Address Gadfly findings on #84

- Object aria-label uses kindDef().label (the canonical "In-ground") instead of an ad-hoc kind.replace() that produced "in ground" and diverged from the UI. 4+ models flagged this. - aria-current, not aria-pressed, for the selected object — selection isn't a toggle, which is what aria-pressed means; aria-current marks the active item. - Modal focus trap made robust: if focus is NOT inside the dialog (fell to <body> because the focused control was removed — ShareGardenModal's remove-share button — or disabled while busy, or externally stolen), Tab now pulls it back in instead of escaping. The previous branches only handled focus being exactly at a known boundary. - Focus restore checks opener.isConnected before calling focus(): the delete/ clear flows this targets often remove the element that opened the dialog, and a disconnected node's focus() silently no-ops. - Hoisted the focusable-element selector to a module constant, and excluded input[type="hidden"] (it matched input:not([disabled]) and, at a boundary, broke the wrap). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01H3zbym8Doka2d7D48maSgZ
Make the canvas keyboard-reachable + trap focus in dialogs (#84 )
2026-07-21 23:33:38 -04:00 · 2026-07-21 23:20:47 -04:00 · 2026-07-21 22:56:01 -04:00 · 2026-07-22 02:53:55 +00:00 · 2026-07-22 02:53:27 +00:00 · 2026-07-22 02:53:13 +00:00
30 changed files with 1853 additions and 123 deletions
@@ -129,21 +129,19 @@ fix what's real → merge when the pipeline is green. Do not grade Gadfly findin
 A push to `main` builds the image and deploys to Komodo; the live instance at
 `pansy.orgrimmar.dudenhoeffer.casa` updates a few minutes later.

-**Gadfly reviews the PR as opened, not as merged.** The workflow triggers on
-`opened`/`reopened`/`ready_for_review` — deliberately *not* `synchronize` — so
-every commit you push afterwards, including the ones you push in response to
-Gadfly itself, is unreviewed unless you ask. Once you've stopped pushing and
-before you merge, comment **`@gadfly review`** on the PR to re-trigger it. The
-phrase is required, and this is not hypothetical: on #76 the follow-up commit
-was the one that contained a real bug.
+**One sweep, not a loop.** Take Gadfly's *initial* review, fix what's real, and
+merge once the build is green. Do NOT re-trigger Gadfly on the fix commits and
+wait for it again — a re-review-per-fix loop burns ~10 min a pass and drags a
+small PR out for an hour (Steve's explicit call, 2026-07-22). The initial review
+is the check; your own build/test/judgment covers the fixes. Gadfly is advisory
+and never blocks merge, so green build + fixes applied is enough.

-**A skipped Gadfly run reports success.** A comment without the trigger phrase
-still starts the workflow, which logs `comment does not contain trigger phrase`
-and exits green in ~2 seconds. So "the pipeline is green" does NOT mean "this
-was reviewed". Confirm a re-review actually ran by its **duration** — a real
-pass takes ~10 minutes, a skip takes 2 seconds. Don't look for a new consensus
-comment: Gadfly EDITS its existing status-board and consensus comments in place,
-so their `created_at` stays at the first review and only `updated_at` moves.
+(Mechanics, if you ever *do* need a manual re-run: the workflow triggers on
+`opened`/`reopened`/`ready_for_review`, not `synchronize`, so pushes don't
+re-review; a `@gadfly review` comment does. A comment without that exact phrase
+still runs and exits green in ~2s — a skip that looks like a pass, so judge a
+real review by its ~10-min duration, not its status. Gadfly edits its consensus
+comment in place, so `updated_at` moves but `created_at` doesn't.)

 Workflow- and config-only changes (CI, this file, docs) go straight to `main`
 without the PR dance.
@@ -163,6 +161,25 @@ Agent config: `OLLAMA_CLOUD_API_KEY`, `PANSY_AGENT_MODEL` (default
 strings pass verbatim to `majordomo.Parse`, so a comma-separated spec gives
 failover for free — don't parse that grammar in pansy.

+The model and enabled flag are also **admin-editable at runtime** in Settings
+(#79); the env vars are just defaults (precedence: DB setting → env → default).
+Two things this makes load-bearing:
+
+- **The live Runner is hot-swapped, not built once.** It sits behind an
+  `atomic.Pointer` in `internal/api` (`agentHolder`), and its routes are
+  registered *unconditionally* with a nil-check on `agent.get()`. Do NOT go back
+  to registering the chat routes only when a key is present — a settings change
+  has to be able to turn the assistant on without a restart, which a missing
+  route can't. `/capabilities` reads the pointer, so it reflects the live state.
+- **`OLLAMA_CLOUD_API_KEY` stays in the environment, never the DB.** Model
+  selection is a setting; the key is not. A secret in `instance_settings` lands
+  in every backup and in the undo history's blast radius. The Settings API
+  reports whether a key is *present*, never its value.
+- The "how to turn a spec into a model" knowledge lives once in
+  `internal/agentmodel`, imported by both `agent` (to run) and `service` (to
+  validate a spec before storing it). It can't live in `agent` — `agent` imports
+  `service`, so a `service`→`agent` import would cycle.
+
 `majordomo` is a **real dependency** now, resolved from the Gitea instance as a
 pseudo-version. There is no `replace` directive and there must not be one: a
 `replace` pointing at `../majordomo` builds on your laptop and breaks the Docker
@@ -9,8 +9,9 @@ Work is tracked in Gitea issues; the tracking epic links every piece in dependen
 - **Placement model:** freeform plops (not a square-foot grid), scaled by real plant spacing. Grid snapping may come later as a toggle.
 - **Spacing is a plant-to-plant rule, so bed edges get half of it.** A bed edge is not a competitor for soil, light or water, so the outer row owes it half the spacing rather than a full one. `FillRegion` centres its lattice accordingly, and lets a plop — a *clump* three spacings across — cross the edge by up to half a spacing so its outermost plants land at that half-spacing. The rule, the square-foot-chart arithmetic behind it, and the failure mode it prevents are written out once in `hexCenters`; #75 is what getting it wrong looked like.
 - **Stack:** Go 1.26.x backend, module `gitea.stevedudenhoeffer.com/steve/pansy`; React + TypeScript + Vite + Tailwind frontend, production build embedded via `embed.FS` → one static binary (`CGO_ENABLED=0`).
- **Users:** multi-user with ownership. Users own gardens; a garden can be shared with other users as viewer (read) or editor (edit content). Owner additionally shares/deletes.
+- **Users:** multi-user with ownership. Users own gardens; a garden can be shared with other users as viewer (read) or editor (edit content). Owner additionally shares/deletes. The first registered user is `is_admin` (set race-free inside the INSERT); admin gates instance-wide Settings (`requireAdmin`), the only thing that reads that flag.
 - **Auth:** OIDC-first (Authentik is the primary IdP), local argon2id passwords as an optional fallback.
+- **Instance settings (#79):** admin-editable, instance-wide config in a single-row `instance_settings` table — pansy's first DB-stored *instance* state (everything else hangs off a garden/object). Today it holds the agent model + on/off; **secrets never move here** — `OLLAMA_CLOUD_API_KEY` stays in the env so it doesn't land in backups or the undo history. Precedence: Settings value → env → default. The live agent Runner sits behind an `atomic.Pointer` in the API layer (`agentHolder`) with its routes always registered, so a settings change swaps it with no restart and no race against in-flight requests; `/capabilities` reads that pointer, so it reports what's live rather than what was configured at boot. The model/registry knowledge lives in one leaf package (`internal/agentmodel`) that both the runner and the settings validator import — agent imports service, so it can live in neither.
 - **Agentic future:** integration with majordomo/executus via typed Go tools (`llm.DefineTool[Args]`) wrapping the same service layer the REST API uses — not MCP/OpenAPI.

 ## Domain model
@@ -72,7 +73,8 @@ GET,POST /gardens/:id/journal PATCH,DELETE /journal/:id           (editor writes
 GET  /gardens/:id/journal/counts  ← entries per object, for the "has notes" indicator
 POST /agent/chat              ← SSE: step events, then the finished turn (editor only)
 GET,DELETE /gardens/:id/agent/history                             (the actor's own thread)
-GET  /capabilities            ← what this instance can do, so the UI offers only what works
+GET  /capabilities            ← what this instance can do RIGHT NOW (tracks the live agent, not just config)
+GET,PATCH /settings           ← instance-wide config (admin only): agent model + on/off
 GET,POST /gardens/:id/shares  PATCH,DELETE /gardens/:id/shares/:userId    (invite by email)
 GET,POST,DELETE /gardens/:id/share-link   ← the public read-only token for this garden
 GET  /public/gardens/:token   ← UNAUTHENTICATED read-only /full; the token is the capability
@@ -67,13 +67,15 @@ The garden assistant reads three more. Setting none of them leaves the assistant

 | Variable                | Default                        | Description                                                                 |
 | ----------------------- | ------------------------------ | --------------------------------------------------------------------------- |
-| `OLLAMA_CLOUD_API_KEY`  | *(empty)*                      | Ollama Cloud API key. Without it the assistant is disabled, not broken — the chat routes simply aren't registered. |
-| `PANSY_AGENT_MODEL`     | `ollama-cloud/glm-5.2:cloud`   | Model spec, passed verbatim to `majordomo.Parse` — a comma-separated list is a failover chain, e.g. `ollama-cloud/glm-5.2:cloud,ollama-cloud/kimi-k2.6:cloud`. |
-| `PANSY_AGENT_ENABLED`   | on when a key is present       | Turns the assistant off without removing the key.                            |
+| `OLLAMA_CLOUD_API_KEY`  | *(empty)*                      | Ollama Cloud API key. Without it the assistant is off, not broken. This is the one agent value that stays in the environment — it is **never** stored in the database or editable in Settings. |
+| `PANSY_AGENT_MODEL`     | `ollama-cloud/glm-5.2:cloud`   | Default model spec, passed verbatim to `majordomo.Parse` — a comma-separated list is a failover chain, e.g. `ollama-cloud/glm-5.2:cloud,ollama-cloud/kimi-k2.6:cloud`. An admin can override this per-instance in **Settings** without a redeploy; a blank Settings value inherits this. |
+| `PANSY_AGENT_ENABLED`   | on when a key is present       | Default on/off for the assistant. Also overridable in Settings (which can inherit this default). |
+
+The model and enabled flag can be changed at runtime by an admin under **Settings** (the gear appears in the nav for admins) — the change swaps the live assistant with no restart. The env vars above are the defaults an untouched instance uses, and the API key is intentionally not among the runtime-editable settings: a secret in the database would land in every backup. Precedence for the model and enabled flag is **Settings value, if set → env var → built-in default**.

