none", "dynamic", "off", "minimal", "low", "medium", "high", "xhigh", "max", "ultra"]
+
+const text = (p) => `${p?.stdout ?? ""}\n${p?.stderr ?? ""}`
+const uniq = (xs) => [...new Set(xs)]
+const json = (p) => {
+  try {
+    return JSON.parse(String(p?.stdout ?? ""))
+  } catch {
+    return null
+  }
+}
+
+/** An effort word as a CLI prints one: lowercase letters, digits, dashes. */
+const isWord = (s) => /^[a-z][a-z0-9-]*$/.test(s)
+
+/** `values` sorted by EFFORT_ORDER, de-duplicated; `null` for nothing usable. */
+export function orderEfforts(values) {
+  const words = uniq((values || []).map((v) => String(v ?? "").trim()).filter(isWord))
+  if (!words.length) return null
+  const rank = (w) => (EFFORT_ORDER.includes(w) ? EFFORT_ORDER.indexOf(w) : EFFORT_ORDER.length + words.indexOf(w))
+  return words.sort((a, b) => rank(a) - rank(b))
+}
+
+/**
+ * The comma- or pipe-separated list that follows `re`'s first capture in `s`,
+ * as ordered effort words. This is how a rejection message is read: "Valid values:
+ * low, medium, high." → ["low", "medium", "high"].
+ */
+export function enumAfter(s, re) {
+  const m = String(s ?? "").match(re)
+  if (!m?.[1]) return null
+  return orderEfforts(m[1].split(/[,|]/).map((w) => w.trim().replace(/^'|'$/g, "").replace(/^and\s+/, "")))
+}
+
+/** The union of every model's efforts, ordered; `null` when no model names any. */
+export function unionEfforts(models) {
+  return orderEfforts((models || []).flatMap((m) => m.efforts || []))
+}
+
+/** Does at least one model take a different set than the union? (Then a flat row lies.) */
+export function perModel(row) {
+  const all = row?.efforts || []
+  return !!row?.models?.some((m) => m.efforts && (m.efforts.length !== all.length || m.efforts.some((e) => !all.includes(e))))
+}
+
+/** models.dev's `api.json`: one provider's models as catalog rows, with each model's effort values when it has any. */
+function modelsDev(p, provider) {
+  const j = json(p)
+  const models = j?.[provider]?.models
+  if (!models || typeof models !== "object") return null
+  const rows = Object.values(models)
+    .filter((m) => m?.id)
+    .map((m) => {
+      const eff = (m.reasoning_options || []).find((o) => o?.type === "effort")?.values
+      const ordered = orderEfforts(eff)
+      return { id: String(m.id), ...(ordered ? { efforts: ordered } : {}) }
+    })
+    .sort((a, b) => a.id.localeCompare(b.id))
+  return rows.length ? rows : null
+}
+
+/** The first `x.y.z[-tag]` in a `--version` answer, or null. */
+export function versionIn(s) {
+  return String(s ?? "").match(/\d+\.\d+\.\d+(?:-[A-Za-z0-9.]+)?/)?.[0] ?? null
+}
+
+// The droid handshake. Factory's own envelope, not plain JSON-RPC and not ACP: every
+// field below is required (`type`, the literal `factoryApiVersion`, a STRING id,
+// `machineId`) and the two `--*-format` flags must both be given. It scaffolds
+// ~/.factory and opens a session, so it runs against a throwaway HOME. Verified to
+// return the full model list with no credential at all.
+const DROID_HELLO = JSON.stringify({
+  jsonrpc: "2.0",
+  factoryApiVersion: "1.0.0",
+  type: "request",
+  id: "1",
+  method: "droid.initialize_session",
+  params: { cwd: "/tmp", machineId: "herdr-e2b-catalog" },
+})
+const THROWAWAY_HOME = 'H="$(mktemp -d)"; export HOME="$H";'
+
+/**
+ * Per harness: the probes to run (in this order: grok's cache is written by the
+ * probe before it) and the pure rule that reads their results.
+ *
+ *   probes.<name>   { cmd }  a shell line run in the box's login shell, or
+ *                   { url }  an unauthenticated GET; `trim` reduces a large answer
+ *                   to the fields `parse` reads before it is saved as a fixture.
+ *   needs           which field a usable row must carry: "efforts", "modes" or null.
+ *   modelsFrom      where the model column comes from, for the docs; null = not
+ *                   enumerable (muse has no pinnable model; opencode's universe is
+ *                   all of models.dev and its own `models` lists only CONFIGURED
+ *                   providers, 7 lines on a clean HOME against 439 with keys, so a
+ *                   box probe would delete 432 valid ids).
+ *   parse(results)  → { efforts, models, modes? } or null when the row cannot be
+ *                   trusted. `efforts` is the flat set the CLI accepts (what a pin may
+ *                   say); each model may carry its own `efforts` and `default`.
+ *
+ * Every rule reads stdout AND stderr and ignores the exit code: the rejection
+ * oracles exit non-zero by design, and droid's `Invalid model` exits 0.
+ */
+export const CATALOG_PROBES = {
+  claude: {
+    needs: "efforts",
+    modelsFrom: "models.dev (anthropic)",
+    probes: {
+      version: { cmd: "claude --version" },
+      // An empty prompt: the CLI validates --effort, warns with the valid set, and
+      // then dies for want of input: exit 1, no session, no tokens.
+      efforts: { cmd: `claude -p --effort __probe__ ""` },
+      models: {
+        url: "https://models.dev/api.json",
+        trim: (s) => JSON.stringify({ anthropic: JSON.parse(s).anthropic }),
+      },
+    },
+    parse: ({ efforts, models }) => {
+      const e = enumAfter(text(efforts), /Valid values:\s*([^.\n]+)/)
+      return e ? { efforts: e, models: modelsDev(models, "anthropic") } : null
+    },
+  },
+  codex: {
+    needs: "efforts",
+    modelsFrom: "codex debug models --bundled",
+    probes: {
+      version: { cmd: "codex --version" },
+      // `--bundled` is the catalog compiled into this binary, offline. Without it
+      // codex silently falls back to the same thing when unauthenticated, so asking
+      // for it outright is the honest version of the same answer.
+      catalog: {
+        cmd: "codex debug models --bundled",
+        trim: (s) =>
+          JSON.stringify({
+            models: (JSON.parse(s).models || []).map((m) => ({
+              slug: m.slug,
+              visibility: m.visibility,
+              default_reasoning_level: m.default_reasoning_level,
+              supported_reasoning_levels: (m.supported_reasoning_levels || []).map((l) => ({ effort: l.effort })),
+            })),
+          }),
+      },
+    },
+    parse: ({ catalog }) => {
+      const j = json(catalog)
+      if (!Array.isArray(j?.models)) return null
+      // `visibility: "list"` is what codex's own picker shows; hidden slugs are
+      // retired or internal.
+      const models = j.models
+        .filter((m) => m?.slug && m.visibility === "list")
+        .map((m) => {
+          const eff = orderEfforts((m.supported_reasoning_levels || []).map((l) => l?.effort))
+          return { id: String(m.slug), ...(eff ? { efforts: eff } : {}), ...(m.default_reasoning_level ? { default: m.default_reasoning_level } : {}) }
+        })
+      const efforts = unionEfforts(models)
+      return efforts ? { efforts, models } : null
+    },
+  },
+  grok: {
+    needs: "efforts",
+    modelsFrom: "~/.grok/models_cache.json after `grok models`",
+    probes: {
+      version: { cmd: "grok --version" },
+      // Needs a credential: the catalog is team-scoped and fetched on the first
+      // authenticated command, which writes the cache the next probe reads. The box
+      // has XAI_API_KEY in its environment; nothing here names its value.
+      models: { cmd: "grok models" },
+      cache: { cmd: 'cat "$HOME/.grok/models_cache.json"' },
+      // A non-empty prompt on purpose: the empty-prompt guard runs BEFORE effort
+      // validation, so `-p ""` would pass every value.
+      efforts: { cmd: "grok --reasoning-effort __probe__ -p x" },
+    },
+    parse: ({ models, cache, efforts }) => {
+      const j = json(cache)
+      if (j?.models && typeof j.models === "object") {
+        const rows = Object.entries(j.models)
+          .filter(([, m]) => !m?.info?.hidden)
+          .map(([id, m]) => {
+            const list = m?.info?.reasoning_efforts || []
+            const eff = orderEfforts(list.map((e) => e?.value))
+            const def = list.find((e) => e?.default)?.value
+            return { id, ...(eff ? { efforts: eff } : {}), ...(def ? { default: def } : {}) }
+          })
+        const all = unionEfforts(rows)
+        if (all) return { efforts: all, models: rows }
+      }
+      // No cache (unauthenticated, or an older grok): the flat set from the
+      // rejection and whatever ids `grok models` listed.
+      const e = enumAfter(text(efforts), /use one of:\s*([^\n;]+)/)
+      if (!e) return null
+      const ids = uniq([...text(models).matchAll(/^\s+[*-]\s+(\S+)/gm)].map((m) => m[1]))
+      return { efforts: e, models: ids.length ? ids.map((id) => ({ id })) : null }
+    },
+  },
+  droid: {
+    needs: "efforts",
+    modelsFrom: "droid.initialize_session (stream-jsonrpc)",
+    probes: {
+      version: { cmd: "droid --version" },
+      catalog: {
+        cmd: `${THROWAWAY_HOME} printf '%s\\n' '${DROID_HELLO}' | droid exec --input-format stream-jsonrpc --output-format stream-jsonrpc`,
+        // Only the response that carries the models, and only the fields read.
+        trim: (s) => {
+          for (const line of String(s).split("\n")) {
+            try {
+              const o = JSON.parse(line)
+              if (o?.type === "response" && Array.isArray(o.result?.availableModels)) {
+                return JSON.stringify({
+                  type: "response",
+                  result: {
+                    availableModels: o.result.availableModels.map((m) => ({
+                      id: m.id,
+                      supportedReasoningEfforts: m.supportedReasoningEfforts,
+                      defaultReasoningEffort: m.defaultReasoningEffort,
+                      deprecated: m.deprecated,
+                    })),
+                  },
+                })
+              }
+            } catch {}
+          }
+          return s
+        },
+      },
+      efforts: { cmd: `${THROWAWAY_HOME} droid exec --reasoning-effort __bogus__ x` },
+      models: { cmd: `${THROWAWAY_HOME} droid exec --model __bogus__ x` },
+    },
+    parse: ({ catalog, efforts, models }) => {
+      let rows = null
+      for (const line of text(catalog).split("\n")) {
+        let o
+        try {
+          o = JSON.parse(line)
+        } catch {
+          continue
+        }
+        if (o?.type === "response" && Array.isArray(o.result?.availableModels)) {
+          rows = o.result.availableModels
+            .filter((m) => m?.id)
+            .map((m) => {
+              const eff = orderEfforts(m.supportedReasoningEfforts)
+              return {
+                id: String(m.id),
+                ...(eff ? { efforts: eff } : {}),
+                ...(m.defaultReasoningEffort ? { default: m.defaultReasoningEffort } : {}),
+                ...(m.deprecated ? { deprecated: true } : {}),
+              }
+            })
+          break
+        }
+      }
+      // The live union, not the syntactic enum: droid accepts nine words at the
+      // flag and then silently coerces one no model supports (`dynamic`, today) to
+      // the model's default, exit 0. A word no model takes is not a choice.
+      const live = unionEfforts(rows)
+      if (live) return { efforts: live, models: rows }
+      const e = enumAfter(text(efforts), /Allowed values:\s*([^\n]+)/)
+      if (!e) return null
+      const ids = text(models).match(/Available built-in models:\s*\n\s*([^\n]+)/)?.[1]
+      return { efforts: e, models: ids ? ids.split(",").map((s) => ({ id: s.trim() })).filter((m) => m.id) : null }
+    },
+  },
+  amp: {
+    needs: "modes",
+    modelsFrom: "amp plugins show-agent-options --json",
+    probes: {
+      version: { cmd: "amp --version" },
+      options: {
+        cmd: "amp plugins show-agent-options --json",
+        trim: (s) =>
+          JSON.stringify({
+            models: (JSON.parse(s).models || []).map((m) => ({
+              id: m.id,
+              capabilities: m.capabilities?.efforts ? { efforts: m.capabilities.efforts } : {},
+            })),
+          }),
+      },
+      help: { cmd: "amp --help" },
+      // amp's own --reasoning-effort vocabulary, from its rejection. Recorded, and
+      // kept APART from the modes: `ultra` is a mode only, `xhigh`/`max` efforts
+      // only, and `low|medium|high` mean different things in each. Never unioned.
+      efforts: { cmd: "amp config model-providers check-access --provider-model a/b --reasoning-effort bogus-zzz" },
+    },
+    parse: ({ options, help, efforts }) => {
+      // "Set the agent mode (low, medium, high, ultra, or a plugin mode by key or
+      // label, case-insensitive)": the bare words up to the first phrase.
+      const inParens = text(help).match(/--mode <value>[\s\S]*?\(([^)]*)\)/)?.[1]
+      const modes = []
+      for (const w of (inParens || "").split(",").map((s) => s.trim())) {
+        if (!/^[a-z]+$/.test(w)) break
+        modes.push(w)
+      }
+      if (!modes.length) return null
+      const j = json(options)
+      const models = Array.isArray(j?.models)
+        ? j.models
+            .filter((m) => m?.id)
+            .map((m) => {
+              const eff = orderEfforts(m.capabilities?.efforts)
+              return { id: String(m.id), ...(eff ? { efforts: eff } : {}) }
+            })
+        : null
+      return { modes, efforts: enumAfter(text(efforts), /Allowed choices are\s*([^.\n]+)/), models }
+    },
+  },
+  prime: {
+    needs: "efforts",
+    modelsFrom: "prime-agent model list",
+    probes: {
+      version: { cmd: "prime-agent --version" },
+      help: { cmd: "prime-agent --help" },
+      models: { cmd: "prime-agent model list" },
+    },
+    parse: ({ help, models }) => {
+      const e = enumAfter(text(help), /--thinking <level>\s+Set reasoning:\s*([^\n]+)/)
+      if (!e) return null
+      // A table: `provider  model  context  max-out  thinking  images`. The id is
+      // spelled the way the pin is: `<provider>/<model>`, split at the first slash.
+      const rows = []
+      for (const line of text(models).split("\n")) {
+        const m = line.match(/^([a-z0-9][a-z0-9._-]*)\s+(\S+)\s+\S+\s+\S+\s+(yes|no)\b/i)
+        if (!m || m[1] === "provider") continue
+        rows.push({ id: `${m[1]}/${m[2]}`, ...(m[3].toLowerCase() === "yes" ? { reasoning: true } : {}) })
+      }
+      return { efforts: e, models: rows.length ? rows : null }
+    },
+  },
+  muse: {
+    needs: "efforts",
+    modelsFrom: null,
+    probes: {
+      version: { cmd: "muse --version" },
+      help: { cmd: "muse exec --help" },
+      // clap validates the value before anything else happens: "invalid value
+      // '__bogus__' … expected none|minimal|…". No config, no network.
+      oracle: { cmd: "muse --reasoning-effort __bogus__" },
+    },
+    parse: ({ help, oracle }) => {
+      const e = enumAfter(text(oracle), /expected\s+([a-z|]+)/) || enumAfter(text(help), /reasoning effort:\s*([a-z|]+)/i)
+      return e ? { efforts: e, models: null } : null
+    },
+  },
+  opencode: {
+    needs: null,
+    modelsFrom: null,
+    probes: { version: { cmd: "opencode --version" } },
+    // Reasoning is a per-model VARIANT picked in its UI, not a setting the plugin
+    // writes (src/effort.js gives it the generic scale); its model universe is all
+    // of models.dev. Only the version is worth reading.
+    parse: () => ({ efforts: null, models: null }),
+  },
+}
+
+/**
+ * Read one harness's probe results into a catalog row, or null when they cannot be
+ * trusted (no version, or the field the row needs is missing). Pure: takes results,
+ * never a spawner. A null here is what makes `mergeCatalog` keep the committed row.
+ *
+ * @param {string} id       key into CATALOG_PROBES
+ * @param {object} results  { <probe>: { stdout, stderr, status } }
+ * @returns {{version:string, efforts:string[]|null, models:object[]|null, modelsFrom:string|null, modes?:string[]}|null}
+ */
+export function interpretCatalog(id, results = {}) {
+  const spec = CATALOG_PROBES[id]
+  if (!spec) return null
+  const version = versionIn(text(results.version))
+  if (!version) return null
+  let parsed
+  try {
+    parsed = spec.parse(results)
+  } catch {
+    parsed = null
+  }
+  if (!parsed) return null
+  const row = {
+    version,
+    efforts: parsed.efforts ?? null,
+    ...(parsed.modes ? { modes: parsed.modes } : {}),
+    models: parsed.models ?? null,
+    modelsFrom: parsed.models ? spec.modelsFrom : null,
+  }
+  if (spec.needs && !row[spec.needs]?.length) return null
+  return row
+}
+
+/** A row without its provenance, for comparing what the CLI said across runs. */
+export function stripMeta(row) {
+  if (!row) return null
+  const { probedFrom, probedAt, template, stale, ...rest } = row
+  return rest
+}
+
+/**
+ * The next committed catalog: every harness the probes cover, taken from `fresh`
+ * where a row was read and kept from `committed` where it was not.
+ *
+ * `fresh[id]` is `{ row, reason, probedFrom?, probedAt? }`: `row` null means the
+ * probe failed and `reason` says how; the two provenance fields, when given, say
+ * where THAT row came from (a fixture replay carries the box's, not "fixture"). A
+ * failed probe never blanks a row: an unauthenticated run of the script would
+ * otherwise empty every scale and turn every user's pin invalid at once. The kept
+ * row is marked `stale: { since, reason }` so the report and the docs can say so.
+ *
+ * @param {object} committed   the current HARNESS_CATALOG
+ * @param {object} fresh       { <id>: { row, reason, probedFrom, probedAt } }
+ * @param {object} meta        { probedFrom, probedAt, templates: { <id>: { name, buildID, updatedAt } } }
+ */
+export function mergeCatalog(committed = {}, fresh = {}, meta = {}) {
+  const out = {}
+  const now = meta.probedAt ?? new Date().toISOString()
+  for (const id of Object.keys(CATALOG_PROBES)) {
+    const got = fresh[id]
+    const template = meta.templates?.[id] ?? committed[id]?.template ?? null
+    if (got?.row) {
+      out[id] = { ...got.row, probedFrom: got.probedFrom ?? meta.probedFrom ?? "box", probedAt: got.probedAt ?? now, template }
+    } else if (committed[id]) {
+      const { stale, ...kept } = committed[id]
+      out[id] = got ? { ...kept, template, stale: { since: now, reason: got.reason || "probe failed" } } : committed[id]
+    }
+  }
+  return out
+}
+
+/** What changed between two rows of the same harness, as short phrases; [] when nothing did. */
+export function diffRow(before, after) {
+  const a = stripMeta(before)
+  const b = stripMeta(after)
+  if (!a) return b ? ["new row"] : []
+  if (!b) return ["row gone"]
+  const out = []
+  if (a.version !== b.version) out.push(`version ${a.version} → ${b.version}`)
+  const list = (name, x, y) => {
+    const xs = x || []
+    const ys = y || []
+    const plus = ys.filter((v) => !xs.includes(v))
+    const minus = xs.filter((v) => !ys.includes(v))
+    if (plus.length || minus.length) out.push(`${name} ${[...plus.map((v) => `+${v}`), ...minus.map((v) => `-${v}`)].join(" ")}`)
+    else if (xs.join(",") !== ys.join(",")) out.push(`${name} reordered`)
+  }
+  list("efforts", a.efforts, b.efforts)
+  if (a.modes || b.modes) list("modes", a.modes, b.modes)
+  const ids = (ms) => (ms || []).map((m) => m.id)
+  const am = ids(a.models)
+  const bm = ids(b.models)
+  const plus = bm.filter((v) => !am.includes(v))
+  const minus = am.filter((v) => !bm.includes(v))
+  if (plus.length || minus.length) {
+    const show = (xs, sign) => xs.slice(0, 4).map((v) => `${sign}${v}`).join(" ") + (xs.length > 4 ? ` ${sign}${xs.length - 4} more` : "")
+    out.push(`models ${[show(plus, "+"), show(minus, "-")].filter(Boolean).join(" ")}`)
+  } else {
+    const changed = (b.models || []).filter((m) => {
+      const o = (a.models || []).find((x) => x.id === m.id)
+      return o && ((o.efforts || []).join(",") !== (m.efforts || []).join(",") || o.default !== m.default)
+    })
+    if (changed.length) out.push(`per-model efforts changed: ${changed.slice(0, 4).map((m) => m.id).join(", ")}${changed.length > 4 ? ` +${changed.length - 4} more` : ""}`)
+  }
+  return out
+}
+
+// --- what gets written -------------------------------------------------------------
+
+/** Source of the committed module. JSON with 2-space indent, one export, a header that says who writes it. */
+export function renderGeneratedModule(catalog, { probedAt = new Date().toISOString() } = {}) {
+  const head = [
+    "// GENERATED by scripts/harness-catalog.mjs. Do not edit, rerun:",
+    "//   npm run catalog -- --write            (boots each template, the authoritative read)",
+    "//   npm run catalog -- --from=fixture --write  (re-derives from test/fixtures/catalog)",
+    "//",
+    "// What each harness's CLI accepts, read off the binary in its E2B template: the",
+    "// effort words a pin may say (`efforts`; amp's `modes`), the model ids it lists",
+    "// (`models`, each with its own efforts and default where the CLI says so), the",
+    "// version that answered, and the template build it was read from. src/effort.js",
+    "// derives EFFORT_SCALES from this; config/config.example.toml's table is rendered",
+    "// from it. Parse rules and the reasoning behind every field: src/catalog.js.",
+    `// Last run: ${probedAt}`,
+    "",
+  ]
+  return `${head.join("\n")}export const HARNESS_CATALOG = ${JSON.stringify(catalog, null, 2)}\n`
+}
+
+export const TOML_BEGIN = "# <catalog>"
+export const TOML_END = "# </catalog>"
+
+/** The first ids of `xs` that fit in `width` characters, at least one: "a, b, …". */
+const examples = (xs, width = 36) => {
+  const out = []
+  for (const x of xs) {
+    if (out.length && `${[...out, x].join(", ")}, …`.length > width) break
+    out.push(x)
+  }
+  return out.length < xs.length ? `${out.join(", ")}, …` : out.join(", ")
+}
+
+/**
+ * The comment table in config/config.example.toml, between the two sentinels: one
+ * line per harness with the CLI version, the model column (count and first ids, or
+ * why there is none) and the effort scale. Rendered as text and spliced in as
+ * text: the file is nearly all comments, and re-stringifying TOML would drop them.
+ */
+export function renderTomlBlock(catalog) {
+  const rows = Object.keys(CATALOG_PROBES)
+    .filter((id) => catalog[id])
+    .map((id) => {
+      const r = catalog[id]
+      const ids = (r.models || []).map((m) => m.id)
+      let models
+      if (id === "opencode") models = 'any models.dev "<provider>/<model>"'
+      else if (id === "muse") models = "(no pinnable model: use --model in your agent command)"
+      else if (id === "amp") models = ids.length ? `${ids.length} listed, no pin route: ${examples(ids, 24)}` : "(no pin route)"
+      else models = ids.length ? `${ids.length}: ${examples(ids)}` : "(not enumerated)"
+      let reasoning
+      if (r.modes) reasoning = `--mode ${r.modes.join(" | ")} (amp's knob is the mode)`
+      else if (r.efforts) reasoning = `${r.efforts.join(" | ")}${perModel(r) ? " (per model)" : ""}`
+      else reasoning = "(not pinned: opencode does reasoning as per-model variants in its UI)"
+      const cli = `${r.version}${r.stale ? " (stale)" : ""}`
+      return [id, cli, models, reasoning]
+    })
+  const w = [0, 1, 2].map((i) => Math.max(...rows.map((r) => r[i].length), ["template", "cli", "model"][i].length))
+  const line = (cols) => `#   ${cols[0].padEnd(w[0])}  ${cols[1].padEnd(w[1])}  ${cols[2].padEnd(w[2])}  ${cols[3]}`.trimEnd()
+  const stale = Object.entries(catalog).filter(([, r]) => r.stale)
+  return [
+    TOML_BEGIN,
+    "# Generated by `npm run catalog -- --write` from the CLI shipped in each template.",
+    "# Do not edit this block: rerun the script. Per-model detail is in",
+    "# src/harness-catalog.generated.js.",
+    line(["template", "cli", "model", "reasoning"]),
+    ...rows.map(line),
+    ...stale.map(([id, r]) => `#   (${id}: kept from an earlier run, probe failed ${r.stale.since.slice(0, 10)}: ${r.stale.reason})`),
+    TOML_END,
+  ].join("\n")
+}
+
+/** `text` with whatever sits between the sentinels replaced by `block`. Throws when the sentinels are missing. */
+export function spliceTomlBlock(text, block) {
+  const s = String(text)
+  const i = s.indexOf(TOML_BEGIN)
+  const j = s.indexOf(TOML_END)
+  if (i < 0 || j < i) throw new Error(`config.example.toml: sentinels ${TOML_BEGIN} … ${TOML_END} not found`)
+  return s.slice(0, i) + block + s.slice(j + TOML_END.length)
+}
diff --git a/src/config.js b/src/config.js
index fca890f..0e1dc76 100644
--- a/src/config.js
+++ b/src/config.js
@@ -7,6 +7,7 @@ import { HARNESSES, readHarnessFile } from "./harnesses.js"
 import { modelEnv, normalizePin } from "./model-pin.js"
 import { AUTH_PATH, CONFIG_PATH, CONNECTIONS_DIR } from "./config-paths.js"
 import { applyConnection, readConnections, selectConnection } from "./connections.js"
+import { harnessHint } from "./effort.js"
 export { AUTH_PATH, CONFIG_PATH } from "./config-paths.js"
 
 // Where the `e2b` CLI keeps its login (@e2b/cli USER_CONFIG_PATH — hardcoded
@@ -79,7 +80,11 @@ const DEFAULTS = {
     // network and writes outside the workspace for no added safety.
     codex: "codex --dangerously-bypass-approvals-and-sandbox",
     grok: "grok --always-approve",
-    amp: "amp --dangerously-allow-all",
+    // amp has no reasoning knob; `--mode low|medium|high|ultra` is the closest
+    // thing, so an effort picked for an amp member (HERDR_E2B_REASONING, set by the
+    // pin or the picker's cell) becomes its mode. The `${…:+…}` expands in the BOX's
+    // shell: no effort, no flag, amp's own default mode.
+    amp: 'amp --dangerously-allow-all ${HERDR_E2B_REASONING:+--mode "$HERDR_E2B_REASONING"}',
     // Ends in `--prompt` ON PURPOSE: the fleet appends its task as one positional
     // argument, and opencode's default-command positional is a PROJECT DIRECTORY
     // (`opencode [project]`), so `opencode --auto "fix the bug"` means "cd into
@@ -447,7 +452,7 @@ export function resolveEnv(cfg, template, env = {}, now = Date.now(), readFile =
     // harness reads plus the two shared ones the file-route pin command reads
     // (src/model-pin.js). Below the user's own `env` table, so a hand-written
     // ANTHROPIC_MODEL still wins over the pin.
-    ...modelEnv(template, cfg?.templateModels?.[template]),
+    ...modelEnv(template, cfg?.templateModels?.[template], harnessHint(template, cfg) ?? template),
     // The discovered rung has two halves, and forwarding wins between them: a name
     // resolves from THIS run's environment, while a stored value is a copy taken
     // whenever `e2b-box auth` last ran. When both name the same box variable the
diff --git a/src/connections.js b/src/connections.js
index 33b9c80..9de21a1 100644
--- a/src/connections.js
+++ b/src/connections.js
@@ -41,12 +41,16 @@ export function suggestedConnectionId(harness, detected) {
   return detected?.classification === "personal" ? "claude-personal" : "claude-local"
 }
 
+/** Harnesses `method: "oauth"` (the plugin's own sign-in, src/oauth.js, ADR 0015) is defined for. */
+export const OAUTH_HARNESSES = ["muse", "amp", "codex"]
+
 function validate(record) {
   connectionId(record?.id)
   if (record.version !== 1 || record.owner !== "personal" ||
       !/^[0-9a-f-]{36}$/.test(record.revision || "") ||
       !((record.harness === "claude" && record.method === "setup-token") ||
-        (record.harness === "codex" && record.method === "borrowed-session" && typeof record.path === "string"))) {
+        (record.harness === "codex" && record.method === "borrowed-session" && typeof record.path === "string") ||
+        (record.method === "oauth" && OAUTH_HARNESSES.includes(record.harness)))) {
     throw new Error(`Invalid connection '${record.id}'.`)
   }
   return record
@@ -95,6 +99,14 @@ export function saveConnection(record, token, { directory = CONNECTIONS_DIR, rep
       if (!validSetupToken(token)) throw new Error("Expected a Claude setup-token value; nothing was saved.")
       writeFileSync(secretPath(next, directory), token, { mode: 0o600, flag: "wx" })
     }
+    // An OAuth connection's secret is the object src/oauth.js returned: a key for
+    // muse (minted by Meta) and amp (pasted from its Security page), codex's whole
+    // auth.json (real refresh token included - the plugin is its only custodian,
+    // boxes never see it; see connectionMaterial).
+    if (next.method === "oauth") {
+      if (!token || typeof token !== "object") throw new Error("Expected the sign-in's credential; nothing was saved.")
+      writeFileSync(secretPath(next, directory), `${JSON.stringify(token)}\n`, { mode: 0o600, flag: "wx" })
+    }
     writeFileSync(temporary, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600, flag: "wx" })
     renameSync(temporary, destination)
     committed = true
@@ -139,7 +151,50 @@ export function selectConnection(cfg = {}, template) {
   return candidates[0] || null
 }
 
+/** The stored secret of an OAuth connection, parsed. Throws the reconnect sentence when it is gone or unreadable. */
+export function readOauthSecret(record, directory = CONNECTIONS_DIR) {
+  try {
+    return JSON.parse(readFileSync(secretPath(record, directory), "utf8"))
+  } catch {
+    throw new Error(`Credential for '${record.id}' is unavailable. Run e2b-box auth reconnect ${record.id}.`)
+  }
+}
+
+/**
+ * Rewrite an OAuth connection's secret in place - the refresh path. Same revision,
+ * atomic rename: a provisioner reading the old bytes sees either the old file or
+ * the new one, never a torn write. Only codex ever needs this (its bearer expires
+ * and its refresh token is single-use, so the plugin rotates it, nobody else).
+ */
+export function rewriteOauthSecret(record, secret, directory = CONNECTIONS_DIR) {
+  const dest = secretPath(record, directory)
+  const tmp = `${dest}.tmp`
+  writeFileSync(tmp, `${JSON.stringify(secret)}\n`, { mode: 0o600, flag: "wx" })
+  try {
+    renameSync(tmp, dest)
+  } finally {
+    rmSync(tmp, { force: true })
+  }
+}
+
 export function connectionMaterial(record, { directory = CONNECTIONS_DIR, readFile = readHarnessFile, now = Date.now() } = {}) {
+  if (record.method === "oauth") {
+    const secret = readOauthSecret(record, directory)
+    if (record.harness === "muse" || record.harness === "amp") {
+      const name = record.harness === "muse" ? "META_API_KEY" : "AMP_API_KEY"
+      if (typeof secret?.[name] !== "string" || !secret[name].trim()) throw new Error(`Credential for '${record.id}' is invalid. Reconnect it.`)
+      return { env: { [name]: secret[name] }, expiresAt: null }
+    }
+    // codex: the plugin holds the real refresh token; the box gets the placeholder
+    // copy (ADR 0010) and lives until the bearer expires. An expired bearer is a
+    // reconnect, not a silent refresh here: provisioning stays synchronous, and
+    // `auth check` / `auth reconnect` are where the plugin rotates the chain.
+    let session = null
+    try { session = HARNESSES.codex.sessionFile.read(JSON.stringify(secret)) } catch { /* not a session */ }
+    if (!session) throw new Error(`Credential for '${record.id}' is invalid. Reconnect it.`)
+    if (Date.parse(session.expires) <= now) throw new Error(`Connection '${record.id}' has expired. Run e2b-box auth reconnect ${record.id} (a browser is only needed if the refresh fails).`)
+    return { env: { CODEX_AUTH_JSON: session.value }, expiresAt: session.expires }
+  }
   if (record.method === "setup-token") {
     if (record.expiresAt && (!Number.isFinite(Date.parse(record.expiresAt)) || Date.parse(record.expiresAt) <= now)) {
       throw new Error(`Connection '${record.id}' has expired. Run e2b-box auth reconnect ${record.id}.`)
@@ -162,6 +217,8 @@ export function connectionMaterial(record, { directory = CONNECTIONS_DIR, readFi
 export const CONFLICTING_AUTH = {
   claude: ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN", "CLAUDE_CODE_OAUTH_REFRESH_TOKEN", "ANTHROPIC_BASE_URL", "CLAUDE_CODE_USE_BEDROCK", "CLAUDE_CODE_USE_VERTEX", "CLAUDE_CODE_USE_FOUNDRY", "ANTHROPIC_PROFILE", "ANTHROPIC_FEDERATION_RULE_ID", "ANTHROPIC_ORGANIZATION_ID"],
   codex: ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_AUTH_JSON", "OPENAI_BASE_URL"],
+  muse: ["META_API_KEY"],
+  amp: ["AMP_API_KEY"],
 }
 