 The assistant acts without asking first, which is only reasonable because every turn is one undoable change set — see the History panel in the editor.

-**If you set the key and the assistant still doesn't appear**, check that the variable reaches the *container*, not just your orchestrator's stack config — Compose needs it listed under the service's `environment:`. pansy logs `garden assistant disabled` at startup with which of the three conditions failed, so the answer is in the first few lines of the log.
+**If you set the key and the assistant still doesn't appear**, check that the variable reaches the *container*, not just your orchestrator's stack config — Compose needs it listed under the service's `environment:`. pansy logs why the assistant is off at startup, and Settings shows the same status (a key present, the resolved model, and whether it's actually running).

 Local email/password auth is live (`POST /api/v1/auth/register`, `/auth/login`, `/auth/logout`, `GET /auth/me`, `GET /auth/providers`); the session is an HttpOnly cookie (`Secure` when `PANSY_BASE_URL` is https). The first account registered becomes admin, and it may register even when `PANSY_REGISTRATION=closed` to bootstrap the instance.

@@ -10,12 +10,10 @@ import (
 	"strings"
 	"time"

-	"gitea.stevedudenhoeffer.com/steve/majordomo"
 	"gitea.stevedudenhoeffer.com/steve/majordomo/agent"
 	"gitea.stevedudenhoeffer.com/steve/majordomo/llm"
-	"gitea.stevedudenhoeffer.com/steve/majordomo/provider/ollama"

-	"gitea.stevedudenhoeffer.com/steve/pansy/internal/config"
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/agentmodel"
 	"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
 	"gitea.stevedudenhoeffer.com/steve/pansy/internal/service"
 )
@@ -41,29 +39,23 @@ type Runner struct {
 	model llm.Model
 }

-// NewRunner resolves the configured model and returns a Runner, or an error if
-// the assistant can't be offered. Callers should treat an error as "no
-// assistant" rather than a startup failure — an instance with no key must still
-// serve the app.
-func NewRunner(svc *service.Service, cfg *config.Config) (*Runner, error) {
-	if !cfg.Agent.Ready() {
+// NewRunner resolves modelSpec against pansy's registry and returns a Runner, or
+// an error if the assistant can't be offered. Callers should treat an error as
+// "no assistant" rather than a startup failure — an instance with no key must
+// still serve the app.
+//
+// It takes the key and spec explicitly rather than a *config.Config so the same
+// constructor serves both boot (from env) and a runtime settings change (from
+// the DB) — the Runner has no idea which one configured it.
+func NewRunner(svc *service.Service, apiKey, modelSpec string) (*Runner, error) {
+	if apiKey == "" {
 		return nil, errors.New("agent: not configured")
 	}
-
-	// A private registry, not the package-level default: pansy passes the key it
-	// was configured with rather than depending on ambient environment, and
-	// majordomo's own ollama-cloud preset reads OLLAMA_API_KEY while pansy (like
-	// gadfly) is configured with OLLAMA_CLOUD_API_KEY. Registering the provider
-	// explicitly makes that bridge visible instead of a mysterious empty token.
-	reg := majordomo.New()
-	reg.RegisterProvider(ollama.Cloud(ollama.WithToken(cfg.Agent.OllamaCloudAPIKey)))
-
-	// The spec goes to Parse VERBATIM. The grammar — including comma-separated
-	// failover chains — is majordomo's, and re-implementing any of it here would
-	// only mean two places to update when it grows.
-	model, err := reg.Parse(cfg.Agent.Model)
+	// agentmodel.Resolve already rejects an empty/blank spec, so don't duplicate
+	// that guard here — one place decides what a valid spec is.
+	model, err := agentmodel.Resolve(apiKey, modelSpec)
 	if err != nil {
-		return nil, fmt.Errorf("agent: resolve model %q: %w", cfg.Agent.Model, err)
+		return nil, err
 	}
 	return &Runner{svc: svc, model: model}, nil
 }
@@ -13,7 +13,6 @@ import (
 	"gitea.stevedudenhoeffer.com/steve/majordomo/llm"
 	"gitea.stevedudenhoeffer.com/steve/majordomo/provider/fake"

-	"gitea.stevedudenhoeffer.com/steve/pansy/internal/config"
 	"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
 	"gitea.stevedudenhoeffer.com/steve/pansy/internal/service"
 )
@@ -232,24 +231,24 @@ func TestReadOnlyTurnWritesNoChangeSet(t *testing.T) {
 	}
 }

-// TestNewRunnerNeedsConfiguration — an instance with no key must not get a
-// half-built runner; the caller treats the error as "no assistant" and carries on.
+// TestNewRunnerNeedsConfiguration — an instance with no key or no model must not
+// get a half-built runner; the caller treats the error as "no assistant" and
+// carries on. (Whether the assistant is ENABLED is resolved before NewRunner is
+// reached, so it isn't NewRunner's concern any more.)
 func TestNewRunnerNeedsConfiguration(t *testing.T) {
 	svc, _ := newAgentTestService(t)
-	for _, cfg := range []*config.Config{
-		{Agent: config.AgentConfig{Enabled: false, OllamaCloudAPIKey: "k", Model: "ollama-cloud/x"}},
-		{Agent: config.AgentConfig{Enabled: true, OllamaCloudAPIKey: "", Model: "ollama-cloud/x"}},
-		{Agent: config.AgentConfig{Enabled: true, OllamaCloudAPIKey: "k", Model: ""}},
+	for _, tc := range []struct{ key, model string }{
+		{"", "ollama-cloud/x"},
+		{"k", ""},
+		{"k", "   "},
 	} {
-		if _, err := NewRunner(svc, cfg); err == nil {
-			t.Errorf("NewRunner accepted %+v", cfg.Agent)
+		if _, err := NewRunner(svc, tc.key, tc.model); err == nil {
+			t.Errorf("NewRunner accepted key=%q model=%q", tc.key, tc.model)
 		}
 	}
 	// A model spec naming a provider that doesn't exist is a configuration
 	// error, not a panic at first use.
-	if _, err := NewRunner(svc, &config.Config{Agent: config.AgentConfig{
-		Enabled: true, OllamaCloudAPIKey: "k", Model: "nonesuch/model",
-	}}); err == nil {
+	if _, err := NewRunner(svc, "k", "nonesuch/model"); err == nil {
 		t.Error("NewRunner accepted an unresolvable model spec")
 	}
 }
@@ -0,0 +1,57 @@
+// Package agentmodel holds the ONE place that knows how pansy turns a model spec
+// into a majordomo model: which provider to register and under which token.
+//
+// It exists as a leaf so both internal/agent (which builds the run loop) and
+// internal/service (which validates a spec before storing it as a setting) can
+// share that knowledge without an import cycle — agent imports service, so the
+// shared bit can live in neither of them.
+package agentmodel
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"gitea.stevedudenhoeffer.com/steve/majordomo"
+	"gitea.stevedudenhoeffer.com/steve/majordomo/llm"
+	"gitea.stevedudenhoeffer.com/steve/majordomo/provider/ollama"
+)
+
+// registry builds the private majordomo registry pansy uses.
+//
+// Private, not the package-level default: pansy passes the key it was configured
+// with rather than depending on ambient environment, and majordomo's own
+// ollama-cloud preset reads OLLAMA_API_KEY while pansy (like gadfly) is
+// configured with OLLAMA_CLOUD_API_KEY. Registering the provider explicitly
+// makes that bridge visible instead of a mysterious empty token.
+func registry(apiKey string) *majordomo.Registry {
+	reg := majordomo.New()
+	reg.RegisterProvider(ollama.Cloud(ollama.WithToken(apiKey)))
+	return reg
+}
+
+// Resolve parses a model spec against pansy's registry into a live model. The
+// spec goes to Parse VERBATIM — the grammar, including comma-separated failover
+// chains, is majordomo's, and re-implementing any of it here would only mean two
+// places to update when it grows.
+func Resolve(apiKey, spec string) (llm.Model, error) {
+	if strings.TrimSpace(spec) == "" {
+		return nil, errors.New("agentmodel: empty model spec")
+	}
+	m, err := registry(apiKey).Parse(spec)
+	if err != nil {
+		return nil, fmt.Errorf("agentmodel: resolve %q: %w", spec, err)
+	}
+	return m, nil
+}
+
+// Validate reports whether a spec resolves, without building anything the caller
+// keeps — the cheap, deterministic check a settings save runs to reject a typo.
+//
+// It does NOT make a live call, so it needs no working key and won't catch a
+// model that is merely absent upstream; that surfaces on first use. Parse
+// resolving (known provider, well-formed spec) is the half worth doing eagerly.
+func Validate(apiKey, spec string) error {
+	_, err := Resolve(apiKey, spec)
+	return err
+}
@@ -0,0 +1,35 @@
+package agentmodel
+
+import "testing"
+
+// TestValidate is what the settings PATCH relies on to reject a typo at save
+// time rather than on the next chat turn.
+func TestValidate(t *testing.T) {
+	if err := Validate("k", "ollama-cloud/glm-5.2:cloud"); err != nil {
+		t.Errorf("valid spec rejected: %v", err)
+	}
+	// No key needed to validate — Parse resolves the provider, it doesn't call it.
+	if err := Validate("", "ollama-cloud/glm-5.2:cloud"); err != nil {
+		t.Errorf("valid spec rejected without a key: %v", err)
+	}
+	// A comma-separated failover chain is majordomo grammar and must resolve.
+	if err := Validate("k", "ollama-cloud/glm-5.2:cloud,ollama-cloud/kimi-k2.6:cloud"); err != nil {
+		t.Errorf("failover chain rejected: %v", err)
+	}
+	for _, bad := range []string{"", "   ", "nonesuch/model"} {
+		if err := Validate("k", bad); err == nil {
+			t.Errorf("Validate accepted %q", bad)
+		}
+	}
+}
+
+// TestResolveReturnsAModel confirms a good spec yields a usable model handle.
+func TestResolveReturnsAModel(t *testing.T) {
+	m, err := Resolve("k", "ollama-cloud/glm-5.2:cloud")
+	if err != nil {
+		t.Fatalf("resolve: %v", err)
+	}
+	if m == nil {
+		t.Fatal("resolve returned a nil model with no error")
+	}
+}
@@ -56,6 +56,16 @@ type stepEvent struct {
 }