 export function applyConnection(record, env, options) {
diff --git a/src/effort-cli.js b/src/effort-cli.js
new file mode 100644
index 0000000..9734ac1
--- /dev/null
+++ b/src/effort-cli.js
@@ -0,0 +1,23 @@
+// `node src/effort-cli.js --fleet | <template>...` — the pickers' effort rows, for bash.
+//
+// One `|`-separated row per template:
+//   <template>|<kind>|<value,value,…>|<configured>|<via>|<model,model,…>|<configured model>
+// `|` and not TAB because bash's `read` with IFS=tab folds an EMPTY field (no
+// configured effort) into its neighbour; `|` is not whitespace, so fields stay put.
+// The two model fields came later and sit LAST, so a reader of the five-field
+// shape (`read -r t k v c via`) keeps working: bash hands the extras to `via`,
+// which only ever decorates a generic row. Model ids carry `/` and `.` but never
+// `,` or `|` (src/harness-catalog.generated.js is the corpus).
+//
+// A file of its own, not a CLI block in src/effort.js: config.js imports effort.js
+// (for `harnessHint`), so effort.js loading config.js back is an import cycle that a
+// top-level await never settles (Node 26: "unsettled top-level await", exit 13).
+import { fleetTemplateChoices, loadConfig } from "./config.js"
+import { effortRows } from "./effort.js"
+
+const cfg = loadConfig()
+const args = process.argv.slice(2)
+const names = args[0] === "--fleet" ? fleetTemplateChoices(cfg) : args
+for (const r of effortRows(names, cfg)) {
+  process.stdout.write(`${r.template}|${r.kind}|${r.values.join(",")}|${r.configured}|${r.via}|${r.models.join(",")}|${r.model}\n`)
+}
diff --git a/src/effort.js b/src/effort.js
new file mode 100644
index 0000000..5ce27c8
--- /dev/null
+++ b/src/effort.js
@@ -0,0 +1,149 @@
+// How hard each agent can be asked to think, in that agent's own words, and which
+// models it knows.
+//
+// `[templates.<name>] reasoning` (src/model-pin.js) pins ONE effort for every box a
+// template boots. The pickers (`e2b-box open`'s template list, the fleet's roster
+// table) let a human pick per box and per member instead, and to offer a list they
+// need to know which words a harness accepts. That list lives here, once, so the
+// roster picker, the single-box picker and the `--reasoning` flag's validation agree.
+// (The bash-facing CLI is src/effort-cli.js: this module is imported by config.js,
+// so a CLI here that loaded config.js would be a top-level-await import cycle,
+// which Node 26 reports as "unsettled top-level await" and exits 13 - observed live.)
+//
+// The WORDS are not typed here. They are read off the CLI shipped in each harness's
+// template by scripts/harness-catalog.mjs and committed to
+// src/harness-catalog.generated.js (src/catalog.js has every parse rule and the
+// reasons). This module used to hold them as literals, config.example.toml held a
+// second copy, the tests a third, and the copies disagreed with each other and with
+// the boxes within a week (docs/research/0003). What stays hand-written below is the
+// plugin's OVERLAY: how a pin reaches the box (`via`), what the picker shows beside
+// the value (`kind`), and the words the plugin declines to offer even though the CLI
+// takes them. Refresh the facts with `npm run catalog -- --write`; never edit them.
+//
+// `kind` is what the picker shows beside the value: `native` (the harness reads it),
+// `generic` (a hint the human applies in the UI), `none` (no scale, cell is blank).
+
+import { HARNESSES, harnessForTemplate } from "./harnesses.js"
+import { HARNESS_CATALOG } from "./harness-catalog.generated.js"
+import { pinSupport } from "./model-pin.js"
+
+/** The generic scale for a harness the plugin cannot set effort on. */
+export const GENERIC_SCALE = ["minimal", "medium", "high", "ultra"]
+
+/**
+ * The plugin's half of each scale. `values` reads the catalog row (default: its
+ * `efforts`); `omit` drops words the CLI accepts but the picker should not offer.
+ */
+const OVERLAY = {
+  claude: { kind: "native", via: "CLAUDE_CODE_EFFORT_LEVEL" },
+  codex: { kind: "native", via: "model_reasoning_effort (the model decides)" },
+  grok: { kind: "native", via: "default_reasoning_effort" },
+  // `none` and `dynamic` mean "let the model decide", not an effort; droid also
+  // silently coerces a word the chosen model lacks to that model's default, so
+  // `effortsForModel` is the check that matters for it.
+  droid: { kind: "native", via: "reasoningEffort (each model a subset)", omit: ["none", "dynamic"] },
+  prime: { kind: "native", via: "defaultThinkingLevel" },
+  muse: { kind: "native", via: "reasoning_effort" },
+  // amp has no reasoning knob the plugin writes; `--mode` picks model + prompt and
+  // the shipped fleet command passes it, so its "effort" IS the mode. Its own
+  // `--reasoning-effort` vocabulary is recorded in the catalog and never mixed in.
+  amp: { kind: "native", via: "--mode", values: (row) => row?.modes },
+  // Reasoning is a per-model VARIANT chosen in opencode's UI, not a setting the
+  // plugin can write; the generic scale only reaches the box as HERDR_E2B_REASONING.
+  opencode: { kind: "generic", via: "pick in opencode's UI", values: () => GENERIC_SCALE },
+}
+
+export const EFFORT_SCALES = Object.fromEntries(
+  Object.entries(OVERLAY).map(([id, o]) => {
+    const row = HARNESS_CATALOG[id]
+    const raw = (o.values ? o.values(row) : row?.efforts) || []
+    const values = raw.filter((v) => !(o.omit || []).includes(v))
+    return [id, { kind: o.kind, values, via: o.via }]
+  }),
+)
+
+/**
+ * The harness behind a template, by name first and by its launch command second:
+ * `[fleet.agents] "drew-claude" = "claude --dangerously-skip-permissions"` says what
+ * a custom template runs, so its picker row can offer claude's scale and its box can
+ * get claude's variables. Null when neither says.
+ */
+export function harnessHint(template, cfg = {}) {
+  const t = String(template ?? "").trim()
+  if (!t) return null
+  const byName = harnessForTemplate(t)
+  if (byName) return byName.id
+  const cmd = String(cfg?.fleetAgents?.[t] ?? cfg?.runAgents?.[t] ?? "").trim()
+  const bin = cmd.split(/\s+/)[0]?.replace(/^.*\//, "") || ""
+  for (const [id, h] of Object.entries(HARNESSES)) if (h.bin === bin) return id
+  return null
+}
+
+/** The scale a template's picker row offers: `{ harness, kind, values, via }`, or null. */
+export function effortScale(template, cfg = {}) {
+  const harness = harnessHint(template, cfg)
+  const scale = harness ? EFFORT_SCALES[harness] : null
+  return scale ? { harness, ...scale } : null
+}
+
+/** Is `value` something this template's harness accepts (or, for a generic scale, offers)? */
+export function validEffort(template, value, cfg = {}) {
+  const scale = effortScale(template, cfg)
+  return !!scale && scale.values.includes(String(value ?? "").trim())
+}
+
+/**
+ * The models a template's harness lists, `{ harness, from, models: [{ id, efforts?,
+ * default? }] }`, or null when the harness enumerates none (muse, opencode) or the
+ * template has no harness. `from` names the command or registry the ids came from.
+ */
+export function modelCatalog(template, cfg = {}) {
+  const harness = harnessHint(template, cfg)
+  const row = harness ? HARNESS_CATALOG[harness] : null
+  return row?.models ? { harness, from: row.modelsFrom, models: row.models } : null
+}
+
+/**
+ * The efforts ONE model takes, when the catalog knows that model; the harness's
+ * whole scale when it does not (a model the catalog has not seen, a harness with a
+ * flat scale). Same `omit` as the scale. This is the check droid needs: it accepts
+ * any of its words at the flag and then quietly runs the model's default.
+ */
+export function effortsForModel(template, model, cfg = {}) {
+  const scale = effortScale(template, cfg)
+  if (!scale) return null
+  const m = String(model ?? "").trim()
+  const own = m ? modelCatalog(template, cfg)?.models.find((x) => x.id === m)?.efforts : null
+  return own ? own.filter((v) => scale.values.includes(v)) : scale.values
+}
+
+/**
+ * One picker row per fleet-eligible template: what the roster table draws.
+ * `configured` is the `[templates.<name>] reasoning` pin when it is on the scale
+ * (the cell opens there); "" when nothing is pinned or the pin is off-scale.
+ *
+ * `models` is the model cell's list: the catalog's ids, but only where the plugin
+ * has a route to deliver the pick (src/model-pin.js `pinSupport`): amp lists 42
+ * models and has no model setting, so its cell is blank; opencode has a route and
+ * no finite list, so it is blank too and `[templates.opencode] model` stays the
+ * way to say it. `model` is the configured pin when it is on that list.
+ */
+export function effortRows(templates, cfg = {}) {
+  return templates.map((t) => {
+    const scale = effortScale(t, cfg)
+    const pinned = String(cfg?.templateModels?.[t]?.reasoning ?? "").trim()
+    const catalog = scale && pinSupport(scale.harness).model ? modelCatalog(t, cfg) : null
+    const models = catalog ? catalog.models.map((m) => m.id) : []
+    const pinnedModel = String(cfg?.templateModels?.[t]?.model ?? "").trim()
+    return {
+      template: t,
+      harness: scale?.harness ?? null,
+      kind: scale?.kind ?? "none",
+      values: scale?.values ?? [],
+      via: scale?.via ?? "",
+      configured: scale && scale.values.includes(pinned) ? pinned : "",
+      models,
+      model: models.includes(pinnedModel) ? pinnedModel : "",
+    }
+  })
+}
diff --git a/src/fleet-auth.js b/src/fleet-auth.js
index 158d0ac..5193cac 100644
--- a/src/fleet-auth.js
+++ b/src/fleet-auth.js
@@ -82,7 +82,13 @@ export function unauthenticatedMembers(members = [], cfg = {}, env = {}) {
     // Blank is missing. An empty credential is the failure that shows up furthest
     // from its cause — the agent boots, reads it and dies authenticating, which
     // reads as a broken key rather than an absent one.
+    // …and the row's own `boxVar`, which is not always among them: opencode has no
+    // host variable to forward (`hostVar: null`, its providers come from a file), so
+    // `credentialVars` is empty there and a member whose OPENCODE_AUTH_CONTENT was
+    // resolved from auth.json read as unauthenticated (observed live, fleet test,
+    // 2026-09-08: the warning named it, the box came up signed in).
     const boxVars = credentialVars(h).map((v) => v.boxVar)
+    if (h.boxVar) boxVars.push(h.boxVar)
     if (h.sessionFile) boxVars.push(h.sessionFile.boxVar)
     if (boxVars.some((v) => typeof resolved?.[v] === "string" && resolved[v].trim())) continue
     // The variable the remedy actually produces — the same one `e2b-box auth`'s own
diff --git a/src/fleet-name.js b/src/fleet-name.js
index 04e809f..b01089a 100644
--- a/src/fleet-name.js
+++ b/src/fleet-name.js
@@ -8,7 +8,7 @@
 // contains a slash. Pure functions here, `node --test` in test/fleet-name.test.js.
 //
 // Also runnable as bin/e2b-fleet's naming helper (see the CLI at the bottom):
-//   node src/fleet-name.js <task-slug> <template>...
+//   node src/fleet-name.js <task-slug> <member-spec>...   (spec: template[:model][*N][@effort])
 import path from "node:path"
 import { pathToFileURL } from "node:url"
 import { loadConfig } from "./config.js"
@@ -107,28 +107,67 @@ export function memberLabel(slug, template) {
  * Two workspaces wearing one name is worse than an error, because nothing on
  * screen says which is which and a fleet is read per member.
  */
+/**
+ * One label per member. The same template N times is N INSTANCES and gets numbered
+ * labels (`t-21-codex`, `t-21-codex-2`, `t-21-codex-3`) — the roster table's count
+ * column and a repeated `-t codex` both mean "more of this one". Two DIFFERENT
+ * templates that collapse to one label (`a/claude` and `b/claude`) are still a
+ * refusal: numbering would hide which member is which.
+ */
 export function memberLabels(slug, templates) {
-  const seen = new Map() // label -> the template that claimed it
+  const claimedBy = new Map() // base label -> the template that claimed it
+  const counts = new Map() // base label -> instances seen so far
   const out = []
   for (const t of templates) {
     const label = memberLabel(slug, t)
-    const claimed = seen.get(label)
-    if (claimed !== undefined) {
+    const claimed = claimedBy.get(label)
+    if (claimed !== undefined && claimed !== t) {
       throw new Error(
         `templates ${JSON.stringify(claimed)} and ${JSON.stringify(t)} both name a member ` +
           `'${label}' — a roster can't hold two members with the same name. ` +
           "Drop one, or pick templates whose names differ after the last '/'.",
       )
     }
-    seen.set(label, t)
-    out.push(label)
+    claimedBy.set(label, t)
+    const n = (counts.get(label) ?? 0) + 1
+    counts.set(label, n)
+    out.push(n === 1 ? label : `${label}-${n}`)
   }
   return out
 }
 
+/**
+ * A member spec, the way `-t` and `--agents` take it: `template`, `template*3`,
+ * `template@xhigh`, `template*3@xhigh` — N instances, each at that effort;
+ * `template:model` pins the model the same way. Returns one `{ template, effort,
+ * model }` per instance; effort and model are "" when the spec names none
+ * (the template's `[templates.<name>] reasoning` pin, or the harness default, applies).
+ * A count that is not 1..20 is refused: a typo should not boot twenty boxes.
+ */
+export function expandMemberSpec(spec) {
+  // `:model` sits right after the template: a model id carries `/` and `.`
+  // (`prime-inference/anthropic/claude-fable-5`) but never `:`, `*` or `@`, and a
+  // template name never carries `:`, so the four parts cannot be confused.
+  const m = /^(.*?)(?::([^:*@\s]+))?(?:\*(\d+))?(?:@([A-Za-z][A-Za-z0-9_-]*))?$/.exec(String(spec ?? "").trim())
+  const template = m?.[1]?.trim() ?? ""
+  if (!m || !template) throw new Error(`member spec ${JSON.stringify(String(spec ?? ""))} names no template`)
+  const count = m[3] === undefined ? 1 : Number(m[3])
+  if (!Number.isInteger(count) || count < 1 || count > 20) {
+    throw new Error(`member spec ${JSON.stringify(spec)}: the count after '*' must be 1..20`)
+  }
+  return Array.from({ length: count }, () => ({ template, effort: m[4] ?? "", model: m[2] ?? "" }))
+}
+
+/** Every spec expanded, in order: the roster as a list of members. */
+export function expandMemberSpecs(specs) {
+  return specs.flatMap(expandMemberSpec)
+}
+
 /** `<prefix>/<slug>-<template>-<rand4>` — the branch one member is created on. */
-export function memberBranch(slug, template, { prefix = DEFAULT_PREFIX, rand, env = process.env } = {}) {
-  return `${sanitizePrefix(prefix)}/${memberLabel(slug, template)}-${rand ?? randomSuffix(env)}`
+export function memberBranch(slug, template, { prefix = DEFAULT_PREFIX, rand, env = process.env, label } = {}) {
+  // `label` is the numbered one for a 2nd+ instance (`t-21-codex-2`), so instances
+  // of one template never share a branch even when the suffix is pinned.
+  return `${sanitizePrefix(prefix)}/${label ?? memberLabel(slug, template)}-${rand ?? randomSuffix(env)}`
 }
 
 // --- CLI ---------------------------------------------------------------------
@@ -140,17 +179,23 @@ export function memberBranch(slug, template, { prefix = DEFAULT_PREFIX, rand, en
 //
 // Exits 2 with a message on stderr when a name can't be built.
 if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
-  const [slug, ...templates] = process.argv.slice(2)
+  // Args are member SPECS (`codex:gpt-5.5*3@ultra`); one row per instance:
+  //   <template>\t<branch>\t<label>\t<effort>\t<model>
+  // An absent effort or model is written as `-`, never left empty: bash's `read`
+  // with a tab IFS folds an empty middle field into its neighbour, and a member
+  // with a model and no effort would come back with the model AS its effort.
+  const [slug, ...specs] = process.argv.slice(2)
   const cfg = loadConfig()
   try {
-    if (!templates.length) throw new Error("no templates given")
+    if (!specs.length) throw new Error("no templates given")
+    const members = expandMemberSpecs(specs)
     // Labels first, for the whole roster: a collision is a property of the SET,
     // so it has to be found before any member's branch is handed back — bash
     // creates worktrees from these rows as it reads them.
-    const labels = memberLabels(slug, templates)
-    const rows = templates.map((t, i) => {
-      const branch = memberBranch(slug, t, { prefix: cfg.fleetPrefix })
-      return `${t}\t${branch}\t${labels[i]}`
+    const labels = memberLabels(slug, members.map((m) => m.template))
+    const rows = members.map((m, i) => {
+      const branch = memberBranch(slug, m.template, { prefix: cfg.fleetPrefix, label: labels[i] })
+      return `${m.template}\t${branch}\t${labels[i]}\t${m.effort || "-"}\t${m.model || "-"}`
     })
     // memberBranch has already refused an unusable slug by here.
     process.stdout.write(`${cfg.fleetBase}\t${sanitizeSlug(slug)}\n${rows.join("\n")}\n`)
diff --git a/src/fleet-seed.js b/src/fleet-seed.js
index 600a867..e57eca6 100644
--- a/src/fleet-seed.js
+++ b/src/fleet-seed.js
@@ -145,7 +145,15 @@ export const DEFAULT_SEEDS = {
   // is `canonicalize(findGitRootForPath(cwd) ?? cwd)` — realpath'd, walked up to
   // the nearest .git — so the seed computes exactly that for itself, in the box.
   // Merged, not written flat: the same file carries model settings and fallbacks.
-  droid: `node -e 'const fs=require("fs"),q=require("path"),d=process.env.HOME+"/.factory",f=d+"/settings.json",rp=function(x){try{return fs.realpathSync(x)}catch{return x}};let g=rp(process.cwd()),x=g;for(;;){if(fs.existsSync(q.join(x,".git"))){g=x;break}const n=q.dirname(x);if(n===x)break;x=n}let s={};try{s=JSON.parse(fs.readFileSync(f,"utf8"))}catch{}let t=s.trustedFolders;if(!t||typeof t!=="object"||Array.isArray(t))t={};if(t[g]){console.log("herdr-e2b: droid already trusts "+g+" - leaving it alone");process.exit(0)}t[g]={trustedAt:new Date().toISOString()};s.trustedFolders=t;fs.mkdirSync(d,{recursive:true});fs.writeFileSync(f,JSON.stringify(s))'`,
+  //
+  // The same write sets the session default `sessionDefaultSettings.autonomyLevel`
+  // to "high" when nothing set it: the interactive `droid` takes its Autonomy Level
+  // from settings.json, not from a flag (`--auto` is `droid exec`'s, docs.factory.ai
+  // /droid-cli/settings, and typed at the TUI it left "Auto (Off) · all actions
+  // require approval" — observed live, fleet test, 2026-09-08). Off, a member stops
+  // at its first edit, which is the droid half of what claude's
+  // `bypassPermissionsModeAccepted` and codex's `trust_level` are for.
+  droid: `node -e 'const fs=require("fs"),q=require("path"),d=process.env.HOME+"/.factory",f=d+"/settings.json",rp=function(x){try{return fs.realpathSync(x)}catch{return x}};let g=rp(process.cwd()),x=g;for(;;){if(fs.existsSync(q.join(x,".git"))){g=x;break}const n=q.dirname(x);if(n===x)break;x=n}let s={};try{s=JSON.parse(fs.readFileSync(f,"utf8"))}catch{}let t=s.trustedFolders;if(!t||typeof t!=="object"||Array.isArray(t))t={};let w=false;if(t[g])console.log("herdr-e2b: droid already trusts "+g+" - leaving it alone");else{t[g]={trustedAt:new Date().toISOString()};s.trustedFolders=t;w=true}let a=s.sessionDefaultSettings;if(!a||typeof a!=="object"||Array.isArray(a))a={};if(a.autonomyLevel===undefined){a.autonomyLevel="high";s.sessionDefaultSettings=a;w=true;console.log("herdr-e2b: droid autonomy set to high for new sessions")}if(w){fs.mkdirSync(d,{recursive:true});fs.writeFileSync(f,JSON.stringify(s))}'`,
   opencode: `node -e 'const fs=require("fs"),d=process.env.HOME+"/.config/opencode",f=d+"/opencode.json";let c={};try{c=JSON.parse(fs.readFileSync(f,"utf8"))}catch{}if(c.autoupdate===false){console.log("herdr-e2b: opencode autoupdate already off - leaving it alone");process.exit(0)}c.autoupdate=false;fs.mkdirSync(d,{recursive:true});fs.writeFileSync(f,JSON.stringify(c))'`,
 }
 
diff --git a/src/fleet-spec.js b/src/fleet-spec.js
new file mode 100644
index 0000000..2e5556d
--- /dev/null
+++ b/src/fleet-spec.js
@@ -0,0 +1,88 @@
+// A saved launch recipe becomes the same member specs as the CLI's -t flags.
+// It contains no fleet identity or runtime state (ADR 0001).
+import { readFileSync, readdirSync } from "node:fs"
+import path from "node:path"
+import { pathToFileURL } from "node:url"
+import { CONFIG_DIR } from "./config-paths.js"
+import { loadConfig } from "./config.js"
+import { expandMemberSpecs } from "./fleet-name.js"
+import { modelCatalog, effortsForModel } from "./effort.js"
+
+export const PRESETS_DIR = path.join(CONFIG_DIR, "presets")
+const presetName = /^[A-Za-z0-9][A-Za-z0-9_-]*$/
+
+function object(value, fields, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`)
+  for (const key of Object.keys(value)) {
+    if (!fields.includes(key)) throw new Error(`${label}: unknown field '${key}'`)
+  }
+}
+
+function text(value, label, optional = true) {
+  if (value === undefined && optional) return ""
+  if (typeof value !== "string" || value.includes("\0")) throw new Error(`${label} must be text without NUL bytes`)
+  return value
+}
+
+export function fleetSpec(value, cfg = {}) {
+  object(value, ["slug", "task", "members"], "fleet")
+  const slug = text(value.slug, "slug")
+  const task = text(value.task, "task")
+  if (!Array.isArray(value.members) || !value.members.length) throw new Error("members must be a nonempty array")
+  const specs = value.members.map((member, i) => {
+    const label = `members[${i}]`
+    object(member, ["template", "model", "reasoning", "count"], label)
+    const template = text(member.template, `${label}.template`, false)
+    const model = text(member.model, `${label}.model`)
+    const reasoning = text(member.reasoning, `${label}.reasoning`)
+    const count = member.count === undefined ? 1 : member.count
+    if (!template || /[\s:*@|]/.test(template)) throw new Error(`${label}.template must be one template name`)
+    if (model && /[\s:*@|]/.test(model)) throw new Error(`${label}.model must be one model id`)
+    if (reasoning && !/^[A-Za-z][A-Za-z0-9_-]*$/.test(reasoning)) throw new Error(`${label}.reasoning must be one effort word`)
+    if (!Number.isInteger(count) || count < 1 || count > 20) throw new Error(`${label}.count must be an integer from 1 to 20`)
+    // Refuse a generated typo before any worktree exists, using the catalog
+    // that also guards box creation. Omitted pins keep the template defaults.
+    const catalog = modelCatalog(template, cfg)
+    if (model && catalog && !catalog.models.some((m) => m.id === model)) throw new Error(`${label}: '${model}' is not a model ${template} lists`)
+    const accepts = effortsForModel(template, model || cfg.templateModels?.[template]?.model, cfg)
+    if (reasoning && accepts && !accepts.includes(reasoning)) throw new Error(`${label}: '${reasoning}' is not an effort ${template} accepts for this model (${accepts.join(", ")})`)
+    return `${template}${model ? `:${model}` : ""}*${count}${reasoning ? `@${reasoning}` : ""}`
+  })
+  return { slug, task, specs }
+}
+
+export function presetPath(name, directory = PRESETS_DIR) {
+  if (!presetName.test(name)) throw new Error("preset name must contain only letters, digits, underscores or hyphens, starting with a letter or digit")
+  return path.join(directory, `${name}.json`)
+}
+
+export function listPresets(directory = PRESETS_DIR) {
+  try {
+    return readdirSync(directory, { withFileTypes: true })
+      .filter((f) => f.isFile() && f.name.endsWith(".json") && presetName.test(f.name.slice(0, -5)))
+      .map((f) => f.name.slice(0, -5)).sort()
+  } catch (error) {
+    if (error.code === "ENOENT") return []
+    throw error
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+  try {
+    const [mode, input] = process.argv.slice(2)
+    if (mode === "--list") {
+      process.stdout.write(listPresets().join("\n"))
+    } else {
+      if (!["--file", "--preset", "--rows"].includes(mode) || !input) throw new Error("use --file PATH, --preset NAME or --list")
+      const file = mode === "--file" ? (input === "-" ? 0 : input) : presetPath(input)
+      const spec = fleetSpec(JSON.parse(readFileSync(file, "utf8")), loadConfig())
+      if (mode === "--rows") {
+        process.stdout.write(`${spec.task.replace(/[\x00-\x1f\x7f]/g, " ")}\n`)
+        for (const m of expandMemberSpecs(spec.specs)) process.stdout.write(`${m.template}|${m.model}|${m.effort}\n`)
+      } else process.stdout.write(JSON.stringify(spec))
+    }
+  } catch (error) {
+    process.stderr.write(`fleet specification: ${error.message}\n`)
+    process.exitCode = 2
+  }
+}
diff --git a/src/harness-auth.js b/src/harness-auth.js
index 36d699a..6239c40 100644
--- a/src/harness-auth.js
+++ b/src/harness-auth.js
@@ -405,9 +405,9 @@ export function buildSummary(rows, plan, cfg = {}) {
         connectionMaterial(selected, { directory: cfg.connectionsDir })
         const account = selected.detected ? ` · ${localAccountLabel(selected.harness, selected.detected)}` : ""
         return { id: r.id, mark: "ok", managed: true,
-          auth: selected.method === "setup-token" ? "OAuth token" : "OAuth session", source: selected.id,
+          auth: selected.method === "setup-token" ? "OAuth token" : selected.method === "oauth" ? "Own sign-in" : "OAuth session", source: selected.id,
           details: [`${selected.id} · Only you`, ...(selected.detected ? [`Local account: ${localAccountLabel(selected.harness, selected.detected)}`] : []),
-            selected.method === "setup-token" ? "Setup token" : "Borrowed local session"],
+            selected.method === "setup-token" ? "Setup token" : selected.method === "oauth" ? "Signed in by this plugin (ADR 0015)" : "Borrowed local session"],
           method: `connection ${selected.id}${account} · Only you · ${selected.method} (locally ready)` }
       }
     } catch (error) {
diff --git a/src/harness-catalog.generated.js b/src/harness-catalog.generated.js
new file mode 100644
index 0000000..f8daafd
--- /dev/null
+++ b/src/harness-catalog.generated.js
@@ -0,0 +1,1620 @@
+// GENERATED by scripts/harness-catalog.mjs. Do not edit, rerun:
+//   npm run catalog -- --write            (boots each template, the authoritative read)
+//   npm run catalog -- --from=fixture --write  (re-derives from test/fixtures/catalog)
+//
+// What each harness's CLI accepts, read off the binary in its E2B template: the
+// effort words a pin may say (`efforts`; amp's `modes`), the model ids it lists
+// (`models`, each with its own efforts and default where the CLI says so), the
+// version that answered, and the template build it was read from. src/effort.js
+// derives EFFORT_SCALES from this; config/config.example.toml's table is rendered
+// from it. Parse rules and the reasoning behind every field: src/catalog.js.
+// Last run: 2026-09-09T12:34:44.121Z
+export const HARNESS_CATALOG = {
+  "claude": {
+    "version": "2.1.265",
+    "efforts": [
+      "low",
+      "medium",
+      "high",
+      "xhigh",
+      "max"
+    ],
+    "models": [
+      {
+        "id": "claude-fable-5",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ]
+      },
+      {
+        "id": "claude-fable-5-1",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ]
+      },
+      {
+        "id": "claude-haiku-4-5"
+      },
+      {
+        "id": "claude-haiku-4-5-20251001"
+      },
+      {
+        "id": "claude-opus-4-5",
+        "efforts": [
+          "low",
+          "medium",
+          "high"
+        ]
+      },
+      {
+        "id": "claude-opus-4-5-20251101",
+        "efforts": [
+          "low",
+          "medium",
+          "high"
+        ]
+      },
+      {
+        "id": "claude-opus-4-6",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "max"
+        ]
+      },
+      {
+        "id": "claude-opus-4-7",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ]
+      },
+      {
+        "id": "claude-opus-4-8",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ]
+      },
+      {
+        "id": "claude-opus-5",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ]
+      },
+      {
+        "id": "claude-sonnet-4-5"
+      },
+      {
+        "id": "claude-sonnet-4-5-20250929"
+      },
+      {
+        "id": "claude-sonnet-4-6",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "max"
+        ]
+      },
+      {
+        "id": "claude-sonnet-5",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ]
+      }
+    ],
+    "modelsFrom": "models.dev (anthropic)",
+    "probedFrom": "box",
+    "probedAt": "2026-09-09T12:26:09.733Z",
+    "template": {
+      "buildID": "56914e14-30f6-4cdc-a310-0f7e63c195a5",
+      "updatedAt": "2026-09-08T21:48:21.20947Z"
+    }
+  },
+  "codex": {
+    "version": "0.153.4",
+    "efforts": [
+      "low",
+      "medium",
+      "high",
+      "xhigh",
+      "max",
+      "ultra"
+    ],
+    "models": [
+      {
+        "id": "gpt-6-astra",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max",
+          "ultra"
+        ],
+        "default": "low"
+      },
+      {
+        "id": "gpt-5.6-sol",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max",
+          "ultra"
+        ],
+        "default": "low"
+      },
+      {
+        "id": "gpt-5.6-terra",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max",
+          "ultra"
+        ],
+        "default": "medium"
+      },
+      {
+        "id": "gpt-5.6-luna",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ],
+        "default": "medium"
+      },
+      {
+        "id": "gpt-5.5",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh"
+        ],
+        "default": "medium"
+      },
+      {
+        "id": "gpt-5.2",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh"
+        ],
+        "default": "medium"
+      }
+    ],
+    "modelsFrom": "codex debug models --bundled",
+    "probedFrom": "box",
+    "probedAt": "2026-09-09T12:26:09.733Z",
+    "template": {
+      "buildID": "24a9314a-0f79-41b0-ae44-630a16557ebf",
+      "updatedAt": "2026-09-08T21:48:21.214107Z"
+    }
+  },
+  "grok": {
+    "version": "1.0.5",
+    "efforts": [
+      "low",
+      "medium",
+      "high",
+      "xhigh"
+    ],
+    "models": [
+      {
+        "id": "grok-4.6",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "grok-4.5",
+        "efforts": [
+          "low",
+          "medium",
+          "high"
+        ],
+        "default": "high"
+      }
+    ],
+    "modelsFrom": "~/.grok/models_cache.json after `grok models`",
+    "probedFrom": "box",
+    "probedAt": "2026-09-09T12:26:09.733Z",
+    "template": {
+      "buildID": "e93c61bb-f035-40a1-b942-c59efb721c5d",
+      "updatedAt": "2026-08-19T08:52:23.61493Z"
+    }
+  },
+  "droid": {
+    "version": "0.213.0",
+    "efforts": [
+      "none",
+      "off",
+      "minimal",
+      "low",
+      "medium",
+      "high",
+      "xhigh",
+      "max"
+    ],
+    "models": [
+      {
+        "id": "auto",
+        "efforts": [
+          "none"
+        ],
+        "default": "none"
+      },
+      {
+        "id": "claude-fable-5.1",
+        "efforts": [
+          "off",
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "claude-fable-5",
+        "efforts": [
+          "off",
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "claude-opus-5",
+        "efforts": [
+          "off",
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "claude-opus-5-fast",
+        "efforts": [
+          "off",
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "claude-opus-4-8",
+        "efforts": [
+          "off",
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "claude-opus-4-8-fast",
+        "efforts": [
+          "off",
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "claude-opus-4-7",
+        "efforts": [
+          "off",
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "claude-opus-4-6",
+        "efforts": [
+          "off",
+          "low",
+          "medium",
+          "high",
+          "max"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "claude-opus-4-5-20251101",
+        "efforts": [
+          "off",
+          "low",
+          "medium",
+          "high"
+        ],
+        "default": "off"
+      },
+      {
+        "id": "claude-sonnet-5",
+        "efforts": [
+          "off",
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "claude-sonnet-4-6",
+        "efforts": [
+          "off",
+          "low",
+          "medium",
+          "high",
+          "max"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "claude-sonnet-4-5-20250929",
+        "efforts": [
+          "off",
+          "low",
+          "medium",
+          "high"
+        ],
+        "default": "off"
+      },
+      {
+        "id": "claude-haiku-4-5-20251001",
+        "efforts": [
+          "off",
+          "low",
+          "medium",
+          "high"
+        ],
+        "default": "off"
+      },
+      {
+        "id": "gpt-6-astra",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ],
+        "default": "medium"
+      },
+      {
+        "id": "gpt-5.6-sol",
+        "efforts": [
+          "none",
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ],
+        "default": "medium"
+      },
+      {
+        "id": "gpt-5.6-sol-fast",
+        "efforts": [
+          "none",
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ],
+        "default": "medium"
+      },
+      {
+        "id": "gpt-5.6-terra",
+        "efforts": [
+          "none",
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ],
+        "default": "medium"
+      },
+      {
+        "id": "gpt-5.6-luna",
+        "efforts": [
+          "none",
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ],
+        "default": "medium"
+      },
+      {
+        "id": "gpt-5.5",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh"
+        ],
+        "default": "medium"
+      },
+      {
+        "id": "gpt-5.5-fast",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh"
+        ],
+        "default": "medium"
+      },
+      {
+        "id": "gpt-5.5-pro",
+        "efforts": [
+          "medium",
+          "high",
+          "xhigh"
+        ],
+        "default": "medium"
+      },
+      {
+        "id": "gpt-5.4",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh"
+        ],
+        "default": "medium"
+      },
+      {
+        "id": "gpt-5.4-fast",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh"
+        ],
+        "default": "medium"
+      },
+      {
+        "id": "gpt-5.4-mini",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "gpt-5.4-mini-fast",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "gpt-5.3-codex",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh"
+        ],
+        "default": "medium"
+      },
+      {
+        "id": "gpt-5.3-codex-fast",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh"
+        ],
+        "default": "medium"
+      },
+      {
+        "id": "gpt-5.2",
+        "efforts": [
+          "off",
+          "low",
+          "medium",
+          "high",
+          "xhigh"
+        ],
+        "default": "low"
+      },
+      {
+        "id": "gemini-3.1-pro-preview",
+        "efforts": [
+          "low",
+          "medium",
+          "high"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "gemini-3.8-flash",
+        "efforts": [
+          "low",
+          "medium",
+          "high"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "gemini-3.7-flash",
+        "efforts": [
+          "low",
+          "medium",
+          "high"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "gemini-3.6-flash",
+        "efforts": [
+          "low",
+          "medium",
+          "high"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "gemini-3.5-flash",
+        "efforts": [
+          "minimal",
+          "low",
+          "medium",
+          "high"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "gemini-3-flash-preview",
+        "efforts": [
+          "minimal",
+          "low",
+          "medium",
+          "high"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "inkling",
+        "efforts": [
+          "off",
+          "minimal",
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "glm-5.3-flash",
+        "efforts": [
+          "low",
+          "high",
+          "max"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "glm-5.3",
+        "efforts": [
+          "low",
+          "high",
+          "max"
+        ],
+        "default": "max"
+      },
+      {
+        "id": "glm-5.2",
+        "efforts": [
+          "off",
+          "high",
+          "max"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "glm-5.2-fast",
+        "efforts": [
+          "off",
+          "high",
+          "max"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "kimi-k3",
+        "efforts": [
+          "off",
+          "low",
+          "high",
+          "max"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "kimi-k2.7-code",
+        "efforts": [
+          "off",
+          "high"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "kimi-k2.6",
+        "efforts": [
+          "off",
+          "high"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "nemotron-3-ultra",
+        "efforts": [
+          "off",
+          "high"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "deepseek-v4-flash-0731",
+        "efforts": [
+          "off",
+          "low",
+          "high",
+          "max"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "deepseek-v4-pro",
+        "efforts": [
+          "off",
+          "low",
+          "high",
+          "max"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "minimax-m3",
+        "efforts": [
+          "high"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "grok-4.6",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "grok-4.5",
+        "efforts": [
+          "low",
+          "medium",
+          "high"
+        ],
+        "default": "high"
+      },
+      {
+        "id": "minimax-m2.7",
+        "efforts": [
+          "high"
+        ],
+        "default": "high",
+        "deprecated": true
+      }
+    ],
+    "modelsFrom": "droid.initialize_session (stream-jsonrpc)",
+    "probedFrom": "box",
+    "probedAt": "2026-09-09T12:26:09.733Z",
+    "template": {
+      "buildID": "c742339f-ea80-4c0b-9ea9-5ea8e9b2ac4a",
+      "updatedAt": "2026-09-08T22:13:20.809781Z"
+    }
+  },
+  "amp": {
+    "version": "0.0.1788926461-g32d216",
+    "efforts": [
+      "none",
+      "minimal",
+      "low",
+      "medium",
+      "high",
+      "xhigh",
+      "max"
+    ],
+    "modes": [
+      "low",
+      "medium",
+      "high",
+      "ultra"
+    ],
+    "models": [
+      {
+        "id": "alibaba/qwen3.8-max",
+        "efforts": [
+          "low",
+          "medium",
+          "xhigh"
+        ]
+      },
+      {
+        "id": "anthropic/claude-fable-5",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ]
+      },
+      {
+        "id": "anthropic/claude-fable-5-1",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ]
+      },
+      {
+        "id": "anthropic/claude-haiku-4-5-20251001",
+        "efforts": [
+          "none",
+          "high"
+        ]
+      },
+      {
+        "id": "anthropic/claude-opus-4-6",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "max"
+        ]
+      },
+      {
+        "id": "anthropic/claude-opus-4-7",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ]
+      },
+      {
+        "id": "anthropic/claude-opus-4-8",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ]
+      },
+      {
+        "id": "anthropic/claude-opus-5",
+        "efforts": [
+          "none",
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ]
+      },
+      {
+        "id": "anthropic/claude-sonnet-4-5-20250929",
+        "efforts": [
+          "none",
+          "high"
+        ]
+      },
+      {
+        "id": "anthropic/claude-sonnet-4-6",
+        "efforts": [
+          "none",
+          "high"
+        ]
+      },
+      {
+        "id": "anthropic/claude-sonnet-5",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ]
+      },
+      {
+        "id": "deepseek/deepseek-v4-flash",
+        "efforts": [
+          "none",
+          "high",
+          "max"
+        ]
+      },
+      {
+        "id": "deepseek/deepseek-v4-pro",
+        "efforts": [
+          "none",
+          "high",
+          "max"
+        ]
+      },
+      {
+        "id": "fireworks-ai/accounts/fireworks/models/glm-5p3",
+        "efforts": [
+          "low",
+          "high",
+          "max"
+        ]
+      },
+      {
+        "id": "fireworks-ai/accounts/fireworks/models/inkling",
+        "efforts": [
+          "none",
+          "low",
+          "medium",
+          "high",
+          "xhigh"
+        ]
+      },
+      {
+        "id": "fireworks-ai/accounts/fireworks/models/kimi-k3",
+        "efforts": [
+          "low",
+          "high",
+          "max"
+        ]
+      },
+      {
+        "id": "google-vertex/gemini-3.1-flash-lite",
+        "efforts": [
+          "minimal",
+          "low",
+          "medium",
+          "high"
+        ]
+      },
+      {
+        "id": "google-vertex/gemini-3.1-pro-preview",
+        "efforts": [
+          "low",
+          "medium",
+          "high"
+        ]
+      },
+      {
+        "id": "google-vertex/gemini-3.5-flash",
+        "efforts": [
+          "minimal",
+          "low",
+          "medium",
+          "high"
+        ]
+      },
+      {
+        "id": "google-vertex/gemini-3.5-flash-lite",
+        "efforts": [
+          "minimal",
+          "low",
+          "medium",
+          "high"
+        ]
+      },
+      {
+        "id": "google-vertex/gemini-3.6-flash",
+        "efforts": [
+          "minimal",
+          "low",
+          "medium",
+          "high"
+        ]
+      },
+      {
+        "id": "google-vertex/gemini-3.8-flash",
+        "efforts": [
+          "low",
+          "medium",
+          "high"
+        ]
+      },
+      {
+        "id": "meta/muse-spark-1.3",
+        "efforts": [
+          "minimal",
+          "low",
+          "medium",
+          "high",
+          "xhigh"
+        ]
+      },
+      {
+        "id": "minimax/MiniMax-M3",
+        "efforts": [
+          "none",
+          "high"
+        ]
+      },
+      {
+        "id": "openai/gpt-5",
+        "efforts": [
+          "minimal",
+          "low",
+          "medium",
+          "high"
+        ]
+      },
+      {
+        "id": "openai/gpt-5-mini",
+        "efforts": [
+          "minimal",
+          "low",
+          "medium",
+          "high"
+        ]
+      },
+      {
+        "id": "openai/gpt-5-nano",
+        "efforts": [
+          "minimal",
+          "low",
+          "medium",
+          "high"
+        ]
+      },
+      {
+        "id": "openai/gpt-5.1",
+        "efforts": [
+          "none",
+          "low",
+          "medium",
+          "high"
+        ]
+      },
+      {
+        "id": "openai/gpt-5.2",
+        "efforts": [
+          "none",
+          "low",
+          "medium",
+          "high",
+          "xhigh"
+        ]
+      },
+      {
+        "id": "openai/gpt-5.3-codex",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh"
+        ]
+      },
+      {
+        "id": "openai/gpt-5.4",
+        "efforts": [
+          "none",
+          "low",
+          "medium",
+          "high",
+          "xhigh"
+        ]
+      },
+      {
+        "id": "openai/gpt-5.5",
+        "efforts": [
+          "none",
+          "low",
+          "medium",
+          "high",
+          "xhigh"
+        ]
+      },
+      {
+        "id": "openai/gpt-5.6-luna",
+        "efforts": [
+          "none",
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ]
+      },
+      {
+        "id": "openai/gpt-5.6-sol",
+        "efforts": [
+          "none",
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ]
+      },
+      {
+        "id": "openai/gpt-5.6-terra",
+        "efforts": [
+          "none",
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ]
+      },
+      {
+        "id": "openai/gpt-6-astra",
+        "efforts": [
+          "low",
+          "medium",
+          "high",
+          "xhigh",
+          "max"
+        ]
+      },
+      {
+        "id": "openai/o3",
+        "efforts": [
+          "low",
+          "medium",
+          "high"
+        ]
+      },
+      {
+        "id": "xai/grok-4.5"
+      },
+      {
+        "id": "xai/grok-4.6"
+      },
+      {
+        "id": "xai/grok-build-0.1"
+      },
+      {
+        "id": "zhipuai/glm-5.2",
+        "efforts": [
+          "none",
+          "high",
+          "max"
+        ]
+      },
+      {
+        "id": "zhipuai/glm-5.3-flash",
+        "efforts": [
+          "low",
+          "high",
+          "max"
+        ]
+      }
+    ],
+    "modelsFrom": "amp plugins show-agent-options --json",
+    "probedFrom": "box",
+    "probedAt": "2026-09-09T12:26:09.733Z",
+    "template": {
+      "buildID": "c0c345d6-227a-4600-b503-fa6089382504",
+      "updatedAt": "2026-09-09T07:24:13.631924Z"
+    }
+  },
+  "prime": {
+    "version": "0.7.0",
+    "efforts": [
+      "off",
+      "minimal",
+      "low",
+      "medium",
+      "high",
+      "xhigh",
+      "max"
+    ],
+    "models": [
+      {
+        "id": "prime-inference/anthropic/claude-fable-5",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/anthropic/claude-haiku-4.5",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/anthropic/claude-opus-4.1",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/anthropic/claude-opus-4.5",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/anthropic/claude-opus-4.6",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/anthropic/claude-opus-4.7",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/anthropic/claude-opus-4.8",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/anthropic/claude-opus-5",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/anthropic/claude-sonnet-4",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/anthropic/claude-sonnet-4.5",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/anthropic/claude-sonnet-4.6",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/anthropic/claude-sonnet-5",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/deepseek/deepseek-chat"
+      },
+      {
+        "id": "prime-inference/deepseek/deepseek-chat-v3-0324"
+      },
+      {
+        "id": "prime-inference/deepseek/deepseek-chat-v3.1",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/deepseek/deepseek-v3.1-terminus",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/deepseek/deepseek-v3.2",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/deepseek/deepseek-v3.2-exp",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/deepseek/deepseek-v4-flash",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/deepseek/deepseek-v4-flash-0731",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/deepseek/deepseek-v4-pro",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/google/gemini-2.5-flash",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/google/gemini-2.5-flash-lite",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/google/gemini-2.5-pro",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/google/gemini-3-flash-preview",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/google/gemini-3.1-pro-preview",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/google/gemini-3.5-flash",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/google/gemini-3.6-flash",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/google/gemma-3-27b-it"
+      },
+      {
+        "id": "prime-inference/meta-llama/Llama-3.2-1B-Instruct"
+      },
+      {
+        "id": "prime-inference/meta-llama/Llama-3.2-3B-Instruct"
+      },
+      {
+        "id": "prime-inference/meta-llama/llama-3.3-70b-instruct"
+      },
+      {
+        "id": "prime-inference/meta-llama/llama-4-maverick"
+      },
+      {
+        "id": "prime-inference/minimax/minimax-m2.5",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/minimax/minimax-m2.7",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/minimax/minimax-m3",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/mistralai/mistral-large-2512"
+      },
+      {
+        "id": "prime-inference/mistralai/mistral-nemo"
+      },
+      {
+        "id": "prime-inference/mistralai/mistral-small-2603",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/mistralai/mixtral-8x22b-instruct"
+      },
+      {
+        "id": "prime-inference/moonshotai/kimi-k2-0905"
+      },
+      {
+        "id": "prime-inference/moonshotai/kimi-k2.5",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/moonshotai/kimi-k2.6",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/moonshotai/kimi-k2.7-code",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/moonshotai/kimi-k3",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/nvidia/nemotron-3-nano-30b-a3b",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/nvidia/nemotron-3-super-120b-a12b",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/nvidia/NVIDIA-Nemotron-3-Ultra-550B-A55B",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/openai/gpt-4.1"
+      },
+      {
+        "id": "prime-inference/openai/gpt-4.1-mini"
+      },
+      {
+        "id": "prime-inference/openai/gpt-4.1-nano"
+      },
+      {
+        "id": "prime-inference/openai/gpt-4o"
+      },
+      {
+        "id": "prime-inference/openai/gpt-4o-mini"
+      },
+      {
+        "id": "prime-inference/openai/gpt-5",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/openai/gpt-5-mini",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/openai/gpt-5-nano",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/openai/gpt-5.1",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/openai/gpt-5.2",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/openai/gpt-5.2-chat"
+      },
+      {
+        "id": "prime-inference/openai/gpt-5.2-pro",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/openai/gpt-5.3-codex",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/openai/gpt-5.4",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/openai/gpt-5.4-mini",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/openai/gpt-5.4-nano",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/openai/gpt-5.4-pro",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/openai/gpt-5.5",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/openai/gpt-5.6",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/openai/gpt-5.6-luna",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/openai/gpt-5.6-luna-pro",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/openai/gpt-5.6-sol",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/openai/gpt-5.6-sol-pro",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/openai/gpt-5.6-terra",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/openai/gpt-5.6-terra-pro",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/openai/gpt-oss-120b",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/openai/gpt-oss-20b",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/poolside/laguna-s-2.1",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/poolside/laguna-xs-2.1",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/qwen/qwen3-235b-a22b-2507"
+      },
+      {
+        "id": "prime-inference/qwen/qwen3-30b-a3b-instruct-2507"
+      },
+      {
+        "id": "prime-inference/qwen/qwen3-8b",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/qwen/qwen3-coder"
+      },
+      {
+        "id": "prime-inference/qwen/qwen3-coder-next"
+      },
+      {
+        "id": "prime-inference/qwen/qwen3-max"
+      },
+      {
+        "id": "prime-inference/qwen/qwen3-vl-235b-a22b-instruct"
+      },
+      {
+        "id": "prime-inference/qwen/qwen3-vl-235b-a22b-thinking",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/qwen/qwen3-vl-30b-a3b-instruct"
+      },
+      {
+        "id": "prime-inference/qwen/qwen3-vl-8b-instruct"
+      },
+      {
+        "id": "prime-inference/qwen/qwen3.5-35b-a3b",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/qwen/qwen3.5-397b-a17b",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/qwen/qwen3.6-27b",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/qwen/qwen3.6-35b-a3b",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/qwen/qwen3.7-flash",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/x-ai/grok-4.20",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/x-ai/grok-4.20-multi-agent",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/xiaomi/mimo-v2.5",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/xiaomi/mimo-v2.5-pro",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/z-ai/glm-4.5",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/z-ai/glm-4.5-air",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/z-ai/glm-4.6",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/z-ai/glm-4.7",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/z-ai/glm-4.7-flash",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/z-ai/glm-5",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/z-ai/glm-5.1",
+        "reasoning": true
+      },
+      {
+        "id": "prime-inference/z-ai/glm-5.2",
+        "reasoning": true
+      }
+    ],
+    "modelsFrom": "prime-agent model list",
+    "probedFrom": "box",
+    "probedAt": "2026-09-09T12:26:09.733Z",
+    "template": {
+      "buildID": "1917ea36-56fd-4124-9517-de845438a6ae",
+      "updatedAt": "2026-08-19T08:51:33.066022Z"
+    }
+  },
+  "muse": {
+    "version": "0.2.1",
+    "efforts": [
+      "none",
+      "minimal",
+      "low",
+      "medium",
+      "high",
+      "xhigh",
+      "ultra"
+    ],
+    "models": null,
+    "modelsFrom": null,
+    "probedFrom": "box",
+    "probedAt": "2026-09-09T12:26:09.733Z",
+    "template": null
+  },
+  "opencode": {
+    "version": "1.18.18",
+    "efforts": null,
+    "models": null,
+    "modelsFrom": null,
+    "probedFrom": "box",
+    "probedAt": "2026-09-09T12:26:09.733Z",
+    "template": {
+      "buildID": "4968d500-4c59-4754-ac33-c291b2c91552",
+      "updatedAt": "2026-08-19T08:50:23.615542Z"
+    }
+  }
+}
diff --git a/src/harnesses.js b/src/harnesses.js
index 97827ea..bf2c45c 100644
--- a/src/harnesses.js
+++ b/src/harnesses.js
@@ -9,7 +9,7 @@ import path from "node:path"
 // agent, a harness is that same agent installed here, and this file is the only
 // place the two are mapped to each other.
 //
-// Governed by docs/adr/0006: detection is a spawn-the-binary probe, reads are
+// Governed by docs/adr/0009: detection is a spawn-the-binary probe, reads are
 // limited to environment variables and a harness's own DOCUMENTED config file, and
 // no Keychain item or OAuth token cache is ever opened. The per-harness facts below
 // were established against vendor source and live binaries — see
@@ -31,6 +31,8 @@ import path from "node:path"
  * an accident that stops being true the first time a vendor moves one.
  */
 const CSI = /\x1b\[[0-?]*[ -/]*[@-~]/g
+/** Three base64url segments starting with `eyJ` (`{"` encoded): a JWT, so a session, not a key. */
+const isJwt = (v) => /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/.test(String(v ?? ""))
 const stripAnsi = (s) => String(s || "").replace(CSI, "")
 
 /**
@@ -447,15 +449,30 @@ export const HARNESSES = {
     // — and nothing at all when several are present, because picking one of two
     // servers' keys is the guess this table does not make.
     keyFile: { path: AMP_SECRETS, field: "apiKey@https://ampcode.com/" },
+    // What `amp login` leaves under `apiKey@…` is NOT an access token: it is the
+    // browser sign-in's OAuth session, a JWT that amp itself refuses when handed back
+    // as AMP_API_KEY ("holds an OAuth session token, which is short-lived", amp
+    // 0.0.1788897629; the template's older amp says "Invalid or missing API key" for
+    // the same value — observed live, fleet test-amp, 2026-09-08). The bearer lives
+    // FIVE MINUTES and the refresh token rotates-invalidates (measured, ADR 0014), so
+    // neither 0010's placeholder trick nor 0011's verbatim rule applies: a JWT-shaped
+    // value reads as "signed in, nothing to borrow" and the remedy names the one
+    // thing that works, an access token the user mints.
     valueFile: {
       path: AMP_SECRETS,
       read: (text) => {
         const j = JSON.parse(text)
-        if (typeof j?.["apiKey@https://ampcode.com/"] === "string") return j["apiKey@https://ampcode.com/"]
-        const keys = Object.keys(j || {}).filter((k) => k.startsWith("apiKey@") && typeof j[k] === "string")
-        return keys.length === 1 ? j[keys[0]] : null
+        let v = null
+        if (typeof j?.["apiKey@https://ampcode.com/"] === "string") v = j["apiKey@https://ampcode.com/"]
+        else {
+          const keys = Object.keys(j || {}).filter((k) => k.startsWith("apiKey@") && typeof j[k] === "string")
+          v = keys.length === 1 ? j[keys[0]] : null
+        }
+        return v && !isJwt(v) ? v : null
       },
     },
+    advice:
+      "`amp login` leaves a short-lived OAuth session a box cannot use; create an access token at https://ampcode.com/settings/security#access-token and set AMP_API_KEY to it",
     parse: ({ stdout, stderr }) => {
       if (/^Signed in as /m.test(stripAnsi(stdout))) return { state: "no-key", source: "login" }
       if (/Invalid or missing API key/.test(stripAnsi(stderr))) return { state: "no-key", source: null }
diff --git a/src/model-pin.js b/src/model-pin.js
index 4f3f9b7..9fb2d9e 100644
--- a/src/model-pin.js
+++ b/src/model-pin.js
@@ -33,7 +33,8 @@
 //   opencode  OPENCODE_CONFIG_CONTENT, inline JSON, "model"         (opencode.ai/docs/config; reasoning is per-model
 //             variants there, so it is not pinned)
 //   codex     ~/.codex/config.toml  model, model_reasoning_effort  (codex-rs config)
-//   grok      ~/.grok/config.toml   [models] default, default_reasoning_effort  (docs.x.ai/build/settings/reference)
+//   grok      ~/.grok/config.toml   [models] default, default_reasoning_effort  (docs.x.ai/build/settings/reference;
+//             grok 1.0.13 accepts low | medium | high | xhigh and rejects "max" with "Invalid reasoning effort")
 //   droid     ~/.factory/settings.json  model, reasoningEffort     (docs.factory.ai/droid-cli/settings)
 //   prime     ~/.prime/agent/settings.json  defaultProvider, defaultModel, defaultThinkingLevel
 //             (settings-manager.js, 0.9.3; model is written as `<provider>/<model>`, split at the first `/`)
@@ -53,7 +54,22 @@ const ENV_ROUTES = {
   }),
   // "inject inline JSON as a final local-scope merge" (opencode's own description of
   // the variable), so it wins over the seeded ~/.config/opencode/opencode.json.
-  opencode: (model) => (model ? { OPENCODE_CONFIG_CONTENT: JSON.stringify({ model }) } : {}),
+  //
+  // The model is ALSO declared under its provider. opencode's TUI only selects a
+  // model it can find in the provider's list, and on a fresh box that list is the
+  // snapshot bundled into the binary until the models.dev fetch lands — so a model
+  // newer than the template's opencode was unknown at the first launch and the TUI
+  // fell back to whatever the provider ranked first (an image model with no tool
+  // use; observed live, fleet test-opencode, 2026-09-08, while `opencode run` with
+  // the same variable honoured the pin). A `provider.<id>.models.<model>` entry
+  // makes the model exist in config, fetch or no fetch; an empty object is enough
+  // (verified on 1.18.18: `opencode models openrouter` lists it, `run` uses it).
+  opencode: (model) => {
+    if (!model) return {}
+    const i = model.indexOf("/")
+    const provider = i > 0 ? { provider: { [model.slice(0, i)]: { models: { [model.slice(i + 1)]: {} } } } } : {}
+    return { OPENCODE_CONFIG_CONTENT: JSON.stringify({ model, ...provider }) }
+  },
 }
 
 // The file route. `M`/`R` are read inside the box; nothing here interpolates a value.
@@ -89,10 +105,12 @@ export function normalizePin(section) {
  * The environment a pinned template's box is created with: the two shared
  * variables plus the harness's own, when it reads one. `{}` for no pin.
  */
-export function modelEnv(template, pin) {
+export function modelEnv(template, pin, harness = template) {
   if (!pin) return {}
   const { model = "", reasoning = "" } = pin
-  const own = ENV_ROUTES[template]?.(model, reasoning) || {}
+  // `harness` is the route key: a custom template that runs claude (src/effort.js
+  // `harnessHint`) gets claude's variables, not just the two shared ones.
+  const own = ENV_ROUTES[harness]?.(model, reasoning) || {}
   return {
     ...(model ? { [MODEL_VAR]: model } : {}),
     ...(reasoning ? { [REASONING_VAR]: reasoning } : {}),
@@ -106,9 +124,9 @@ export function modelEnv(template, pin) {
  * user's own template) or nothing is pinned. The command reads the variables
  * `modelEnv` set, so it is only useful on a box created with them.
  */
-export function pinCommand(template, pin) {
+export function pinCommand(template, pin, harness = template) {
   if (!pin) return ""
-  return FILE_ROUTES[String(template ?? "")] ?? ""
+  return FILE_ROUTES[String(harness ?? template ?? "")] ?? ""
 }
 
 /** For docs, the picker and the refusal message: what a pin can do per template. */
diff --git a/src/oauth.js b/src/oauth.js
new file mode 100644
index 0000000..0c36443
--- /dev/null
+++ b/src/oauth.js
@@ -0,0 +1,270 @@
+// The plugin's OWN sign-in to a vendor, stored as a connection (ADR 0015).
+//
+// Every other credential this plugin handles is one it FOUND: a variable in the
+// environment, a key in a harness's config file, a session a harness left on disk
+// (ADR 0009, 0010, 0011). This module is the one place the plugin signs in itself,
+// using the same public OAuth client each vendor's CLI uses, so what comes back is a
+// login the laptop's own CLI never touches: it rotates nothing on the laptop and the
+// laptop rotates nothing under it. The result is stored under `connections/`
+// (ADR 0013) and delivered like any other connection.
+//
+// What each vendor yields, and why it is that and not a session:
+//   muse   Meta's device flow, then Meta's own "mint a Muse API key" call. A key,
+//          no refresh, no expiry the plugin has to track. This is exactly what
+//          `muse login` does for itself.
+//   amp    no OAuth at all: amp's long-lived access token (`sgamp_…`) can only be
+//          read behind the web app's recent-sign-in gate, so the plugin opens that
+//          page and stores what the human pastes. The reasons are measured, below.
+//   codex  Codex CLI's PKCE flow against auth.openai.com, its own client id. A
+//          ten-day bearer plus a single-use refresh token, of which the plugin is the
+//          sole custodian: boxes get the placeholder rule's copy (ADR 0010), the
+//          plugin refreshes on `auth check` / `auth reconnect`, and never at
+//          box-create time, so provisioning stays synchronous and pure.
+//
+// The flows are written against injectable `fetch`, `open`, `now` and `sleep` so
+// test/oauth.test.js runs every one of them against a scripted server with no
+// network and no browser. Nothing here prints; the CLI decides what a human sees.
+//
+// Every request body below is data the vendor's own CLI sends. Client ids are
+// PUBLIC clients (no secret exists), copied from the shipped CLIs — the same ids
+// replicas-cli 0.2.634 uses for the same purpose.
+
+import { createHash, randomBytes } from "node:crypto"
+import http from "node:http"
+
+/** `{ code_verifier, code_challenge }` for PKCE S256, base64url per RFC 7636. */
+export function pkcePair(bytes = randomBytes(32)) {
+  const b64url = (b) => b.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")
+  const verifier = b64url(bytes)
+  return { verifier, challenge: b64url(createHash("sha256").update(verifier).digest()) }
+}
+
+/** `exp` of a JWT as ISO, or null when the token is not a decodable JWT. */
+export function jwtExpiryIso(token) {
+  try {
+    const seg = String(token).split(".")[1]
+    const pad = "=".repeat((4 - (seg.length % 4)) % 4)
+    const j = JSON.parse(Buffer.from(seg.replace(/-/g, "+").replace(/_/g, "/") + pad, "base64").toString("utf8"))
+    return Number.isFinite(j?.exp) ? new Date(j.exp * 1000).toISOString() : null
+  } catch {
+    return null
+  }
+}
+
+const form = (o) => new URLSearchParams(o).toString()
+const FORM = { "Content-Type": "application/x-www-form-urlencoded" }
+const JSON_H = { "Content-Type": "application/json", Accept: "application/json" }
+
+async function readJson(res) {
+  const text = await res.text()
+  try {
+    return JSON.parse(text)
+  } catch {
+    return { _raw: text }
+  }
+}
+
+/**
+ * RFC 8628 device flow, shared by muse (Meta) and amp (WorkOS): ask for a code, hand
+ * the human a URL, poll until the vendor answers with tokens.
+ *
+ * `onCode({ url, userCode, expiresIn })` is the CLI's hook to print and/or open the
+ * URL. `authorization_pending` and `slow_down` are the only errors that keep polling;
+ * anything else is the vendor saying no, and the message names it.
+ */
+export async function deviceFlow({ authorizeUrl, tokenUrl, clientId, extra = {}, onCode, fetch, sleep, now = Date.now }) {
+  const start = await fetch(authorizeUrl, { method: "POST", headers: FORM, body: form({ client_id: clientId, ...extra }) })
+  const device = await readJson(start)
+  if (!start.ok || typeof device?.device_code !== "string" || typeof device?.user_code !== "string") {
+    throw new Error(`sign-in could not start (${start.status}${device?.error ? `: ${device.error}` : ""})`)
+  }
+  const url = typeof device.verification_uri_complete === "string" ? device.verification_uri_complete : device.verification_uri
+  const expiresIn = Number.isFinite(device.expires_in) ? device.expires_in : 600
+  await onCode?.({ url, userCode: device.user_code, expiresIn })
+  const deadline = now() + expiresIn * 1000
+  let interval = Math.max(1, Number.isFinite(device.interval) ? device.interval : 5) * 1000
+  while (now() < deadline) {
+    await sleep(interval)
+    const res = await fetch(tokenUrl, {
+      method: "POST",
+      headers: FORM,
+      body: form({ grant_type: "urn:ietf:params:oauth:grant-type:device_code", device_code: device.device_code, client_id: clientId }),
+    })
+    const body = await readJson(res)
+    if (res.ok && typeof body?.access_token === "string") return body
+    if (body?.error === "slow_down") {
+      interval += 5000
+      continue
+    }
+    if (body?.error === "authorization_pending") continue
+    throw new Error(body?.error === "access_denied" ? "sign-in was denied in the browser" : `sign-in failed: ${body?.error_description || body?.error || res.status}`)
+  }
+  throw new Error("sign-in expired before it was approved in the browser")
+}
+
+// ─── muse ─────────────────────────────────────────────────────────────────────
+
+export const MUSE = {
+  clientId: "1031625952748946",
+  authorizeUrl: "https://auth.meta.com/oidc/device/authorization/",
+  tokenUrl: "https://auth.meta.com/oidc/device/token/",
+  keyUrl: "https://api.meta.ai/muse-code/key",
+}
+
+/**
+ * Sign in with a Meta account, then have Meta mint a Muse API key for it. Returns
+ * `{ META_API_KEY }` — a key, which is what `[templates.muse.env]` and the muse
+ * harness row already know how to deliver.
+ */
+export async function museConnect({ fetch, sleep, onCode, now }) {
+  const tokens = await deviceFlow({ ...MUSE, extra: {}, onCode, fetch, sleep, now })
+  const res = await fetch(MUSE.keyUrl, {
+    method: "POST",
+    headers: { ...JSON_H, Authorization: `Bearer ${tokens.access_token}`, "x-api-version": "1.0.0" },
+    body: "{}",
+  })
+  const body = await readJson(res)
+  if (!res.ok) throw new Error(`Muse did not issue an API key (${res.status}${body?.message ? `: ${body.message}` : ""})`)
+  if (typeof body?.api_key !== "string" || !body.api_key) {
+    throw new Error(`Muse did not issue an API key.${typeof body?.action_url === "string" ? ` Finish setup at ${body.action_url} and connect again.` : ""}`)
+  }
+  return { secret: { kind: "api-key", META_API_KEY: body.api_key }, expiresAt: null }
+}
+
+// ─── amp ──────────────────────────────────────────────────────────────────────
+//
+// amp is the harness where the plugin's own sign-in buys nothing, and it is worth
+// recording why so nobody re-derives it. `amp login` is a WorkOS device flow
+// (`authapi.ampcode.com/user_management/authorize/device`, client
+// `client_01JNSEYM3V0J5AXK4YXNXRXTGP`) and the plugin can run it; the result is the
+// five-minute bearer plus rotating refresh token ADR 0014 measured. The credential a
+// box needs is the long-lived ACCESS TOKEN (`sgamp_…`) the Security settings page
+// shows, and that page reads it through a SvelteKit remote function
+// (`POST /_app/remote/…/getAccessToken`) which (a) accepts only the browser's cookie
+// session, never a bearer ("Authentication required"), (b) refuses cross-site
+// callers, and (c) demands a RECENT sign-in ("REAUTH_REQUIRED") — all measured live,
+// 2026-09-09. Nothing a CLI holds satisfies that, by design: it is amp's sudo gate.
+//
+// So `auth connect amp` opens that page and takes the token the human pastes. One
+// paste, once; the token lives until they rotate it, and N boxes can hold it.
+
+export const AMP = {
+  settingsUrl: "https://ampcode.com/settings/security#access-token",
+}
+
+/** `sgamp_…`: amp's long-lived access token, the only amp credential a connection stores. */
+export function validAmpAccessToken(value) {
+  return typeof value === "string" && /^sgamp_[A-Za-z0-9_-]{16,}$/.test(value)
+}
+
+/**
+ * Open amp's Security page and take the pasted token. `prompt` is the CLI's
+ * readline (injected, so tests pass a value); `onCode` is the same hook the device
+ * flows use, here carrying the page URL and no code.
+ */
+export async function ampConnect({ onCode, prompt }) {
+  await onCode?.({ url: AMP.settingsUrl, userCode: null, expiresIn: 600 })
+  const value = String((await prompt?.("Paste the access token from that page: ")) ?? "").trim()
+  if (!validAmpAccessToken(value)) throw new Error("Expected an amp access token (sgamp_…); nothing was saved.")
+  return { secret: { kind: "api-key", AMP_API_KEY: value }, expiresAt: null }
+}
+
+// ─── codex ────────────────────────────────────────────────────────────────────
+
+export const CODEX = {
+  clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
+  authorizeUrl: "https://auth.openai.com/oauth/authorize",
+  tokenUrl: "https://auth.openai.com/oauth/token",
+  callbackPort: 1455,
+  callbackPath: "/auth/callback",
+  scope: "openid profile email offline_access",
+}
+
+/** The browser URL for one PKCE attempt; `state` and `challenge` are the caller's. */
+export function codexAuthorizeUrl({ challenge, state, port = CODEX.callbackPort }) {
+  const q = new URLSearchParams({
+    response_type: "code",
+    client_id: CODEX.clientId,
+    redirect_uri: `http://localhost:${port}${CODEX.callbackPath}`,
+    scope: CODEX.scope,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    id_token_add_organizations: "true",
+    codex_cli_simplified_flow: "true",
+    state,
+    originator: "codex_cli_rs",
+  })
+  return `${CODEX.authorizeUrl}?${q}`
+}
+
+/** The `~/.codex/auth.json` shape codex reads, from a token response. */
+export function codexAuthJson(tokens, now = Date.now) {
+  return {
+    auth_mode: "chatgpt",
+    OPENAI_API_KEY: null,
+    tokens: { id_token: tokens.id_token, access_token: tokens.access_token, refresh_token: tokens.refresh_token, account_id: tokens.account_id },
+    last_refresh: new Date(now()).toISOString(),
+  }
+}
+
+/**
+ * Codex's refresh grant, the request codex-rs itself sends. Returns a NEW auth.json
+ * (new bearer, new single-use refresh token). Whoever calls this owns the chain:
+ * the old refresh token is dead afterwards, which is why only the plugin ever does.
+ */
+export async function codexRefresh(authJson, { fetch, now = Date.now }) {
+  const res = await fetch(CODEX.tokenUrl, {
+    method: "POST",
+    headers: JSON_H,
+    body: JSON.stringify({ client_id: CODEX.clientId, grant_type: "refresh_token", refresh_token: authJson?.tokens?.refresh_token, scope: "openid profile email" }),
+  })
+  const body = await readJson(res)
+  if (!res.ok || typeof body?.access_token !== "string") throw new Error(`codex refresh failed (${res.status}${body?.error ? `: ${body.error}` : ""}) - sign in again with auth reconnect`)
+  return codexAuthJson({ ...authJson.tokens, ...body, account_id: authJson?.tokens?.account_id }, now)
+}
+
+/**
+ * Codex CLI's own sign-in: PKCE, a localhost callback on codex's port, the token
+ * exchange. Resolves to `{ secret: <auth.json object>, expiresAt }` where expiresAt
+ * is the bearer's. `listen` is injectable so the test can drive the callback
+ * without a socket; the default binds codex's port on 127.0.0.1.
+ */
+export async function codexConnect({ fetch, onCode, now = Date.now, listen = listenOnce, port = CODEX.callbackPort, pkce = pkcePair(), state = randomBytes(16).toString("hex") }) {
+  const url = codexAuthorizeUrl({ challenge: pkce.challenge, state, port })
+  const callback = listen({ port, path: CODEX.callbackPath })
+  await onCode?.({ url, userCode: null, expiresIn: 600 })
+  const q = await callback
+  if (q.error) throw new Error(`sign-in failed: ${q.error}${q.error_description ? ` - ${q.error_description}` : ""}`)
+  if (q.state !== state) throw new Error("sign-in returned a different state than it was given - possible CSRF, nothing was saved")
+  if (!q.code) throw new Error("sign-in returned no authorization code")
+  const res = await fetch(CODEX.tokenUrl, {
+    method: "POST",
+    headers: FORM,
+    body: form({ grant_type: "authorization_code", code: q.code, redirect_uri: `http://localhost:${port}${CODEX.callbackPath}`, client_id: CODEX.clientId, code_verifier: pkce.verifier }),
+  })
+  const tokens = await readJson(res)
+  if (!res.ok || typeof tokens?.access_token !== "string") throw new Error(`token exchange failed (${res.status}${tokens?.error ? `: ${tokens.error}` : ""})`)
+  return { secret: codexAuthJson(tokens, now), expiresAt: jwtExpiryIso(tokens.access_token) }
+}
+
+/** One HTTP request on 127.0.0.1:<port><path>, its query as an object, then the server closes. */
+export function listenOnce({ port, path: expected }) {
+  return new Promise((resolve, reject) => {
+    const server = http.createServer((req, res) => {
+      const u = new URL(req.url, `http://127.0.0.1:${port}`)
+      if (u.pathname !== expected) {
+        res.writeHead(404).end("Not Found")
+        return
+      }
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" })
+      res.end("<!doctype html><title>herdr-e2b</title><p>Signed in. You can close this tab and return to the terminal.</p>")
+      server.close()
+      resolve(Object.fromEntries(u.searchParams))
+    })
+    server.on("error", (e) => reject(e.code === "EADDRINUSE" ? new Error(`port ${port} is in use - close any other codex sign-in and try again`) : e))
+    server.listen(port, "127.0.0.1")
+  })
+}
+
+/** Which harnesses `auth connect --oauth` knows, and the connect function for each. */
+export const OAUTH_CONNECT = { muse: museConnect, amp: ampConnect, codex: codexConnect }
diff --git a/src/pane-parse.js b/src/pane-parse.js
index 7ecc670..1b5155e 100644
--- a/src/pane-parse.js
+++ b/src/pane-parse.js
@@ -9,6 +9,7 @@
 //                  "<focused_pane> <dashboard_pane> <tab_pane_ids>",
 //                  "-" for any absent value, tab ids comma-separated.
 //   origin         invoking pane from plugin context or HERDR_PANE_ID.
+//   cwd            the invoking pane's directory from plugin context, "-" if none.
 //   procs          foreground process names, one per line (nothing if none).
 //
 // Empty or malformed input is an ordinary outcome here — herdr isn't running,
@@ -45,11 +46,13 @@ if (mode === "panes") {
   console.log(panesLine(title));
 } else if (mode === "origin") {
   console.log(doc?.focused_pane_id || doc?.focusedPaneId || process.env.HERDR_PANE_ID || "-");
+} else if (mode === "cwd") {
+  console.log(doc?.focused_pane_cwd || doc?.focusedPaneCwd || doc?.workspace_cwd || doc?.workspaceCwd || "-");
 } else if (mode === "procs") {
   for (const p of doc?.result?.process_info?.foreground_processes ?? []) {
     console.log(p?.name ?? "");
   }
 } else {
-  console.error(`pane-parse: unknown mode '${mode ?? ""}' (expected 'panes', 'origin' or 'procs')`);
+  console.error(`pane-parse: unknown mode '${mode ?? ""}' (expected 'panes', 'origin', 'cwd' or 'procs')`);
   process.exitCode = 2;
 }
diff --git a/src/provision.js b/src/provision.js
index 0dc0073..8616f58 100644
--- a/src/provision.js
+++ b/src/provision.js
@@ -27,6 +27,7 @@ import {
 } from "./config.js"
 import { seedCommand } from "./fleet-seed.js"
 import { pinCommand } from "./model-pin.js"
+import { effortScale, effortsForModel, harnessHint, modelCatalog } from "./effort.js"
 import { selectConnection } from "./connections.js"
 import {
   requireApiKey,
@@ -165,6 +166,35 @@ async function main() {
     // An explicit choice (`e2b-box open --template …`, the picker, E2B_TEMPLATE)
     // beats the per-branch rules; without one, the rules and default decide.
     const template = input.template || resolveTemplate(branch, cfg)
+    // A per-box model or effort (`e2b-box open --model … --reasoning xhigh`, the
+    // pickers' two cells) overrides `[templates.<name>]` for THIS box only: it is
+    // folded into the pin before resolveEnv and pinCommand read it, so both routes
+    // see one value. Checked against the catalog (src/harness-catalog.generated.js)
+    // first, because the harnesses do not: a wrong model dies on the first turn,
+    // and droid takes any of its effort words and silently runs the model's
+    // default. The check is per MODEL where the catalog knows one, since grok-4.5
+    // has no `xhigh` while grok-4.6 does.
+    if (input.model || input.reasoning) {
+      const pinned = cfg.templateModels?.[template] || {}
+      const model = input.model || pinned.model || ""
+      if (input.model) {
+        const catalog = modelCatalog(template, cfg)
+        if (catalog && !catalog.models.some((m) => m.id === input.model)) {
+          const some = catalog.models.slice(0, 3).map((m) => m.id).join(", ")
+          throw new Error(`'${input.model}' is not a model ${template} lists (${catalog.models.length} in its catalog, e.g. ${some}; from ${catalog.from})`)
+        }
+      }
+      if (input.reasoning) {
+        const accepts = effortsForModel(template, model, cfg)
+        if (accepts && !accepts.includes(input.reasoning)) {
+          throw new Error(`'${input.reasoning}' is not an effort ${template}${model ? ` on ${model}` : ""} accepts (${accepts.join(" | ")})`)
+        }
+      }
+      cfg.templateModels = {
+        ...cfg.templateModels,
+        [template]: { ...pinned, ...(input.model ? { model: input.model } : {}), ...(input.reasoning ? { reasoning: input.reasoning } : {}) },
+      }
+    }
     const connection = selectConnection(cfg, template)
     connectionHarness = connection?.harness || null
     const createEnv = resolveEnv(cfg, template, process.env)
@@ -247,6 +277,8 @@ async function main() {
     await writeRecord(key, {
       sandboxId: sandbox.sandboxId,
       template: usedTemplate,
+      ...(input.reasoning ? { reasoning: input.reasoning } : {}),
+      ...(input.model ? { model: input.model } : {}),
       connectionId: connection?.id || null,
       connectionRevision: connection?.revision || null,
       connectionHarness,
@@ -354,7 +386,7 @@ async function main() {
   // arrive as HERDR_E2B_MODEL / HERDR_E2B_REASONING in the box's environment (set at
   // create time by resolveEnv), so this command carries no value and does nothing on
   // a box created before the pin was configured. Best-effort like the seed.
-  const pin = pinCommand(boxTemplate, cfg.templateModels?.[boxTemplate])
+  const pin = pinCommand(boxTemplate, cfg.templateModels?.[boxTemplate], harnessHint(boxTemplate, cfg) ?? boxTemplate)
   if (pin) {
     await sandbox.files.write("/home/user/.herdr-e2b-model.sh", `${pin}\n`)
     await sandbox.commands
diff --git a/test/catalog.test.js b/test/catalog.test.js
new file mode 100644
index 0000000..fdf6f39
--- /dev/null
+++ b/test/catalog.test.js
@@ -0,0 +1,262 @@
+import test from "node:test"
+import assert from "node:assert/strict"
+import { readFileSync, readdirSync } from "node:fs"
+import path from "node:path"
+import { fileURLToPath } from "node:url"
+
+import {
+  CATALOG_PROBES,
+  EFFORT_ORDER,
+  diffRow,
+  enumAfter,
+  interpretCatalog,
+  mergeCatalog,
+  orderEfforts,
+  perModel,
+  renderTomlBlock,
+  spliceTomlBlock,
+  stripMeta,
+  TOML_BEGIN,
+  TOML_END,
+} from "../src/catalog.js"
+import { HARNESS_CATALOG } from "../src/harness-catalog.generated.js"
+import { HARNESSES } from "../src/harnesses.js"
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..")
+const FIXTURES = path.join(ROOT, "test", "fixtures", "catalog")
+const fixture = (id) => JSON.parse(readFileSync(path.join(FIXTURES, `${id}.json`), "utf8"))
+
+// Every probe result below is captured output from the CLI in that harness's E2B
+// template (scripts/harness-catalog.mjs --from=box --write). They are fixtures on
+// purpose: CI has none of these installed, and the point of the parse rules is that
+// they read RESULTS. Nothing here spawns or fetches.
+
+test("the probe table covers every harness behind a shipped template, and nothing else", () => {
+  assert.deepEqual(Object.keys(CATALOG_PROBES).sort(), Object.keys(HARNESSES).sort())
+  for (const [id, spec] of Object.entries(CATALOG_PROBES)) {
+    assert.ok(spec.probes.version?.cmd, `${id}: every row asks the binary its version`)
+    assert.ok(["efforts", "modes", null].includes(spec.needs), `${id}: needs is efforts, modes or null`)
+    assert.equal(typeof spec.parse, "function")
+    for (const [name, p] of Object.entries(spec.probes)) {
+      assert.ok((p.cmd && !p.url) || (p.url && !p.cmd), `${id}.${name}: a command or a URL, not both`)
+      // The rule that makes this output safe to paste: no probe line carries a value
+      // that looks like a secret or expands one onto a command line.
+      if (p.cmd) assert.doesNotMatch(p.cmd, /sk-|fk-|xai-|Bearer|API_KEY=/i, `${id}.${name}: no credential material on a command line`)
+    }
+  }
+})
+
+test("there is a fixture for every harness, captured from its template", () => {
+  const files = readdirSync(FIXTURES).filter((f) => f.endsWith(".json")).map((f) => f.slice(0, -5)).sort()
+  assert.deepEqual(files, Object.keys(CATALOG_PROBES).sort())
+  for (const id of files) {
+    const fx = fixture(id)
+    assert.equal(fx.harness, id)
+    assert.equal(fx.probedFrom, "box", `${id}: the committed fixture was read off the template, not a laptop`)
+    assert.deepEqual(Object.keys(fx.probes).sort(), Object.keys(CATALOG_PROBES[id].probes).sort(), `${id}: one result per probe`)
+  }
+})
+
+test("every fixture parses into a usable row, in the shape the plugin reads", () => {
+  for (const id of Object.keys(CATALOG_PROBES)) {
+    const row = interpretCatalog(id, fixture(id).probes)
+    assert.ok(row, `${id}: the captured output parses`)
+    assert.match(row.version, /^\d+\.\d+\.\d+/, `${id}: a version`)
+    const spec = CATALOG_PROBES[id]
+    if (spec.needs) {
+      const words = row[spec.needs]
+      assert.ok(Array.isArray(words) && words.length >= 3, `${id}: at least three ${spec.needs}`)
+      assert.equal(new Set(words).size, words.length, `${id}: no duplicate words`)
+      if (spec.needs === "efforts") {
+        assert.deepEqual(words, orderEfforts(words), `${id}: written in EFFORT_ORDER`)
+      }
+    }
+    if (row.models) {
+      assert.ok(row.models.length > 0)
+      assert.equal(row.modelsFrom, spec.modelsFrom)
+      for (const m of row.models) {
+        assert.ok(typeof m.id === "string" && m.id.trim() === m.id && m.id, `${id}: a bare, trimmed id`)
+        if (m.efforts) assert.deepEqual(m.efforts, orderEfforts(m.efforts), `${id}/${m.id}: ordered`)
+        if (m.default) assert.ok(m.efforts?.includes(m.default), `${id}/${m.id}: the default is on its own list`)
+      }
+      assert.equal(new Set(row.models.map((m) => m.id)).size, row.models.length, `${id}: no duplicate ids`)
+    } else {
+      assert.equal(row.modelsFrom, null)
+    }
+  }
+})
+
+// What each harness-specific rule is FOR, pinned against its own fixture. These are
+// structural claims about the mechanism, not the vendor's current word list.
+test("codex: the bundled catalog, listed models only, efforts per model with a default", () => {
+  const row = interpretCatalog("codex", fixture("codex").probes)
+  const hidden = JSON.parse(fixture("codex").probes.catalog.stdout).models.filter((m) => m.visibility !== "list")
+  for (const h of hidden) assert.ok(!row.models.some((m) => m.id === h.slug), `${h.slug} is hidden in codex's own picker`)
+  assert.ok(row.models.every((m) => m.efforts && m.default), "every listed model says what it takes and what it starts at")
+  assert.deepEqual(row.efforts, orderEfforts(row.models.flatMap((m) => m.efforts)), "the scale is the union")
+})
+
+test("grok: the cache the authenticated `grok models` wrote, hidden models dropped, per-model efforts", () => {
+  const fx = fixture("grok").probes
+  const row = interpretCatalog("grok", fx)
+  const cache = JSON.parse(fx.cache.stdout)
+  assert.equal(row.models.length, Object.values(cache.models).filter((m) => !m.info?.hidden).length)
+  assert.ok(row.models.every((m) => m.efforts))
+  // Without the cache (unauthenticated), the flat set still comes off the rejection.
+  const flat = interpretCatalog("grok", { ...fx, cache: { stdout: "", stderr: "cat: no such file", status: 1 } })
+  assert.ok(flat, "the rejection oracle alone is enough for a scale")
+  assert.deepEqual(flat.efforts, row.efforts)
+  assert.ok(flat.models.every((m) => !m.efforts), "ids from `grok models`, no per-model detail")
+})
+
+test("droid: the handshake's availableModels, and the LIVE union rather than the syntactic enum", () => {
+  const fx = fixture("droid").probes
+  const row = interpretCatalog("droid", fx)
+  const syntactic = enumAfter(`${fx.efforts.stdout}\n${fx.efforts.stderr}`, /Allowed values:\s*([^\n]+)/)
+  assert.ok(syntactic.includes("dynamic"), "the flag accepts `dynamic`")
+  assert.ok(!row.efforts.includes("dynamic"), "no listed model takes it, so the scale does not offer it")
+  assert.ok(perModel(row), "droid is the harness where a flat row lies")
+  assert.ok(row.models.some((m) => m.efforts.length === 1), "some model takes exactly one word")
+  // Handshake gone (an older protocol): the two rejection oracles still give a row.
+  const fallback = interpretCatalog("droid", { ...fx, catalog: { stdout: "", stderr: "", status: 1 } })
+  assert.deepEqual(fallback.efforts, syntactic)
+  assert.ok(fallback.models.length > 10 && fallback.models.every((m) => !m.efforts))
+})
+
+test("amp: modes are the scale; its --reasoning-effort words are recorded and never mixed in", () => {
+  const row = interpretCatalog("amp", fixture("amp").probes)
+  assert.ok(row.modes.includes("low") && row.modes.includes("high"))
+  assert.ok(!row.modes.some((m) => /-|\s/.test(m)), "the parenthetical's prose never leaks into the modes")
+  assert.ok(row.efforts, "amp's own effort vocabulary is kept")
+  assert.ok(row.efforts.some((e) => !row.modes.includes(e)), "and it is a different vocabulary")
+})
+
+test("prime: `<provider>/<model>` ids split at the first slash, thinking flag carried", () => {
+  const row = interpretCatalog("prime", fixture("prime").probes)
+  assert.ok(row.models.every((m) => m.id.includes("/")))
+  assert.ok(row.models.some((m) => m.id.split("/").length > 2), "a provider whose model ids themselves contain a slash")
+  assert.ok(!row.models.some((m) => m.id.startsWith("provider/")), "the header row is not a model")
+})
+
+test("claude: efforts off the CLI's rejection, models off models.dev's anthropic provider", () => {
+  const fx = fixture("claude").probes
+  const row = interpretCatalog("claude", fx)
+  assert.ok(row.models.every((m) => m.id.startsWith("claude-")))
+  assert.ok(row.models.some((m) => m.efforts) && row.models.some((m) => !m.efforts), "models.dev says which models take an effort at all")
+  // The model column is optional: a registry outage must not lose the scale.
+  const noReg = interpretCatalog("claude", { ...fx, models: { stdout: "", stderr: "fetch failed", status: null } })
+  assert.deepEqual(noReg.efforts, row.efforts)
+  assert.equal(noReg.models, null)
+})
+
+test("muse and opencode: a scale with no model list, and a version with nothing else", () => {
+  const muse = interpretCatalog("muse", fixture("muse").probes)
+  assert.ok(muse.efforts.length >= 5)
+  assert.equal(muse.models, null)
+  const oc = interpretCatalog("opencode", fixture("opencode").probes)
+  assert.equal(oc.efforts, null)
+  assert.equal(oc.models, null)
+})
+
+test("a probe that did not answer is a null row, never an empty scale", () => {
+  for (const id of Object.keys(CATALOG_PROBES)) {
+    assert.equal(interpretCatalog(id, {}), null, `${id}: nothing in, nothing out`)
+    const fx = fixture(id).probes
+    assert.equal(interpretCatalog(id, { ...fx, version: { stdout: "", stderr: "not found", status: 127 } }), null, `${id}: no version, no row`)
+    const spec = CATALOG_PROBES[id]
+    if (spec.needs === "efforts") {
+      const blank = Object.fromEntries(Object.keys(fx).map((k) => [k, k === "version" ? fx[k] : { stdout: "", stderr: "", status: 1 }]))
+      assert.equal(interpretCatalog(id, blank), null, `${id}: a version with no words is not a row`)
+    }
+  }
+  assert.equal(interpretCatalog("not-a-harness", fixture("claude").probes), null)
+})
+
+test("orderEfforts and enumAfter: the vendor's order and quoting never reach the table", () => {
+  assert.deepEqual(orderEfforts(["xhigh", "high", "medium", "low"]), ["low", "medium", "high", "xhigh"])
+  assert.deepEqual(orderEfforts(["max", "max", "  low "]), ["low", "max"])
+  assert.deepEqual(orderEfforts(["zzz", "high", "aaa"]), ["high", "zzz", "aaa"], "unknown words keep their own order, after the known ones")
+  assert.equal(orderEfforts([]), null)
+  assert.equal(orderEfforts(["", "Not A Word"]), null)
+  assert.deepEqual(enumAfter("Valid values: low, medium, high, xhigh, max.", /Valid values:\s*([^.\n]+)/), ["low", "medium", "high", "xhigh", "max"])
+  assert.deepEqual(enumAfter("expected none|minimal|low", /expected\s+([a-z|]+)/), ["none", "minimal", "low"])
+  assert.deepEqual(enumAfter("Expected 'none' | 'off', received", /Expected (.+), received/), ["none", "off"])
+  assert.equal(enumAfter("nothing here", /Valid values:\s*([^.\n]+)/), null)
+  assert.equal(EFFORT_ORDER[0], "none")
+  assert.equal(EFFORT_ORDER.at(-1), "ultra")
+})
+
+// --- the committed module is what the fixtures say -----------------------------------
+
+test("src/harness-catalog.generated.js is exactly what the fixtures parse to (rerun the script if not)", () => {
+  for (const id of Object.keys(CATALOG_PROBES)) {
+    const want = interpretCatalog(id, fixture(id).probes)
+    const have = stripMeta(HARNESS_CATALOG[id])
+    assert.deepEqual(
+      have,
+      want,
+      `${id}: the generated row has drifted from its fixture, run \`node scripts/harness-catalog.mjs --from=fixture --write\``,
+    )
+    assert.equal(HARNESS_CATALOG[id].probedFrom, "box")
+    assert.ok(HARNESS_CATALOG[id].probedAt)
+    assert.equal(HARNESS_CATALOG[id].stale, undefined, `${id}: a shipped row is never stale`)
+  }
+})
+
+test("config/config.example.toml carries the rendered <catalog> block verbatim", () => {
+  const toml = readFileSync(path.join(ROOT, "config", "config.example.toml"), "utf8")
+  const block = renderTomlBlock(HARNESS_CATALOG)
+  assert.ok(block.startsWith(TOML_BEGIN) && block.endsWith(TOML_END))
+  assert.ok(toml.includes(block), "the example config's table is the generated one, run the script with --write")
+  assert.ok(block.split("\n").every((l) => l.startsWith("#")), "every line is a TOML comment")
+  assert.ok(block.split("\n").every((l) => l.length <= 170), "no line runs off a review pane")
+  // Splicing is idempotent and only ever touches what sits between the sentinels.
+  assert.equal(spliceTomlBlock(toml, block), toml)
+  const other = spliceTomlBlock(`before\n${TOML_BEGIN}\nold\n${TOML_END}\nafter`, block)
+  assert.equal(other, `before\n${block}\nafter`)
+  assert.throws(() => spliceTomlBlock("no sentinels here", block), /sentinels/)
+})
+
+// --- what a refresh does with what it read ---------------------------------------------
+
+test("mergeCatalog: a read row replaces, a failed probe keeps the committed row and marks it stale", () => {
+  const meta = { probedFrom: "box", probedAt: "2026-09-10T00:00:00.000Z", templates: { claude: { name: "p/claude", buildID: "b2", updatedAt: "x" } } }
+  const fresh = {
+    claude: { row: { version: "9.9.9", efforts: ["low"], models: null, modelsFrom: null } },
+    codex: { row: null, reason: "sandbox timed out" },
+  }
+  const out = mergeCatalog(HARNESS_CATALOG, fresh, meta)
+  assert.equal(out.claude.version, "9.9.9")
+  assert.equal(out.claude.probedAt, meta.probedAt)
+  assert.deepEqual(out.claude.template, meta.templates.claude)
+  assert.equal(out.codex.version, HARNESS_CATALOG.codex.version, "not blanked")
+  assert.deepEqual(out.codex.efforts, HARNESS_CATALOG.codex.efforts)
+  assert.deepEqual(out.codex.stale, { since: meta.probedAt, reason: "sandbox timed out" })
+  assert.deepEqual(stripMeta(out.grok), stripMeta(HARNESS_CATALOG.grok), "a harness not probed this run is carried over untouched")
+  assert.equal(out.grok.stale, undefined)
+  // A replay carries the capture's provenance, not the transport's.
+  const replay = mergeCatalog({}, { muse: { row: { version: "1.0.0", efforts: ["low"], models: null, modelsFrom: null }, probedFrom: "box", probedAt: "2026-09-09T00:00:00.000Z" } }, { probedFrom: "fixture" })
+  assert.equal(replay.muse.probedFrom, "box")
+  assert.equal(replay.muse.probedAt, "2026-09-09T00:00:00.000Z")
+  // The stale mark clears on the next successful read.
+  const again = mergeCatalog(out, { codex: { row: stripMeta(HARNESS_CATALOG.codex) } }, meta)
+  assert.equal(again.codex.stale, undefined)
+  // A stale row renders as such.
+  assert.match(renderTomlBlock(out), /codex.*\(stale\)/)
+  assert.match(renderTomlBlock(out), /kept from an earlier run, probe failed 2026-09-10: sandbox timed out/)
+})
+
+test("diffRow: says what moved, in words a PR body can carry", () => {
+  const a = { version: "1.0.0", efforts: ["low", "high"], models: [{ id: "m1", efforts: ["low"] }, { id: "m2" }], modelsFrom: "x" }
+  assert.deepEqual(diffRow(a, a), [])
+  assert.deepEqual(diffRow(a, { ...a, probedAt: "later", probedFrom: "box" }), [], "provenance is not drift")
+  assert.deepEqual(diffRow(a, { ...a, version: "1.1.0" }), ["version 1.0.0 → 1.1.0"])
+  assert.deepEqual(diffRow(a, { ...a, efforts: ["low", "medium", "high"] }), ["efforts +medium"])
+  assert.deepEqual(diffRow(a, { ...a, efforts: ["low"] }), ["efforts -high"])
+  assert.deepEqual(diffRow(a, { ...a, models: [{ id: "m1", efforts: ["low"] }, { id: "m3" }] }), ["models +m3 -m2"])
+  assert.deepEqual(diffRow(a, { ...a, models: [{ id: "m1", efforts: ["low", "high"] }, { id: "m2" }] }), ["per-model efforts changed: m1"])
+  assert.deepEqual(diffRow(undefined, a), ["new row"])
+  assert.deepEqual(diffRow(a, undefined), ["row gone"])
+  const many = { ...a, models: [...a.models, ...["a", "b", "c", "d", "e", "f"].map((id) => ({ id }))] }
+  assert.match(diffRow(a, many)[0], /\+a \+b \+c \+d \+2 more/)
+})
diff --git a/test/cli.test.sh b/test/cli.test.sh
index 0b9f5a0..75508a1 100644
--- a/test/cli.test.sh
+++ b/test/cli.test.sh
@@ -18,7 +18,7 @@ for t in jq git node; do command -v "$t" >/dev/null || { echo "cli.test: '$t' no
 echo "── lint: bash -n ──"
 for f in "$ROOT"/bin/e2b-box "$ROOT"/bin/e2b-box-open "$ROOT"/bin/e2b-box-pull "$ROOT"/bin/e2b-fleet "$ROOT"/bin/e2b-fleet-open \
          "$ROOT"/bin/e2b-dash "$ROOT"/bin/e2b-dash-toggle "$ROOT"/bin/e2b-popup "$ROOT"/bin/e2b-bench \
-         "$ROOT"/bin/e2b-domain "$ROOT"/bin/teardown-worktree "$ROOT"/bin/lib/*.sh "$ROOT"/install.sh "$ROOT"/test/e2e-run.sh; do
+         "$ROOT"/bin/e2b-domain "$ROOT"/bin/e2b-picker-warm "$ROOT"/bin/teardown-worktree "$ROOT"/bin/lib/*.sh "$ROOT"/install.sh "$ROOT"/test/e2e-run.sh; do
   if bash -n "$f" 2>/dev/null; then ok "bash -n $(basename "$f")"; else bad "bash -n $(basename "$f")"; fi
 done
 echo "── lint: node --check ──"
@@ -306,6 +306,25 @@ out=$("$E2B" auth --nope </dev/null 2>&1); rc=$?
 { [ "$rc" -eq 2 ] && printf '%s' "$out" | grep -q "unknown option"; } \
   && ok "auth rejects a flag it does not know → exit 2" || bad "auth --nope (rc=$rc, out=$out)"
 