 func (h *handlers) agentChat(c *gin.Context) {
+	// The route is always registered, so the assistant being off is a runtime
+	// state, not a missing route: answer it plainly rather than 404ing a path
+	// that exists. Loaded once here so a settings-driven swap mid-request can't
+	// make it flip between the guard and the Run call.
+	runner := h.agent.get()
+	if runner == nil {
+		writeAPIError(c, http.StatusServiceUnavailable, "AGENT_DISABLED", "the garden assistant isn't enabled on this instance")
+		return
+	}
+
 	var req chatRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
 		writeAPIError(c, http.StatusBadRequest, "INVALID_INPUT", "a gardenId and a message are required")
@@ -78,7 +88,7 @@ func (h *handlers) agentChat(c *gin.Context) {
 	stopBeat := stream.keepAlive(keepAliveInterval)
 	defer stopBeat()

-	turn, err := h.agent.Run(c.Request.Context(), actor.ID, req.GardenID, req.Message,
+	turn, err := runner.Run(c.Request.Context(), actor.ID, req.GardenID, req.Message,
 		replayHistory(history),
 		func(s mdagent.Step) {
 			send(chatEvent{Step: &stepEvent{Index: s.Index, Tools: toolNames(s)}})
@@ -108,6 +118,21 @@ func (h *handlers) agentChat(c *gin.Context) {
 	send(chatEvent{Done: turn})
 }

+// sseWriteTimeout bounds ONE write to the stream, not the stream itself.
+//
+// It is refreshed per frame, which is the only shape that satisfies both ends:
+// the server's absolute WriteTimeout would cut a long turn (#78), while removing
+// the deadline entirely would let a client that stops reading block a write
+// forever once the socket buffer fills — pinning the run goroutine and this
+// stream's mutex with it, and taking the keep-alive down too since it needs the
+// same lock. Generous, because it is a backstop against a stuck peer and not a
+// pacing mechanism.
+//
+// A var, not a const, ONLY so the test can shrink it to prove the deadline is
+// refreshed per frame rather than set once — a set-once 30s deadline would pass
+// a test whose whole run is under a second. Production never reassigns it.
+var sseWriteTimeout = 30 * time.Second
+
 // eventStream serializes writes to one SSE response.
 //
 // The mutex is load-bearing, not decoration: step events are sent from the
@@ -116,6 +141,7 @@ func (h *handlers) agentChat(c *gin.Context) {
 // frames long before it crashes anything.
 type eventStream struct {
 	c  *gin.Context
+	rc *http.ResponseController
 	mu sync.Mutex
 }

@@ -124,12 +150,34 @@ type eventStream struct {
 // Headers go out before the first write and the stream is flushed immediately,
 // so a proxy holding the response until it looks complete can't reintroduce
 // exactly the silence streaming exists to remove.
+//
+// Taking the write deadline off the server's absolute WriteTimeout and onto a
+// per-write one is what makes a turn longer than 30s possible at all (#78).
+// WriteTimeout is an ABSOLUTE deadline from when the request header was read,
+// not an idle timeout, so a streaming response is cut mid-turn however recently
+// it wrote. Without this the 4-minute runTimeout is unreachable and the
+// keep-alive below tops out at one tick — pacing a connection that is destroyed
+// underneath it.
+//
+// That failure is INVISIBLE from in here: writes past the deadline return
+// err == nil and their bytes are dropped, so there is nothing to detect on the
+// write path. Only the client sees it, as a truncated stream it reports as a
+// dropped connection. Hence a deadline set up front and refreshed per frame,
+// rather than anything checked after the fact.
 func openEventStream(c *gin.Context) *eventStream {
 	c.Header("Content-Type", "text/event-stream")
 	c.Header("Cache-Control", "no-cache")
 	c.Header("X-Accel-Buffering", "no")
+	s := &eventStream{c: c, rc: http.NewResponseController(c.Writer)}
+	// Probe once here rather than reporting per frame: a writer that can't take
+	// deadlines will fail identically on every write, and the operator needs to
+	// hear it once. If this fails the stream still works — it is just back to
+	// being cut at WriteTimeout, which is worth saying out loud.
+	if err := s.rc.SetWriteDeadline(time.Now().Add(sseWriteTimeout)); err != nil {
+		slog.Error("api: SSE write deadlines unavailable; long turns will be truncated at the server WriteTimeout", "error", err)
+	}
 	c.Writer.Flush()
-	return &eventStream{c: c}
+	return s
 }

 func (s *eventStream) send(ev chatEvent) {
@@ -144,6 +192,11 @@ func (s *eventStream) send(ev chatEvent) {
 func (s *eventStream) write(frame string) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
+	// Refresh for THIS write, so the stream as a whole is unbounded but no single
+	// write is. Error deliberately unchecked: openEventStream already reported
+	// whether deadlines work at all, and this call can only fail the same way, so
+	// checking here would log once per frame to say the same thing.
+	_ = s.rc.SetWriteDeadline(time.Now().Add(sseWriteTimeout))
 	_, _ = io.WriteString(s.c.Writer, frame)
 	s.c.Writer.Flush()
 }
@@ -0,0 +1,89 @@
+package api
+
+import (
+	"context"
+	"log/slog"
+	"sync"
+	"sync/atomic"
+
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/agent"
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/service"
+)
+
+// agentHolder owns the live assistant Runner and lets an admin swap it at
+// runtime when the model settings change (#79).
+//
+// The Runner used to be a plain handlers field set once at boot, with the chat
+// routes registered only when it existed. That made the assistant permanently
+// whatever the environment said at startup. Now the routes are always
+// registered and the Runner lives behind an atomic pointer, so a settings change
+// can turn the assistant on, off, or onto a different model without a restart —
+// and without a data race against in-flight requests reading the pointer.
+//
+// A nil pointer means "no assistant right now"; handlers nil-check get() rather
+// than assuming a Runner is present.
+type agentHolder struct {
+	svc *service.Service
+
+	ptr atomic.Pointer[agent.Runner]
+	// rebuildMu serializes rebuilds so two concurrent settings saves can't
+	// interleave into a torn "resolve A, resolve B, store A, store B" swap. The
+	// read path (get) stays lock-free on the atomic pointer.
+	rebuildMu sync.Mutex
+}
+
+// newAgentHolder builds the holder and resolves the initial Runner from whatever
+// the settings + environment currently say. A resolution failure is logged and
+// left as "no assistant", never fatal: a garden planner must still boot.
+func newAgentHolder(ctx context.Context, svc *service.Service) *agentHolder {
+	h := &agentHolder{svc: svc}
+	h.rebuild(ctx)
+	return h
+}
+
+// get returns the current Runner, or nil if the assistant is off.
+func (h *agentHolder) get() *agent.Runner { return h.ptr.Load() }
+
+// rebuild resolves the effective agent configuration and swaps the Runner to
+// match: a new one when the assistant should be on, nil when it shouldn't. It is
+// safe to call at boot and from a settings save; concurrent calls serialize.
+//
+// It logs what it did rather than returning an error, because every caller wants
+// the same thing — best-effort apply, keep serving either way — and a settings
+// save must not fail just because the new model won't resolve. The save already
+// validated the spec; a rebuild failure here means the environment changed under
+// it, and "assistant off, with a reason in the log" is the right outcome.
+func (h *agentHolder) rebuild(ctx context.Context) {
+	h.rebuildMu.Lock()
+	defer h.rebuildMu.Unlock()
+
+	eff, err := h.svc.EffectiveAgent(ctx)
+	if err != nil {
+		// EffectiveAgent errors only if the settings row can't be read — a DB fault,
+		// and a very transient one when it happens right after a settings write. We
+		// keep the current Runner rather than tear down a working assistant on a
+		// blip: the state is already persisted, so the next rebuild (any later save,
+		// or a restart) reconciles it. Loud, because a persistent failure here means
+		// the live assistant no longer matches stored settings.
+		slog.Error("api: could not resolve agent settings; leaving the assistant as-is", "error", err)
+		return
+	}
+	if !eff.Ready() {
+		if h.ptr.Swap(nil) != nil {
+			slog.Info("api: garden assistant turned off",
+				"enabled", eff.Enabled, "hasKey", eff.APIKey != "", "hasModel", eff.Model != "")
+		}
+		return
+	}
+	runner, err := agent.NewRunner(h.svc, eff.APIKey, eff.Model)
+	if err != nil {
+		// Configured but unusable. Turn the assistant off rather than leaving a
+		// stale Runner on the old model — an admin who just pointed it at a broken
+		// spec should see it stop, not silently keep answering on the previous one.
+		slog.Error("api: garden assistant disabled (model won't resolve)", "error", err, "model", eff.Model)
+		h.ptr.Store(nil)
+		return
+	}
+	h.ptr.Store(runner)
+	slog.Info("api: garden assistant ready", "model", eff.Model)
+}
@@ -6,24 +6,40 @@ import (
 	"testing"
 )

-// TestAgentRoutesAbsentWithoutAKey — an instance with no API key must start,
-// serve the app, and simply not offer the assistant. The routes aren't
-// registered at all, so this is a 404 rather than a handler that apologizes:
-// the same shape as OIDC when unconfigured.
-func TestAgentRoutesAbsentWithoutAKey(t *testing.T) {
+// TestAgentDisabledWithoutAKey — an instance with no API key must start, serve
+// the app, and not offer the assistant.
+//
+// The contract CHANGED with #79: the chat route is now always registered (so a
+// settings change can turn the assistant on without a restart), so "off" is a
+// runtime 503 rather than a missing route. capabilities reports agent:false, and
+// the frontend keys the chat tab off that — so a user never reaches the 503.
+func TestAgentDisabledWithoutAKey(t *testing.T) {
 	r := authEngine(t, localCfg()) // localCfg has no agent configuration
 	cookie := registerAndCookie(t, r, "[email protected]")
 	gid := createGardenAPI(t, r, cookie, "G")

+	// Chat is refused, plainly, because there is no Runner to run.
 	w := doJSON(t, r, http.MethodPost, "/api/v1/agent/chat",
 		map[string]any{"gardenId": gid, "message": "plant garlic"}, cookie)
-	if w.Code != http.StatusNotFound {
-		t.Errorf("chat without a key: status %d, want 404", w.Code)
+	if w.Code != http.StatusServiceUnavailable {
+		t.Errorf("chat without a key: status %d, want 503", w.Code)
 	}

+	// Capabilities advertises the assistant as unavailable, which is what the UI
+	// actually consults.
+	w = doJSON(t, r, http.MethodGet, "/api/v1/capabilities", nil, cookie)
+	if w.Code != http.StatusOK {
+		t.Fatalf("capabilities: status %d", w.Code)
+	}
+	if agent, _ := decodeMap(t, w.Body.Bytes())["agent"].(bool); agent {
+		t.Error("capabilities reported agent:true with no key")
+	}
+
+	// History is just stored data behind the ordinary garden-role check, so it
+	// reads fine (empty) whether or not a Runner exists — it isn't gated on one.
 	path := "/api/v1/gardens/" + strconv.FormatInt(gid, 10) + "/agent/history"
-	if w := doJSON(t, r, http.MethodGet, path, nil, cookie); w.Code != http.StatusNotFound {
-		t.Errorf("history without a key: status %d, want 404", w.Code)
+	if w := doJSON(t, r, http.MethodGet, path, nil, cookie); w.Code != http.StatusOK {
+		t.Errorf("history without a key: status %d, want 200 (it's data, not the model)", w.Code)
 	}

 	// And the rest of the app is entirely unaffected.
@@ -6,13 +6,13 @@
 package api

 import (
+	"context"
 	"log/slog"
 	"net/http"

 	"github.com/gin-gonic/gin"
 	sloggin "github.com/samber/slog-gin"

-	"gitea.stevedudenhoeffer.com/steve/pansy/internal/agent"
 	"gitea.stevedudenhoeffer.com/steve/pansy/internal/config"
 	"gitea.stevedudenhoeffer.com/steve/pansy/internal/service"
 )
@@ -23,9 +23,12 @@ type handlers struct {
 	cfg  *config.Config
 	svc  *service.Service
 	oidc *oidcClient // nil unless OIDC is configured (see config.OIDCReady)
-	// agent is nil unless the assistant is configured; the chat routes are only
-	// registered when it isn't, so a handler never has to check.
-	agent *agent.Runner
+	// agent holds the live Runner behind an atomic pointer. Unlike oidc it is
+	// never nil — the holder is always present and its Runner may be nil when the
+	// assistant is off. The chat routes are registered unconditionally and
+	// nil-check agent.get(), so a settings change can turn the assistant on or off
+	// at runtime (#79) rather than only at boot.
+	agent *agentHolder
 }

 // New builds the gin engine with the standard middleware stack and registers the
@@ -131,37 +134,30 @@ func New(cfg *config.Config, svc *service.Service) *gin.Engine {
 	plantings.PATCH("/:id", h.updatePlanting)
 	plantings.DELETE("/:id", h.deletePlanting)

-	// The garden assistant, registered only when it can actually be offered —
-	// the same shape as OIDC. An instance with no API key serves the app
-	// normally and simply doesn't have these routes.
-	if !cfg.Agent.Ready() {
-		// Say WHY, at startup, in the logs an operator is already looking at.
-		// Someone who set the key and sees no assistant otherwise has nothing to
-		// check — and "is the variable reaching the container?" is exactly the
-		// question they need answered.
-		slog.Info("api: garden assistant disabled",
-			"enabled", cfg.Agent.Enabled,
-			"hasApiKey", cfg.Agent.OllamaCloudAPIKey != "",
-			"model", cfg.Agent.Model,
-			"hint", "needs OLLAMA_CLOUD_API_KEY set in the container's environment (not just the stack's)")
-	}
-	if cfg.Agent.Ready() {
-		runner, err := agent.NewRunner(svc, cfg)
-		if err != nil {
-			// Configured but unusable (an unresolvable model spec, say). Log it and
-			// carry on without the assistant rather than refusing to start: a
-			// garden planner that won't boot because of a chat feature is worse
-			// than one without chat.
-			slog.Error("api: garden assistant disabled", "error", err)
-		} else {
-			h.agent = runner
-			agentGroup := v1.Group("/agent", h.requireAuth())
-			agentGroup.POST("/chat", h.agentChat)
-			gardens.GET("/:id/agent/history", h.getAgentHistory)
-			gardens.DELETE("/:id/agent/history", h.deleteAgentHistory)
-			slog.Info("api: garden assistant enabled", "model", cfg.Agent.Model)
-		}
+	// The garden assistant. Its routes are registered UNCONDITIONALLY and the live
+	// Runner sits behind an atomic pointer in the holder, so a settings change can
+	// turn the assistant on or off at runtime (#79). Each handler nil-checks
+	// agent.get(); a chat request while the assistant is off gets a clean 503
+	// (AGENT_DISABLED), not a panic and not a missing route.
+	//
+	// The holder resolves its initial Runner from settings + environment at
+	// construction. If the key never reaches the container, the assistant is off
+	// and the reason is logged below — the same operability need #72 added.
+	h.agent = newAgentHolder(context.Background(), svc)
+	if cfg.Agent.OllamaCloudAPIKey == "" {
+		slog.Info("api: garden assistant has no API key",
+			"hint", "set OLLAMA_CLOUD_API_KEY in the container's environment (not just the stack's); the model can be chosen in Settings")
 	}
+	agentGroup := v1.Group("/agent", h.requireAuth())
+	agentGroup.POST("/chat", h.agentChat)
+	gardens.GET("/:id/agent/history", h.getAgentHistory)
+	gardens.DELETE("/:id/agent/history", h.deleteAgentHistory)
+
+	// Instance settings: admin-only, and the first thing to enforce is_admin.
+	// requireAdmin runs after requireAuth (it reads the actor requireAuth stored).
+	settings := v1.Group("/settings", h.requireAuth(), h.requireAdmin())
+	settings.GET("", h.getSettings)
+	settings.PATCH("", h.updateSettings)

 	// Undo. A change set is addressed by its own id; the service resolves the
 	// owning garden for the permission check, same as objects and plantings.
@@ -203,11 +199,12 @@ func New(cfg *config.Config, svc *service.Service) *gin.Engine {
 // capabilities reports what this instance can actually do, so the UI offers only
 // what works.
 //
-// It reports whether the runner BUILT, not whether it was configured: a
-// configured-but-unresolvable model leaves the routes unregistered, and saying
-// "yes" there would offer a chat tab whose first message 404s.
+// It reports whether the assistant is live RIGHT NOW, not merely configured:
+// the chat routes always exist, but a request while the Runner is nil is refused,
+// so offering the tab must track the live Runner. Reading agent.get() (an atomic
+// load) means this reflects a settings-driven swap on the very next poll.
 func (h *handlers) capabilities(c *gin.Context) {
-	c.JSON(http.StatusOK, gin.H{"agent": h.agent != nil})
+	c.JSON(http.StatusOK, gin.H{"agent": h.agent.get() != nil})
 }