+# `pick --needed` is how the `open` action decides whether the popup is worth
+# drawing: 0 when the picker would open, 1 when the template is already settled.
+echo "── behavior: pick --needed says whether there is anything to ask ──"
+pkdir="$TMP/pick-needed"; mkdir -p "$pkdir/repo" "$pkdir/state"
+printf '[sandbox]\ntemplate = "base"\ntemplates = ["claude", "codex", "base"]\n' > "$pkdir/config.toml"
+git -C "$pkdir/repo" init -q && git -C "$pkdir/repo" commit -q --allow-empty -m init
+(cd "$pkdir/repo" && env -u E2B_TEMPLATE HERDR_PLUGIN_CONFIG_DIR="$pkdir" HERDR_PLUGIN_STATE_DIR="$pkdir/state" "$E2B" pick --needed </dev/null >/dev/null 2>&1); rc=$?
+[ "$rc" -eq 0 ] && ok "a fresh worktree with a menu to choose from → 0" || bad "pick --needed on a fresh worktree (rc=$rc)"
+(cd "$pkdir/repo" && E2B_TEMPLATE=claude HERDR_PLUGIN_CONFIG_DIR="$pkdir" HERDR_PLUGIN_STATE_DIR="$pkdir/state" "$E2B" pick --needed </dev/null >/dev/null 2>&1); rc=$?
+[ "$rc" -eq 1 ] && ok "E2B_TEMPLATE settles it → 1" || bad "pick --needed with E2B_TEMPLATE (rc=$rc)"
+printf '[sandbox]\ntemplate = "base"\ntemplates = ["base"]\n' > "$pkdir/config.toml"
+(cd "$pkdir/repo" && env -u E2B_TEMPLATE HERDR_PLUGIN_CONFIG_DIR="$pkdir" HERDR_PLUGIN_STATE_DIR="$pkdir/state" "$E2B" pick --needed </dev/null >/dev/null 2>&1); rc=$?
+[ "$rc" -eq 1 ] && ok "a single candidate is not a choice → 1" || bad "pick --needed with one template (rc=$rc)"
+# Without --needed and without a terminal, the answer is the key and an empty line
+# (which a `$(…)` capture strips): the caller opens the box plain, as `open` would.
+out=$(cd "$pkdir/repo" && env -u E2B_TEMPLATE HERDR_PLUGIN_CONFIG_DIR="$pkdir" HERDR_PLUGIN_STATE_DIR="$pkdir/state" "$E2B" pick </dev/null 2>/dev/null); rc=$?
+{ [ "$rc" -eq 0 ] && printf '%s' "$out" | grep -qx 'repo-[0-9a-f]\{8\}'; } \
+  && ok "pick with no terminal answers key + nothing, exit 0" || bad "pick without a tty (rc=$rc, out=$out)"
+
 # What the `open` picker draws beside each template. Asserted here rather than in a
 # unit test because the two halves have to agree across a process boundary: the node
 # side emits `<template>\t<mark>` and bash cuts the columns apart. Driven with a
@@ -583,6 +602,31 @@ FBASE=$(git -C "$FREPO" rev-parse HEAD)
 # gets its own test below, with the id pinned.
 fleet() { ( cd "$FREPO" && env -u HERDR_WORKSPACE_ID HERDR_E2B_FLEET_RAND=ab12 "$FLEET" "$@" 2>&1 ); }
 
+SPEC_CFG="$TMP/fleet-spec-config"; mkdir -p "$SPEC_CFG/presets"
+cat > "$SPEC_CFG/presets/compare.json" <<'JSON'
+{"slug":"saved-run","task":"fix the login bug","members":[{"template":"codex","model":"gpt-6-astra","reasoning":"high","count":2},{"template":"claude"}]}
+JSON
+specfleet() { ( cd "$FREPO" && HERDR_PLUGIN_CONFIG_DIR="$SPEC_CFG" "$FLEET" "$@" 2>&1 ); }
+out=$(specfleet create --file "$SPEC_CFG/presets/compare.json" -n); rc=$?
+{ [ "$rc" -eq 0 ] && [[ "$out" = *saved-run-codex-2* ]] && [[ "$out" = *gpt-6-astra* ]] && [[ "$out" = *'--reasoning high'* ]] && [[ "$out" = *'writes the brief'* ]]; } \
+  && ok "fleet JSON plans counts, model, reasoning and task headlessly" || bad "fleet JSON plan (rc=$rc, out=$out)"
+out=$(specfleet override --preset compare --task '' -t claude -n); rc=$?
+{ [ "$rc" -eq 0 ] && [[ "$out" = *override-claude* ]] && [[ "$out" != *'writes the brief'* ]] && [[ "$out" != *saved-run* ]] && [[ "$out" != *gpt-6-astra* ]]; } \
+  && ok "fleet flags override saved slug, task and roster" || bad "fleet preset overrides (rc=$rc, out=$out)"
+out=$(specfleet create --file - -n < "$SPEC_CFG/presets/compare.json"); rc=$?
+{ [ "$rc" -eq 0 ] && [[ "$out" = *saved-run-codex-2* ]]; } \
+  && ok "fleet reads generated JSON from stdin" || bad "fleet JSON stdin (rc=$rc, out=$out)"
+out=$(specfleet presets); rc=$?
+{ [ "$rc" -eq 0 ] && [ "$out" = compare ]; } \
+  && ok "fleet presets lists config-adjacent recipes" || bad "fleet preset listing (rc=$rc, out=$out)"
+out=$(specfleet --file "$SPEC_CFG/presets/compare.json" --preset compare -n); rc=$?
+{ [ "$rc" -eq 2 ] && [[ "$out" = *'use one --file or --preset'* ]]; } \
+  && ok "fleet refuses competing recipe sources" || bad "fleet competing sources (rc=$rc, out=$out)"
+printf '{"members":[{"template":"codex","model":"invented"}]}' > "$SPEC_CFG/presets/bad.json"
+out=$(specfleet nope --preset bad -n); rc=$?
+{ [ "$rc" -eq 2 ] && [[ "$out" = *'not a model'* ]] && [[ "$out" != *'herdr worktree create'* ]]; } \
+  && ok "invalid JSON model fails before any member plan" || bad "fleet JSON validation (rc=$rc, out=$out)"
+
 out=$(fleet --slug "Login Fix" -t claude --dry-run); rc=$?
 { [ "$rc" -eq 0 ] \
   && printf '%s\n' "$out" | grep -qx \
@@ -786,16 +830,17 @@ out=$( cd "$FREPO" && HERDR_E2B_FLEET_RAND=ab12 HERDR_PLUGIN_CONFIG_DIR="$NSCFG"
   && ok "a roster whose members would share a name is refused, naming both" \
   || bad "roster label collision (rc=$rc, out=$out)"
 
-# A roster holds a template at most once (CONTEXT.md), so a repeated -t is one
-# member — and the plan keeps first-seen order, which is what makes it assertable.
+# A repeated -t is MORE MEMBERS of that template: numbered labels, a branch each,
+# plan order preserved — which is what makes it assertable.
 out=$(fleet --slug dup -t claude -t claude -t codex -n); rc=$?
 creates=$(printf '%s\n' "$out" | grep -c 'herdr worktree create' || true)
-{ [ "$rc" -eq 0 ] && [ "$creates" -eq 2 ] \
+{ [ "$rc" -eq 0 ] && [ "$creates" -eq 3 ] \
   && [ "$(printf '%s\n' "$out" | grep -c 'e2b/dup-claude-ab12')" -eq 1 ] \
-  && printf '%s\n' "$out" | grep -q "collapsed 1 duplicate" \
-  && [ "$(printf '%s\n' "$out" | grep -n 'member dup-claude' | cut -d: -f1)" \
+  && [ "$(printf '%s\n' "$out" | grep -c 'e2b/dup-claude-2-ab12')" -eq 1 ] \
+  && printf '%s\n' "$out" | grep -q '^  member dup-claude-2$' \
+  && [ "$(printf '%s\n' "$out" | grep -n 'member dup-claude-2' | cut -d: -f1)" \
        -lt "$(printf '%s\n' "$out" | grep -n 'member dup-codex' | cut -d: -f1)" ]; } \
-  && ok "a template given twice is one member, in first-seen order" \
+  && ok "a template given twice is two numbered members, in first-seen order" \
   || bad "duplicate template collapse (rc=$rc, creates=$creates, out=$out)"
 
 echo "── fleet: create is the one-liner, and it plans the same fleet ──"
@@ -1002,11 +1047,32 @@ got=$(printf '%s\n' "$out" | grep -c '^  member ')
   && ok "--agents all is one member per configured template ($want)" \
   || bad "--agents all (rc=$rc, got=$got, want=$want)"
 
-# Mixing the two spellings is one roster, and the dedupe still applies across them.
+# Mixing the two spellings is one roster; a name in both is two members of it.
 out=$(fleet create mixed -t claude --agents claude,codex -n)
-{ [ "$(printf '%s\n' "$out" | grep -c '^  member ')" -eq 2 ] \
-  && printf '%s\n' "$out" | grep -q "collapsed 1 duplicate"; } \
-  && ok "-t and --agents are one roster, deduped across both" || bad "mixed roster (out=$out)"
+{ [ "$(printf '%s\n' "$out" | grep -c '^  member ')" -eq 3 ] \
+  && printf '%s\n' "$out" | grep -q '^  member mixed-claude-2$'; } \
+  && ok "-t and --agents are one roster, counted across both" || bad "mixed roster (out=$out)"
+
+# Member SPECS: NAME*N is N instances, @EFFORT rides into each member's open as
+# --reasoning, and a bare name carries none — the pin, or the harness default, applies.
+out=$(fleet create spec -t 'codex*2@ultra' -t grok@xhigh -t claude -n); rc=$?
+{ [ "$rc" -eq 0 ] \
+  && [ "$(printf '%s\n' "$out" | grep -c 'open -t codex --reasoning ultra$')" -eq 2 ] \
+  && [ "$(printf '%s\n' "$out" | grep -c 'open -t grok --reasoning xhigh$')" -eq 1 ] \
+  && [ "$(printf '%s\n' "$out" | grep -c 'open -t claude$')" -eq 1 ] \
+  && printf '%s\n' "$out" | grep -q 'e2b/spec-codex-2-ab12'; } \
+  && ok "member specs: *N instances and @effort per member" || bad "member specs (rc=$rc, out=$out)"
+# `:MODEL` rides into each member's open as --model, beside the effort; a model id
+# keeps its slashes, and the template half is still what the roster check reads.
+out=$(fleet create spec -t 'codex:gpt-5.5*2@ultra' -t 'prime:prime-inference/anthropic/claude-fable-5' -t claude -n); rc=$?
+{ [ "$rc" -eq 0 ] \
+  && [ "$(printf '%s\n' "$out" | grep -c 'open -t codex --reasoning ultra --model gpt-5.5$')" -eq 2 ] \
+  && [ "$(printf '%s\n' "$out" | grep -c 'open -t prime --model prime-inference/anthropic/claude-fable-5$')" -eq 1 ] \
+  && [ "$(printf '%s\n' "$out" | grep -c 'open -t claude$')" -eq 1 ]; } \
+  && ok "member specs: :MODEL per member, beside @EFFORT" || bad "member specs with :MODEL (rc=$rc, out=$out)"
+out=$(fleet create spec -t 'codex*0' -n 2>&1); rc=$?
+{ [ "$rc" -ne 0 ] && printf '%s\n' "$out" | grep -q '1\.\.20'; } \
+  && ok "a spec count outside 1..20 is refused before anything is created" || bad "spec count (rc=$rc, out=$out)"
 
 echo "── fleet: a roster name nobody configured is refused ──"
 # An unknown name used to plan fine and only fail minutes later, when its box tried
@@ -1616,6 +1682,26 @@ out=$( cd "$FREPO" && HERDR_E2B_FLEET_RAND=ab12 HERDR_ENV=1 STUB_DELAY="$STUB_DE
   && ok "--dashboard execs the board rather than waiting on the members" \
   || bad "--dashboard did not reach the board (rc=$rc, out=$out)"
 
+# The board must have something to show the moment it takes the pane: a `pending`
+# placeholder per member, written before any member is spawned and keyed off the
+# label since no worktree exists yet. The stub never runs e2b-box, so no real record
+# ever replaces it here and it is still there to read.
+PENDING="$HERDR_PLUGIN_STATE_DIR/boxes/boarded-claude-pending.json"
+{ [ -f "$PENDING" ] \
+  && [ "$(jq -r .status "$PENDING")" = pending ] \
+  && [ "$(jq -r .label "$PENDING")" = boarded-claude ] \
+  && [ "$(jq -r .template "$PENDING")" = claude ] \
+  && [ "$(jq -r .key "$PENDING")" = boarded-claude-pending ]; } \
+  && ok "a pending placeholder per member is on the board before the members are away" \
+  || bad "pending placeholder (file=$PENDING, content=$(cat "$PENDING" 2>/dev/null))"
+rm -f "$PENDING"
+# A member that fails leaves no placeholder behind: its report says why instead.
+# (`pout`, not `out`: the boarded run's output is still asserted on below.)
+pout=$(spawn herdr-fail --slug pfail -t claude); prc=$?
+{ [ "$prc" -ne 0 ] && [ ! -f "$HERDR_PLUGIN_STATE_DIR/boxes/pfail-claude-pending.json" ]; } \
+  && ok "a failed member clears its placeholder" \
+  || bad "failed member left a placeholder (rc=$prc, $(ls "$HERDR_PLUGIN_STATE_DIR/boxes" 2>/dev/null))"
+
 # The header and the pointer belong in the pane; the report does not — the board
 # owns the pane from the exec on, so anything printed after it would be painted over.
 { printf '%s\n' "$out" | grep -q "fleet 'boarded'" \
@@ -2209,6 +2295,17 @@ pty_python() {
   printf '%s' "$py"
 }
 
+if PY=$(pty_python); then
+  while IFS= read -r line; do
+    case "$line" in
+      OK\ *) ok "${line#OK }" ;;
+      *) bad "$line" ;;
+    esac
+  done < <("$PY" "$ROOT/test/picker-cache-pty.py" "$ROOT" "$BASH" "$(command -v node)" 2>&1)
+else
+  skip "picker cache pty coverage: no usable python3"
+fi
+
 if PY=$(pty_python); then
   cat > "$TMP/ptycheck.py" <<'PYCHECK'
 import os, pty, select, sys, time
@@ -2250,6 +2347,11 @@ def run(script, keys, sink=None):
     for k in keys:
         os.write(fd, k)
         drain(fd, sink=sink)
+        if k == b"\x1b":
+            # These are ordinary-terminal choosers, not popup renderers. Bash
+            # 3.2 needs a whole second to distinguish Escape from a key sequence;
+            # sending the next arrow sooner makes it part of that Escape read.
+            time.sleep(1.2)
     deadline = time.time() + 6
     while time.time() < deadline:
         if os.waitpid(pid, os.WNOHANG)[0]:
@@ -2282,8 +2384,21 @@ PICK = call("ask_template_tty demo codex %s 3" % MENU)
 MARKS = "\"$(printf 'key (env)\\nkey (file)\\n')\""
 PICKANN = call("ask_template_tty demo codex %s 3 %s" % (MENU, MARKS))
 ROST = call("ask_roster_tty demo %s 3 codex" % MENU)
+# The same two pickers with effort rows (src/effort.js's `|` format): claude opens
+# on its configured `high`, codex has a scale but no pin, base has no scale at all.
+EFF = "\"$(printf 'claude|native|low,medium,high,xhigh,max|high|X\\ncodex|native|low,medium,high,xhigh,max,ultra||Y\\nbase|none|||')\""
+ROSTE = call("ask_roster_tty demo %s 3 codex %s" % (MENU, EFF))
+PICKE = call("ask_template_tty demo codex %s 3 '' %s" % (MENU, EFF))
+# The same rows with the two model fields (six and seven): claude is pinned to
+# c-b, codex lists three models and pins none, base lists none. The model column
+# sits BETWEEN template and effort, so → lands on it first.
+EFFM = "\"$(printf 'claude|native|low,medium,high,xhigh,max|high|X|c-a,c-b|c-b\\ncodex|native|low,medium,high,xhigh,max,ultra||Y|g-a,g-b,g-c|\\nbase|none|||||')\""
+ROSTM = call("ask_roster_tty demo %s 3 codex %s" % (MENU, EFFM))
+PICKM = call("ask_template_tty demo codex %s 3 '' %s" % (MENU, EFFM))
+PICKC = call("ask_template_tty demo codex %s 3 '' %s" % (MENU, EFFM), "CHOOSER_CENTER=1; ")
 VALID = 'alnum() { case "$1" in *[a-zA-Z0-9]*) return 0;; esac; return 1; }; '
 SLUG = call("ask_slug_tty '' alnum", VALID)
+SLUGC = call("ask_slug_tty '' alnum", "CHOOSER_CENTER=1; " + VALID)
 # The same screen with the optional fleet-task field on. Two lines come back —
 # the slug, then the task — so an empty task is an empty second line, which the
 # capture below strips exactly as the caller's own $(…) does.
@@ -2310,6 +2425,59 @@ cases = [
     ("roster: a number toggles that row",        ROST, [b"1", b"\r"], "claude\ncodex|rc=0"),
     ("roster: q aborts, choosing nothing",       ROST, [b"q"], "|rc=2"),
     ("roster: bare esc aborts",                  ROST, [b"\x1b"], "|rc=2"),
+    # The effort and count cells. Focus is a CELL: →/tab moves to the effort column,
+    # enter there opens the row's list (↑/↓ choose, enter takes, esc keeps), and
+    # taking or leaving it keeps the focus on that cell, so ← (or shift-tab) back to
+    # the template column and then enter launches.
+    # A row with no chosen effort answers bare, so the fleet reads what it read
+    # before this column existed.
+    ("roster+effort: enter is still the bare default roster", ROSTE, [b"\r"], "codex|rc=0"),
+    ("roster+effort: → then enter opens the list; ↓ enter takes the first word; ← enter launches", ROSTE, [b"\x1b[C", b"\r", b"\x1b[B", b"\r", b"\x1b[D", b"\r"], "codex\tlow|rc=0"),
+    ("roster+effort: a taken value leaves the focus on its cell, so enter reopens the list", ROSTE, [b"\x1b[C", b"\r", b"\x1b[B", b"\r", b"\r", b"\x1b[B", b"\r", b"\x1b[D", b"\r"], "codex\tmedium|rc=0"),
+    ("roster+effort: tab focuses the cell too; k in the list wraps to the last word", ROSTE, [b"\t", b"\r", b"k", b"\r", b"\x1b[D", b"\r"], "codex\tultra|rc=0"),
+    ("roster+effort: esc inside the list keeps the value it had, and the focus on the cell", ROSTE, [b"\t", b"\r", b"j", b"\x1b", b"\x1b[D", b"\r"], "codex|rc=0"),
+    ("roster+effort: a number inside the list picks that word", ROSTE, [b"\t", b"\r", b"6", b"\x1b[D", b"\r"], "codex\tultra|rc=0"),
+    ("roster+effort: + is another member at the row's effort", ROSTE, [b"\t", b"\r", b"j", b"\r", b"+", b"\x1b[D", b"\r"], "codex\tlow\ncodex\tlow|rc=0"),
+    ("roster+effort: s ticks, grows to two and unfolds; #1 gets its own word", ROSTE, [b"k", b"s", b"\r", b"j", b"\r", b"\x1b[D", b"\r"], "claude\txhigh\nclaude\thigh\ncodex|rc=0"),
+    ("roster+effort: s again folds, members kept", ROSTE, [b"s", b"s", b"\r"], "codex\ncodex|rc=0"),
+    ("roster+effort: enter on the count column launches", ROSTE, [b"\t", b"\t", b"\r"], "codex|rc=0"),
+    ("roster+effort: a template with no scale has no list to open", ROSTE, [b"j", b" ", b"\t", b"\r"], "codex\nbase|rc=0"),
+    ("single+effort: enter is bare when nothing is pinned", PICKE, [b"\r"], "codex|rc=0"),
+    ("single+effort: → enter ↓ enter picks an effort, ← enter confirms", PICKE, [b"\x1b[C", b"\r", b"\x1b[B", b"\r", b"\x1b[D", b"\r"], "codex\tlow|rc=0"),
+    ("single+effort: the focus stays on the cell just set, so enter reopens its list", PICKE, [b"\x1b[C", b"\r", b"\x1b[B", b"\r", b"\r", b"\x1b[B", b"\r", b"\x1b[D", b"\r"], "codex\tmedium|rc=0"),
+    ("single+effort: ← returns to the template column", PICKE, [b"\t", b"\x1b[D", b"\r"], "codex|rc=0"),
+    ("single+effort: a pinned row opens on its pin", PICKE, [b"k", b"\r"], "claude\thigh|rc=0"),
+    ("single+effort: a number answers with that row's own cell", PICKE, [b"1"], "claude\thigh|rc=0"),
+    # The model cell. Its list is the harness's catalog; choosing one adds a THIRD
+    # field, and an unchosen effort between them is `-` (an empty tab field would
+    # fold away under bash's read), so readers split on tabs and drop the dash.
+    ("single+model: enter is bare when nothing is pinned", PICKM, [b"\r"], "codex|rc=0"),
+    ("single+model: → enter ↓ enter picks a model, ← enter confirms", PICKM, [b"\x1b[C", b"\r", b"\x1b[B", b"\r", b"\x1b[D", b"\r"], "codex\t-\tg-a|rc=0"),
+    ("single+model: → → is the effort column, past the model", PICKM, [b"\x1b[C", b"\x1b[C", b"\r", b"\x1b[B", b"\r", b"\x1b[D", b"\x1b[D", b"\r"], "codex\tlow|rc=0"),
+    ("single+model: both cells chosen come back as three fields", PICKM, [b"\t", b"\r", b"3", b"\t", b"\r", b"6", b"\x1b[D", b"\x1b[D", b"\r"], "codex\tultra\tg-c|rc=0"),
+    ("single+model: a pinned row opens on its pinned model and effort", PICKM, [b"k", b"\r"], "claude\thigh\tc-b|rc=0"),
+    ("single+model: esc inside the model list keeps the pin", PICKM, [b"k", b"\t", b"\r", b"j", b"\x1b", b"\x1b[D", b"\r"], "claude\thigh\tc-b|rc=0"),
+    ("single+model: ← from the effort column lands on the model column", PICKM, [b"\t", b"\t", b"\x1b[D", b"\r", b"2", b"\x1b[D", b"\r"], "codex\t-\tg-b|rc=0"),
+    ("roster+model: → enter ↓ enter picks a model, ← enter launches", ROSTM, [b"\x1b[C", b"\r", b"\x1b[B", b"\r", b"\x1b[D", b"\r"], "codex\t-\tg-a|rc=0"),
+    ("roster+model: s unfolds onto #1's model cell; each instance gets its own", ROSTM, [b"s", b"\r", b"\x1b[B", b"\r", b"\x1b[D", b"\r"], "codex\t-\tg-a\ncodex|rc=0"),
+    ("roster+model: on an instance row → past the model cell is its effort cell", ROSTM, [b"s", b"\t", b"\r", b"j", b"\r", b"\x1b[D", b"\x1b[D", b"\r"], "codex\tlow\ncodex|rc=0"),
+    ("roster+model: the count column is the fourth", ROSTM, [b"\t", b"\t", b"\t", b"+", b"\r"], "codex\ncodex|rc=0"),
+    ("roster+model: a template with no models has no model list to open", ROSTM, [b"j", b" ", b"\t", b"\r"], "codex\nbase|rc=0"),
+    # Tab walks every cell and then on to the next row, so one key visits the whole
+    # table; shift-tab (and ←) walk the same path backwards: off a row's first column
+    # onto the LAST cell of the row above, wrapping to the bottom.
+    ("single+model: tab past the last cell lands on the next row's template", PICKM, [b"\t", b"\t", b"\t", b"\r"], "base|rc=0"),
+    ("single+model: → past the last cell wraps the same way", PICKM, [b"\x1b[C", b"\x1b[C", b"\x1b[C", b"\r"], "base|rc=0"),
+    ("single+model: tab on a row with no cells is the next row", PICKM, [b"j", b"\t", b"\r"], "claude\thigh\tc-b|rc=0"),
+    ("roster+model: tab past the count cell is the next row; space ticks it there", ROSTM, [b"\t", b"\t", b"\t", b"\t", b" ", b"\r"], "codex\nbase|rc=0"),
+    ("roster+model: shift-tab off the template column is the row above's last cell (its count), then its effort", ROSTM, [b"\x1b[Z", b"\x1b[Z", b"\r", b"j", b"\r", b" ", b"\x1b[D", b"\x1b[D", b"\r"], "claude\txhigh\tc-b\ncodex|rc=0"),
+    ("single+model: shift-tab off the template column is the row above's effort cell", PICKM, [b"\x1b[Z", b"\r", b"j", b"\r", b"\x1b[D", b"\x1b[D", b"\r"], "claude\txhigh\tc-b|rc=0"),
+    ("single+model: shift-tab from the top row wraps to the bottom row", PICKM, [b"k", b"\x1b[Z", b"\r"], "base|rc=0"),
+    ("single+model: ← walks back the same way", PICKM, [b"\x1b[D", b"\x1b[D", b"\r", b"1", b"\x1b[D", b"\r"], "claude\thigh\tc-a|rc=0"),
+    ("roster+model: shift-tab back onto an unfolded row lands on the last instance's effort cell", ROSTM, [b"s", b"\t", b"\t", b"\t", b"\t", b"\t", b"\x1b[Z", b"\r", b"j", b"\r", b"\x1b[D", b"\x1b[D", b"\r"], "codex\ncodex\tlow|rc=0"),
+    # Centering (the popup) pads the frame; it must not change a single answer.
+    ("centered: the same keys give the same answer", PICKC, [b"\x1b[C", b"\r", b"\x1b[B", b"\r", b"\x1b[D", b"\r"], "codex\t-\tg-a|rc=0"),
+    ("centered: the slug screen still reads what was typed", SLUGC, [b"a", b"\r"], "a|rc=0"),
     ("slug: typed text comes back raw",          SLUG,
      [b"L", b"o", b"g", b"i", b"n", b" ", b"F", b"i", b"x", b"\r"], "Login Fix|rc=0"),
     ("slug: backspace deletes",                  SLUG, [b"a", b"b", b"\x7f", b"c", b"\r"], "ac|rc=0"),
diff --git a/test/config.test.js b/test/config.test.js
index 4e9d635..f93419c 100644
--- a/test/config.test.js
+++ b/test/config.test.js
@@ -608,7 +608,7 @@ test("resolveFleet: every shipped agent starts unattended", () => {
   assert.equal(agents.claude, "claude --dangerously-skip-permissions")
   assert.equal(agents.codex, "codex --dangerously-bypass-approvals-and-sandbox")
   assert.equal(agents.grok, "grok --always-approve")
-  assert.equal(agents.amp, "amp --dangerously-allow-all")
+  assert.equal(agents.amp, 'amp --dangerously-allow-all ${HERDR_E2B_REASONING:+--mode "$HERDR_E2B_REASONING"}')
   assert.equal(agents.muse, "muse --yolo")
   // Trailing `--prompt` is load-bearing: the fleet appends its task positionally,
   // and opencode's positional is a project DIRECTORY, not a prompt.
@@ -644,7 +644,7 @@ test("resolveFleet: an empty command still switches a shipped default off", () =
   // "plain shell, no agent" is what a control arm needs, so it has to beat a default.
   const { agents } = resolveFleet({ agents: { claude: "" } })
   assert.equal(agents.claude, "")
-  assert.equal(agents.amp, "amp --dangerously-allow-all")
+  assert.equal(agents.amp, 'amp --dangerously-allow-all ${HERDR_E2B_REASONING:+--mode "$HERDR_E2B_REASONING"}')
 })
 