 // healthz is a liveness probe: always returns {"ok": true} when the server is up.
@@ -0,0 +1,264 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+)
+
+func seedLotPath(id int64) string {
+	return "/api/v1/seed-lots/" + strconv.FormatInt(id, 10)
+}
+
+// decodeList decodes a bare JSON array body. Seed lot listing returns the array
+// directly rather than wrapping it (unlike /journal's {"entries": …}), so a
+// helper that assumed an object would quietly read nothing.
+func decodeList(t *testing.T, body []byte) []any {
+	t.Helper()
+	var out []any
+	if err := json.Unmarshal(body, &out); err != nil {
+		t.Fatalf("decode list: %v (%s)", err, body)
+	}
+	return out
+}
+
+// createPlantAPI makes a custom plant and returns its id.
+func createPlantAPI(t *testing.T, r *gin.Engine, cookie *http.Cookie, name string, spacing float64) int64 {
+	t.Helper()
+	w := doJSON(t, r, http.MethodPost, "/api/v1/plants", map[string]any{
+		"name": name, "category": "vegetable", "spacingCm": spacing, "color": "#4a7c3f", "icon": "🌱",
+	}, cookie)
+	if w.Code != http.StatusCreated {
+		t.Fatalf("create plant %q: status %d, body %s", name, w.Code, w.Body.String())
+	}
+	return int64(decodeMap(t, w.Body.Bytes())["id"].(float64))
+}
+
+// TestSeedLotCrudAPI walks the whole seed lot lifecycle over HTTP.
+//
+// It exists for the reason CLAUDE.md gives: service tests cannot see a route
+// that was never registered, or one registered with the wrong :param name. Every
+// other handler file had a sibling API test; this group did not, which is the
+// state PATCH/DELETE /journal/:id shipped in — implemented, unit-tested, and
+// completely unreachable.
+func TestSeedLotCrudAPI(t *testing.T) {
+	r := authEngine(t, localCfg())
+	cookie := registerAndCookie(t, r, "[email protected]")
+	plantID := createPlantAPI(t, r, cookie, "Music Garlic", 15)
+
+	// Create.
+	w := doJSON(t, r, http.MethodPost, "/api/v1/seed-lots", map[string]any{
+		"plantId": plantID, "vendor": "Johnny's", "sku": "2761",
+		"quantity": 100, "unit": "seeds", "packedForYear": 2026, "costCents": 495,
+	}, cookie)
+	if w.Code != http.StatusCreated {
+		t.Fatalf("create: status %d, body %s", w.Code, w.Body.String())
+	}
+	lot := decodeMap(t, w.Body.Bytes())
+	id := int64(lot["id"].(float64))
+	if lot["vendor"] != "Johnny's" || lot["unit"] != "seeds" {
+		t.Errorf("unexpected lot: %+v", lot)
+	}
+
+	// GET by id — the route most likely to be missing or mis-registered.
+	w = doJSON(t, r, http.MethodGet, seedLotPath(id), nil, cookie)
+	if w.Code != http.StatusOK {
+		t.Fatalf("get: status %d, body %s", w.Code, w.Body.String())
+	}
+	if got := decodeMap(t, w.Body.Bytes()); int64(got["id"].(float64)) != id {
+		t.Errorf("get returned id %v, want %d", got["id"], id)
+	}
+
+	// List, and the ?plantId= filter.
+	w = doJSON(t, r, http.MethodGet, "/api/v1/seed-lots", nil, cookie)
+	if w.Code != http.StatusOK {
+		t.Fatalf("list: status %d, body %s", w.Code, w.Body.String())
+	}
+	if n := len(decodeList(t, w.Body.Bytes())); n != 1 {
+		t.Fatalf("list returned %d lots, want 1: %s", n, w.Body.String())
+	}
+
+	other := createPlantAPI(t, r, cookie, "Cherokee Purple", 45)
+	w = doJSON(t, r, http.MethodGet, "/api/v1/seed-lots?plantId="+strconv.FormatInt(other, 10), nil, cookie)
+	if w.Code != http.StatusOK {
+		t.Fatalf("filtered list: status %d, body %s", w.Code, w.Body.String())
+	}
+	if n := len(decodeList(t, w.Body.Bytes())); n != 0 {
+		t.Errorf("filter by a plant with no lots returned %d, want 0", n)
+	}
+	// A bad plantId filter is 400, whether non-numeric or out of range — the
+	// handler rejects id < 1, not just unparseable strings.
+	for _, bad := range []string{"nope", "0", "-1"} {
+		if w := doJSON(t, r, http.MethodGet, "/api/v1/seed-lots?plantId="+bad, nil, cookie); w.Code != http.StatusBadRequest {
+			t.Errorf("plantId=%q filter = %d, want 400", bad, w.Code)
+		}
+	}
+
+	// PATCH with the current version.
+	w = doJSON(t, r, http.MethodPatch, seedLotPath(id), map[string]any{
+		"vendor": "Fedco", "version": lot["version"],
+	}, cookie)
+	if w.Code != http.StatusOK {
+		t.Fatalf("patch: status %d, body %s", w.Code, w.Body.String())
+	}
+	updated := decodeMap(t, w.Body.Bytes())
+	if updated["vendor"] != "Fedco" {
+		t.Errorf("vendor = %v, want Fedco", updated["vendor"])
+	}
+	if updated["version"].(float64) != lot["version"].(float64)+1 {
+		t.Errorf("patch didn't bump version: %v -> %v", lot["version"], updated["version"])
+	}
+
+	// A stale version conflicts and carries the current row back, so the client
+	// can rebase without a second request.
+	w = doJSON(t, r, http.MethodPatch, seedLotPath(id), map[string]any{
+		"vendor": "stale", "version": lot["version"],
+	}, cookie)
+	if w.Code != http.StatusConflict {
+		t.Fatalf("stale patch: status %d, want 409", w.Code)
+	}
+	if cur, ok := decodeMap(t, w.Body.Bytes())["current"].(map[string]any); !ok || cur["vendor"] != "Fedco" {
+		t.Errorf("409 body missing the current row: %s", w.Body.String())
+	}
+
+	// DELETE.
+	if w := doJSON(t, r, http.MethodDelete, seedLotPath(id), nil, cookie); w.Code != http.StatusNoContent {
+		t.Fatalf("delete: status %d, body %s", w.Code, w.Body.String())
+	}
+	if w := doJSON(t, r, http.MethodGet, seedLotPath(id), nil, cookie); w.Code != http.StatusNotFound {
+		t.Errorf("get after delete = %d, want 404", w.Code)
+	}
+}
+
+// TestSeedLotRemainingIsDerivedAPI checks that `remaining` reflects plantings
+// through the HTTP surface, not just in the service.
+//
+// DESIGN.md makes derivation load-bearing — "a decremented column drifts the
+// moment a planting is edited behind its back" — so a route that returned a
+// stored or stale figure would break the invariant silently, and the number is
+// the whole reason anyone opens the seed shelf.
+func TestSeedLotRemainingIsDerivedAPI(t *testing.T) {
+	r := authEngine(t, localCfg())
+	cookie := registerAndCookie(t, r, "[email protected]")
+	plantID := createPlantAPI(t, r, cookie, "Beans", 10)
+
+	w := doJSON(t, r, http.MethodPost, "/api/v1/seed-lots", map[string]any{
+		"plantId": plantID, "quantity": 50, "unit": "seeds",
+	}, cookie)
+	if w.Code != http.StatusCreated {
+		t.Fatalf("create lot: status %d, body %s", w.Code, w.Body.String())
+	}
+	lotID := int64(decodeMap(t, w.Body.Bytes())["id"].(float64))
+
+	gid := createGardenAPI(t, r, cookie, "G")
+	w = doJSON(t, r, http.MethodPost, objectsPath(gid), map[string]any{
+		"kind": "bed", "widthCm": 100, "heightCm": 100, "plantable": true,
+	}, cookie)
+	if w.Code != http.StatusCreated {
+		t.Fatalf("create object: status %d, body %s", w.Code, w.Body.String())
+	}
+	oid := int64(decodeMap(t, w.Body.Bytes())["id"].(float64))
+
+	// Plant 12 of them against the lot.
+	w = doJSON(t, r, http.MethodPost, objectPlantingsPath(oid), map[string]any{
+		"plantId": plantID, "xCm": 0, "yCm": 0, "radiusCm": 20, "count": 12, "seedLotId": lotID,
+	}, cookie)
+	if w.Code != http.StatusCreated {
+		t.Fatalf("create planting: status %d, body %s", w.Code, w.Body.String())
+	}
+
+	w = doJSON(t, r, http.MethodGet, seedLotPath(lotID), nil, cookie)
+	if w.Code != http.StatusOK {
+		t.Fatalf("get lot: status %d, body %s", w.Code, w.Body.String())
+	}
+	got := decodeMap(t, w.Body.Bytes())
+	if rem, ok := got["remaining"].(float64); !ok || rem != 38 {
+		t.Errorf("remaining = %v, want 38 (50 bought - 12 planted): %s", got["remaining"], w.Body.String())
+	}
+
+	// Over-plant it: 45 more (57 total against 50 bought) drives remaining
+	// NEGATIVE. That's deliberate — the number is a derived truth about what
+	// you've committed, not a floor clamped at zero, and "you've planted more than
+	// you bought" is exactly the signal a gardener wants rather than a hidden -7.
+	w = doJSON(t, r, http.MethodPost, objectPlantingsPath(oid), map[string]any{
+		"plantId": plantID, "xCm": 40, "yCm": 40, "radiusCm": 20, "count": 45, "seedLotId": lotID,
+	}, cookie)
+	if w.Code != http.StatusCreated {
+		t.Fatalf("over-plant: status %d, body %s", w.Code, w.Body.String())
+	}
+	w = doJSON(t, r, http.MethodGet, seedLotPath(lotID), nil, cookie)
+	if rem, ok := decodeMap(t, w.Body.Bytes())["remaining"].(float64); !ok || rem != -7 {
+		t.Errorf("remaining after over-planting = %v, want -7 (50 - 57)", rem)
+	}
+}
+
+// TestSeedLotsArePrivateAPI checks the ACL through the router.
+//
+// Lots are private to the buyer and deliberately never travel with a shared
+// garden, so another user must not be able to read or edit one. Per the
+// project's convention, no-access is ErrNotFound rather than ErrForbidden —
+// existence is masked — so every one of these is a 404, not a 403.
+func TestSeedLotsArePrivateAPI(t *testing.T) {
+	r := authEngine(t, localCfg())
+	alice := registerAndCookie(t, r, "[email protected]")
+	bob := registerAndCookie(t, r, "[email protected]")
+
+	plantID := createPlantAPI(t, r, alice, "Alice's garlic", 15)
+	w := doJSON(t, r, http.MethodPost, "/api/v1/seed-lots", map[string]any{
+		"plantId": plantID, "vendor": "Secret Vendor", "quantity": 10, "unit": "bulbs",
+	}, alice)
+	if w.Code != http.StatusCreated {
+		t.Fatalf("alice create: status %d, body %s", w.Code, w.Body.String())
+	}
+	lotID := int64(decodeMap(t, w.Body.Bytes())["id"].(float64))
+
+	for _, tc := range []struct {
+		name   string
+		method string
+		body   any
+	}{
+		{"get", http.MethodGet, nil},
+		{"patch", http.MethodPatch, map[string]any{"vendor": "hijacked", "version": 1}},
+		{"delete", http.MethodDelete, nil},
+	} {