 test("resolveEnv: amp gets the welcome-splash skip, and a user can still override it", () => {
diff --git a/test/connections.test.js b/test/connections.test.js
index 661ae88..63e0407 100644
--- a/test/connections.test.js
+++ b/test/connections.test.js
@@ -5,7 +5,7 @@ import { tmpdir } from "node:os"
 import path from "node:path"
 import { spawnSync } from "node:child_process"
 import { fileURLToPath } from "node:url"
-import { classifySubscription, connectionMaterial, readConnections, removeConnection, saveConnection, selectConnection, suggestedConnectionId } from "../src/connections.js"
+import { classifySubscription, connectionMaterial, readConnections, readOauthSecret, removeConnection, rewriteOauthSecret, saveConnection, selectConnection, suggestedConnectionId } from "../src/connections.js"
 import { resolveEnv } from "../src/config.js"
 import { unauthenticatedMembers } from "../src/fleet-auth.js"
 import { seedCommand } from "../src/fleet-seed.js"
@@ -346,3 +346,57 @@ sys.exit(os.waitstatus_to_exitcode(status))`
   assert.equal(record.detected.classification, "organization")
   assert.equal(connectionMaterial(record, { directory }).env.CLAUDE_CODE_OAUTH_TOKEN, TOKEN)
 })
+
+// ── oauth connections: the plugin's own sign-in, stored locally (ADR 0015) ─────
+
+test("oauth connections: a key for muse/amp, a placeholdered auth.json for codex, all from one secret file", (t) => {
+  const directory = fixture(t)
+  const muse = saveConnection({ id: "muse-personal", harness: "muse", method: "oauth" }, { kind: "api-key", META_API_KEY: "muse-key" }, { directory })
+  const amp = saveConnection({ id: "amp-personal", harness: "amp", method: "oauth" }, { kind: "api-key", AMP_API_KEY: "sgamp_user_abcdefghijklmnop" }, { directory })
+  const exp = Math.floor(Date.now() / 1000) + 3600
+  const bearer = `eyJhbGciOiJub25lIn0.${Buffer.from(JSON.stringify({ exp })).toString("base64url")}.sig`
+  const codex = saveConnection({ id: "codex-own", harness: "codex", method: "oauth" }, { auth_mode: "chatgpt", tokens: { id_token: "id", access_token: bearer, refresh_token: "real-refresh" } }, { directory })
+  assert.deepEqual(readConnections(directory).map((c) => c.id), ["amp-personal", "codex-own", "muse-personal"])
+  assert.deepEqual(connectionMaterial(muse, { directory }).env, { META_API_KEY: "muse-key" })
+  assert.deepEqual(connectionMaterial(amp, { directory }).env, { AMP_API_KEY: "sgamp_user_abcdefghijklmnop" })
+  const material = connectionMaterial(codex, { directory })
+  const shipped = JSON.parse(material.env.CODEX_AUTH_JSON)
+  // The box never sees the real refresh token: the plugin is that chain's only custodian.
+  assert.equal(shipped.tokens.access_token, bearer)
+  assert.notEqual(shipped.tokens.refresh_token, "real-refresh")
+  assert.equal(material.expiresAt, new Date(exp * 1000).toISOString())
+  // Secrets are private files; metadata never carries them.
+  for (const f of readdirSync(directory).filter((n) => n.endsWith(".secret"))) assert.equal(statSync(path.join(directory, f)).mode & 0o777, 0o600)
+  assert.doesNotMatch(readFileSync(path.join(directory, "codex-own.json"), "utf8"), /real-refresh|eyJ/)
+})
+
+test("oauth connections: an expired codex bearer asks for reconnect; a rewrite keeps the revision", (t) => {
+  const directory = fixture(t)
+  const old = `eyJhbGciOiJub25lIn0.${Buffer.from(JSON.stringify({ exp: 1 })).toString("base64url")}.sig`
+  const rec = saveConnection({ id: "codex-own", harness: "codex", method: "oauth" }, { auth_mode: "chatgpt", tokens: { access_token: old, refresh_token: "r1" } }, { directory })
+  assert.throws(() => connectionMaterial(rec, { directory }), /has expired.*auth reconnect codex-own/)
+  const fresh = `eyJhbGciOiJub25lIn0.${Buffer.from(JSON.stringify({ exp: Math.floor(Date.now() / 1000) + 600 })).toString("base64url")}.sig`
+  rewriteOauthSecret(rec, { auth_mode: "chatgpt", tokens: { access_token: fresh, refresh_token: "r2" } }, directory)
+  assert.equal(readOauthSecret(rec, directory).tokens.refresh_token, "r2")
+  assert.ok(connectionMaterial(rec, { directory }).env.CODEX_AUTH_JSON)
+  assert.equal(readdirSync(directory).filter((n) => n.endsWith(".secret")).length, 1)
+})
+
+test("oauth connections: only muse, amp and codex; a bad or missing secret is a reconnect, never a fallback", (t) => {
+  const directory = fixture(t)
+  assert.throws(() => saveConnection({ id: "claude-x", harness: "claude", method: "oauth" }, { x: 1 }, { directory }), /Invalid connection/)
+  assert.throws(() => saveConnection({ id: "muse-x", harness: "muse", method: "oauth" }, "not-an-object", { directory }), /nothing was saved/)
+  const rec = saveConnection({ id: "muse-personal", harness: "muse", method: "oauth" }, { kind: "api-key", META_API_KEY: "k" }, { directory })
+  rmSync(path.join(directory, readdirSync(directory).find((n) => n.endsWith(".secret"))))
+  assert.throws(() => connectionMaterial(rec, { directory }), /unavailable.*auth reconnect muse-personal/)
+  const amp = saveConnection({ id: "amp-personal", harness: "amp", method: "oauth" }, { kind: "api-key", AMP_API_KEY: "" }, { directory })
+  assert.throws(() => connectionMaterial(amp, { directory }), /invalid/)
+})
+
+test("oauth connections: a selected muse or amp connection replaces the template's own credential", (t) => {
+  const directory = fixture(t)
+  const muse = saveConnection({ id: "muse-personal", harness: "muse", method: "oauth" }, { kind: "api-key", META_API_KEY: "from-connection" }, { directory })
+  const cfg = { connections: [muse], connectionsDir: directory, envTemplates: { muse: { META_API_KEY: "hand-written" } } }
+  assert.equal(resolveEnv(cfg, "muse", {}).META_API_KEY, "from-connection")
+  assert.deepEqual(unauthenticatedMembers([{ template: "muse", label: "m" }], cfg, {}), [])
+})
diff --git a/test/effort.test.js b/test/effort.test.js
new file mode 100644
index 0000000..da1b0fa
--- /dev/null
+++ b/test/effort.test.js
@@ -0,0 +1,106 @@
+import test from "node:test"
+import assert from "node:assert/strict"
+import { EFFORT_SCALES, GENERIC_SCALE, effortRows, effortScale, effortsForModel, harnessHint, modelCatalog, validEffort } from "../src/effort.js"
+import { HARNESS_CATALOG } from "../src/harness-catalog.generated.js"
+
+// The words are not pinned here: they are read off each template's CLI into
+// src/harness-catalog.generated.js (test/catalog.test.js proves the fixtures still
+// produce that file). What this pins is the OVERLAY: that every scale is derived
+// from the catalog the way src/effort.js says it is.
+test("effort scales derive from the catalog, with the plugin's overlay applied", () => {
+  assert.deepEqual(Object.keys(EFFORT_SCALES).sort(), Object.keys(HARNESS_CATALOG).sort())
+  for (const id of ["claude", "codex", "grok", "prime", "muse"]) {
+    assert.deepEqual(EFFORT_SCALES[id].values, HARNESS_CATALOG[id].efforts, `${id} is the CLI's own list, unfiltered`)
+    assert.equal(EFFORT_SCALES[id].kind, "native")
+  }
+  // droid: the CLI's words minus the two that mean "let the model decide".
+  assert.deepEqual(
+    EFFORT_SCALES.droid.values,
+    HARNESS_CATALOG.droid.efforts.filter((v) => v !== "none" && v !== "dynamic"),
+  )
+  assert.ok(EFFORT_SCALES.droid.values.length > 0)
+  // amp: its modes, never its --reasoning-effort vocabulary.
+  assert.deepEqual(EFFORT_SCALES.amp.values, HARNESS_CATALOG.amp.modes)
+  assert.equal(EFFORT_SCALES.amp.via, "--mode")
+  // opencode: the generic scale, whatever the catalog says.
+  assert.equal(EFFORT_SCALES.opencode.kind, "generic")
+  assert.deepEqual(EFFORT_SCALES.opencode.values, GENERIC_SCALE)
+  for (const [id, s] of Object.entries(EFFORT_SCALES)) {
+    assert.ok(s.values.length > 0, `${id} offers something`)
+    assert.equal(new Set(s.values).size, s.values.length, `${id} has no duplicates`)
+    assert.ok(s.via, `${id} says how the pin travels`)
+  }
+})
+
+test("harnessHint: a shipped template by name, a custom one by the command it runs", () => {
+  assert.equal(harnessHint("codex"), "codex")
+  assert.equal(harnessHint("drew-claude", { fleetAgents: { "drew-claude": "claude --dangerously-skip-permissions" } }), "claude")
+  assert.equal(harnessHint("mine", { fleetAgents: { mine: "/opt/bin/grok --always-approve" } }), "grok")
+  assert.equal(harnessHint("mine", { fleetAgents: { mine: "my-cli --go" } }), null)
+  assert.equal(harnessHint("base"), null)
+  assert.equal(harnessHint(""), null)
+})
+
+test("effortScale and validEffort follow the hint; no hint means no scale", () => {
+  assert.equal(effortScale("grok").harness, "grok")
+  assert.equal(effortScale("base"), null)
+  assert.equal(validEffort("grok", EFFORT_SCALES.grok.values.at(-1)), true)
+  assert.equal(validEffort("grok", "__not_a_word__"), false)
+  assert.equal(validEffort("opencode", "ultra"), true)
+  assert.equal(validEffort("base", "high"), false)
+})
+
+test("modelCatalog: the CLI's list for a harness that has one, null for one that does not", () => {
+  const droid = modelCatalog("droid")
+  assert.equal(droid.harness, "droid")
+  assert.ok(droid.models.length > 10)
+  assert.ok(droid.models.every((m) => typeof m.id === "string" && m.id))
+  assert.equal(modelCatalog("muse"), null, "muse has no pinnable model")
+  assert.equal(modelCatalog("opencode"), null, "opencode's universe is models.dev, not a list")
+  assert.equal(modelCatalog("base"), null)
+  assert.equal(modelCatalog("mine", { fleetAgents: { mine: "codex" } }).harness, "codex")
+})
+
+test("effortsForModel: a model's own subset when the catalog knows it, the scale otherwise", () => {
+  // Some droid model takes fewer words than the union, which is the whole point.
+  const narrow = HARNESS_CATALOG.droid.models.find((m) => m.efforts && m.efforts.length < EFFORT_SCALES.droid.values.length)
+  assert.ok(narrow, "the catalog has a droid model with a narrower scale")
+  const own = effortsForModel("droid", narrow.id)
+  assert.ok(own.length <= narrow.efforts.length)
+  assert.ok(own.every((v) => EFFORT_SCALES.droid.values.includes(v)), "never offers a word the overlay omits")
+  assert.deepEqual(effortsForModel("droid", "no-such-model"), EFFORT_SCALES.droid.values)
+  assert.deepEqual(effortsForModel("droid", ""), EFFORT_SCALES.droid.values)
+  assert.deepEqual(effortsForModel("muse", "anything"), EFFORT_SCALES.muse.values, "a flat scale is the answer for every model")
+  assert.equal(effortsForModel("base", "x"), null)
+})
+
+test("effortRows: one row per template, opening on the configured pin only when it is on the scale", () => {
+  const top = EFFORT_SCALES.grok.values.at(-1)
+  const cfg = { templateModels: { grok: { reasoning: top }, codex: { reasoning: "__off_scale__" } }, fleetAgents: { mine: "claude" } }
+  const rows = effortRows(["grok", "codex", "opencode", "mine", "base"], cfg)
+  assert.deepEqual(rows.map((r) => [r.template, r.kind, r.configured]), [
+    ["grok", "native", top],
+    ["codex", "native", ""], // not on codex's scale, so the cell opens blank
+    ["opencode", "generic", ""],
+    ["mine", "native", ""],
+    ["base", "none", ""],
+  ])
+  assert.deepEqual(rows[4].values, [])
+  assert.equal(rows[3].harness, "claude")
+})
+
+test("effortRows: the model cell lists the catalog only where a pin can be delivered", () => {
+  const droidModel = HARNESS_CATALOG.droid.models[1].id
+  const cfg = { templateModels: { droid: { model: droidModel }, codex: { model: "not-a-listed-model" } } }
+  const rows = Object.fromEntries(effortRows(["droid", "codex", "claude", "amp", "muse", "opencode", "base"], cfg).map((r) => [r.template, r]))
+  assert.deepEqual(rows.droid.models, HARNESS_CATALOG.droid.models.map((m) => m.id))
+  assert.equal(rows.droid.model, droidModel, "the pin opens the cell when it is on the list")
+  assert.ok(rows.codex.models.length > 0)
+  assert.equal(rows.codex.model, "", "a pin off the list opens the cell on default")
+  assert.ok(rows.claude.models.every((id) => id.startsWith("claude-")))
+  assert.deepEqual(rows.amp.models, [], "amp lists models and has no model setting: no cell")
+  assert.deepEqual(rows.muse.models, [], "muse has no pinnable model")
+  assert.deepEqual(rows.opencode.models, [], "opencode's universe is not a list")
+  assert.deepEqual(rows.base.models, [])
+  for (const r of Object.values(rows)) assert.ok(r.models.every((id) => !id.includes(",") && !id.includes("|")), `${r.template}: ids survive the | and , separators`)
+})
diff --git a/test/fixtures/catalog/amp.json b/test/fixtures/catalog/amp.json
new file mode 100644
index 0000000..b86fc78
--- /dev/null
+++ b/test/fixtures/catalog/amp.json
@@ -0,0 +1,28 @@
+{
+  "harness": "amp",
+  "version": "0.0.1788926461-g32d216",
+  "probedFrom": "box",
+  "capturedAt": "2026-09-09T12:26:09.733Z",
+  "probes": {
+    "version": {
+      "stdout": "0.0.1788926461-g32d216 (released 2026-09-09T04:01:01.000Z, 8h ago)\n",
+      "stderr": "",
+      "status": 0
+    },
+    "options": {
+      "stdout": "{\"models\":[{\"id\":\"alibaba/qwen3.8-max\",\"capabilities\":{\"efforts\":[\"low\",\"medium\",\"xhigh\"]}},{\"id\":\"anthropic/claude-fable-5\",\"capabilities\":{\"efforts\":[\"low\",\"medium\",\"high\",\"xhigh\",\"max\"]}},{\"id\":\"anthropic/claude-fable-5-1\",\"capabilities\":{\"efforts\":[\"low\",\"medium\",\"high\",\"xhigh\",\"max\"]}},{\"id\":\"anthropic/claude-haiku-4-5-20251001\",\"capabilities\":{\"efforts\":[\"none\",\"high\"]}},{\"id\":\"anthropic/claude-opus-4-6\",\"capabilities\":{\"efforts\":[\"low\",\"medium\",\"high\",\"max\"]}},{\"id\":\"anthropic/claude-opus-4-7\",\"capabilities\":{\"efforts\":[\"low\",\"medium\",\"high\",\"xhigh\",\"max\"]}},{\"id\":\"anthropic/claude-opus-4-8\",\"capabilities\":{\"efforts\":[\"low\",\"medium\",\"high\",\"xhigh\",\"max\"]}},{\"id\":\"anthropic/claude-opus-5\",\"capabilities\":{\"efforts\":[\"none\",\"low\",\"medium\",\"high\",\"xhigh\",\"max\"]}},{\"id\":\"anthropic/claude-sonnet-4-5-20250929\",\"capabilities\":{\"efforts\":[\"none\",\"high\"]}},{\"id\":\"anthropic/claude-sonnet-4-6\",\"capabilities\":{\"efforts\":[\"none\",\"high\"]}},{\"id\":\"anthropic/claude-sonnet-5\",\"capabilities\":{\"efforts\":[\"low\",\"medium\",\"high\",\"xhigh\",\"max\"]}},{\"id\":\"deepseek/deepseek-v4-flash\",\"capabilities\":{\"efforts\":[\"none\",\"high\",\"max\"]}},{\"id\":\"deepseek/deepseek-v4-pro\",\"capabilities\":{\"efforts\":[\"none\",\"high\",\"max\"]}},{\"id\":\"fireworks-ai/accounts/fireworks/models/glm-5p3\",\"capabilities\":{\"efforts\":[\"low\",\"high\",\"max\"]}},{\"id\":\"fireworks-ai/accounts/fireworks/models/inkling\",\"capabilities\":{\"efforts\":[\"none\",\"low\",\"medium\",\"high\",\"xhigh\"]}},{\"id\":\"fireworks-ai/accounts/fireworks/models/kimi-k3\",\"capabilities\":{\"efforts\":[\"low\",\"high\",\"max\"]}},{\"id\":\"google-vertex/gemini-3.1-flash-lite\",\"capabilities\":{\"efforts\":[\"minimal\",\"low\",\"medium\",\"high\"]}},{\"id\":\"google-vertex/gemini-3.1-pro-preview\",\"capabilities\":{\"efforts\":[\"low\",\"medium\",\"high\"]}},{\"id\":\"google-vertex/gemini-3.5-flash\",\"capabilities\":{\"efforts\":[\"minimal\",\"low\",\"medium\",\"high\"]}},{\"id\":\"google-vertex/gemini-3.5-flash-lite\",\"capabilities\":{\"efforts\":[\"minimal\",\"low\",\"medium\",\"high\"]}},{\"id\":\"google-vertex/gemini-3.6-flash\",\"capabilities\":{\"efforts\":[\"minimal\",\"low\",\"medium\",\"high\"]}},{\"id\":\"google-vertex/gemini-3.8-flash\",\"capabilities\":{\"efforts\":[\"low\",\"medium\",\"high\"]}},{\"id\":\"meta/muse-spark-1.3\",\"capabilities\":{\"efforts\":[\"minimal\",\"low\",\"medium\",\"high\",\"xhigh\"]}},{\"id\":\"minimax/MiniMax-M3\",\"capabilities\":{\"efforts\":[\"none\",\"high\"]}},{\"id\":\"openai/gpt-5\",\"capabilities\":{\"efforts\":[\"minimal\",\"low\",\"medium\",\"high\"]}},{\"id\":\"openai/gpt-5-mini\",\"capabilities\":{\"efforts\":[\"minimal\",\"low\",\"medium\",\"high\"]}},{\"id\":\"openai/gpt-5-nano\",\"capabilities\":{\"efforts\":[\"minimal\",\"low\",\"medium\",\"high\"]}},{\"id\":\"openai/gpt-5.1\",\"capabilities\":{\"efforts\":[\"none\",\"low\",\"medium\",\"high\"]}},{\"id\":\"openai/gpt-5.2\",\"capabilities\":{\"efforts\":[\"none\",\"low\",\"medium\",\"high\",\"xhigh\"]}},{\"id\":\"openai/gpt-5.3-codex\",\"capabilities\":{\"efforts\":[\"low\",\"medium\",\"high\",\"xhigh\"]}},{\"id\":\"openai/gpt-5.4\",\"capabilities\":{\"efforts\":[\"none\",\"low\",\"medium\",\"high\",\"xhigh\"]}},{\"id\":\"openai/gpt-5.5\",\"capabilities\":{\"efforts\":[\"none\",\"low\",\"medium\",\"high\",\"xhigh\"]}},{\"id\":\"openai/gpt-5.6-luna\",\"capabilities\":{\"efforts\":[\"none\",\"low\",\"medium\",\"high\",\"xhigh\",\"max\"]}},{\"id\":\"openai/gpt-5.6-sol\",\"capabilities\":{\"efforts\":[\"none\",\"low\",\"medium\",\"high\",\"xhigh\",\"max\"]}},{\"id\":\"openai/gpt-5.6-terra\",\"capabilities\":{\"efforts\":[\"none\",\"low\",\"medium\",\"high\",\"xhigh\",\"max\"]}},{\"id\":\"openai/gpt-6-astra\",\"capabilities\":{\"efforts\":[\"low\",\"medium\",\"high\",\"xhigh\",\"max\"]}},{\"id\":\"openai/o3\",\"capabilities\":{\"efforts\":[\"low\",\"medium\",\"high\"]}},{\"id\":\"xai/grok-4.5\",\"capabilities\":{\"efforts\":[]}},{\"id\":\"xai/grok-4.6\",\"capabilities\":{\"efforts\":[]}},{\"id\":\"xai/grok-build-0.1\",\"capabilities\":{\"efforts\":[]}},{\"id\":\"zhipuai/glm-5.2\",\"capabilities\":{\"efforts\":[\"none\",\"high\",\"max\"]}},{\"id\":\"zhipuai/glm-5.3-flash\",\"capabilities\":{\"efforts\":[\"low\",\"high\",\"max\"]}}]}",
+      "stderr": "",
+      "status": 0
+    },
+    "help": {
+      "stdout": "Amp CLI\n\nUsage: amp [options] [command]\n\nCommands:\n\n  version                       Print the version number and exit\n  logout                        Log out by removing stored API key\n  login                         Log in to Amp\n  orb                           Commands for Amp-managed orbs\n    system-metrics              Print historical orb system metrics for a thread URL or ID\n    portal                      Register a portal for an existing process and print its URL; use \"amp orb service start\"\n                                for long-lived servers\n      access                    Set portal access\n    service                     [alias: services] Manage long-lived services (dev servers, watchers) as supervised\n                                processes that survive Amp CLI updates and restart on failure\n      ensure                    Ensure every service declared in .amp/services.yaml is running and exposed at its portal\n                                URLs\n      start                     Start an undeclared ad-hoc supervised service, e.g.: amp orb service start preview\n                                --command 'pnpm dev' --portal\n      restart                   Restart a declared service from .amp/services.yaml or reload an existing ad-hoc service\n      stop                      Stop a service\n      status                    Show supervisor status for a service\n      logs                      Show recent logs for a service\n      list                      List orb services\n    restart-processes           Refresh environment variables and restart all processes in an orb thread\n    id-token                    Mint a short-lived OIDC token with a caller-chosen audience and print it to stdout\n  portal                        Commands for accessing Amp portal URLs\n    login-url                   Mint a single-use login URL (valid ~60s) that signs a non-browser client into an Amp\n                                portal URL; fetching it once sets the portal session cookie and redirects to the portal\n                                page\n  clone                         Clone an Amp-hosted Project, Personal Plugins or Skills repository, or Workspace Plugins\n                                or Skills repository\n  git-setup                     Configure the Amp Git credential helper\n  files                         Download files from Amp\n    get                         Download a private Amp attachment\n  top                           Show live active threads\n  last                          [alias: l] Continue the last thread\n  report-bug                    [alias: report, diagnostics] Report a bug with diagnostics from the amp --no-tui runner\n                                in this directory\n  threads                       [alias: t, thread] Manage threads\n    new                         [alias: n] Create a new thread\n    continue                    [alias: c] Continue an existing thread\n    list                        [alias: l, ls] List all threads\n    usage                       Show usage information for a thread\n    visibility                  [alias: v] Show or set default visibility for this repository\n    search                      [alias: find] Search threads\n    color                       Set a thread color\n    label                       Add labels to a thread\n    share                       [alias: s] Share a thread\n      multiplayer               Turn multiplayer on or off\n        on                      Turn multiplayer on for the default duration (1 week)\n        off                     Turn multiplayer off\n        ttl                     Turn multiplayer on for a specific duration\n    rename                      [alias: r] Rename a thread\n    archive                     Archive a thread\n    delete                      Delete a thread\n    markdown                    [alias: md] Render thread as markdown\n    export                      Export a thread as JSON\n    raw                         [alias: raw-thread] Export raw actor thread data as JSON\n  tools                         [alias: tool] Tool management commands\n    list                        [alias: ls] List all active tools (including MCP tools)\n    show                        Show details about an active tool\n  plugins                       [alias: plugin] Manage project, system, personal, and workspace plugins\n    add                         Install a plugin from a URL\n    remove                      [alias: rm] Remove an installed plugin\n    update                      Update installed plugins or one imported shared plugin\n    list                        [alias: ls] List loaded project, system, personal, and workspace plugins\n    import                      Import a shared personal plugin into a plugin repository checkout\n    repositories                [alias: repos] List available Personal Plugins and Workspace Plugins repositories\n    show-agent-options          Show models and built-in tool names available to plugin agents\n    exec                        Execute a plugin with a given event\n    show-docs                   Output the plugin API documentation understood by this version of Amp\n  skill                         [alias: skills] Manage skills from shared references, Git repositories, or local paths\n    add                         Install skills from a source\n    list                        [alias: ls] List all available skills\n    remove                      [alias: rm] Remove an installed skill\n    info                        Show information about a skill\n    repositories                [alias: repos] List available Personal Skills and Workspace Skills repositories\n  permissions                   [alias: permission] Manage permissions\n    list                        [alias: ls] List permissions\n    test                        Test permissions\n    edit                        Edit permissions\n    add                         Add permission rule\n  mcp                           Manage MCP servers\n    add                         Add an MCP server configuration\n    list                        List available MCP servers\n    remove                      Remove an MCP server configuration\n    remote                      Manage MCP servers saved to ampcode.com\n      list                      List stored remote MCP servers\n      add                       Add a stored remote MCP server\n      update                    Update a stored remote MCP server\n      remove                    Remove a stored remote MCP server\n      check                     Check a stored remote MCP server\n      tools                     List tools for a stored remote MCP server\n      login                     Log in to a stored remote MCP server\n      logout                    Log out of a stored remote MCP server\n    oauth                       Manage OAuth credentials for MCP servers in local CLI settings\n      login                     Register OAuth client credentials for an MCP server\n      logout                    Remove OAuth credentials for an MCP server\n      status                    Show OAuth status for an MCP server\n    doctor                      Check MCP server status\n    approve                     Approve a workspace MCP server\n  config                        Manage Amp configuration\n    edit                        Open the Amp settings file in $EDITOR\n    keymap                      List command keymap entries\n    model-providers             Manage model provider keys and subscriptions\n      list                      List model provider keys and subscriptions\n      activate                  Activate a model provider key (deactivates any other active key of the same provider)\n      deactivate                Deactivate a model provider key\n      show                      Show complete non-secret model provider connection data as JSON\n      delete                    Delete a model provider key or subscription\n      test                      Test a model provider key or subscription\n      check-access              Check which model provider serves a model by running a small inference\n      add-router                Add an AI model router and select the models routed through it\n      edit-router               Edit an AI model router\n      setup-guide               Explain how to obtain the credential an AI model router needs\n      edit-key                  Edit a model provider API key name or model mapping\n      add-chatgpt-subscription  Link your ChatGPT subscription to Amp as a model provider by signing in to OpenAI in\n                                your browser\n    vocabulary                  Manage personal dictation vocabulary\n      show                      Show personal dictation vocabulary (default)\n      add                       Add terms without replacing existing vocabulary\n      set                       Replace personal dictation vocabulary; omit terms to clear it\n  domains                       Manage custom domains for sites\n    list                        List custom domains, statuses, and required DNS records\n    add                         Add a custom domain\n    check                       Request an immediate DNS and provisioning status check\n    remove                      [alias: rm] Remove a custom domain\n  projects                      Manage Amp projects\n    create                      Create an Amp-hosted project or map an existing Git repository\n    update                      Update project settings by ID, [@]namespace/name, or repository\n    list                        List projects accessible to you\n    status                      Show the project matched by this directory's git remotes\n    get                         Get a project by ID, [@]namespace/name, or repository\n    snapshots                   Manage a project’s shared orb snapshots\n      list                      List shared orb snapshots by project and orb size\n      delete                    [alias: rm] Delete all shared orb snapshots, or one orb size with --resource\n    gallery-media               Manage a project’s Amp Store gallery media\n      get                       Print a project’s Amp Store gallery media as JSON\n      set                       Set a project’s Amp Store gallery media from a JSON array of\n                                {\"type\":\"image\"|\"video\",\"url\":\"<Amp artifact URL>\",\"width\":N,\"height\":N} items\n    delete                      [alias: rm] Delete a project by ID, [@]namespace/name, or repository\n  apps                          Manage workspace apps\n    deploy                      Deploy a directory to a workspace app\n    create                      Create a workspace app\n    edit                        Edit a workspace app\n    list                        List apps in a workspace\n    deployments                 List deployment history for an app\n    delete                      Delete a workspace app\n  oauth-clients                 Manage workspace External API OAuth clients\n    list                        List OAuth clients and client IDs\n    create                      Create a Sign in with Amp OAuth client\n    edit                        Edit a Sign in with Amp OAuth client\n  secrets                       Manage environment variables and secrets for orbs and Apps\n    list                        List secret and environment variable names\n    history                     Show the change history of secrets and environment variables, including deletions\n                                (values are never shown)\n    get                         Get an environment variable value (secret values are never returned)\n    set                         Add or update a secret or environment variable\n    delete                      [alias: rm] Delete a secret or environment variable\n  svc                           Call connected services and MCP servers through Amp\n    gmail                       Call the connected Gmail account\n      search_messages           Search Gmail messages\n      read_message              Read one Gmail message\n      list_labels               List Gmail labels\n      create_draft              Create a Gmail draft\n      send_message              Send a Gmail message\n      send_draft                Send a Gmail draft\n      modify_labels             Modify Gmail message labels\n  usage                         Show your current Amp usage and credit balance\n  update                        [alias: up] Update Amp CLI\n\nOptions:\n\n  --visibility <visibility>\n      Set thread visibility (private, unlisted, workspace, group)\n  -V, --version\n      Print the version number and exit\n  -v\n      Alias for --version\n  --notifications\n      Enable notification alerts (audio locally, terminal bell over SSH or with AMP_FORCE_BEL; enabled by default when\n      not in execute mode)\n  --no-notifications\n      Disable notification alerts (audio locally, terminal bell over SSH or with AMP_FORCE_BEL; enabled by default when\n      not in execute mode)\n  --color\n      Enable color output (enabled by default if stdout and stderr are sent to a TTY)\n  --no-color\n      Disable color output (enabled by default if stdout and stderr are sent to a TTY)\n  --settings-file <value>\n      Custom settings file path (overrides the default location /home/user/.config/amp/settings.json)\n  --log-level <value>\n      Set log level (parent, children, category, sinks, parentSinks, filters, lowestLevel, contextLocalStorage)\n  --log-file <value>\n      Set log file location (overrides the default location /home/user/.cache/amp/logs/cli.log)\n  --ide\n      Enable IDE connection (default). When enabled, Amp automatically includes your open IDE's file and text selection\n      with every message.\n  --no-ide\n      Disable IDE connection\n  --mcp-config <value>\n      JSON configuration or file path for MCP servers to merge with existing settings\n  -m, --mode <value>\n      Set the agent mode (low, medium, high, ultra, or a plugin mode by key or label, case-insensitive) — controls the\n      model, system prompt, and tool selection\n  --features <value>\n      Enable a thread feature (known: fast, Faster serving for supported models, billed at a premium; pro, GPT-5.6 Pro\n      mode (OpenAI API only, not supported by ChatGPT subscriptions))\n  --fast\n      Run new threads in Fast mode (faster serving for supported models, billed at a premium); alias for --features fast\n  --executor <value>\n      Run a new thread locally, in an orb, or on a runner (local, orb, runner:<id>)\n  --no-tui\n      Run Amp without a TUI: serve remote thread creation requests for the current directory. Use --runner-id <id> to\n      set a stable runner ID.\n  --remote-control-terminal\n      Enable terminal access from ampcode.com for remote-controlled threads\n  --no-remote-control-terminal\n      Disable terminal access from ampcode.com for remote-controlled threads\n  -x, --execute [message]\n      Use execute mode, optionally with user message. In execute mode, agent will execute provided prompt (either as\n      argument, or via stdin). By default, only the last assistant message is printed. Enabled automatically when\n      redirecting stdout.\n  -ox, --orb-execute\n      When used with -x/--execute, execute in an async orb on the Amp server. The -ox shorthand enables both options.\n      With `threads continue`, sends the message to the existing thread so it runs on that thread’s own remote executor.\n  --project [project]\n      With the orb executor, run the new thread on this Amp project (namespace/name, owner/repo, or repository URL)\n      instead of inferring it from the current directory’s Git remotes.\n  --orb-size <size>\n      With the orb executor, use this size instead of the project default.\n  --title <title>\n      With --execute, set the title of the new thread before starting the agent.\n  --stream-json\n      When used with --execute, output in Claude Code-compatible stream JSON format instead of plain text.\n  --stream-json-thinking\n      Include thinking blocks in stream JSON output (non-Claude Code extension). Implies --stream-json.\n  --stream-json-input\n      Read JSON Lines user messages from stdin. Requires both --execute and --stream-json.\n  --plugin-ready-timeout [seconds]\n      When used with --execute, how long to wait for plugins to become ready before running the turn, so plugin\n      lifecycle hooks (agent.start/agent.end) are not skipped. Off unless this flag is set; the bare flag uses 10. Max\n      300. Use 0 to disable.\n  --no-archive-after-execute\n      When used with --execute on a new thread or with the review command, leave the thread unarchived after the command\n      finishes.\n  -l, --label <label>\n      Add a label to the thread created or continued by this command. Repeat the flag for multiple labels.\n\nEnvironment variables:\n\n  AMP_API_KEY                  Access token for Amp (see https://ampcode.com/settings/security#access-token)\n  AMP_URL                      URL for the Amp service (default is https://ampcode.com/)\n  AMP_LOG_LEVEL                Set log level (can also use --log-level)\n  AMP_LOG_FILE                 Set log file location (can also use --log-file)\n  AMP_REMOTE_CONTROL_TERMINAL  Enable (1) or disable (0) terminal access from ampcode.com when no CLI flag is supplied\n  AMP_SETTINGS_FILE            Set settings file path (can also use --settings-file, default:\n                               /home/user/.config/amp/settings.json)\n\nExamples:\n\nStart an interactive session:\n\n  $ amp\n\nStart an interactive session with a user message:\n\n  $ echo \"commit all my unstaged changes\" | amp\n\nUse execute mode (--execute or -x) to send a command to an agent, have it execute it, print only the agent's last message, and then exit:\n\n  $ amp -x \"what file in this folder is in markdown format?\"\n  All Markdown files in this folder:\n  - README.md (root)\n  - AGENT.md (root)\n  - Documentation (7 files in doc/)\n  - Various README.md files in subdirectories\n  Total: **13 Markdown files** found across the project.\n\nStream JSON output and extract assistant text blocks with jq:\n\n  $ amp -x \"what file in this folder is in markdown format?\" --stream-json | jq -r 'select(.type==\"assistant\") | .message.content[] | select(.type==\"text\") | .text'\n\nStream JSON output with thinking blocks and extract them with jq:\n\n  $ amp -x \"what file in this folder is in markdown format?\" --stream-json-thinking | jq -r 'select(.type==\"assistant\") | .message.content[] | select(.type==\"thinking\") | .thinking'\n\nPipe data to the agent and send along a prompt in execute mode:\n\n  $ cat ~/.zshrc | amp -x \"what does the 'beautiful' function do?\"\n  The `beautiful` function creates an infinite loop that prints the letter \"o\" in cycling colors every 0.2 seconds.\n\nExecute a prompt from a file and store final assistant message output in a file (redirecting stdout is equivalent to providing -x/--execute):\n\n  $ amp < prompt.txt > output.txt\n\nAdd an MCP server with a local command:\n\n  $ amp mcp add context7 -- npx -y @upstash/context7-mcp\n\nAdd an MCP server with environment variables:\n\n  $ amp mcp add postgres --env PGUSER=orb -- npx -y @modelcontextprotocol/server-postgres postgresql://localhost/orbing\n\nAdd a remote MCP server:\n\n  $ amp mcp add hugging-face https://huggingface.co/mcp\n\nConfiguration:\n\nAmp can be configured using a JSON settings file located at /home/user/.config/amp/settings.json. All settings use the \"amp.\" prefix.\n\nSettings reference:\n\n  amp.dangerouslyAllowAll\n      Disable all command confirmation prompts (agent will execute all commands without asking)\n  amp.defaultVisibility\n      Define default thread visibility per repository origin using mappings like \"github.com/org/repo\": \"workspace\".\n      Values: private, workspace, group.\n  amp.experimental.modes\n      Enable experimental agent modes by name\n  amp.fuzzy.alwaysIncludePaths\n      Glob patterns for paths that should always be included in fuzzy file search, even if gitignored\n  amp.git.commit.ampThread.enabled\n      Enable adding Amp-Thread trailer in git commits\n  amp.git.commit.coauthor.enabled\n      Enable adding Amp as co-author in git commits\n  amp.guardedFiles.allowlist\n      Array of file glob patterns that are allowed to be accessed without confirmation. Takes precedence over the\n      built-in denylist.\n  amp.keymap\n      Command shortcuts keyed by command ID. Values can be a shortcut string, an array of shortcuts, or null. User\n      keymap entries override workspace entries. Run \"amp config keymap\" to list all command IDs, descriptions, and\n      effective keys, with null for unbound commands.\n  amp.mcpServers\n      Model Context Protocol servers to connect to for additional tools\n  amp.network.timeout\n      How many seconds to wait for network requests to the Amp server before timing out\n  amp.notifications.enabled\n      Enable notification alerts when the agent completes tasks. Over SSH, or when AMP_FORCE_BEL is set, this sends a\n      terminal bell.\n  amp.notifications.system.enabled\n      Enable system notifications when terminal is not focused\n  amp.permissions\n      Permission rules for tool calls. See amp permissions --help\n  amp.proxy\n      Proxy URL used for both HTTP and HTTPS requests to the Amp server\n  amp.remoteThreadCreation.enabled\n      Let ampcode.com create new threads that open in the interactive Amp TUI on this machine, in the directory where it\n      was started\n  amp.showCosts\n      Set to false to hide costs while working on a thread\n  amp.skills.disableClaudeCodeSkills\n      Disable skills from .claude/skills/, ~/.claude/skills/, and ~/.claude/plugins/cache/. Local Amp skill directories,\n      custom paths, built-in skills, Personal Skills, and Workspace Skills are not affected.\n  amp.skills.path\n      Path to additional directories containing skills. Supports colon-separated paths (semicolon on Windows). Use ~ for\n      home directory.\n  amp.terminal.animation\n      Set to false to disable terminal animations (or use the equivalent NO_ANIMATION=1 env var)\n  amp.terminal.copyOnSelect\n      Automatically copy selection to clipboard.\n  amp.terminal.detailsExpandedByDefault\n      Expand thinking and tool call details by default in the CLI transcript.\n  amp.thread.autoArchiveOnQuit\n      Automatically archive open CLI threads when quitting Amp\n  amp.tools.disable\n      Array of tool names to disable. Use 'builtin:toolname' to disable only the builtin tool with that name (allowing\n      an MCP server to provide a tool by that name).\n  amp.tools.enable\n      Array of tool name patterns to enable. Supports glob patterns (e.g., 'mcp__metabase__*'). If not set, all tools\n      are enabled. If set, only matching tools are enabled.\n  amp.updates.mode\n      Control update checking behavior: \"warn\" shows update notifications, \"disabled\" turns off checking, \"auto\"\n      automatically runs update.\n\nExample configuration:\n\n{\n  \"amp.dangerouslyAllowAll\": false,\n  \"amp.defaultVisibility\": {\n    \"github.com/ampcode/amp\": \"workspace\"\n  },\n  \"amp.experimental.modes\": [],\n  \"amp.fuzzy.alwaysIncludePaths\": [],\n  \"amp.git.commit.ampThread.enabled\": true,\n  \"amp.git.commit.coauthor.enabled\": true,\n  \"amp.guardedFiles.allowlist\": [],\n  \"amp.keymap\": {},\n  \"amp.mcpServers\": {\n    \"filesystem\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"@modelcontextprotocol/server-filesystem\",\n        \"/path/to/allowed/dir\"\n      ]\n    }\n  },\n  \"amp.network.timeout\": 30,\n  \"amp.notifications.enabled\": true,\n  \"amp.notifications.system.enabled\": true,\n  \"amp.permissions\": [\n    {\n      \"tool\": \"Bash\",\n      \"action\": \"ask\",\n      \"matches\": {\n        \"cmd\": [\n          \"git push*\",\n          \"git commit*\",\n          \"git branch -D*\",\n          \"git checkout HEAD*\"\n        ]\n      }\n    }\n  ],\n  \"amp.remoteThreadCreation.enabled\": false,\n  \"amp.showCosts\": true,\n  \"amp.skills.disableClaudeCodeSkills\": false,\n  \"amp.terminal.animation\": true,\n  \"amp.terminal.copyOnSelect\": true,\n  \"amp.terminal.detailsExpandedByDefault\": false,\n  \"amp.thread.autoArchiveOnQuit\": false,\n  \"amp.tools.disable\": [\n    \"browser_navigate\",\n    \"builtin:edit_file\"\n  ],\n  \"amp.updates.mode\": \"auto\"\n}\n\n\n",
+      "stderr": "",
+      "status": 0
+    },
+    "efforts": {
+      "stdout": "",
+      "stderr": "Error: error: option '--reasoning-effort <effort>' argument 'bogus-zzz' is invalid. Allowed choices are none, minimal, low, medium, high, xhigh, max.\n",
+      "status": 1
+    }
+  }
+}
diff --git a/test/fixtures/catalog/claude.json b/test/fixtures/catalog/claude.json
new file mode 100644
index 0000000..0e28625
--- /dev/null
+++ b/test/fixtures/catalog/claude.json
@@ -0,0 +1,23 @@
+{
+  "harness": "claude",
+  "version": "2.1.265",
+  "probedFrom": "box",
+  "capturedAt": "2026-09-09T12:26:09.733Z",
+  "probes": {
+    "version": {
+      "stdout": "2.1.265 (Claude Code)\n",
+      "stderr": "",
+      "status": 0
+    },
+    "efforts": {
+      "stdout": "",
+      "stderr": "Warning: Unknown --effort value '__probe__' — ignoring it and using the default effort. Valid values: low, medium, high, xhigh, max.\nError: Input must be provided either through stdin or as a prompt argument when using --print\n",
+      "status": 1
+    },
+    "models": {
+      "stdout": "{\"anthropic\":{\"id\":\"anthropic\",\"env\":[\"ANTHROPIC_API_KEY\"],\"npm\":\"@ai-sdk/anthropic\",\"name\":\"Anthropic\",\"doc\":\"https://docs.anthropic.com/en/docs/about-claude/models\",\"models\":{\"claude-sonnet-4-6\":{\"id\":\"claude-sonnet-4-6\",\"name\":\"Claude Sonnet 4.6\",\"description\":\"Claude workhorse for coding agents, careful analysis, and production cost control\",\"family\":\"claude-sonnet\",\"attachment\":true,\"reasoning\":true,\"reasoning_options\":[{\"type\":\"effort\",\"values\":[\"low\",\"medium\",\"high\",\"max\"]},{\"type\":\"budget_tokens\",\"min\":1024}],\"tool_call\":true,\"structured_output\":true,\"temperature\":true,\"knowledge\":\"2025-08-31\",\"release_date\":\"2026-02-17\",\"last_updated\":\"2026-03-13\",\"modalities\":{\"input\":[\"text\",\"image\",\"pdf\"],\"output\":[\"text\"]},\"open_weights\":false,\"limit\":{\"context\":1000000,\"output\":128000},\"cost\":{\"input\":3,\"output\":15,\"cache_read\":0.3,\"cache_write\":3.75}},\"claude-opus-5\":{\"id\":\"claude-opus-5\",\"name\":\"Claude Opus 5\",\"description\":\"Strongest Claude Opus model for coding, agents, and professional work\",\"family\":\"claude-opus\",\"attachment\":true,\"reasoning\":true,\"reasoning_options\":[{\"type\":\"effort\",\"values\":[\"low\",\"medium\",\"high\",\"xhigh\",\"max\"]}],\"tool_call\":true,\"structured_output\":true,\"temperature\":false,\"knowledge\":\"2026-05\",\"release_date\":\"2026-07-24\",\"last_updated\":\"2026-07-24\",\"modalities\":{\"input\":[\"text\",\"image\",\"pdf\"],\"output\":[\"text\"]},\"open_weights\":false,\"limit\":{\"context\":1000000,\"output\":128000},\"experimental\":{\"modes\":{\"fast\":{\"cost\":{\"input\":10,\"output\":50,\"cache_read\":1,\"cache_write\":12.5},\"provider\":{\"body\":{\"speed\":\"fast\"},\"headers\":{\"anthropic-beta\":\"fast-mode-2026-02-01\"}}}}},\"cost\":{\"input\":5,\"output\":25,\"cache_read\":0.5,\"cache_write\":6.25}},\"claude-opus-4-5\":{\"id\":\"claude-opus-4-5\",\"name\":\"Claude Opus 4.5 (latest)\",\"description\":\"Flagship Claude model for deep reasoning, coding, and long-horizon agents\",\"family\":\"claude-opus\",\"attachment\":true,\"reasoning\":true,\"reasoning_options\":[{\"type\":\"effort\",\"values\":[\"low\",\"medium\",\"high\"]},{\"type\":\"budget_tokens\",\"min\":1024}],\"tool_call\":true,\"structured_output\":true,\"temperature\":true,\"knowledge\":\"2025-05\",\"release_date\":\"2025-11-24\",\"last_updated\":\"2025-11-24\",\"modalities\":{\"input\":[\"text\",\"image\",\"pdf\"],\"output\":[\"text\"]},\"open_weights\":false,\"limit\":{\"context\":200000,\"output\":64000},\"cost\":{\"input\":5,\"output\":25,\"cache_read\":0.5,\"cache_write\":6.25}},\"claude-fable-5-1\":{\"id\":\"claude-fable-5-1\",\"name\":\"Claude Fable 5.1\",\"description\":\"Claude model for demanding reasoning and long-horizon agentic work\",\"family\":\"claude-fable\",\"attachment\":true,\"reasoning\":true,\"reasoning_options\":[{\"type\":\"effort\",\"values\":[\"low\",\"medium\",\"high\",\"xhigh\",\"max\"]}],\"tool_call\":true,\"structured_output\":true,\"temperature\":false,\"knowledge\":\"2026-06\",\"release_date\":\"2026-09-01\",\"last_updated\":\"2026-09-01\",\"modalities\":{\"input\":[\"text\",\"image\",\"pdf\"],\"output\":[\"text\"]},\"open_weights\":false,\"limit\":{\"context\":1000000,\"output\":128000},\"cost\":{\"input\":10,\"output\":50,\"cache_read\":0.25,\"cache_write\":12.5}},\"claude-opus-4-6\":{\"id\":\"claude-opus-4-6\",\"name\":\"Claude Opus 4.6\",\"description\":\"High-end Claude for difficult coding, planning, and slower expert reasoning\",\"family\":\"claude-opus\",\"attachment\":true,\"reasoning\":true,\"reasoning_options\":[{\"type\":\"effort\",\"values\":[\"low\",\"medium\",\"high\",\"max\"]},{\"type\":\"budget_tokens\",\"min\":1024}],\"tool_call\":true,\"structured_output\":true,\"temperature\":true,\"knowledge\":\"2025-05-31\",\"release_date\":\"2026-02-04\",\"last_updated\":\"2026-03-13\",\"modalities\":{\"input\":[\"text\",\"image\",\"pdf\"],\"output\":[\"text\"]},\"open_weights\":false,\"limit\":{\"context\":1000000,\"output\":128000},\"cost\":{\"input\":5,\"output\":25,\"cache_read\":0.5,\"cache_write\":6.25}},\"claude-sonnet-4-5-20250929\":{\"id\":\"claude-sonnet-4-5-20250929\",\"name\":\"Claude Sonnet 4.5\",\"description\":\"Balanced Claude model for coding, analysis, agent workflows, and cost control\",\"family\":\"claude-sonnet\",\"attachment\":true,\"reasoning\":true,\"reasoning_options\":[{\"type\":\"budget_tokens\",\"min\":1024}],\"tool_call\":true,\"structured_output\":true,\"temperature\":true,\"knowledge\":\"2025-07-31\",\"release_date\":\"2025-09-29\",\"last_updated\":\"2025-09-29\",\"modalities\":{\"input\":[\"text\",\"image\",\"pdf\"],\"output\":[\"text\"]},\"open_weights\":false,\"limit\":{\"context\":1000000,\"output\":64000},\"cost\":{\"input\":3,\"output\":15,\"cache_read\":0.3,\"cache_write\":3.75}},\"claude-opus-4-7\":{\"id\":\"claude-opus-4-7\",\"name\":\"Claude Opus 4.7\",\"description\":\"Stronger Opus tier for advanced software work and high-stakes reasoning\",\"family\":\"claude-opus\",\"attachment\":true,\"reasoning\":true,\"reasoning_options\":[{\"type\":\"effort\",\"values\":[\"low\",\"medium\",\"high\",\"xhigh\",\"max\"]}],\"tool_call\":true,\"structured_output\":true,\"temperature\":false,\"knowledge\":\"2026-01-31\",\"release_date\":\"2026-04-14\",\"last_updated\":\"2026-04-16\",\"modalities\":{\"input\":[\"text\",\"image\",\"pdf\"],\"output\":[\"text\"]},\"open_weights\":false,\"limit\":{\"context\":1000000,\"output\":128000},\"cost\":{\"input\":5,\"output\":25,\"cache_read\":0.5,\"cache_write\":6.25}},\"claude-haiku-4-5-20251001\":{\"id\":\"claude-haiku-4-5-20251001\",\"name\":\"Claude Haiku 4.5\",\"description\":\"Fast Claude model for responsive assistance, classification, and lightweight agents\",\"family\":\"claude-haiku\",\"attachment\":true,\"reasoning\":true,\"reasoning_options\":[{\"type\":\"budget_tokens\",\"min\":1024}],\"tool_call\":true,\"structured_output\":true,\"temperature\":true,\"knowledge\":\"2025-02-28\",\"release_date\":\"2025-10-15\",\"last_updated\":\"2025-10-15\",\"modalities\":{\"input\":[\"text\",\"image\",\"pdf\"],\"output\":[\"text\"]},\"open_weights\":false,\"limit\":{\"context\":200000,\"output\":64000},\"cost\":{\"input\":1,\"output\":5,\"cache_read\":0.1,\"cache_write\":1.25}},\"claude-fable-5\":{\"id\":\"claude-fable-5\",\"name\":\"Claude Fable 5\",\"description\":\"Claude model for creative writing, analysis, and controlled agent workflows\",\"family\":\"claude-fable\",\"attachment\":true,\"reasoning\":true,\"reasoning_options\":[{\"type\":\"effort\",\"values\":[\"low\",\"medium\",\"high\",\"xhigh\",\"max\"]}],\"tool_call\":true,\"structured_output\":true,\"temperature\":false,\"release_date\":\"2026-06-07\",\"last_updated\":\"2026-06-09\",\"modalities\":{\"input\":[\"text\",\"image\",\"pdf\"],\"output\":[\"text\"]},\"open_weights\":false,\"limit\":{\"context\":1000000,\"output\":128000},\"cost\":{\"input\":10,\"output\":50,\"cache_read\":1,\"cache_write\":12.5}},\"claude-haiku-4-5\":{\"id\":\"claude-haiku-4-5\",\"name\":\"Claude Haiku 4.5 (latest)\",\"description\":\"Fast Claude lane for lightweight agents, office tasks, and responsive chat\",\"family\":\"claude-haiku\",\"attachment\":true,\"reasoning\":true,\"reasoning_options\":[{\"type\":\"budget_tokens\",\"min\":1024}],\"tool_call\":true,\"structured_output\":true,\"temperature\":true,\"knowledge\":\"2025-02-28\",\"release_date\":\"2025-10-15\",\"last_updated\":\"2025-10-15\",\"modalities\":{\"input\":[\"text\",\"image\",\"pdf\"],\"output\":[\"text\"]},\"open_weights\":false,\"limit\":{\"context\":200000,\"output\":64000},\"cost\":{\"input\":1,\"output\":5,\"cache_read\":0.1,\"cache_write\":1.25}},\"claude-sonnet-4-5\":{\"id\":\"claude-sonnet-4-5\",\"name\":\"Claude Sonnet 4.5 (latest)\",\"description\":\"Balanced Claude model for coding, analysis, agent workflows, and cost control\",\"family\":\"claude-sonnet\",\"attachment\":true,\"reasoning\":true,\"reasoning_options\":[{\"type\":\"budget_tokens\",\"min\":1024}],\"tool_call\":true,\"structured_output\":true,\"temperature\":true,\"knowledge\":\"2025-07-31\",\"release_date\":\"2025-09-29\",\"last_updated\":\"2025-09-29\",\"modalities\":{\"input\":[\"text\",\"image\",\"pdf\"],\"output\":[\"text\"]},\"open_weights\":false,\"limit\":{\"context\":1000000,\"output\":64000},\"cost\":{\"input\":3,\"output\":15,\"cache_read\":0.3,\"cache_write\":3.75}},\"claude-opus-4-8\":{\"id\":\"claude-opus-4-8\",\"name\":\"Claude Opus 4.8\",\"description\":\"Top Claude Opus tier for the hardest reasoning, coding, and long-horizon agents\",\"family\":\"claude-opus\",\"attachment\":true,\"reasoning\":true,\"reasoning_options\":[{\"type\":\"effort\",\"values\":[\"low\",\"medium\",\"high\",\"xhigh\",\"max\"]}],\"tool_call\":true,\"structured_output\":true,\"temperature\":false,\"knowledge\":\"2026-01\",\"release_date\":\"2026-05-28\",\"last_updated\":\"2026-05-28\",\"modalities\":{\"input\":[\"text\",\"image\",\"pdf\"],\"output\":[\"text\"]},\"open_weights\":false,\"limit\":{\"context\":1000000,\"output\":128000},\"experimental\":{\"modes\":{\"fast\":{\"cost\":{\"input\":10,\"output\":50,\"cache_read\":1,\"cache_write\":12.5},\"provider\":{\"body\":{\"speed\":\"fast\"},\"headers\":{\"anthropic-beta\":\"fast-mode-2026-02-01\"}}}}},\"cost\":{\"input\":5,\"output\":25,\"cache_read\":0.5,\"cache_write\":6.25}},\"claude-sonnet-5\":{\"id\":\"claude-sonnet-5\",\"name\":\"Claude Sonnet 5\",\"description\":\"Everyday Claude agent model for coding, planning, browsing, and general work\",\"family\":\"claude-sonnet\",\"attachment\":true,\"reasoning\":true,\"reasoning_options\":[{\"type\":\"toggle\"},{\"type\":\"effort\",\"values\":[\"low\",\"medium\",\"high\",\"xhigh\",\"max\"]}],\"tool_call\":true,\"structured_output\":true,\"temperature\":false,\"knowledge\":\"2026-01-31\",\"release_date\":\"2026-06-29\",\"last_updated\":\"2026-06-30\",\"modalities\":{\"input\":[\"text\",\"image\",\"pdf\"],\"output\":[\"text\"]},\"open_weights\":false,\"limit\":{\"context\":1000000,\"output\":128000},\"cost\":{\"input\":2,\"output\":10,\"cache_read\":0.2,\"cache_write\":2.5}},\"claude-opus-4-5-20251101\":{\"id\":\"claude-opus-4-5-20251101\",\"name\":\"Claude Opus 4.5\",\"description\":\"Flagship Claude model for deep reasoning, coding, and long-horizon agents\",\"family\":\"claude-opus\",\"attachment\":true,\"reasoning\":true,\"reasoning_options\":[{\"type\":\"effort\",\"values\":[\"low\",\"medium\",\"high\"]},{\"type\":\"budget_tokens\",\"min\":1024}],\"tool_call\":true,\"structured_output\":true,\"temperature\":true,\"knowledge\":\"2025-05\",\"release_date\":\"2025-11-24\",\"last_updated\":\"2025-11-01\",\"modalities\":{\"input\":[\"text\",\"image\",\"pdf\"],\"output\":[\"text\"]},\"open_weights\":false,\"limit\":{\"context\":200000,\"output\":64000},\"cost\":{\"input\":5,\"output\":25,\"cache_read\":0.5,\"cache_write\":6.25}}}}}",
+      "stderr": "",
+      "status": 200
+    }
+  }
+}
diff --git a/test/fixtures/catalog/codex.json b/test/fixtures/catalog/codex.json
new file mode 100644
index 0000000..93c92aa
--- /dev/null
+++ b/test/fixtures/catalog/codex.json
@@ -0,0 +1,18 @@
+{
+  "harness": "codex",
+  "version": "0.153.4",
+  "probedFrom": "box",
+  "capturedAt": "2026-09-09T12:26:09.733Z",
+  "probes": {
+    "version": {
+      "stdout": "codex-cli 0.153.4\n",
+      "stderr": "",
+      "status": 0
+    },
+    "catalog": {
+      "stdout": "{\"models\":[{\"slug\":\"gpt-6-astra\",\"visibility\":\"list\",\"default_reasoning_level\":\"low\",\"supported_reasoning_levels\":[{\"effort\":\"low\"},{\"effort\":\"medium\"},{\"effort\":\"high\"},{\"effort\":\"xhigh\"},{\"effort\":\"max\"},{\"effort\":\"ultra\"}]},{\"slug\":\"gpt-5.6-sol\",\"visibility\":\"list\",\"default_reasoning_level\":\"low\",\"supported_reasoning_levels\":[{\"effort\":\"low\"},{\"effort\":\"medium\"},{\"effort\":\"high\"},{\"effort\":\"xhigh\"},{\"effort\":\"max\"},{\"effort\":\"ultra\"}]},{\"slug\":\"gpt-5.6-terra\",\"visibility\":\"list\",\"default_reasoning_level\":\"medium\",\"supported_reasoning_levels\":[{\"effort\":\"low\"},{\"effort\":\"medium\"},{\"effort\":\"high\"},{\"effort\":\"xhigh\"},{\"effort\":\"max\"},{\"effort\":\"ultra\"}]},{\"slug\":\"gpt-5.6-luna\",\"visibility\":\"list\",\"default_reasoning_level\":\"medium\",\"supported_reasoning_levels\":[{\"effort\":\"low\"},{\"effort\":\"medium\"},{\"effort\":\"high\"},{\"effort\":\"xhigh\"},{\"effort\":\"max\"}]},{\"slug\":\"gpt-daybreak-blue-latest\",\"visibility\":\"hide\",\"default_reasoning_level\":\"low\",\"supported_reasoning_levels\":[{\"effort\":\"low\"},{\"effort\":\"medium\"},{\"effort\":\"high\"},{\"effort\":\"xhigh\"},{\"effort\":\"max\"},{\"effort\":\"ultra\"}]},{\"slug\":\"gpt-daybreak-red-latest\",\"visibility\":\"hide\",\"default_reasoning_level\":\"medium\",\"supported_reasoning_levels\":[{\"effort\":\"low\"},{\"effort\":\"medium\"},{\"effort\":\"high\"},{\"effort\":\"xhigh\"},{\"effort\":\"max\"},{\"effort\":\"ultra\"}]},{\"slug\":\"gpt-5.5\",\"visibility\":\"list\",\"default_reasoning_level\":\"medium\",\"supported_reasoning_levels\":[{\"effort\":\"low\"},{\"effort\":\"medium\"},{\"effort\":\"high\"},{\"effort\":\"xhigh\"}]},{\"slug\":\"gpt-5.4\",\"visibility\":\"hide\",\"default_reasoning_level\":\"medium\",\"supported_reasoning_levels\":[{\"effort\":\"low\"},{\"effort\":\"medium\"},{\"effort\":\"high\"},{\"effort\":\"xhigh\"}]},{\"slug\":\"gpt-5.4-mini\",\"visibility\":\"hide\",\"default_reasoning_level\":\"medium\",\"supported_reasoning_levels\":[{\"effort\":\"low\"},{\"effort\":\"medium\"},{\"effort\":\"high\"},{\"effort\":\"xhigh\"}]},{\"slug\":\"gpt-5.2\",\"visibility\":\"list\",\"default_reasoning_level\":\"medium\",\"supported_reasoning_levels\":[{\"effort\":\"low\"},{\"effort\":\"medium\"},{\"effort\":\"high\"},{\"effort\":\"xhigh\"}]},{\"slug\":\"codex-auto-review\",\"visibility\":\"hide\",\"default_reasoning_level\":\"medium\",\"supported_reasoning_levels\":[{\"effort\":\"low\"},{\"effort\":\"medium\"},{\"effort\":\"high\"},{\"effort\":\"xhigh\"},{\"effort\":\"max\"}]}]}",
+      "stderr": "",
+      "status": 0
+    }
+  }
+}
diff --git a/test/fixtures/catalog/droid.json b/test/fixtures/catalog/droid.json
new file mode 100644
index 0000000..8bffafd
--- /dev/null
+++ b/test/fixtures/catalog/droid.json
@@ -0,0 +1,28 @@
+{
+  "harness": "droid",
+  "version": "0.213.0",
+  "probedFrom": "box",
+  "capturedAt": "2026-09-09T12:26:09.733Z",
+  "probes": {
+    "version": {
+      "stdout": "0.213.0\n",
+      "stderr": "",
+      "status": 0
+    },
+    "catalog": {
+      "stdout": "{\"type\":\"response\",\"result\":{\"availableModels\":[{\"id\":\"auto\",\"supportedReasoningEfforts\":[\"none\"],\"defaultReasoningEffort\":\"none\",\"deprecated\":false},{\"id\":\"claude-fable-5.1\",\"supportedReasoningEfforts\":[\"off\",\"low\",\"medium\",\"high\",\"xhigh\",\"max\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"claude-fable-5\",\"supportedReasoningEfforts\":[\"off\",\"low\",\"medium\",\"high\",\"xhigh\",\"max\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"claude-opus-5\",\"supportedReasoningEfforts\":[\"off\",\"low\",\"medium\",\"high\",\"xhigh\",\"max\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"claude-opus-5-fast\",\"supportedReasoningEfforts\":[\"off\",\"low\",\"medium\",\"high\",\"xhigh\",\"max\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"claude-opus-4-8\",\"supportedReasoningEfforts\":[\"off\",\"low\",\"medium\",\"high\",\"xhigh\",\"max\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"claude-opus-4-8-fast\",\"supportedReasoningEfforts\":[\"off\",\"low\",\"medium\",\"high\",\"xhigh\",\"max\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"claude-opus-4-7\",\"supportedReasoningEfforts\":[\"off\",\"low\",\"medium\",\"high\",\"xhigh\",\"max\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"claude-opus-4-6\",\"supportedReasoningEfforts\":[\"off\",\"low\",\"medium\",\"high\",\"max\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"claude-opus-4-5-20251101\",\"supportedReasoningEfforts\":[\"off\",\"low\",\"medium\",\"high\"],\"defaultReasoningEffort\":\"off\",\"deprecated\":false},{\"id\":\"claude-sonnet-5\",\"supportedReasoningEfforts\":[\"off\",\"low\",\"medium\",\"high\",\"xhigh\",\"max\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"claude-sonnet-4-6\",\"supportedReasoningEfforts\":[\"off\",\"low\",\"medium\",\"high\",\"max\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"claude-sonnet-4-5-20250929\",\"supportedReasoningEfforts\":[\"off\",\"low\",\"medium\",\"high\"],\"defaultReasoningEffort\":\"off\",\"deprecated\":false},{\"id\":\"claude-haiku-4-5-20251001\",\"supportedReasoningEfforts\":[\"off\",\"low\",\"medium\",\"high\"],\"defaultReasoningEffort\":\"off\",\"deprecated\":false},{\"id\":\"gpt-6-astra\",\"supportedReasoningEfforts\":[\"low\",\"medium\",\"high\",\"xhigh\",\"max\"],\"defaultReasoningEffort\":\"medium\",\"deprecated\":false},{\"id\":\"gpt-5.6-sol\",\"supportedReasoningEfforts\":[\"none\",\"low\",\"medium\",\"high\",\"xhigh\",\"max\"],\"defaultReasoningEffort\":\"medium\",\"deprecated\":false},{\"id\":\"gpt-5.6-sol-fast\",\"supportedReasoningEfforts\":[\"none\",\"low\",\"medium\",\"high\",\"xhigh\",\"max\"],\"defaultReasoningEffort\":\"medium\",\"deprecated\":false},{\"id\":\"gpt-5.6-terra\",\"supportedReasoningEfforts\":[\"none\",\"low\",\"medium\",\"high\",\"xhigh\",\"max\"],\"defaultReasoningEffort\":\"medium\",\"deprecated\":false},{\"id\":\"gpt-5.6-luna\",\"supportedReasoningEfforts\":[\"none\",\"low\",\"medium\",\"high\",\"xhigh\",\"max\"],\"defaultReasoningEffort\":\"medium\",\"deprecated\":false},{\"id\":\"gpt-5.5\",\"supportedReasoningEfforts\":[\"low\",\"medium\",\"high\",\"xhigh\"],\"defaultReasoningEffort\":\"medium\",\"deprecated\":false},{\"id\":\"gpt-5.5-fast\",\"supportedReasoningEfforts\":[\"low\",\"medium\",\"high\",\"xhigh\"],\"defaultReasoningEffort\":\"medium\",\"deprecated\":false},{\"id\":\"gpt-5.5-pro\",\"supportedReasoningEfforts\":[\"medium\",\"high\",\"xhigh\"],\"defaultReasoningEffort\":\"medium\",\"deprecated\":false},{\"id\":\"gpt-5.4\",\"supportedReasoningEfforts\":[\"low\",\"medium\",\"high\",\"xhigh\"],\"defaultReasoningEffort\":\"medium\",\"deprecated\":false},{\"id\":\"gpt-5.4-fast\",\"supportedReasoningEfforts\":[\"low\",\"medium\",\"high\",\"xhigh\"],\"defaultReasoningEffort\":\"medium\",\"deprecated\":false},{\"id\":\"gpt-5.4-mini\",\"supportedReasoningEfforts\":[\"low\",\"medium\",\"high\",\"xhigh\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"gpt-5.4-mini-fast\",\"supportedReasoningEfforts\":[\"low\",\"medium\",\"high\",\"xhigh\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"gpt-5.3-codex\",\"supportedReasoningEfforts\":[\"low\",\"medium\",\"high\",\"xhigh\"],\"defaultReasoningEffort\":\"medium\",\"deprecated\":false},{\"id\":\"gpt-5.3-codex-fast\",\"supportedReasoningEfforts\":[\"low\",\"medium\",\"high\",\"xhigh\"],\"defaultReasoningEffort\":\"medium\",\"deprecated\":false},{\"id\":\"gpt-5.2\",\"supportedReasoningEfforts\":[\"off\",\"low\",\"medium\",\"high\",\"xhigh\"],\"defaultReasoningEffort\":\"low\",\"deprecated\":false},{\"id\":\"gemini-3.1-pro-preview\",\"supportedReasoningEfforts\":[\"low\",\"medium\",\"high\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"gemini-3.8-flash\",\"supportedReasoningEfforts\":[\"low\",\"medium\",\"high\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"gemini-3.7-flash\",\"supportedReasoningEfforts\":[\"low\",\"medium\",\"high\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"gemini-3.6-flash\",\"supportedReasoningEfforts\":[\"low\",\"medium\",\"high\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"gemini-3.5-flash\",\"supportedReasoningEfforts\":[\"minimal\",\"low\",\"medium\",\"high\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"gemini-3-flash-preview\",\"supportedReasoningEfforts\":[\"minimal\",\"low\",\"medium\",\"high\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"inkling\",\"supportedReasoningEfforts\":[\"off\",\"minimal\",\"low\",\"medium\",\"high\",\"xhigh\",\"max\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"glm-5.3-flash\",\"supportedReasoningEfforts\":[\"low\",\"high\",\"max\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"glm-5.3\",\"supportedReasoningEfforts\":[\"low\",\"high\",\"max\"],\"defaultReasoningEffort\":\"max\",\"deprecated\":false},{\"id\":\"glm-5.2\",\"supportedReasoningEfforts\":[\"off\",\"high\",\"max\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"glm-5.2-fast\",\"supportedReasoningEfforts\":[\"off\",\"high\",\"max\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"kimi-k3\",\"supportedReasoningEfforts\":[\"off\",\"low\",\"high\",\"max\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"kimi-k2.7-code\",\"supportedReasoningEfforts\":[\"off\",\"high\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"kimi-k2.6\",\"supportedReasoningEfforts\":[\"off\",\"high\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"nemotron-3-ultra\",\"supportedReasoningEfforts\":[\"off\",\"high\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"deepseek-v4-flash-0731\",\"supportedReasoningEfforts\":[\"off\",\"low\",\"high\",\"max\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"deepseek-v4-pro\",\"supportedReasoningEfforts\":[\"off\",\"low\",\"high\",\"max\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"minimax-m3\",\"supportedReasoningEfforts\":[\"high\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"grok-4.6\",\"supportedReasoningEfforts\":[\"low\",\"medium\",\"high\",\"xhigh\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"grok-4.5\",\"supportedReasoningEfforts\":[\"low\",\"medium\",\"high\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":false},{\"id\":\"minimax-m2.7\",\"supportedReasoningEfforts\":[\"high\"],\"defaultReasoningEffort\":\"high\",\"deprecated\":true}]}}",
+      "stderr": "",
+      "status": 0
+    },
+    "efforts": {
+      "stdout": "",
+      "stderr": "Unsupported reasoning effort provided\nAllowed values: none, dynamic, off, minimal, low, medium, high, xhigh, max\nInvalid enum value. Expected 'none' | 'dynamic' | 'off' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh' | 'max', received '__bogus__'\n",
+      "status": 1
+    },
+    "models": {
+      "stdout": "",
+      "stderr": "Invalid model: __bogus__\n\nAvailable built-in models:\n  auto, claude-fable-5.1, claude-fable-5, claude-opus-5, claude-opus-5-fast, claude-opus-4-8, claude-opus-4-8-fast, claude-opus-4-7, claude-opus-4-6, claude-opus-4-5-20251101, claude-sonnet-5, claude-sonnet-4-6, claude-sonnet-4-5-20250929, claude-haiku-4-5-20251001, gpt-6-astra, gpt-5.6-sol, gpt-5.6-sol-fast, gpt-5.6-terra, gpt-5.6-luna, gpt-5.5, gpt-5.5-fast, gpt-5.5-pro, gpt-5.4, gpt-5.4-fast, gpt-5.4-mini, gpt-5.4-mini-fast, gpt-5.3-codex, gpt-5.3-codex-fast, gpt-5.2, gemini-3.1-pro-preview, gemini-3.8-flash, gemini-3.7-flash, gemini-3.6-flash, gemini-3.5-flash, gemini-3-flash-preview, inkling, glm-5.3-flash, glm-5.3, glm-5.2, glm-5.2-fast, kimi-k3, kimi-k2.7-code, kimi-k2.6, nemotron-3-ultra, deepseek-v4-flash-0731, deepseek-v4-pro, minimax-m3, grok-4.6, grok-4.5, minimax-m2.7\n\nNo custom models configured. Add them to ~/.factory/settings.json\nInvalid model: __bogus__\n\nAvailable built-in models:\n  auto, claude-fable-5.1, claude-fable-5, claude-opus-5, claude-opus-5-fast, claude-opus-4-8, claude-opus-4-8-fast, claude-opus-4-7, claude-opus-4-6, claude-opus-4-5-20251101, claude-sonnet-5, claude-sonnet-4-6, claude-sonnet-4-5-20250929, claude-haiku-4-5-20251001, gpt-6-astra, gpt-5.6-sol, gpt-5.6-sol-fast, gpt-5.6-terra, gpt-5.6-luna, gpt-5.5, gpt-5.5-fast, gpt-5.5-pro, gpt-5.4, gpt-5.4-fast, gpt-5.4-mini, gpt-5.4-mini-fast, gpt-5.3-codex, gpt-5.3-codex-fast, gpt-5.2, gemini-3.1-pro-preview, gemini-3.8-flash, gemini-3.7-flash, gemini-3.6-flash, gemini-3.5-flash, gemini-3-flash-preview, inkling, glm-5.3-flash, glm-5.3, glm-5.2, glm-5.2-fast, kimi-k3, kimi-k2.7-code, kimi-k2.6, nemotron-3-ultra, deepseek-v4-flash-0731, deepseek-v4-pro, minimax-m3, grok-4.6, grok-4.5, minimax-m2.7\n\nNo custom models configured. Add them to ~/.factory/settings.json\n",
+      "status": 1
+    }
+  }
+}
diff --git a/test/fixtures/catalog/grok.json b/test/fixtures/catalog/grok.json
new file mode 100644
index 0000000..a8ff8d8
--- /dev/null
+++ b/test/fixtures/catalog/grok.json
@@ -0,0 +1,28 @@
+{
+  "harness": "grok",
+  "version": "1.0.5",
+  "probedFrom": "box",
+  "capturedAt": "2026-09-09T12:26:09.733Z",
+  "probes": {
+    "version": {
+      "stdout": "grok 1.0.5 (5115b46bc9)\n",
+      "stderr": "",
+      "status": 0
+    },
+    "models": {
+      "stdout": "You are logged in with grok.com.\n\nDefault model: grok-4.6\n\nAvailable models:\n  * grok-4.6 (default)\n  - grok-4.5\n",
+      "stderr": "",
+      "status": 0
+    },
+    "cache": {
+      "stdout": "{\n  \"fetched_at\": \"2026-09-09T12:26:11.344028749Z\",\n  \"grok_version\": \"1.0.5\",\n  \"auth_method\": \"session\",\n  \"origin\": \"https://cli-chat-proxy.grok.com/v1/models\",\n  \"etag\": \"W/\\\"17945962175790342248\\\"\",\n  \"models\": {\n    \"grok-4.6\": {\n      \"info\": {\n        \"id\": \"grok-4.6\",\n        \"model\": \"grok-4.6\",\n        \"model_family\": \"xai\",\n        \"base_url\": \"https://cli-chat-proxy.grok.com/v1\",\n        \"name\": \"Grok 4.6\",\n        \"description\": \"SpaceXAI's latest frontier model\",\n        \"max_completion_tokens\": null,\n        \"temperature\": null,\n        \"top_p\": null,\n        \"api_backend\": \"responses\",\n        \"auth_scheme\": \"bearer\",\n        \"extra_headers\": {},\n        \"context_window\": 500000,\n        \"auto_compact_threshold_percent\": 80,\n        \"system_prompt_label\": \"Grok 4.6\",\n        \"use_concise\": false,\n        \"agent_type\": \"grok-build-plan\",\n        \"inference_idle_timeout_secs\": null,\n        \"max_retries\": null,\n        \"hidden\": false,\n        \"supported_in_api\": true,\n        \"reasoning_effort\": \"high\",\n        \"supports_reasoning_effort\": true,\n        \"reasoning_efforts\": [\n          {\n            \"id\": \"xhigh\",\n            \"value\": \"xhigh\",\n            \"label\": \"Extra High Effort\",\n            \"description\": \"Highest effort and reasoning level\",\n            \"default\": false\n          },\n          {\n            \"id\": \"high\",\n            \"value\": \"high\",\n            \"label\": \"High Effort\",\n            \"description\": \"Higher implementation quality with extensive reasoning\",\n            \"default\": true\n          },\n          {\n            \"id\": \"medium\",\n            \"value\": \"medium\",\n            \"label\": \"Medium Effort\",\n            \"description\": \"Balanced effort with standard implementation and testing\",\n            \"default\": false\n          },\n          {\n            \"id\": \"low\",\n            \"value\": \"low\",\n            \"label\": \"Low Effort\",\n            \"description\": \"Quick, fast implementations\",\n            \"default\": false\n          }\n        ],\n        \"supports_backend_search\": true,\n        \"compactions_remaining\": 1,\n        \"compaction_at_tokens\": true,\n        \"show_model_fingerprint\": false,\n        \"stream_tool_calls\": null,\n        \"laziness_detector\": {\n          \"enabled\": false,\n          \"max_nudges_per_session\": 0,\n          \"idle_threshold_ms\": null,\n          \"min_confidence\": null,\n          \"include_reasoning\": null\n        }\n      },\n      \"api_key\": null,\n      \"env_key\": null,\n      \"api_base_url\": null\n    },\n    \"grok-4.5\": {\n      \"info\": {\n        \"id\": \"grok-4.5\",\n        \"model\": \"grok-4.5\",\n        \"model_family\": \"xai\",\n        \"base_url\": \"https://cli-chat-proxy.grok.com/v1\",\n        \"name\": \"Grok 4.5\",\n        \"description\": null,\n        \"max_completion_tokens\": null,\n        \"temperature\": null,\n        \"top_p\": null,\n        \"api_backend\": \"responses\",\n        \"auth_scheme\": \"bearer\",\n        \"extra_headers\": {},\n        \"context_window\": 500000,\n        \"auto_compact_threshold_percent\": 80,\n        \"system_prompt_label\": \"Grok 4.5\",\n        \"use_concise\": false,\n        \"agent_type\": \"grok-build-plan\",\n        \"inference_idle_timeout_secs\": null,\n        \"max_retries\": null,\n        \"hidden\": false,\n        \"supported_in_api\": true,\n        \"reasoning_effort\": \"high\",\n        \"supports_reasoning_effort\": true,\n        \"reasoning_efforts\": [\n          {\n            \"id\": \"high\",\n            \"value\": \"high\",\n            \"label\": \"High Effort\",\n            \"description\": \"Highest implementation quality with extensive reasoning\",\n            \"default\": true\n          },\n          {\n            \"id\": \"medium\",\n            \"value\": \"medium\",\n            \"label\": \"Medium Effort\",\n            \"description\": \"Balanced effort with standard implementation and testing\",\n            \"default\": false\n          },\n          {\n            \"id\": \"low\",\n            \"value\": \"low\",\n            \"label\": \"Low Effort\",\n            \"description\": \"Quick, fast implementations\",\n            \"default\": false\n          }\n        ],\n        \"supports_backend_search\": true,\n        \"compactions_remaining\": 1,\n        \"compaction_at_tokens\": true,\n        \"show_model_fingerprint\": false,\n        \"stream_tool_calls\": null,\n        \"laziness_detector\": {\n          \"enabled\": false,\n          \"max_nudges_per_session\": 0,\n          \"idle_threshold_ms\": null,\n          \"min_confidence\": null,\n          \"include_reasoning\": null\n        }\n      },\n      \"api_key\": null,\n      \"env_key\": null,\n      \"api_base_url\": null\n    }\n  }\n}",
+      "stderr": "",
+      "status": 0
+    },
+    "efforts": {
+      "stdout": "",
+      "stderr": "--effort/--reasoning-effort: unknown effort level '__probe__'; use one of: xhigh, high, medium, low\nError: --effort/--reasoning-effort: unknown effort level '__probe__'; use one of: xhigh, high, medium, low\n",
+      "status": 1
+    }
+  }
+}
diff --git a/test/fixtures/catalog/muse.json b/test/fixtures/catalog/muse.json
new file mode 100644
index 0000000..0d50a33
--- /dev/null
+++ b/test/fixtures/catalog/muse.json
@@ -0,0 +1,23 @@
+{
+  "harness": "muse",
+  "version": "0.2.1",
+  "probedFrom": "box",
+  "capturedAt": "2026-09-09T12:26:09.733Z",
+  "probes": {
+    "version": {
+      "stdout": "Muse Code 0.2.1 (0.2.1-R1215.1)\n",
+      "stderr": "",
+      "status": 0
+    },
+    "help": {
+      "stdout": "muse exec — run one prompt non-interactively (headless)\n\nUsage: muse exec [OPTIONS] [PROMPT]\n\nOptions:\n      --json\n          Emit machine-readable JSONL events on stdout\n      --prompt-file <PATH>\n          Read the prompt from a file instead of an argument\n      --api-key-stdin\n          Read the provider API key from stdin\n      --provider <MODE>\n          Startup provider: echo or meta (default: meta)\n      --preset <NAME>\n          Run a built-in preset: native-basic, miniswe\n      --model <ID>\n          Model id for non-echo providers\n      --reasoning-effort <EFFORT>\n          Meta reasoning effort: none|minimal|low|medium|high|xhigh|ultra\n          (default: high)\n      --parallel-tool-calls\n          Enable Meta API parallel tool calls\n      --no-parallel-tool-calls\n          Disable Meta API parallel tool calls\n      --base-url <URL>\n          Override the provider base URL\n      --image <PATH>\n          Attach a local image file (repeatable)\n      --workspace <PATH>\n          Root policy-gated workspace tools at PATH\n  -w, --worktree [<MODE>]\n          Session git worktree: off|create|existing\n      --worktree-base <REF>\n          Base ref for --worktree create (default: HEAD)\n      --worktree-existing <PATH>\n          Existing worktree path for --worktree existing\n      --context-compaction-strategy <ID>\n          Context compaction strategy: summary-preserved-suffix/v1,\n          prefix-extension-summary/v1, prefix-extension-inventory-summary/v1\n      --context-compaction-soft-threshold <FRAC>\n          Soft compaction threshold\n      --context-compaction-hard-threshold <FRAC>\n          Hard compaction threshold\n      --max-model-steps <N>\n          Cap the number of model steps\n      --max-tool-output-bytes <N>\n          Cap tool output bytes fed back to the model\n      --session-id <UUID>\n          Use a specific session id\n      --allow-workspace-switch\n          Allow switching the workspace mid-run\n      --user-input-auto-resolve\n          Offer request_user_input and auto-cancel prompts (headless)\n      --subagent-worktree-isolation\n          Compatibility flag; capability defaults on. Only an affirmative\n          per-child request asks for isolation; omission stays shared. Requests\n          may reject when capability, provider, or Git prerequisites are\n          unavailable.\n      --disable-web-tools\n          Disable web tools for this run\n      --expand-file-mentions\n          Expand @file mentions in this run\n      --no-foreign-personal-context\n          Exclude foreign personal rules and skills from this run\n      --no-session-log\n          Do not persist session event logs to disk\n  -h, --help\n          Print this help\n\nSafety (approval and the sandbox are ON by default):\n      --yolo\n          Disable approval and sandbox and trust this workspace (this run)\n      --trust-workspace\n          Load this workspace's skills and rules (this run)\n      --disable-approval\n          Disable tool approval prompts for this run\n      --disable-sandbox\n          Disable shell filesystem/network sandboxing for this run\n      --sandbox-network <MODE>\n          Sandbox network mode (default: proxy-only)\n      --disable-write\n          Disable non-shell workspace filesystem writes\n      --disable-shell\n          Disable workspace shell execution\n      --enable-shell-tool\n          Use the legacy shell tool instead of the managed platform shell\n\n",
+      "stderr": "",
+      "status": 0
+    },
+    "oracle": {
+      "stdout": "",
+      "stderr": "invalid TUI options: error: invalid value '__bogus__' for '--reasoning-effort <REASONING_EFFORT>': unsupported reasoning effort `__bogus__`; expected none|minimal|low|medium|high|xhigh|ultra\nmuse — interactive terminal coding agent\n\nIf no subcommand is given, options run the interactive TUI; pass a prompt to start\na session, or use a command below.\n\nUsage: muse [OPTIONS] [PROMPT]\n       muse [OPTIONS] <COMMAND>\n\nCommands:\n  resume           Resume a previous session (--last or <session-uuid>)\n  exec             Run one prompt non-interactively (headless)\n  config           Validate enterprise configuration documents\n  export           Export a session transcript to a file\n  trace            Inspect a recorded session or run trace\n  skills           List, inspect, enable, or disable skills\n  sandbox          Check or set up the OS sandbox\n  session-message  Send or serve cross-session messages\n  auth             Store provider API credentials\n  login            Log in to a provider\n  logout           Remove stored provider credentials\n  init             Scaffold agent config in this workspace\n\nOptions:\n  -h, --help\n          Print help\n  -V, --version\n          Print version\n      --agents <JSON>\n          Supply one ephemeral agent-definition overlay\n      --provider <MODE>\n          Startup provider: echo or meta (default: meta)\n      --preset <NAME>\n          Run a built-in preset: native-basic, miniswe\n      --model <MODEL>\n          Model id for non-echo providers\n      --reasoning-effort <EFFORT>\n          Meta reasoning effort: none|minimal|low|medium|high|xhigh|ultra\n          (default: high)\n      --base-url <URL>\n          Override the Meta provider base URL\n      --image <PATH>\n          Attach a local image file to the next submitted prompt\n      --workspace <PATH>\n          Register policy-gated workspace tools rooted at PATH\n  -w, --worktree [<MODE>]\n          Session Git worktree: off|create|existing; a bare -w means create\n          (default: off)\n      --worktree-base <REF>\n          Base ref for --worktree create (default: HEAD)\n      --worktree-existing <PATH>\n          Existing worktree path for --worktree existing\n      --parallel-tool-calls\n          Enable Meta API parallel tool calls\n      --no-parallel-tool-calls\n          Disable Meta API parallel tool calls\n      --subagent-worktree-isolation\n          Compatibility flag; capability defaults on. Only an affirmative\n          per-child request asks for isolation; omission stays shared. Requests\n          may reject when capability, provider, or Git prerequisites are\n          unavailable.\n      --approval-mode <MODE>\n          Tool approval mode: untrusted|on-request|never (default: on-request)\n      --approval-judge <off|on>\n          LLM approval judge for Prompt-bound calls (default: on)\n      --no-session-log\n          Do not persist session event logs to disk\n      --echo-delay-ms <MS>\n          Deterministic echo reply delay (echo provider only)\n\nSafety (approval and the sandbox are ON by default):\n      --yolo\n          Disable approval and sandboxing and trust this workspace for this run\n      --trust-workspace\n          Trust this workspace for this run (load its skills and rules); does\n          not save trust\n      --disable-approval\n          Disable tool approval prompts for this workspace run\n      --disable-sandbox\n          Disable shell filesystem/network sandboxing for this run\n      --sandbox-network <MODE>\n          Sandbox network mode: restricted|enabled|proxy-only (default:\n          proxy-only)\n      --disable-write\n          Disable non-shell workspace filesystem writes\n      --disable-shell\n          Disable workspace shell execution\n      --enable-shell-tool\n          Use the legacy shell tool instead of the managed platform shell\n\nRun `muse <command> --help` for command-specific options.\n\n",
+      "status": 2
+    }
+  }
+}
diff --git a/test/fixtures/catalog/opencode.json b/test/fixtures/catalog/opencode.json
new file mode 100644
index 0000000..fcc0c18
--- /dev/null
+++ b/test/fixtures/catalog/opencode.json
@@ -0,0 +1,13 @@
+{
+  "harness": "opencode",
+  "version": "1.18.18",
+  "probedFrom": "box",
+  "capturedAt": "2026-09-09T12:26:09.733Z",
+  "probes": {
+    "version": {
+      "stdout": "1.18.18\n",
+      "stderr": "",
+      "status": 0
+    }
+  }
+}
diff --git a/test/fixtures/catalog/prime.json b/test/fixtures/catalog/prime.json
new file mode 100644
index 0000000..aa7034e
--- /dev/null
+++ b/test/fixtures/catalog/prime.json
@@ -0,0 +1,23 @@
+{
+  "harness": "prime",
+  "version": "0.7.0",
+  "probedFrom": "box",
+  "capturedAt": "2026-09-09T12:26:09.733Z",
+  "probes": {
+    "version": {
+      "stdout": "",
+      "stderr": "0.7.0\n",
+      "status": 0
+    },
+    "help": {
+      "stdout": "",
+      "stderr": "prime-agent - AI coding assistant with an IPython tool\n\nUsage:\n  prime-agent [options] [@files...] [message...]\n  prime-agent <command> [args...]\n\nOptions:\nRun options:\n  -p, --print                        Print a response and exit\n  --mode <text|json|rpc|acp|daemon>  Select the output mode (default: text)\n  --cwd <dir>                        Use a specific working directory\n  --offline                          Disable startup network operations\n  --verbose                          Force verbose startup\n  --daemon-socket <path>             Use a specific daemon socket\n\nModel options:\n  --provider <name>    Select a model provider\n  --model <id>         Select a model\n  --api-key <key>      Use an API key for this run\n  --models <patterns>  Set comma-separated models for cycling\n  --thinking <level>   Set reasoning: off, minimal, low, medium, high, xhigh, max\n\nSession options:\n  -c, --continue           Continue the previous session\n  -r, --resume <path|id>   Resume a saved session\n  --fork <path|id>         Fork a saved session into a new session\n  --session-dir <dir>      Use a custom session directory\n  --no-session             Do not save the session\n  --goal <objective>       Seed a persistent goal for a new root session\n  --goal-token-budget <n>  Set a positive token budget for --goal\n\nTool and resource options:\n  -t, --tools <list>          Allowlist comma-separated tool names\n  -nt, --no-tools             Disable all tools by default\n  -nbt, --no-builtin-tools    Disable built-in tools by default\n  -e, --extension <source>    Load an extension (repeatable)\n  -ne, --no-extensions        Disable extension discovery\n  --skill <path>              Load a skill (repeatable)\n  -ns, --no-skills            Disable skill discovery\n  --prompt-template <path>    Load a prompt template (repeatable)\n  -np, --no-prompt-templates  Disable prompt template discovery\n  --theme <path>              Load a theme (repeatable)\n  --no-themes                 Disable theme discovery\n  -nc, --no-context-files     Disable AGENTS.md and CLAUDE.md discovery\n\nPrompt options:\n  --system-prompt <text>         Replace the default system prompt\n  --append-system-prompt <text>  Append to the system prompt (repeatable)\n  --                             Treat all following arguments as messages\n\nAutonomous options:\n  --autonomous                        Continue until gates pass or a limit is reached\n  --autonomous-gate <command>         Run a completion gate (repeatable)\n  --autonomous-gate-retries <n>       Set positive retries per failed gate (default: 3)\n  --autonomous-gate-timeout-ms <n>    Set positive per-gate timeout in ms (default: 300000)\n  --autonomous-max-continuations <n>  Set positive follow-up limit (default: 3)\n  --autonomous-max-turns <n>          Set positive assistant-turn limit (default: 12)\n  --autonomous-max-tokens <n>         Set positive token limit (default: 80000)\n  --autonomous-timeout-ms <n>         Set positive wall-clock limit in ms (default: 1800000)\n\nHelp:\n  -v, --version  Show version and exit\n  -h, --help     Show this help\n\nCommands:\n  help      Show command help\n  agents    Search and open sessions\n  list      List agents\n  attach    Attach the interactive UI to an agent\n  stop      Stop an agent\n  rename    Rename an agent\n  send      Send a message to an agent\n  schedule  Manage prompts that run later or on a recurring schedule\n  status    Show background service status\n  doctor    Inspect and safely clean up background services\n  shutdown  Stop every agent and background service\n  package   Manage capability packages\n  update    Update Prime Agent\n  model     Inspect available models\n  session   Manage saved sessions\n  config    Configure package resources\n\nRun \"prime-agent help <command>\" for command details.\n",
+      "status": 0
+    },
+    "models": {
+      "stdout": "",
+      "stderr": "provider         model                                     context  max-out  thinking  images\nprime-inference  anthropic/claude-fable-5                  1M       128K     yes       yes   \nprime-inference  anthropic/claude-haiku-4.5                200K     64K      yes       yes   \nprime-inference  anthropic/claude-opus-4.1                 200K     32K      yes       yes   \nprime-inference  anthropic/claude-opus-4.5                 200K     64K      yes       yes   \nprime-inference  anthropic/claude-opus-4.6                 1M       128K     yes       yes   \nprime-inference  anthropic/claude-opus-4.7                 1M       128K     yes       yes   \nprime-inference  anthropic/claude-opus-4.8                 1M       128K     yes       yes   \nprime-inference  anthropic/claude-opus-5                   1M       128K     yes       yes   \nprime-inference  anthropic/claude-sonnet-4                 200K     64K      yes       yes   \nprime-inference  anthropic/claude-sonnet-4.5               200K     64K      yes       yes   \nprime-inference  anthropic/claude-sonnet-4.6               1M       128K     yes       yes   \nprime-inference  anthropic/claude-sonnet-5                 1M       128K     yes       yes   \nprime-inference  deepseek/deepseek-chat                    163.8K   16K      no        no    \nprime-inference  deepseek/deepseek-chat-v3-0324            163.8K   65.5K    no        no    \nprime-inference  deepseek/deepseek-chat-v3.1               163.8K   32.8K    yes       no    \nprime-inference  deepseek/deepseek-v3.1-terminus           163.8K   32.8K    yes       no    \nprime-inference  deepseek/deepseek-v3.2                    163.8K   65.5K    yes       no    \nprime-inference  deepseek/deepseek-v3.2-exp                163.8K   65.5K    yes       no    \nprime-inference  deepseek/deepseek-v4-flash                1.0M     393.2K   yes       no    \nprime-inference  deepseek/deepseek-v4-flash-0731           1.0M     65.5K    yes       no    \nprime-inference  deepseek/deepseek-v4-pro                  1.0M     384K     yes       no    \nprime-inference  google/gemini-2.5-flash                   1.0M     65.5K    yes       yes   \nprime-inference  google/gemini-2.5-flash-lite              1.0M     65.5K    yes       yes   \nprime-inference  google/gemini-2.5-pro                     1.0M     65.5K    yes       yes   \nprime-inference  google/gemini-3-flash-preview             1.0M     65.5K    yes       yes   \nprime-inference  google/gemini-3.1-pro-preview             1.0M     65.5K    yes       yes   \nprime-inference  google/gemini-3.5-flash                   1.0M     65.5K    yes       yes   \nprime-inference  google/gemini-3.6-flash                   1.0M     65.5K    yes       yes   \nprime-inference  google/gemma-3-27b-it                     262.1K   131.1K   no        yes   \nprime-inference  meta-llama/Llama-3.2-1B-Instruct          60K      60K      no        no    \nprime-inference  meta-llama/Llama-3.2-3B-Instruct          80K      80K      no        no    \nprime-inference  meta-llama/llama-3.3-70b-instruct         131.1K   16.4K    no        no    \nprime-inference  meta-llama/llama-4-maverick               1.0M     16.4K    no        yes   \nprime-inference  minimax/minimax-m2.5                      204.8K   196.6K   yes       no    \nprime-inference  minimax/minimax-m2.7                      204.8K   131.1K   yes       no    \nprime-inference  minimax/minimax-m3                        524.3K   512K     yes       yes   \nprime-inference  mistralai/mistral-large-2512              262.1K   8.2K     no        yes   \nprime-inference  mistralai/mistral-nemo                    131.1K   16.4K    no        no    \nprime-inference  mistralai/mistral-small-2603              262.1K   8.2K     yes       yes   \nprime-inference  mistralai/mixtral-8x22b-instruct          65.5K    8.2K     no        no    \nprime-inference  moonshotai/kimi-k2-0905                   98.3K    98.3K    no        no    \nprime-inference  moonshotai/kimi-k2.5                      262.1K   65.5K    yes       yes   \nprime-inference  moonshotai/kimi-k2.6                      262.1K   262.1K   yes       yes   \nprime-inference  moonshotai/kimi-k2.7-code                 262.1K   262.1K   yes       yes   \nprime-inference  moonshotai/kimi-k3                        1.0M     1.0M     yes       yes   \nprime-inference  nvidia/nemotron-3-nano-30b-a3b            262.1K   262.1K   yes       no    \nprime-inference  nvidia/nemotron-3-super-120b-a12b         262.1K   4.1K     yes       no    \nprime-inference  nvidia/NVIDIA-Nemotron-3-Ultra-550B-A55B  131.1K   16.4K    yes       no    \nprime-inference  openai/gpt-4.1                            1.0M     32.8K    no        yes   \nprime-inference  openai/gpt-4.1-mini                       1.0M     32.8K    no        yes   \nprime-inference  openai/gpt-4.1-nano                       1.0M     32.8K    no        yes   \nprime-inference  openai/gpt-4o                             128K     16.4K    no        yes   \nprime-inference  openai/gpt-4o-mini                        128K     16.4K    no        yes   \nprime-inference  openai/gpt-5                              400K     128K     yes       yes   \nprime-inference  openai/gpt-5-mini                         400K     128K     yes       yes   \nprime-inference  openai/gpt-5-nano                         400K     128K     yes       yes   \nprime-inference  openai/gpt-5.1                            400K     128K     yes       yes   \nprime-inference  openai/gpt-5.2                            400K     128K     yes       yes   \nprime-inference  openai/gpt-5.2-chat                       128K     16.4K    no        yes   \nprime-inference  openai/gpt-5.2-pro                        400K     128K     yes       yes   \nprime-inference  openai/gpt-5.3-codex                      400K     128K     yes       yes   \nprime-inference  openai/gpt-5.4                            1.1M     128K     yes       yes   \nprime-inference  openai/gpt-5.4-mini                       400K     128K     yes       yes   \nprime-inference  openai/gpt-5.4-nano                       400K     128K     yes       yes   \nprime-inference  openai/gpt-5.4-pro                        1.1M     128K     yes       yes   \nprime-inference  openai/gpt-5.5                            1.1M     128K     yes       yes   \nprime-inference  openai/gpt-5.6                            128K     8.2K     yes       no    \nprime-inference  openai/gpt-5.6-luna                       1.1M     128K     yes       yes   \nprime-inference  openai/gpt-5.6-luna-pro                   1.1M     128K     yes       yes   \nprime-inference  openai/gpt-5.6-sol                        1.1M     128K     yes       yes   \nprime-inference  openai/gpt-5.6-sol-pro                    1.1M     128K     yes       yes   \nprime-inference  openai/gpt-5.6-terra                      1.1M     128K     yes       yes   \nprime-inference  openai/gpt-5.6-terra-pro                  1.1M     128K     yes       yes   \nprime-inference  openai/gpt-oss-120b                       131.1K   131.1K   yes       no    \nprime-inference  openai/gpt-oss-20b                        131.1K   131.1K   yes       no    \nprime-inference  poolside/laguna-s-2.1                     1.0M     131.1K   yes       no    \nprime-inference  poolside/laguna-xs-2.1                    262.1K   32.8K    yes       no    \nprime-inference  qwen/qwen3-235b-a22b-2507                 262.1K   32.8K    no        no    \nprime-inference  qwen/qwen3-30b-a3b-instruct-2507          262.1K   32K      no        no    \nprime-inference  qwen/qwen3-8b                             131.1K   8.2K     yes       no    \nprime-inference  qwen/qwen3-coder                          262.1K   65.5K    no        no    \nprime-inference  qwen/qwen3-coder-next                     262.1K   262.1K   no        no    \nprime-inference  qwen/qwen3-max                            262.1K   65.5K    no        no    \nprime-inference  qwen/qwen3-vl-235b-a22b-instruct          262.1K   32.8K    no        yes   \nprime-inference  qwen/qwen3-vl-235b-a22b-thinking          131.1K   32.8K    yes       yes   \nprime-inference  qwen/qwen3-vl-30b-a3b-instruct            262.1K   16.4K    no        yes   \nprime-inference  qwen/qwen3-vl-8b-instruct                 262.1K   32.8K    no        yes   \nprime-inference  qwen/qwen3.5-35b-a3b                      262.1K   262.1K   yes       yes   \nprime-inference  qwen/qwen3.5-397b-a17b                    262.1K   65.5K    yes       yes   \nprime-inference  qwen/qwen3.6-27b                          262.1K   131.1K   yes       yes   \nprime-inference  qwen/qwen3.6-35b-a3b                      262.1K   262.1K   yes       yes   \nprime-inference  qwen/qwen3.7-flash                        1M       65.5K    yes       yes   \nprime-inference  x-ai/grok-4.20                            2M       30K      yes       yes   \nprime-inference  x-ai/grok-4.20-multi-agent                2M       30K      yes       yes   \nprime-inference  xiaomi/mimo-v2.5                          1.1M     131.1K   yes       yes   \nprime-inference  xiaomi/mimo-v2.5-pro                      1.1M     131.1K   yes       no    \nprime-inference  z-ai/glm-4.5                              131.1K   98.3K    yes       no    \nprime-inference  z-ai/glm-4.5-air                          131.1K   98.3K    yes       no    \nprime-inference  z-ai/glm-4.6                              204.8K   131.1K   yes       no    \nprime-inference  z-ai/glm-4.7                              204.8K   131.1K   yes       no    \nprime-inference  z-ai/glm-4.7-flash                        202.8K   16.4K    yes       no    \nprime-inference  z-ai/glm-5                                204.8K   131.1K   yes       no    \nprime-inference  z-ai/glm-5.1                              204.8K   131.1K   yes       no    \nprime-inference  z-ai/glm-5.2                              1.0M     262.1K   yes       no    \n",
+      "status": 0
+    }
+  }
+}
diff --git a/test/fleet-auth.test.js b/test/fleet-auth.test.js
index 3d247b0..4e69ad3 100644
--- a/test/fleet-auth.test.js
+++ b/test/fleet-auth.test.js
@@ -37,6 +37,14 @@ test("a value discovered by `e2b-box auth` authenticates the member", () => {
   assert.deepEqual(unauthenticatedMembers([member("claude")], cfg, {}), [])
 })
 