+		if w := doJSON(t, r, tc.method, seedLotPath(lotID), tc.body, bob); w.Code != http.StatusNotFound {
+			t.Errorf("bob %s = %d, want 404 (existence is masked)", tc.name, w.Code)
+		}
+	}
+
+	// Bob's own listing must not include it either.
+	w = doJSON(t, r, http.MethodGet, "/api/v1/seed-lots", nil, bob)
+	if w.Code != http.StatusOK {
+		t.Fatalf("bob list: status %d", w.Code)
+	}
+	if n := len(decodeList(t, w.Body.Bytes())); n != 0 {
+		t.Errorf("bob sees %d of alice's lots, want 0: %s", n, w.Body.String())
+	}
+
+	// And it's still intact for alice.
+	if w := doJSON(t, r, http.MethodGet, seedLotPath(lotID), nil, alice); w.Code != http.StatusOK {
+		t.Errorf("alice lost access to her own lot: %d", w.Code)
+	}
+}
+
+// TestSeedLotsRequireAuthAPI: the group is behind requireAuth, and an
+// unauthenticated caller gets 401 rather than an empty list.
+func TestSeedLotsRequireAuthAPI(t *testing.T) {
+	r := authEngine(t, localCfg())
+	for _, tc := range []struct {
+		method, path string
+	}{
+		{http.MethodGet, "/api/v1/seed-lots"},
+		{http.MethodPost, "/api/v1/seed-lots"},
+		{http.MethodGet, seedLotPath(1)},
+		{http.MethodPatch, seedLotPath(1)},
+		{http.MethodDelete, seedLotPath(1)},
+	} {
+		if w := doJSON(t, r, tc.method, tc.path, nil, nil); w.Code != http.StatusUnauthorized {
+			t.Errorf("%s %s = %d, want 401", tc.method, tc.path, w.Code)
+		}
+	}
+}
@@ -0,0 +1,143 @@
+package api
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/service"
+)
+
+// Instance settings (#79): admin-only, instance-wide. The authoritative admin
+// check is in the service; requireAdmin here is a cheap early 403 that also
+// keeps the route group readable.
+
+// requireAdmin rejects a non-admin actor. It runs after requireAuth, so the
+// actor is already resolved and carries IsAdmin — no extra query. Returns 403
+// (not 404): a logged-in user knows settings exist, they just may not touch them.
+func (h *handlers) requireAdmin() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if !mustActor(c).IsAdmin {
+			writeAPIError(c, http.StatusForbidden, "FORBIDDEN", "admin access required")
+			c.Abort()
+			return
+		}
+		c.Next()
+	}
+}
+
+// settingsResponse is what GET/PATCH /settings return. It carries the stored
+// settings plus a read-only view of what's resolved and live, so the UI can show
+// "inheriting ollama-cloud/glm-5.2:cloud from the environment" and whether a key
+// is present — without ever exposing the key itself.
+type settingsResponse struct {
+	Settings *domain.InstanceSettings `json:"settings"`
+	// Effective is the configuration actually in force after layering settings
+	// over the environment.
+	Effective effectiveView `json:"effective"`
+}
+
+type effectiveView struct {
+	Model   string `json:"model"`
+	Enabled bool   `json:"enabled"`
+	// HasApiKey reports whether OLLAMA_CLOUD_API_KEY is set. The key itself is
+	// never serialized — an admin may know one exists, not what it is.
+	HasApiKey bool `json:"hasApiKey"`
+	// AgentLive is whether the assistant Runner is actually built right now. It
+	// can be false even when Enabled+HasApiKey are true (an unresolvable model),
+	// which is exactly the case the UI needs to surface.
+	AgentLive bool `json:"agentLive"`
+}
+
+// settingsPayload builds the response, or an error. It does NOT swallow an
+// EffectiveAgent failure into a misleading empty "effective" view — an empty
+// view would report no model and no key, which reads as "nothing configured"
+// rather than "we couldn't read it". Since EffectiveAgent re-reads the same row
+// GetInstanceSettings just returned, a failure here is a genuine DB fault worth
+// surfacing as a 500, not papering over.
+func (h *handlers) settingsPayload(c *gin.Context, st *domain.InstanceSettings) (settingsResponse, error) {
+	eff, err := h.svc.EffectiveAgent(c.Request.Context())
+	if err != nil {
+		return settingsResponse{}, err
+	}
+	return settingsResponse{
+		Settings: st,
+		Effective: effectiveView{
+			Model:     eff.Model,
+			Enabled:   eff.Enabled,
+			HasApiKey: eff.APIKey != "",
+			AgentLive: h.agent.get() != nil,
+		},
+	}, nil
+}
+
+func (h *handlers) getSettings(c *gin.Context) {
+	st, err := h.svc.GetInstanceSettings(c.Request.Context(), mustActor(c).ID)
+	if err != nil {
+		writeServiceError(c, err)
+		return
+	}
+	payload, err := h.settingsPayload(c, st)
+	if err != nil {
+		writeServiceError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, payload)
+}
+
+// settingsUpdateRequest is the PATCH body. agentModel "" means inherit the env
+// var. agentEnabled is json.RawMessage so an explicit null (inherit) is
+// distinguishable from an absent field and from true/false.
+type settingsUpdateRequest struct {
+	AgentModel   string          `json:"agentModel"`
+	AgentEnabled json.RawMessage `json:"agentEnabled"`
+	Version      int64           `json:"version" binding:"required"`
+}
+
+func (h *handlers) updateSettings(c *gin.Context) {
+	var req settingsUpdateRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		writeAPIError(c, http.StatusBadRequest, "INVALID_INPUT", "a current version is required")
+		return
+	}
+
+	// agentEnabled: absent or null → inherit (nil); true/false → explicit override.
+	// The shared parseNullable does exactly this three-way decode; present is
+	// irrelevant here because absent and null both mean "inherit".
+	enabled, _, err := parseNullable[bool](req.AgentEnabled)
+	if err != nil {
+		writeAPIError(c, http.StatusBadRequest, "INVALID_INPUT", "agentEnabled must be true, false, or null")
+		return
+	}
+
+	st, err := h.svc.UpdateInstanceSettings(c.Request.Context(), mustActor(c).ID, service.InstanceSettingsPatch{
+		AgentModel:   req.AgentModel,
+		AgentEnabled: enabled,
+		Version:      req.Version,
+	})
+	if err != nil {
+		if errors.Is(err, domain.ErrVersionConflict) {
+			writeVersionConflict(c, st)
+			return
+		}
+		writeServiceError(c, err)
+		return
+	}
+
+	// Apply the change to the LIVE assistant. Detached from the request context:
+	// the write is committed and the rebuild describes it, so a client that hangs
+	// up now must not leave the running Runner out of step with the stored
+	// settings. Mirrors the same reasoning as the history-write detachment.
+	h.agent.rebuild(context.WithoutCancel(c.Request.Context()))
+
+	payload, err := h.settingsPayload(c, st)
+	if err != nil {
+		writeServiceError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, payload)
+}
@@ -0,0 +1,208 @@
+package api
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/config"
+)
+
+// agentCfg is a config with the assistant configured — a (fake) key, on, and a
+// resolvable model. The key isn't real, but ValidateAgentModel/NewRunner only
+// PARSE the spec (no live call), so a Runner still builds and capabilities
+// reports it live. That's enough to exercise the runtime on/off swap.
+func agentCfg() *config.Config {
+	c := localCfg()
+	c.Agent = config.AgentConfig{
+		Model:             "ollama-cloud/glm-5.2:cloud",
+		OllamaCloudAPIKey: "test-key",
+		Enabled:           true,
+	}
+	return c
+}
+
+func settingsVersion(t *testing.T, r *gin.Engine, cookie *http.Cookie) int64 {
+	t.Helper()
+	w := doJSON(t, r, http.MethodGet, "/api/v1/settings", nil, cookie)
+	if w.Code != http.StatusOK {
+		t.Fatalf("get settings: status %d, body %s", w.Code, w.Body.String())
+	}
+	st, _ := decodeMap(t, w.Body.Bytes())["settings"].(map[string]any)
+	return int64(st["version"].(float64))
+}
+
+// TestSettingsAdminOnly: the first registered user is admin and can read/write
+// settings; a second user is not and gets 403 (not 404 — settings aren't a
+// masked resource).
+func TestSettingsAdminOnly(t *testing.T) {
+	r := authEngine(t, localCfg())
+	admin := registerAndCookie(t, r, "[email protected]") // first user → admin
+	member := registerAndCookie(t, r, "[email protected]")
+
+	if w := doJSON(t, r, http.MethodGet, "/api/v1/settings", nil, admin); w.Code != http.StatusOK {
+		t.Fatalf("admin GET settings: status %d, body %s", w.Code, w.Body.String())
+	}
+
+	if w := doJSON(t, r, http.MethodGet, "/api/v1/settings", nil, member); w.Code != http.StatusForbidden {
+		t.Errorf("member GET settings: status %d, want 403", w.Code)
+	}
+	if w := doJSON(t, r, http.MethodPatch, "/api/v1/settings",
+		map[string]any{"agentModel": "x", "version": 1}, member); w.Code != http.StatusForbidden {
+		t.Errorf("member PATCH settings: status %d, want 403", w.Code)
+	}
+	// Unauthenticated is 401, before the admin check.
+	if w := doJSON(t, r, http.MethodGet, "/api/v1/settings", nil, nil); w.Code != http.StatusUnauthorized {
+		t.Errorf("anonymous GET settings: status %d, want 401", w.Code)
+	}
+}
+
+// TestSettingsInheritFromEnv: an untouched instance reports the env model as
+// effective, and an empty stored model keeps inheriting it.
+func TestSettingsInheritFromEnv(t *testing.T) {
+	r := authEngine(t, agentCfg())
+	admin := registerAndCookie(t, r, "[email protected]")
+
+	w := doJSON(t, r, http.MethodGet, "/api/v1/settings", nil, admin)
+	if w.Code != http.StatusOK {
+		t.Fatalf("get: status %d, body %s", w.Code, w.Body.String())
+	}
+	body := decodeMap(t, w.Body.Bytes())
+	st := body["settings"].(map[string]any)
+	eff := body["effective"].(map[string]any)
+
+	if st["agentModel"] != "" {
+		t.Errorf("stored model = %v, want empty (inherit)", st["agentModel"])
+	}
+	if eff["model"] != "ollama-cloud/glm-5.2:cloud" {
+		t.Errorf("effective model = %v, want the env value", eff["model"])
+	}
+	if eff["hasApiKey"] != true || eff["agentLive"] != true {
+		t.Errorf("effective = %+v, want a key present and the agent live", eff)
+	}
+}
+
+// TestSettingsUpdateSwapsTheRunner is the core of #79: changing settings takes
+// effect on the LIVE assistant, with no restart. Driven entirely through HTTP.
+func TestSettingsUpdateSwapsTheRunner(t *testing.T) {
+	r := authEngine(t, agentCfg())
+	admin := registerAndCookie(t, r, "[email protected]")
+
+	capsAgent := func() bool {
+		w := doJSON(t, r, http.MethodGet, "/api/v1/capabilities", nil, admin)
+		return decodeMap(t, w.Body.Bytes())["agent"] == true
+	}
+
+	// Configured and on out of the box.
+	if !capsAgent() {
+		t.Fatal("assistant should be live at boot with a key + enabled")
+	}
+
+	// Turn it OFF via settings → capabilities flips immediately.
+	v := settingsVersion(t, r, admin)
+	w := doJSON(t, r, http.MethodPatch, "/api/v1/settings",
+		map[string]any{"agentModel": "", "agentEnabled": false, "version": v}, admin)
+	if w.Code != http.StatusOK {
+		t.Fatalf("disable: status %d, body %s", w.Code, w.Body.String())
+	}
+	if capsAgent() {
+		t.Error("assistant still live after being disabled — the runner wasn't swapped")
+	}
+	// Chat now refuses, at runtime, on a route that still exists.
+	gid := createGardenAPI(t, r, admin, "G")
+	if w := doJSON(t, r, http.MethodPost, "/api/v1/agent/chat",
+		map[string]any{"gardenId": gid, "message": "hi"}, admin); w.Code != http.StatusServiceUnavailable {
+		t.Errorf("chat while disabled: status %d, want 503", w.Code)
+	}
+
+	// Turn it back ON, with an explicit model, and confirm it's live again and the
+	// effective model reflects the change.
+	v = settingsVersion(t, r, admin)
+	w = doJSON(t, r, http.MethodPatch, "/api/v1/settings", map[string]any{
+		"agentModel": "ollama-cloud/kimi-k2.6:cloud", "agentEnabled": true, "version": v,
+	}, admin)
+	if w.Code != http.StatusOK {
+		t.Fatalf("re-enable: status %d, body %s", w.Code, w.Body.String())
+	}
+	if eff := decodeMap(t, w.Body.Bytes())["effective"].(map[string]any); eff["model"] != "ollama-cloud/kimi-k2.6:cloud" {
+		t.Errorf("effective model = %v after change, want the new one", eff["model"])
+	}
+	if !capsAgent() {
+		t.Error("assistant not live after being re-enabled")
+	}
+}
+
+// TestSettingsRejectsBadModel: a spec that won't resolve is a 400 at save time,
+// not a broken assistant on the next turn.
+func TestSettingsRejectsBadModel(t *testing.T) {
+	r := authEngine(t, agentCfg())
+	admin := registerAndCookie(t, r, "[email protected]")
+	v := settingsVersion(t, r, admin)
+
+	if w := doJSON(t, r, http.MethodPatch, "/api/v1/settings",
+		map[string]any{"agentModel": "nonesuch/model", "version": v}, admin); w.Code != http.StatusBadRequest {
+		t.Errorf("bad model: status %d, want 400", w.Code)
+	}
+	// agentEnabled must be a bool or null, not a string.
+	if w := doJSON(t, r, http.MethodPatch, "/api/v1/settings",
+		map[string]any{"agentModel": "", "agentEnabled": "yes", "version": v}, admin); w.Code != http.StatusBadRequest {
+		t.Errorf("string agentEnabled: status %d, want 400", w.Code)
+	}
+}
+
+// TestSettingsVersionConflict: a stale version 409s and carries the current row.
+func TestSettingsVersionConflict(t *testing.T) {
+	r := authEngine(t, agentCfg())
+	admin := registerAndCookie(t, r, "[email protected]")
+	v := settingsVersion(t, r, admin)
+
+	// First write succeeds and bumps the version.
+	if w := doJSON(t, r, http.MethodPatch, "/api/v1/settings",
+		map[string]any{"agentModel": "", "agentEnabled": false, "version": v}, admin); w.Code != http.StatusOK {
+		t.Fatalf("first update: status %d, body %s", w.Code, w.Body.String())
+	}
+	// Reusing the old version conflicts.
+	w := doJSON(t, r, http.MethodPatch, "/api/v1/settings",
+		map[string]any{"agentModel": "", "agentEnabled": true, "version": v}, admin)
+	if w.Code != http.StatusConflict {
+		t.Fatalf("stale update: status %d, want 409", w.Code)
+	}
+	if cur, ok := decodeMap(t, w.Body.Bytes())["current"].(map[string]any); !ok || cur["version"].(float64) != float64(v+1) {
+		t.Errorf("409 body missing the current row at the bumped version: %s", w.Body.String())
+	}
+}
+
+// TestSettingsSwapUnderRace runs settings saves concurrently with chat requests,
+// so `go test -race` proves the atomic swap of the live Runner is safe against
+// in-flight readers. The whole point of the atomic.Pointer is this: without it,
+// toggling the assistant while a request reads it is a data race.
+func TestSettingsSwapUnderRace(t *testing.T) {
+	r := authEngine(t, agentCfg())
+	admin := registerAndCookie(t, r, "[email protected]")
+
+	done := make(chan struct{})
+	// Readers hammer capabilities, whose h.agent.get() is the SAME atomic Load the
+	// chat handler does — so this races the pointer read against the writer's swap
+	// without ever invoking the model (a real Run would hit the network on a fake
+	// key). If get() is race-clean here it is race-clean in chat.
+	for i := 0; i < 4; i++ {
+		go func() {
+			for {
+				select {
+				case <-done:
+					return
+				default:
+					doJSON(t, r, http.MethodGet, "/api/v1/capabilities", nil, admin)
+				}
+			}
+		}()
+	}
+	// Writer: flip the assistant on and off, swapping the pointer each time.
+	for i := 0; i < 12; i++ {
+		v := settingsVersion(t, r, admin)
+		doJSON(t, r, http.MethodPatch, "/api/v1/settings",
+			map[string]any{"agentModel": "", "agentEnabled": i%2 == 0, "version": v}, admin)
+	}
+	close(done)
+}
@@ -0,0 +1,101 @@
+package api
+
+import (
+	"bufio"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+)
+
+// streamFrames spins up a real http.Server with the given WriteTimeout and an
+// SSE handler that emits `frames` data frames, one every `tick`, then returns.
+// It reports how many frames the client actually received and any read error —
+// the only vantage point from which the deadline failures in #78/#87 are
+// visible, since the writes themselves return nil when the bytes are dropped.
+func streamFrames(t *testing.T, serverWriteTimeout, tick time.Duration, frames int) (int, error) {
+	t.Helper()
+	gin.SetMode(gin.TestMode)
+	r := gin.New()
+	r.GET("/stream", func(c *gin.Context) {
+		s := openEventStream(c)
+		for i := 0; i < frames; i++ {
+			time.Sleep(tick)
+			s.send(chatEvent{Error: "frame"})
+		}
+	})
+
+	srv := httptest.NewUnstartedServer(r)
+	srv.Config.WriteTimeout = serverWriteTimeout
+	srv.Start()
+	defer srv.Close()
+
+	resp, err := srv.Client().Get(srv.URL + "/stream")
+	if err != nil {
+		t.Fatalf("get: %v", err)
+	}
+	defer resp.Body.Close()
+
+	got := 0
+	sc := bufio.NewScanner(resp.Body)
+	for sc.Scan() {
+		if strings.HasPrefix(sc.Text(), "data: ") {
+			got++
+		}
+	}
+	return got, sc.Err()
+}
+
+// TestEventStreamOutlivesServerWriteTimeout is the regression test for #78.
+//
+// http.Server.WriteTimeout is an ABSOLUTE deadline measured from when the
+// request header was read — not an idle timeout — so a streaming response is cut
+// once it passes, however recently the handler wrote. pansy sets it to 30s while
+// an agent turn may run for minutes. openEventStream must override it.
+//
+// This has to be asserted from the CLIENT side because the failure cannot be
+// observed from the handler: writes made after the deadline return err == nil
+// and their bytes are silently discarded. A test that checked the return of
+// io.WriteString would pass against the bug.
+func TestEventStreamOutlivesServerWriteTimeout(t *testing.T) {
+	// sseWriteTimeout stays at its 30s default here, so the per-frame refresh
+	// keeps the stream alive with a huge margin — CI slowness only ever makes
+	// this pass more surely. The server's 300ms WriteTimeout is the thing being
+	// overridden; frames straddle it (300ms/600ms/900ms).
+	got, err := streamFrames(t, 300*time.Millisecond, 300*time.Millisecond, 3)
+	if err != nil {
+		t.Errorf("client read error after %d/3 frames: %v", got, err)
+	}
+	if got != 3 {
+		t.Errorf("client received %d frames, want 3 — the stream was cut at the server WriteTimeout", got)
+	}
+}
+
+// TestEventStreamRefreshesDeadlinePerFrame guards the #87 fix specifically: the
+// write deadline is refreshed on EVERY frame, not set once.
+//
+// A set-once deadline is a plausible "simplification" and it reintroduces the
+// unbounded-block risk the per-frame refresh exists to prevent — yet it would
+// sail through the test above, whose whole run is far under sseWriteTimeout. So
+// shrink sseWriteTimeout below the stream's total duration and send frames whose
+// gap stays comfortably under it: per-frame refresh delivers them all, while a
+// deadline set once at open would expire mid-stream and cut it short.
+func TestEventStreamRefreshesDeadlinePerFrame(t *testing.T) {
+	orig := sseWriteTimeout
+	sseWriteTimeout = 400 * time.Millisecond
+	t.Cleanup(func() { sseWriteTimeout = orig })
+
+	// The server WriteTimeout is generous (5s), so it isn't the limiter — the
+	// per-frame sseWriteTimeout is. 8 frames at a 100ms tick span 800ms, well past
+	// the 400ms deadline, but each 100ms gap is a 4× margin under it.
+	got, err := streamFrames(t, 5*time.Second, 100*time.Millisecond, 8)
+	if err != nil {
+		t.Errorf("client read error after %d/8 frames: %v", got, err)
+	}
+	if got != 8 {
+		t.Errorf("client received %d frames, want 8 — a set-once deadline would cut the stream at ~%v; the refresh must be per-frame",
+			got, sseWriteTimeout)
+	}
+}
@@ -76,13 +76,6 @@ type AgentConfig struct {
 	Enabled bool
 }