+test("opencode's auth.json pointer authenticates the member (its boxVar has no host variable)", () => {
+  // opencode forwards a whole auth.json under OPENCODE_AUTH_CONTENT and has no
+  // `hostVar`, so the row's own `boxVar` must count: a member that came up signed
+  // in was being named as unauthenticated (fleet test, 2026-09-08).
+  const cfg = { envDiscovered: { opencode: { OPENCODE_AUTH_CONTENT: '{"openrouter":{"type":"api","key":"k"}}' } } }
+  assert.deepEqual(unauthenticatedMembers([{ template: "opencode", label: "m" }], cfg, {}), [])
+})
+
 test("a forwarded NAME authenticates the member only when this shell holds it", () => {
   const cfg = { envForward: { claude: { ANTHROPIC_API_KEY: "ANTHROPIC_API_KEY" } } }
   assert.deepEqual(unauthenticatedMembers([member("claude")], cfg, { ANTHROPIC_API_KEY: "sk-ant-x" }), [])
diff --git a/test/fleet-name.test.js b/test/fleet-name.test.js
index 6cf69e4..a9300b1 100644
--- a/test/fleet-name.test.js
+++ b/test/fleet-name.test.js
@@ -5,7 +5,7 @@
 // fleets.
 import { test } from "node:test"
 import assert from "node:assert/strict"
-import { sanitizeSlug, memberBranch, memberLabel, memberLabels, templateSlug, randomSuffix, SLUG_MAX } from "../src/fleet-name.js"
+import { sanitizeSlug, memberBranch, memberLabel, memberLabels, templateSlug, randomSuffix, SLUG_MAX, expandMemberSpec, expandMemberSpecs } from "../src/fleet-name.js"
 
 test("sanitizeSlug: lowercases and turns spaces into a single separator", () => {
   assert.equal(sanitizeSlug("Login Fix"), "login-fix")
@@ -152,3 +152,34 @@ test("memberLabels: two templates that collapse to one label are refused, both n
 test("memberLabels: a bare name colliding with a namespaced one is still a collision", () => {
   assert.throws(() => memberLabels("x", ["amp", "ondrejs-project/amp"]), /amp/)
 })
+
+// ── instances and member specs ────────────────────────────────────────────────
+
+test("memberLabels: the same template twice is two numbered instances, not a collision", () => {
+  assert.deepEqual(memberLabels("t-21", ["codex", "codex", "grok", "codex"]), ["t-21-codex", "t-21-codex-2", "t-21-grok", "t-21-codex-3"])
+})
+
+test("expandMemberSpec: template, :model, *N, @effort, and all of them", () => {
+  assert.deepEqual(expandMemberSpec("codex"), [{ template: "codex", effort: "", model: "" }])
+  assert.deepEqual(expandMemberSpec("grok@xhigh"), [{ template: "grok", effort: "xhigh", model: "" }])
+  assert.deepEqual(expandMemberSpec("codex*3@ultra"), Array(3).fill({ template: "codex", effort: "ultra", model: "" }))
+  assert.deepEqual(expandMemberSpec(" ondrejs-project/drew-claude*2 "), Array(2).fill({ template: "ondrejs-project/drew-claude", effort: "", model: "" }))
+  // A model id keeps its slashes and dots; the template keeps its project prefix.
+  assert.deepEqual(expandMemberSpec("claude:claude-opus-5"), [{ template: "claude", effort: "", model: "claude-opus-5" }])
+  assert.deepEqual(expandMemberSpec("prime:prime-inference/anthropic/claude-fable-5@high"), [
+    { template: "prime", effort: "high", model: "prime-inference/anthropic/claude-fable-5" },
+  ])
+  assert.deepEqual(expandMemberSpec("ondrejs-project/codex:gpt-5.5*2@xhigh"), Array(2).fill({ template: "ondrejs-project/codex", effort: "xhigh", model: "gpt-5.5" }))
+  assert.throws(() => expandMemberSpec("codex*0"), /1\.\.20/)
+  assert.throws(() => expandMemberSpec("codex*21"), /1\.\.20/)
+  assert.throws(() => expandMemberSpec("*3"), /names no template/)
+  assert.throws(() => expandMemberSpec(":gpt-5.5"), /names no template/)
+  assert.deepEqual(expandMemberSpecs(["codex*2", "grok@high"]).map((m) => m.template), ["codex", "codex", "grok"])
+})
+
+test("memberBranch: a numbered instance label keeps two instances on two branches under one pinned suffix", () => {
+  const a = memberBranch("t-21", "codex", { rand: "ab12", label: "t-21-codex" })
+  const b = memberBranch("t-21", "codex", { rand: "ab12", label: "t-21-codex-2" })
+  assert.equal(a, "e2b/t-21-codex-ab12")
+  assert.equal(b, "e2b/t-21-codex-2-ab12")
+})
diff --git a/test/fleet-seed.test.js b/test/fleet-seed.test.js
index 3a98160..13d1e3f 100644
--- a/test/fleet-seed.test.js
+++ b/test/fleet-seed.test.js
@@ -1,5 +1,9 @@
 import test from "node:test"
 import assert from "node:assert/strict"
+import { execFileSync } from "node:child_process"
+import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs"
+import os from "node:os"
+import path from "node:path"
 import { DEFAULT_SEEDS, seedCommand } from "../src/fleet-seed.js"
 
 // --- which command a template is seeded with ---------------------------------
@@ -57,3 +61,42 @@ test("a shipped command reads its credential from a variable, never a value", ()
     assert.match(cmd, /leaving it alone/, `${template}: no no-clobber bail-out`)
   }
 })
+
+// --- the droid seed, actually executed -----------------------------------------
+// Against a fake HOME and a fake project with a .git, the way provision.js runs it
+// from the project dir in a box. Exercised rather than read because the trust key
+// droid checks is computed in the box (realpath, nearest .git), and the autonomy
+// default is what keeps an unattended member from stopping at its first edit.
+
+function runDroidSeed(home) {
+  const proj = path.join(home, "proj")
+  mkdirSync(path.join(proj, ".git"), { recursive: true })
+  const out = execFileSync("bash", ["-c", DEFAULT_SEEDS.droid], {
+    cwd: proj,
+    env: { PATH: process.env.PATH, HOME: home },
+    encoding: "utf8",
+  })
+  return { out, settings: JSON.parse(readFileSync(path.join(home, ".factory/settings.json"), "utf8")) }
+}
+
+test("droid: trusts the git root and defaults new sessions to high autonomy, once", () => {
+  const home = mkdtempSync(path.join(os.tmpdir(), "herdr-seed-"))
+  const { out, settings } = runDroidSeed(home)
+  assert.equal(Object.keys(settings.trustedFolders).length, 1)
+  assert.match(Object.keys(settings.trustedFolders)[0], /proj$/)
+  assert.equal(settings.sessionDefaultSettings.autonomyLevel, "high")
+  assert.match(out, /autonomy set to high/)
+  const again = runDroidSeed(home)
+  assert.match(again.out, /already trusts/)
+  assert.deepEqual(again.settings, settings)
+})
+
+test("droid: a chosen autonomy level and existing settings are left alone", () => {
+  const home = mkdtempSync(path.join(os.tmpdir(), "herdr-seed-"))
+  mkdirSync(path.join(home, ".factory"))
+  writeFileSync(path.join(home, ".factory/settings.json"), JSON.stringify({ model: "kimi-k3", sessionDefaultSettings: { autonomyLevel: "off" } }))
+  const { settings } = runDroidSeed(home)
+  assert.equal(settings.model, "kimi-k3")
+  assert.equal(settings.sessionDefaultSettings.autonomyLevel, "off")
+  assert.equal(Object.keys(settings.trustedFolders).length, 1)
+})
diff --git a/test/fleet-spec.test.js b/test/fleet-spec.test.js
new file mode 100644
index 0000000..63336a1
--- /dev/null
+++ b/test/fleet-spec.test.js
@@ -0,0 +1,69 @@
+import test from "node:test"
+import assert from "node:assert/strict"
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs"
+import os from "node:os"
+import path from "node:path"
+import { fleetSpec, listPresets, presetPath } from "../src/fleet-spec.js"
+import { expandMemberSpecs } from "../src/fleet-name.js"
+import { modelCatalog, effortsForModel } from "../src/effort.js"
+
+test("JSON preserves task text and expands each count without losing per-member pins", () => {
+  const model = modelCatalog("codex").models[0].id
+  const reasoning = effortsForModel("codex", model)[0]
+  const task = "Fix the bug\nKeep `quotes` and $(literal text)."
+  const spec = fleetSpec({ slug: "login", task, members: [
+    { template: "codex", model, reasoning, count: 2 },
+    { template: "codex", count: 1 },
+  ] })
+  assert.equal(spec.slug, "login")
+  assert.equal(spec.task, task)
+  assert.deepEqual(expandMemberSpecs(spec.specs), [
+    { template: "codex", model, effort: reasoning },
+    { template: "codex", model, effort: reasoning },
+    { template: "codex", model: "", effort: "" },
+  ])
+})
+
+test("a reusable roster needs neither a slug nor a task", () => {
+  assert.deepEqual(fleetSpec({ members: [{ template: "claude" }] }), {
+    slug: "", task: "", specs: ["claude*1"],
+  })
+})
+
+test("invalid generated fields fail instead of silently using defaults", () => {
+  for (const value of [null, [], {}, { members: [] }, { members: "codex" },
+    { task: 42, members: [{ template: "codex" }] },
+    { slug: "a\0b", members: [{ template: "codex" }] },
+    { member: [], members: [{ template: "codex" }] }]) {
+    assert.throws(() => fleetSpec(value))
+  }
+  for (const member of [null, "codex", {}, { template: "codex", effort: "high" },
+    { template: "codex*2" }, { template: "codex", model: "x|y" },
+    ...[0, 21, 1.5, "2", null].map((count) => ({ template: "codex", count }))]) {
+    assert.throws(() => fleetSpec({ members: [member] }))
+  }
+})
+
+test("model and per-model reasoning use the current catalog", () => {
+  assert.throws(() => fleetSpec({ members: [{ template: "codex", model: "made-up-model" }] }), /not a model/)
+  assert.throws(() => fleetSpec({ members: [{ template: "codex", reasoning: "made-up-effort" }] }), /not an effort/)
+  const model = modelCatalog("grok").models.find((m) => m.efforts)
+  assert.ok(model)
+  const reasoning = effortsForModel("grok", model.id)[0]
+  assert.doesNotThrow(() => fleetSpec({ members: [{ template: "grok", model: model.id, reasoning }] }))
+})
+
+test("preset names stay inside the presets directory and list without reading recipes", () => {
+  const dir = mkdtempSync(path.join(os.tmpdir(), "fleet-presets-"))
+  try {
+    writeFileSync(path.join(dir, "compare.json"), "invalid JSON is diagnosed on selection")
+    writeFileSync(path.join(dir, "fast.json"), "{}")
+    writeFileSync(path.join(dir, "ignored.txt"), "")
+    writeFileSync(path.join(dir, "bad name.json"), "")
+    mkdirSync(path.join(dir, "directory.json"))
+    assert.deepEqual(listPresets(dir), ["compare", "fast"])
+    assert.equal(presetPath("compare", dir), path.join(dir, "compare.json"))
+    for (const name of ["../escape", "/tmp/escape", "", "bad\nname"]) assert.throws(() => presetPath(name, dir))
+    assert.deepEqual(listPresets(path.join(dir, "absent")), [])
+  } finally { rmSync(dir, { recursive: true, force: true }) }
+})
diff --git a/test/harnesses.test.js b/test/harnesses.test.js
index b1d180a..691c2ef 100644
--- a/test/harnesses.test.js
+++ b/test/harnesses.test.js
@@ -1,6 +1,6 @@
 import test from "node:test"
 import assert from "node:assert/strict"
-import { HARNESSES, interpretProbe } from "../src/harnesses.js"
+import { HARNESSES, interpretProbe, remedyFor } from "../src/harnesses.js"
 
 // --- what the plugin can borrow ----------------------------------------------
 // `state` answers one question only: can this plugin authenticate a box from what
@@ -619,6 +619,19 @@ test("amp reads its key from the default server's entry", () => {
   assert.equal(f.read('{"apiKey@https://ampcode.com/":"amp-key"}'), "amp-key")
 })
 
+test("amp does not borrow the OAuth session `amp login` stores under the same key", () => {
+  // A JWT under `apiKey@…` is the browser sign-in's session, not an access token: amp
+  // itself rejects it as AMP_API_KEY ("holds an OAuth session token, which is
+  // short-lived"), so borrowing it boots a member that dies on its first request.
+  const jwt = "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1In0.c2lnbmF0dXJl"
+  const f = HARNESSES.amp.valueFile
+  assert.equal(f.read(JSON.stringify({ "apiKey@https://ampcode.com/": jwt })), null)
+  assert.equal(f.read(JSON.stringify({ "apiKey@https://amp.example/": jwt })), null)
+  // The remedy names the one credential that works, not `amp login` again.
+  assert.match(remedyFor("amp"), /ampcode\.com\/settings\/security/)
+  assert.match(remedyFor("amp"), /AMP_API_KEY/)
+})
+
 test("amp falls back to a sole entry when the server is not the default one", () => {
   // amp's server is configurable, so the key name is not fixed.
   assert.equal(HARNESSES.amp.valueFile.read('{"apiKey@https://amp.internal/":"self-hosted"}'), "self-hosted")
diff --git a/test/model-pin.test.js b/test/model-pin.test.js
index 59884d3..f8abcec 100644
--- a/test/model-pin.test.js
+++ b/test/model-pin.test.js
@@ -40,9 +40,16 @@ test("modelEnv: claude reads its own variables", () => {
   assert.equal(modelEnv("claude", { reasoning: "low" }).ANTHROPIC_MODEL, undefined)
 })
 
-test("modelEnv: opencode reads inline JSON config, model only", () => {
+test("modelEnv: opencode reads inline JSON config, model only, declared under its provider", () => {
   const env = modelEnv("opencode", { model: "openrouter/qwen/qwen3.8-max-0902", reasoning: "high" })
-  assert.deepEqual(JSON.parse(env.OPENCODE_CONFIG_CONTENT), { model: "openrouter/qwen/qwen3.8-max-0902" })
+  // The provider entry is what lets the TUI pick a model its bundled models.dev
+  // snapshot has never heard of; the model id keeps every slash after the first.
+  assert.deepEqual(JSON.parse(env.OPENCODE_CONFIG_CONTENT), {
+    model: "openrouter/qwen/qwen3.8-max-0902",
+    provider: { openrouter: { models: { "qwen/qwen3.8-max-0902": {} } } },
+  })
+  // No provider half, nothing to declare it under: the model alone.
+  assert.deepEqual(JSON.parse(modelEnv("opencode", { model: "bare-id" }).OPENCODE_CONFIG_CONTENT), { model: "bare-id" })
   // Reasoning is per-model variants in opencode, so a reasoning-only pin sets no
   // opencode variable at all rather than an empty config.
   assert.equal(modelEnv("opencode", { reasoning: "high" }).OPENCODE_CONFIG_CONTENT, undefined)
diff --git a/test/oauth.test.js b/test/oauth.test.js
new file mode 100644
index 0000000..335e03e
--- /dev/null
+++ b/test/oauth.test.js
@@ -0,0 +1,139 @@
+import test from "node:test"
+import assert from "node:assert/strict"
+import { createHash } from "node:crypto"
+import {
+  AMP, CODEX, MUSE, ampConnect, codexAuthorizeUrl, codexConnect, codexRefresh, deviceFlow,
+  jwtExpiryIso, museConnect, pkcePair, validAmpAccessToken,
+} from "../src/oauth.js"
+
+// Every flow runs against a scripted `fetch`: a list of handlers matched by URL,
+// each returning { status, body }. Nothing here touches the network or a browser.
+function scripted(routes) {
+  const calls = []
+  const fetch = async (url, init = {}) => {
+    calls.push({ url, init })
+    const route = routes.find((r) => (typeof r.url === "string" ? r.url === url : r.url.test(url)))
+    if (!route) throw new Error(`unexpected request to ${url}`)
+    const step = typeof route.reply === "function" ? route.reply(init, calls) : route.reply
+    return { ok: step.status < 400, status: step.status, text: async () => JSON.stringify(step.body) }
+  }
+  return { fetch, calls }
+}
+const sleep = async () => {}
+const jwt = (exp) => `eyJhbGciOiJub25lIn0.${Buffer.from(JSON.stringify({ exp })).toString("base64url")}.sig`
+
+test("pkce pair: verifier is base64url of the bytes, challenge is its S256", () => {
+  const bytes = Buffer.alloc(32, 7)
+  const { verifier, challenge } = pkcePair(bytes)
+  assert.equal(verifier, bytes.toString("base64url"))
+  assert.equal(challenge, createHash("sha256").update(verifier).digest("base64url"))
+  assert.doesNotMatch(verifier + challenge, /[+/=]/)
+})
+
+test("jwtExpiryIso reads exp, and refuses anything that is not a JWT", () => {
+  assert.equal(jwtExpiryIso(jwt(1_800_000_000)), new Date(1_800_000_000 * 1000).toISOString())
+  assert.equal(jwtExpiryIso("sgamp_notajwt"), null)
+  assert.equal(jwtExpiryIso(undefined), null)
+})
+
+test("device flow: hands the human the complete URL and code, polls through pending and slow_down, returns tokens", async () => {
+  let polls = 0
+  const { fetch, calls } = scripted([
+    { url: "https://x/auth", reply: { status: 200, body: { device_code: "dc", user_code: "AB-CD", verification_uri: "https://x/d", verification_uri_complete: "https://x/d?user_code=AB-CD", expires_in: 300, interval: 1 } } },
+    { url: "https://x/token", reply: () => (++polls === 1 ? { status: 400, body: { error: "authorization_pending" } } : polls === 2 ? { status: 400, body: { error: "slow_down" } } : { status: 200, body: { access_token: "tok" } }) },
+  ])
+  const seen = []
+  const tokens = await deviceFlow({ authorizeUrl: "https://x/auth", tokenUrl: "https://x/token", clientId: "cid", onCode: (c) => seen.push(c), fetch, sleep })
+  assert.equal(tokens.access_token, "tok")
+  assert.deepEqual(seen, [{ url: "https://x/d?user_code=AB-CD", userCode: "AB-CD", expiresIn: 300 }])
+  assert.equal(calls[0].init.body, "client_id=cid")
+  assert.match(calls[1].init.body, /grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code&device_code=dc&client_id=cid/)
+  assert.equal(polls, 3)
+})
+
+test("device flow: a denial and an expiry are named, not retried forever", async () => {
+  const denied = scripted([
+    { url: "https://x/auth", reply: { status: 200, body: { device_code: "dc", user_code: "A", verification_uri: "https://x/d", expires_in: 300, interval: 1 } } },
+    { url: "https://x/token", reply: { status: 400, body: { error: "access_denied" } } },
+  ])
+  await assert.rejects(deviceFlow({ authorizeUrl: "https://x/auth", tokenUrl: "https://x/token", clientId: "c", fetch: denied.fetch, sleep }), /denied in the browser/)
+  let t = 0
+  const expired = scripted([
+    { url: "https://x/auth", reply: { status: 200, body: { device_code: "dc", user_code: "A", verification_uri: "https://x/d", expires_in: 10, interval: 5 } } },
+    { url: "https://x/token", reply: { status: 400, body: { error: "authorization_pending" } } },
+  ])
+  await assert.rejects(deviceFlow({ authorizeUrl: "https://x/auth", tokenUrl: "https://x/token", clientId: "c", fetch: expired.fetch, sleep, now: () => (t += 6000) }), /expired before it was approved/)
+})
+
+test("muse: Meta device flow, then Meta mints the API key; only the key is kept", async () => {
+  const { fetch, calls } = scripted([
+    { url: MUSE.authorizeUrl, reply: { status: 200, body: { device_code: "dc", user_code: "XCCF-DXML", verification_uri: "https://auth.meta.com/oauth/device", expires_in: 600, interval: 5 } } },
+    { url: MUSE.tokenUrl, reply: { status: 200, body: { access_token: "meta-id-token" } } },
+    { url: MUSE.keyUrl, reply: (init) => (init.headers.Authorization === "Bearer meta-id-token" && init.headers["x-api-version"] === "1.0.0" ? { status: 200, body: { api_key: "muse-key-1" } } : { status: 401, body: {} }) },
+  ])
+  const r = await museConnect({ fetch, sleep, onCode: () => {} })
+  assert.deepEqual(r, { secret: { kind: "api-key", META_API_KEY: "muse-key-1" }, expiresAt: null })
+  assert.equal(calls[0].init.body, `client_id=${MUSE.clientId}`)
+})
+
+test("muse: an account that has not finished setup is told where, and nothing is stored", async () => {
+  const { fetch } = scripted([
+    { url: MUSE.authorizeUrl, reply: { status: 200, body: { device_code: "dc", user_code: "A", verification_uri: "https://m/d", expires_in: 600, interval: 5 } } },
+    { url: MUSE.tokenUrl, reply: { status: 200, body: { access_token: "t" } } },
+    { url: MUSE.keyUrl, reply: { status: 200, body: { action_url: "https://dev.meta.ai/setup" } } },
+  ])
+  await assert.rejects(museConnect({ fetch, sleep }), /Finish setup at https:\/\/dev\.meta\.ai\/setup/)
+})
+
+test("amp: opens the Security page and keeps exactly the pasted access token", async () => {
+  const seen = []
+  const r = await ampConnect({ onCode: (c) => seen.push(c), prompt: async () => "  sgamp_user_abcdefghijklmnop \n" })
+  assert.deepEqual(seen, [{ url: AMP.settingsUrl, userCode: null, expiresIn: 600 }])
+  assert.deepEqual(r, { secret: { kind: "api-key", AMP_API_KEY: "sgamp_user_abcdefghijklmnop" }, expiresAt: null })
+  // A session JWT pasted by mistake is refused: it is the five-minute bearer of ADR 0014.
+  await assert.rejects(ampConnect({ prompt: async () => jwt(1_900_000_000) }), /Expected an amp access token/)
+  await assert.rejects(ampConnect({ prompt: async () => "" }), /nothing was saved/)
+  assert.equal(validAmpAccessToken("sgamp_user_0123456789abcdefXYZ"), true)
+  assert.equal(validAmpAccessToken(jwt(1)), false)
+})
+
+test("codex: authorize URL carries codex's own client id, PKCE and originator", () => {
+  const u = new URL(codexAuthorizeUrl({ challenge: "ch", state: "st" }))
+  assert.equal(u.origin + u.pathname, CODEX.authorizeUrl)
+  assert.equal(u.searchParams.get("client_id"), CODEX.clientId)
+  assert.equal(u.searchParams.get("redirect_uri"), "http://localhost:1455/auth/callback")
+  assert.equal(u.searchParams.get("code_challenge"), "ch")
+  assert.equal(u.searchParams.get("code_challenge_method"), "S256")
+  assert.equal(u.searchParams.get("originator"), "codex_cli_rs")
+  assert.equal(u.searchParams.get("scope"), CODEX.scope)
+})
+
+test("codex: PKCE callback, state check, exchange, auth.json shape with the bearer's expiry", async () => {
+  const exp = 1_900_000_000
+  const { fetch, calls } = scripted([
+    { url: CODEX.tokenUrl, reply: (init) => (/grant_type=authorization_code&code=the-code&redirect_uri=http%3A%2F%2Flocalhost%3A1455%2Fauth%2Fcallback&client_id=app_EMoamEEZ73f0CkXaXp7hrann&code_verifier=/.test(init.body) ? { status: 200, body: { id_token: "id", access_token: jwt(exp), refresh_token: "rt-1" } } : { status: 400, body: { error: "bad" } }) },
+  ])
+  const listen = () => Promise.resolve({ code: "the-code", state: "st" })
+  const r = await codexConnect({ fetch, onCode: () => {}, listen, state: "st", now: () => 1_700_000_000_000 })
+  assert.equal(r.secret.auth_mode, "chatgpt")
+  assert.equal(r.secret.tokens.refresh_token, "rt-1")
+  assert.equal(r.secret.last_refresh, new Date(1_700_000_000_000).toISOString())
+  assert.equal(r.expiresAt, new Date(exp * 1000).toISOString())
+  assert.equal(calls.length, 1)
+  await assert.rejects(codexConnect({ fetch, listen: () => Promise.resolve({ code: "c", state: "other" }), state: "st" }), /different state/)
+  await assert.rejects(codexConnect({ fetch, listen: () => Promise.resolve({ error: "access_denied", error_description: "no" }), state: "st" }), /access_denied - no/)
+})
+
+test("codex refresh: the request codex sends, and the rotated auth.json that comes back", async () => {
+  const { fetch, calls } = scripted([
+    { url: CODEX.tokenUrl, reply: { status: 200, body: { id_token: "id2", access_token: jwt(2_000_000_000), refresh_token: "rt-2" } } },
+  ])
+  const before = { auth_mode: "chatgpt", tokens: { id_token: "id1", access_token: "old", refresh_token: "rt-1", account_id: "acct" } }
+  const after = await codexRefresh(before, { fetch, now: () => 1_700_000_000_000 })
+  assert.deepEqual(JSON.parse(calls[0].init.body), { client_id: CODEX.clientId, grant_type: "refresh_token", refresh_token: "rt-1", scope: "openid profile email" })
+  assert.equal(after.tokens.refresh_token, "rt-2")
+  assert.equal(after.tokens.account_id, "acct")
+  assert.equal(after.tokens.id_token, "id2")
+  const dead = scripted([{ url: CODEX.tokenUrl, reply: { status: 400, body: { error: "invalid_grant" } } }])
+  await assert.rejects(codexRefresh(before, { fetch: dead.fetch }), /codex refresh failed \(400: invalid_grant\)/)
+})
diff --git a/test/picker-cache-pty.py b/test/picker-cache-pty.py
new file mode 100644
index 0000000..de9b9c2
--- /dev/null
+++ b/test/picker-cache-pty.py
@@ -0,0 +1,318 @@
+"""Offline popup frames, with resolver startup held behind a gate."""
+import json
+import os
+import pty
+import re
+import select
+import shutil
+import shlex
+import signal
+import subprocess
+import sys
+import tempfile
+import time
+from pathlib import Path
+
+ROOT, BASH, NODE = map(Path, sys.argv[1:])
+ANSI = re.compile(rb"\x1b\[[0-9;?]*[A-Za-z]")
+
+
+class Popup:
+    def __init__(self, env, root=ROOT):
+        self.output = b""
+        self.pid, self.fd = pty.fork()
+        if self.pid == 0:
+            os.execve(str(BASH), [str(BASH), "-c", '\"$1\" \"$2\" --render; printf "\\n__PICKER_EXIT__\\n"', "picker-test", str(BASH), str(root / "bin/e2b-popup")], env)
+
+    def read(self, seconds=.1):
+        end = time.monotonic() + seconds
+        while time.monotonic() < end:
+            if select.select([self.fd], [], [], .02)[0]:
+                try:
+                    data = os.read(self.fd, 65536)
+                except OSError:
+                    break
+                if not data:
+                    break
+                self.output += data
+        return ANSI.sub(b"", self.output).decode(errors="replace")
+
+    def until(self, text, timeout=5):
+        end = time.monotonic() + timeout
+        while time.monotonic() < end:
+            if text in self.read(.03):
+                return
+        raise AssertionError("missing %r in %r" % (text, self.read()))
+
+    def keys(self, value):
+        os.write(self.fd, value)
+
+    def close(self):
+        try:
+            os.kill(self.pid, signal.SIGKILL)
+        except ProcessLookupError:
+            pass
+        os.close(self.fd)
+        # Some macOS PTYs leave an exiting process unreaped past the deadline.
+        os.waitpid(self.pid, os.WNOHANG)
+
+
+with tempfile.TemporaryDirectory(prefix="picker-cache-") as tmp:
+    tmp = Path(tmp).resolve()
+    repo, config, state = (tmp / name for name in ("repo", "config", "state"))
+    for directory in (repo, config, state):
+        directory.mkdir()
+    subprocess.run(["git", "init", "-q", str(repo)], check=True)
+    gate = tmp / "gate"
+    node = tmp / "node"
+    node.write_text('#!/bin/sh\nwhile [ ! -f "$PICKER_GATE" ]; do sleep 0.01; done\nexec %s "$@"\n' % shlex.quote(str(NODE)))
+    node.chmod(0o755)
+    calls = tmp / "calls"
+    herdr = tmp / "herdr"
+    herdr.write_text('#!/bin/sh\nprintf "%s\\n" "$@" > "$PICKER_CALLS"\n')
+    herdr.chmod(0o755)
+    env = dict(os.environ, HERDR_E2B_NODE=str(node), HERDR_BIN_PATH=str(herdr),
+               PICKER_GATE=str(gate), PICKER_CALLS=str(calls), HERDR_PLUGIN_STATE_DIR=str(state),
+               HERDR_PLUGIN_CONFIG_DIR=str(config), HERDR_PLUGIN_CONTEXT_JSON="", E2B_TEMPLATE="",
+               E2B_PICK_CWD=str(repo), E2B_POPUP_MODE="pick-box", E2B_DASH_ORIGIN_PANE="w1:p1")
+
+    def configure(names):
+        (config / "config.toml").write_text('[sandbox]\ntemplate="base"\ntemplates=%s\n' % json.dumps(names))
+
+    def cache():
+        return next(state.rglob("input"))
+
+    def run_case(name, fn):
+        try:
+            detail = fn()
+            print("OK " + name + (" (%s)" % detail if detail else ""), flush=True)
+        except Exception as error:
+            print("FAIL " + name + ": " + str(error), flush=True)
+
+    def cold():
+        configure(["base", "claude", "codex"])
+        p = Popup(env)
+        try:
+            assert "E2B template for" not in p.read(.3)
+            gate.touch()
+            p.until("E2B template for")
+            p.keys(b"q")
+            p.read(.3)
+            assert b"claude\ncodex" in cache().read_bytes()
+        finally:
+            p.close()
+    run_case("picker without cache keeps the resolver-first path and writes input", cold)
+
+    def hit():
+        gate.unlink(missing_ok=True)
+        p = Popup(env)
+        try:
+            p.until("E2B template for", 1)
+            assert "claude" in p.read()
+            p.keys(b"q")
+            p.read(.3)
+            assert not list((state / "pickers").glob("refresh.*")), "abort left its refresh directory"
+            assert not calls.exists(), "abort contacted Herdr"
+        finally:
+            gate.touch()
+            p.close()
+    run_case("picker cache paints before a blocked Node starts resolving", hit)
+
+    def stale():
+        configure(["base", "grok"])
+        gate.unlink(missing_ok=True)
+        p = Popup(env)
+        try:
+            p.until("E2B template for", 1)
+            assert "claude" in p.read()
+            p.keys(b"\r")
+            assert not calls.exists(), "cached answer launched before refresh"
+            gate.touch()
+            p.until("grok")
+            assert not calls.exists(), "changed rows accepted a stale confirmation"
+            assert b"base\ngrok" in cache().read_bytes()
+            assert b"base\nclaude\ncodex" not in cache().read_bytes()
+            assert p.output.count(b"\x1b[2J") == 1, "refresh cleared the screen"
+            p.keys(b"q")
+            p.read(.3)
+        finally:
+            gate.touch()
+            p.close()
+    run_case("stale picker rows refresh in place without a keystroke", stale)
+
+    def settled():
+        p = Popup(dict(env, E2B_TEMPLATE="codex"))
+        try:
+            end = time.monotonic() + 5
+            while not calls.exists() and time.monotonic() < end:
+                p.read(.05)
+            assert "E2B_TEMPLATE=codex" in calls.read_text()
+            assert "E2B template for" not in p.read()
+        finally:
+            p.close()
+    run_case("settled template hands off without painting a picker", settled)
+
+    def branch():
+        calls.unlink(missing_ok=True)
+        configure(["base", "claude"])
+        with (config / "config.toml").open("a") as f:
+            f.write('\n[[sandbox.template_rules]]\npattern=".*"\ntemplate="codex"\n')
+        p = Popup(env)
+        try:
+            end = time.monotonic() + 5
+            while not calls.exists() and time.monotonic() < end:
+                p.read(.05)
+            assert calls.exists(), p.read()
+            assert "E2B_TEMPLATE=" not in calls.read_text()
+            assert cache().read_bytes().split(b"\0")[5] == b""
+        finally:
+            p.close()
+    run_case("refresh can settle a cached picker through a branch rule", branch)
+
+    def fleet():
+        configure(["base", "claude", "codex"])
+        # The regular fleet owner writes the same arguments on a cold open.
+        subprocess.run([str(ROOT / "bin/e2b-box"), "fleet"], cwd=repo,
+                       env=dict(env, E2B_PICKER_INPUT=str(tmp / "fresh")), check=True,
+                       stdout=subprocess.DEVNULL, stderr=subprocess.PIPE)
+        gate.unlink(missing_ok=True)
+        p = Popup(dict(env, E2B_POPUP_MODE="pick-fleet"))
+        try:
+            p.until("New E2B fleet", 1)
+            gate.touch()
+            p.keys(b"speed\r")
+            p.until("claude")
+            p.keys(b"q")
+            p.read(.3)
+        finally:
+            gate.touch()
+            p.close()
+    run_case("fleet cache paints the slug immediately and reaches cached roster rows", fleet)
+
+    def fleet_handoff(preset=False):
+        plugin = tmp / ("preset plugin" if preset else "plugin with spaces")
+        (plugin / "bin/lib").mkdir(parents=True)
+        (plugin / "src").mkdir()
+        for name in ("e2b-popup", "lib/paths.sh", "lib/pane.sh", "lib/chooser.sh", "lib/picker-cache.sh"):
+            shutil.copyfile(ROOT / "bin" / name, plugin / "bin" / name)
+        (plugin / "src/fleet-name.js").write_text('process.exit(process.argv[2] === "speed" ? 0 : 1)')
+        box = plugin / "bin/e2b-box"
+        box.write_text('#!/bin/sh\nif [ -n "$E2B_PICKER_INPUT" ]; then cp "$PICKER_FRESH" "$E2B_PICKER_INPUT"; else printf "%s\\n" "$@" > "$PICKER_CALLS"; fi\n')
+        box.chmod(0o755)
+        fields = cache().read_bytes().split(b"\0")
+        fields[9:14] = [b"", b"claude", b"1", b"claude", b"claude|native|high,low|high|env|model-a,model-b|model-a"]
+        if preset:
+            (plugin / "package.json").write_text('{"type":"module"}')
+            (plugin / "src/fleet-spec.js").write_text(
+                "process.argv[1] = %s; await import(%s);" % (
+                    json.dumps(str(ROOT / "src/fleet-spec.js")), json.dumps((ROOT / "src/fleet-spec.js").as_uri())))
+            (config / "presets").mkdir(exist_ok=True)
+            (config / "presets/bad.json").write_text('{"members":[{"template":"claude","model":"invented"}]}')
+            (config / "presets/quick.json").write_text('{"members":[{"template":"claude"}]}')
+            (config / "presets/compare.json").write_text(json.dumps({
+                "task": "saved instruction",
+                "members": [{"template": "claude", "model": "claude-fable-5", "reasoning": "high", "count": 2},
+                            {"template": "claude", "model": "claude-fable-5-1", "reasoning": "low"}]}))
+            fields[13] = b"claude|native|high,low|high|env|claude-fable-5,claude-fable-5-1|claude-fable-5"
+        fresh = tmp / "fleet-fresh"
+        fresh.write_bytes(b"\0".join(fields))
+        cache().write_bytes(fresh.read_bytes())
+        calls.unlink(missing_ok=True)
+        p = Popup(dict(env, E2B_POPUP_MODE="pick-fleet", PICKER_FRESH=str(fresh)), plugin)
+        try:
+            p.until("New E2B fleet")
+            p.keys(b"spee\t")
+            p.read(.03)
+            p.keys(b"\x1b[Z")
+            assert "__PICKER_EXIT__" not in p.read(.03), "slug Shift-Tab closed the popup"
+            p.keys(b"d\tfix the bug\r")
+            p.until("claude-fable-5" if preset else "model-a")
+            if preset:
+                p.keys(b"P")
+                p.until("preset: quick")
+                p.output = b""
+                p.keys(b"p")
+                p.until("not a model")
+                p.until("preset: quick")
+                p.keys(b"p")
+                p.until("preset: compare")
+                p.until("saved instruction")
+                p.until("3 members")
+                p.keys(b"+")
+                p.until("4 members")
+            p.keys(b"\t")
+            p.read(.03)
+            p.keys(b"\x1b[Z")
+            assert "__PICKER_EXIT__" not in p.read(.03), "roster Shift-Tab closed the popup"
+            p.keys(b"\r")
+            end = time.monotonic() + 3
+            while not calls.exists() and time.monotonic() < end:
+                p.read(.05)
+            expected = ["fleet", "--slug", "speed", "--task", "fix the bug"]
+            if preset:
+                expected += ["--preset", "compare"]
+                for member in ["claude:claude-fable-5@high", "claude:claude-fable-5@high", "claude:claude-fable-5-1@low", "claude:claude-fable-5@high"]:
+                    expected += ["-t", member]
+            else:
+                expected += ["-t", "claude:model-a@high"]
+            assert calls.read_text().splitlines() == expected, calls.read_text()
+        finally:
+            p.close()
+    run_case("cached fleet handoff preserves task, template, model and effort flags", fleet_handoff)
+    run_case("popup preset fills editable counts and per-instance model/reasoning cells", lambda: fleet_handoff(True))
+
+    def escape_quickly(mode, roster=False):
+        gate.touch()
+        subprocess.run([str(ROOT / "bin/e2b-picker-warm")],
+                       env=dict(env, HERDR_PLUGIN_CONTEXT_JSON=json.dumps({"workspace_cwd": str(repo)})), check=True)
+        calls.unlink(missing_ok=True)
+        if not roster:
+            gate.unlink()
+        p = Popup(dict(env, E2B_POPUP_MODE=mode))
+        try:
+            p.until("E2B template for" if mode == "pick-box" else "New E2B fleet")
+            if roster:
+                p.keys(b"speed\r")
+                p.until("space tick")
+            else:
+                p.keys(b"\r" if mode == "pick-box" else b"speed\r")
+                p.read(.03)
+            start = time.monotonic()
+            p.keys(b"\x1b")
+            p.until("__PICKER_EXIT__", .4)
+            elapsed = (time.monotonic() - start) * 1000
+            assert elapsed < 200, "Escape took %.1f ms" % elapsed
+            assert not calls.exists(), "Escape launched work"
+            return "%.1f ms" % elapsed
+        finally:
+            gate.touch()
+            p.close()
+    run_case("Escape cancels a pending box confirmation immediately", lambda: escape_quickly("pick-box"))
+    run_case("Escape cancels a pending fleet slug immediately", lambda: escape_quickly("pick-fleet"))
+    run_case("Escape closes the fleet roster immediately", lambda: escape_quickly("pick-fleet", True))
+
+    def popup_arrow_keys():
+        gate.touch()
+        p = Popup(env)
+        try:
+            p.until("E2B template for")
+            p.keys(b"\x1b[B")
+            assert "__PICKER_EXIT__" not in p.read(.03), "down arrow closed the popup"
+            p.keys(b"\x1b[C")
+            assert "__PICKER_EXIT__" not in p.read(.03), "right arrow closed the popup"
+            p.keys(b"\r")
+            p.until("enter take")
+            p.output = b""
+            start = time.monotonic()
+            p.keys(b"\x1b")
+            p.until("enter confirm", .4)
+            assert time.monotonic() - start < .2
+            assert "__PICKER_EXIT__" not in p.read(.03), "dropdown Escape closed the popup"
+            p.keys(b"\x1b[Z")
+            p.read(.03)
+            p.keys(b"\r")
+            p.until("__PICKER_EXIT__")
+            assert "E2B_TEMPLATE=claude" in calls.read_text(), "Shift-Tab failed to return to template column"
+        finally:
+            p.close()
+    run_case("popup arrows and Shift-Tab still work; dropdown Escape only goes back", popup_arrow_keys)
diff --git a/test/popup.test.js b/test/popup.test.js
index 5f6d6ca..12f0cb8 100644
--- a/test/popup.test.js
+++ b/test/popup.test.js
@@ -13,6 +13,11 @@ function fixture(t) {
   t.after(() => rmSync(dir, { recursive: true, force: true }))
   const herdr = path.join(dir, "herdr")
   const calls = path.join(dir, "calls")
+  // `open`'s action asks `e2b-box pick --needed` before choosing popup or pane; a
+  // pinned menu of three keeps that answer independent of this machine's config.
+  const config = path.join(dir, "config")
+  mkdirSync(config)
+  writeFileSync(path.join(config, "config.toml"), '[sandbox]\ntemplate = "base"\ntemplates = ["claude", "codex", "base"]\n')
   writeFileSync(herdr, `#!/bin/sh
 printf "%s\\n" "$@" > "$POPUP_CALLS"
 printf "%s\\n" "$*" >> "$POPUP_CALLS.all"
@@ -26,13 +31,20 @@ exit "\${POPUP_EXIT:-0}"
     calls,
     herdr,
     dir,
+    config,
     run: (binary, args = [], env = {}) => spawnSync(path.join(root, "bin", binary), args, {
       encoding: "utf8",
-      env: { ...process.env, HERDR_PLUGIN_CONTEXT_JSON: "", HERDR_PANE_ID: "", HERDR_BIN_PATH: herdr, HERDR_PLUGIN_STATE_DIR: dir, POPUP_CALLS: calls, ...env },
+      env: { ...process.env, E2B_TEMPLATE: "", HERDR_PLUGIN_CONTEXT_JSON: "", HERDR_PANE_ID: "", HERDR_BIN_PATH: herdr, HERDR_PLUGIN_STATE_DIR: dir, HERDR_PLUGIN_CONFIG_DIR: config, POPUP_CALLS: calls, ...env },
     }),
   }
 }
 
+// The popup opened as a config surface: what bin/lib/pane.sh `pane_open_popup` asks herdr for.
+const popupCall = (mode, origin, cwd) => [
+  "plugin", "pane", "open", "--plugin", "e2b-dev.herdr-e2b", "--entrypoint", "popup", "--placement", "popup", "--width", "90%", "--height", "85%",
+  "--env", "E2B_DASH_POPUP=1", "--env", `E2B_POPUP_MODE=${mode}`, "--env", `E2B_DASH_ORIGIN_PANE=${origin}`, "--cwd", cwd, "--env", `E2B_PICK_CWD=${cwd}`,
+]
+
 test("settings actions launch pane and popup views without needing their own terminal", (t) => {
   const f = fixture(t)
   const manifest = TOML.parse(readFileSync(path.join(root, "herdr-plugin.toml"), "utf8"))
@@ -41,14 +53,16 @@ test("settings actions launch pane and popup views without needing their own ter
     const action = manifest.actions.find((action) => action.id === id)
     const result = spawnSync(action.command[0], action.command.slice(1), {
       encoding: "utf8",
-      env: { ...process.env, HERDR_PLUGIN_ROOT: root, HERDR_PLUGIN_CONTEXT_JSON: "", HERDR_PANE_ID: "", HERDR_BIN_PATH: f.herdr, HERDR_PLUGIN_STATE_DIR: f.dir, POPUP_CALLS: f.calls },
+      env: { ...process.env, E2B_TEMPLATE: "", HERDR_PLUGIN_ROOT: root, HERDR_PLUGIN_CONTEXT_JSON: "", HERDR_PANE_ID: "", HERDR_BIN_PATH: f.herdr, HERDR_PLUGIN_STATE_DIR: f.dir, HERDR_PLUGIN_CONFIG_DIR: f.config, POPUP_CALLS: f.calls },
     })
     assert.equal(result.status, 0, result.stderr)
     const called = readFileSync(f.calls, "utf8").trim().split("\n")
     if (id === "dashboard") {
       assert.deepEqual(called, ["pane", "run", "w1:p1", "e2b-dash"])
     } else if (id === "open" || id === "fleet") {
-      assert.deepEqual(called, ["plugin", "pane", "open", "--plugin", manifest.id, "--entrypoint", id === "open" ? "box" : "fleet", "--placement", "split", "--target-pane", "w1:p1", "--direction", "down", "--focus"])
+      // Both actions put their questions in the popup, over the invoking pane, about
+      // the worktree the action ran in (here: the plugin root, the process cwd).
+      assert.deepEqual(called, popupCall(id === "open" ? "pick-box" : "pick-fleet", "w1:p1", process.cwd()))
     } else {
       assert.deepEqual(called, ["plugin", "pane", "open", "--plugin", manifest.id, "--entrypoint", "popup", "--placement", "popup", "--width", "90%", "--height", "85%", "--env", "E2B_DASH_POPUP=1", "--env", "E2B_DASH_ORIGIN_PANE=w1:p1"])
     }
@@ -122,21 +136,65 @@ printf '%s\\n' "$HERDR_PLUGIN_ID" "$HERDR_PLUGIN_ROOT" "$HERDR_PLUGIN_CONFIG_DIR
   assert.equal(f.run("e2b-popup", ["--render", "unexpected"]).status, 2)
 })
 
-test("box and fleet splits follow the invoking pane and focus below it", (t) => {
+test("box and fleet actions open the popup over the invoking pane, about its worktree", (t) => {
   const f = fixture(t)
-  for (const [binary, entrypoint] of [["e2b-box-open", "box"], ["e2b-fleet-open", "fleet"]]) {
+  for (const [binary, mode] of [["e2b-box-open", "pick-box"], ["e2b-fleet-open", "pick-fleet"]]) {
     for (const context of [JSON.stringify({ focused_pane_id: "w2:p3" }), ""]) {
       const result = f.run(binary, [], { HERDR_PLUGIN_CONTEXT_JSON: context, HERDR_PANE_ID: "w3:p4" })
       assert.equal(result.status, 0, result.stderr)
-      assert.deepEqual(readFileSync(f.calls, "utf8").trim().split("\n"), [
-        "plugin", "pane", "open", "--plugin", "e2b-dev.herdr-e2b", "--entrypoint", entrypoint,
-        "--placement", "split", "--target-pane", context ? "w2:p3" : "w3:p4", "--direction", "down", "--focus",
-      ])
+      assert.deepEqual(readFileSync(f.calls, "utf8").trim().split("\n"), popupCall(mode, context ? "w2:p3" : "w3:p4", process.cwd()))
     }
+    // The context's cwd is the worktree the popup is about, not where the action happens to run.
+    const ctx = JSON.stringify({ focused_pane_id: "w2:p3", focused_pane_cwd: f.dir })
+    assert.equal(f.run(binary, [], { HERDR_PLUGIN_CONTEXT_JSON: ctx }).status, 0)
+    assert.deepEqual(readFileSync(f.calls, "utf8").trim().split("\n"), popupCall(mode, "w2:p3", f.dir))
+    // No popup to be had: the pane below, as before. Both attempts failing is a failure.
     assert.equal(f.run(binary, [], { POPUP_EXIT: "1", HERDR_PANE_ID: "w3:p4" }).status, 1)
   }
 })
 
+test("--render in pick-box mode hands the answer to a pane under the origin and exits, closing the popup", (t) => {
+  const f = fixture(t)
+  const repo = path.join(f.dir, "repo")
+  mkdirSync(repo)
+  spawnSync("git", ["-C", repo, "init", "-q"])
+  spawnSync("git", ["-C", repo, "commit", "-q", "--allow-empty", "-m", "init"])
+  // No terminal here, so the picker cannot draw: pick answers with the key alone and
+  // the hand-off opens the box plain. With E2B_TEMPLATE set the answer is that name.
+  for (const [env, extra] of [[{}, []], [{ E2B_TEMPLATE: "codex" }, ["--env", "E2B_TEMPLATE=codex"]]]) {
+    const result = spawnSync("bash", [path.join(root, "bin/e2b-popup"), "--render"], {
+      encoding: "utf8",
+      env: {
+        ...process.env, E2B_TEMPLATE: "", HERDR_PLUGIN_CONTEXT_JSON: "", HERDR_PANE_ID: "", HERDR_BIN_PATH: f.herdr, HERDR_PLUGIN_STATE_DIR: f.dir,
+        HERDR_PLUGIN_CONFIG_DIR: f.config, POPUP_CALLS: f.calls, E2B_POPUP_MODE: "pick-box", E2B_PICK_CWD: repo, E2B_DASH_ORIGIN_PANE: "w2:p3", ...env,
+      },
+    })
+    assert.equal(result.status, 0, result.stderr)
+    const called = readFileSync(f.calls, "utf8").trim().split("\n")
+    assert.deepEqual(called.slice(0, 13), [
+      "plugin", "pane", "open", "--plugin", "e2b-dev.herdr-e2b", "--entrypoint", "box", "--placement", "split", "--target-pane", "w2:p3", "--direction", "down",
+    ])
+    assert.equal(called[13], "--focus")
+    assert.deepEqual(called.slice(14, 16), ["--cwd", repo])
+    assert.equal(called[16], "--env")
+    assert.match(called[17], /^KEY=repo-[0-9a-f]{8}$/)
+    assert.deepEqual(called.slice(18), extra)
+  }
+})
+
+test("the popup picker's hand-off carries what was picked into the box pane's environment", (t) => {
+  const f = fixture(t)
+  const result = f.run("e2b-box-open", ["--target-pane", "w5:p6", "--placement", "below", "--cwd", "/tmp/w", "--box", "k1", "--template", "codex", "--reasoning", "high", "--model", "gpt-5.5"])
+  assert.equal(result.status, 0, result.stderr)
+  assert.deepEqual(readFileSync(f.calls, "utf8").trim().split("\n"), [
+    "plugin", "pane", "open", "--plugin", "e2b-dev.herdr-e2b", "--entrypoint", "box", "--placement", "split", "--target-pane", "w5:p6", "--direction", "down", "--focus",
+    "--cwd", "/tmp/w", "--env", "KEY=k1", "--env", "E2B_TEMPLATE=codex", "--env", "E2B_REASONING=high", "--env", "E2B_MODEL=gpt-5.5",
+  ])
+  // Empty picks are not passed on: an unchosen effort must not become an empty pin.
+  assert.equal(f.run("e2b-box-open", ["--target-pane", "w5:p6", "--box", "k1", "--template", "codex", "--reasoning", "", "--model", ""]).status, 0)
+  assert.deepEqual(readFileSync(f.calls, "utf8").trim().split("\n").slice(-4), ["--env", "KEY=k1", "--env", "E2B_TEMPLATE=codex"])
+})
+
 test("the popup's Enter opens the box where [dashboard].popup_open says, pinned to that box", (t) => {
   const f = fixture(t)
   // Explicit target beats context and focus: inside a popup both name the popup.
@@ -182,3 +240,64 @@ test("[dashboard].popup_open reaches the dashboard's settings, anything else mea
     assert.equal(JSON.parse(result.stdout).popup_open, expected, `popup_open = ${value}`)
   }
 })
+
+test("picker refresh returns input without asking or contacting Herdr, and headless render keeps its handoff", (t) => {
+  const f = fixture(t)
+  const reply = path.join(f.dir, "picker-input")
+  const result = f.run("e2b-box", ["pick"], { E2B_PICKER_INPUT: reply })
+  assert.equal(result.status, 0, result.stderr)
+  assert.match(result.stdout, /^herdr-e2b-sandbox-[0-9a-f]{8}\n\n$/)
+  const fields = readFileSync(reply).toString().split("\0")
+  assert.equal(fields[1], process.cwd())
+  assert.equal(fields[4], "base")
+  assert.equal(fields[5], "base\nclaude\ncodex")
+  assert.match(fields[8], /codex\|/)
+  assert.throws(() => readFileSync(f.calls), { code: "ENOENT" })
+
+  const rendered = f.run("e2b-popup", ["--render"], { E2B_POPUP_MODE: "pick-box", E2B_PICK_CWD: process.cwd() })
+  assert.equal(rendered.status, 0, rendered.stderr)
+  assert.doesNotMatch(rendered.stdout, /E2B template/)
+  assert.match(readFileSync(f.calls, "utf8"), /KEY=herdr-e2b-sandbox-/)
+})
+
+test("fleet refresh fills the same worktree cache without asking or creating members", (t) => {
+  const f = fixture(t)
+  const reply = path.join(f.dir, "picker-input")
+  assert.equal(f.run("e2b-box", ["pick"], { E2B_PICKER_INPUT: reply }).status, 0)
+  const before = readFileSync(reply).toString().split("\0")
+  const result = f.run("e2b-box", ["fleet"], { E2B_PICKER_INPUT: reply })
+  assert.equal(result.status, 0, result.stderr)
+  const after = readFileSync(reply).toString().split("\0")
+  assert.deepEqual(after.slice(0, 9), before.slice(0, 9))
+  assert.equal(after[10], "claude\ncodex")
+  assert.match(after[13], /codex\|/)
+  assert.throws(() => readFileSync(f.calls), { code: "ENOENT" })
+})
+
+test("startup warms both picker inputs for restored pane directories without opening anything", (t) => {
+  const f = fixture(t)
+  const repos = [path.join(f.dir, "focused repo"), path.join(f.dir, "other repo")]
+  for (const repo of repos) {
+    mkdirSync(repo)
+    spawnSync("git", ["-C", repo, "init", "-q"])
+  }
+  writeFileSync(f.herdr, `#!/bin/sh
+printf '%s\\n' "$*" >> "$POPUP_CALLS"
+printf '%s\\n' '${JSON.stringify({ result: { panes: repos.map(cwd => ({ cwd, foreground_cwd: cwd })) } })}'
+`, { mode: 0o755 })
+  const manifest = TOML.parse(readFileSync(path.join(root, "herdr-plugin.toml"), "utf8"))
+  assert.deepEqual(manifest.startup[0].command, ["bash", "bin/e2b-picker-warm", "--all"])
+  assert.deepEqual(manifest.events.find(e => e.on === "workspace.created").command, ["bash", "bin/e2b-picker-warm"])
+  const result = f.run("e2b-picker-warm", ["--all"], {
+    HERDR_PLUGIN_CONTEXT_JSON: JSON.stringify({ focused_pane_cwd: repos[0] }), KEY: "unrelated-box", E2B_TEMPLATE: "pinned-elsewhere",
+  })
+  assert.equal(result.status, 0, result.stderr)
+  assert.equal(readFileSync(f.calls, "utf8"), "pane list\n")
+  for (const repo of repos) {
+    const cache = path.join(f.dir, "pickers", ...repo.split("/").filter(Boolean).map(p => `d-${p}`), "input")
+    const fields = readFileSync(cache).toString().split("\0")
+    assert.equal(fields[1], repo)
+    assert.equal(fields[5], "base\nclaude\ncodex")
+    assert.equal(fields[10], "claude\ncodex")
+  }
+})
diff --git a/tui/src/main.rs b/tui/src/main.rs
index ffa55f3..9e40993 100644
--- a/tui/src/main.rs
+++ b/tui/src/main.rs
@@ -717,6 +717,20 @@ fn main() -> std::io::Result<()> {
         }
 
         if let Some((label, key, verb, wt)) = app.run.take() {
+            // A fleet member that has no box yet: e2b-fleet writes a `pending`
+            // placeholder so the board shows the member while its worktree and
+            // pane come up. Nothing but kill (which just clears it) is meaningful
+            // on one, and `open` on it would boot a second box beside the pane's.
+            if verb != "kill"
+                && app
+                    .boxes
+                    .iter()
+                    .any(|b| b.key == key && b.status == "pending")
+            {
+                app.msg =
+                    format!("{label} is still being created: its box will appear here in a moment");
+                continue;
+            }
             // kill/status/pause/resume target the box by KEY (no worktree needed).
             // Everything else operates ON the worktree, so it MUST exist — never
             // fall back to the current dir (that would provision/sync the wrong folder).