-// Ready reports whether the assistant can actually be offered. Both the route
-// registration and whatever advertises capabilities gate on this, so what's
-// advertised always matches what's live.
-func (a AgentConfig) Ready() bool {
-	return a.Enabled && a.OllamaCloudAPIKey != "" && a.Model != ""
-}
-
 // Enabled reports whether enough OIDC config is present to attempt discovery.
 func (o OIDCConfig) Enabled() bool {
 	return o.Issuer != "" && o.ClientID != ""
@@ -242,6 +242,22 @@ const (
 	ConflictUnsupported = "unsupported"
 )

+// InstanceSettings is the single row of instance-wide, admin-editable
+// configuration (#79). Secrets are deliberately absent — see migration 0010.
+//
+// Both agent fields express "inherit from the environment unless set":
+// AgentModel == "" falls back to PANSY_AGENT_MODEL; AgentEnabled == nil inherits
+// the env default. EffectiveAgent resolves them against the environment.
+type InstanceSettings struct {
+	// AgentModel overrides PANSY_AGENT_MODEL when non-empty. Passed verbatim to
+	// majordomo.Parse, exactly like the env var it shadows.
+	AgentModel string `json:"agentModel"`
+	// AgentEnabled overrides PANSY_AGENT_ENABLED when non-nil. nil = inherit.
+	AgentEnabled *bool  `json:"agentEnabled"`
+	Version      int64  `json:"version"`
+	UpdatedAt    string `json:"updatedAt"`
+}
+
 // User is a pansy account. It may have a local password, OIDC identity, or both.
 type User struct {
 	ID           int64   `json:"id"`
@@ -0,0 +1,110 @@
+package service
+
+import (
+	"context"
+	"strings"
+
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/agentmodel"
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
+)
+
+// Instance settings (#79): admin-editable, instance-wide configuration. The
+// admin gate lives HERE, in the seam, not in the handler — the same rule every
+// other permission follows. The API's requireAdmin middleware is a cheap early
+// 403, not the authority.
+
+// requireAdmin returns nil iff the actor is an admin, else ErrForbidden.
+//
+// ErrForbidden, not ErrNotFound: settings are not a resource whose existence is
+// masked. A logged-in non-admin knows the instance has settings; they simply may
+// not touch them. (Contrast objects/lots, where no-access masks existence.)
+func (s *Service) requireAdmin(ctx context.Context, actorID int64) error {
+	u, err := s.store.GetUserByID(ctx, actorID)
+	if err != nil {
+		return err
+	}
+	if !u.IsAdmin {
+		return domain.ErrForbidden
+	}
+	return nil
+}
+
+// GetInstanceSettings returns the instance settings for an admin.
+func (s *Service) GetInstanceSettings(ctx context.Context, actorID int64) (*domain.InstanceSettings, error) {
+	if err := s.requireAdmin(ctx, actorID); err != nil {
+		return nil, err
+	}
+	return s.store.GetInstanceSettings(ctx)
+}
+
+// InstanceSettingsPatch is a full replacement of the editable fields plus the
+// current version. Both agent fields carry their "inherit" sentinel: an empty
+// AgentModel means fall back to env, a nil AgentEnabled means inherit.
+type InstanceSettingsPatch struct {
+	AgentModel   string
+	AgentEnabled *bool
+	Version      int64
+}
+
+// UpdateInstanceSettings applies an admin's change, version-guarded. It returns
+// (current row, ErrVersionConflict) on a stale version, like every mutable
+// resource. The model spec is validated before it is stored, so a typo is a 400
+// now rather than a broken assistant on the next turn.
+//
+// It does NOT rebuild the running agent — that is the API layer's job, because
+// the live Runner lives there. The caller rebuilds on success.
+func (s *Service) UpdateInstanceSettings(ctx context.Context, actorID int64, patch InstanceSettingsPatch) (*domain.InstanceSettings, error) {
+	if err := s.requireAdmin(ctx, actorID); err != nil {
+		return nil, err
+	}
+	model := strings.TrimSpace(patch.AgentModel)
+	// Validate a non-empty spec up front. An empty one is the "inherit env"
+	// sentinel and needs no check — the env value was validated at boot.
+	if model != "" {
+		if err := agentmodel.Validate(s.cfg.Agent.OllamaCloudAPIKey, model); err != nil {
+			return nil, domain.ErrInvalidInput
+		}
+	}
+	return s.store.UpdateInstanceSettings(ctx, &domain.InstanceSettings{
+		AgentModel:   model,
+		AgentEnabled: patch.AgentEnabled,
+		Version:      patch.Version,
+	})
+}
+
+// EffectiveAgent resolves the agent configuration actually in force: DB settings
+// override the environment, and the API key always comes from the environment.
+//
+// This is internal plumbing (the API layer calls it to build the Runner), NOT an
+// admin-gated operation — resolving what's configured is not the same as editing
+// it, and the agent bootstrap must work before any user is even authenticated.
+type EffectiveAgent struct {
+	Model   string
+	Enabled bool
+	APIKey  string
+}
+
+// Ready mirrors config.AgentConfig.Ready: enabled, with a key and a model.
+func (e EffectiveAgent) Ready() bool {
+	return e.Enabled && e.APIKey != "" && e.Model != ""
+}
+
+// EffectiveAgent reads the settings row and layers it over the environment.
+func (s *Service) EffectiveAgent(ctx context.Context) (EffectiveAgent, error) {
+	st, err := s.store.GetInstanceSettings(ctx)
+	if err != nil {
+		return EffectiveAgent{}, err
+	}
+	eff := EffectiveAgent{
+		Model:   s.cfg.Agent.Model,
+		Enabled: s.cfg.Agent.Enabled,
+		APIKey:  s.cfg.Agent.OllamaCloudAPIKey,
+	}
+	if st.AgentModel != "" {
+		eff.Model = st.AgentModel
+	}
+	if st.AgentEnabled != nil {
+		eff.Enabled = *st.AgentEnabled
+	}
+	return eff, nil
+}
@@ -0,0 +1,117 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/config"
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
+)
+
+// settingsTestService builds a service whose env config carries the given agent
+// model/enabled/key, so EffectiveAgent's env fallback can be exercised.
+func settingsTestService(t *testing.T, envModel string, envEnabled bool, key string) (*Service, int64) {
+	t.Helper()
+	cfg := openConfig()
+	cfg.Agent = config.AgentConfig{Model: envModel, Enabled: envEnabled, OllamaCloudAPIKey: key}
+	s := newTestService(t, cfg)
+	admin := seedUser(t, s, "[email protected]") // first user is admin
+	return s, admin
+}
+
+// TestRequireAdmin: the first user is admin; a second is not and gets
+// ErrForbidden (not ErrNotFound — settings existence isn't masked).
+func TestRequireAdmin(t *testing.T) {
+	s, admin := settingsTestService(t, "ollama-cloud/x", true, "k")
+	member := seedUser(t, s, "[email protected]")
+
+	if err := s.requireAdmin(context.Background(), admin); err != nil {
+		t.Errorf("admin rejected: %v", err)
+	}
+	if err := s.requireAdmin(context.Background(), member); !errors.Is(err, domain.ErrForbidden) {
+		t.Errorf("member requireAdmin = %v, want ErrForbidden", err)
+	}
+}
+
+// TestEffectiveAgentLayering: DB settings override env; the API key always comes
+// from env; the "inherit" sentinels fall back.
+func TestEffectiveAgentLayering(t *testing.T) {
+	ctx := context.Background()
+	s, admin := settingsTestService(t, "ollama-cloud/env-model", true, "envkey")
+
+	// Untouched: everything inherits env.
+	eff, err := s.EffectiveAgent(ctx)
+	if err != nil {
+		t.Fatalf("effective: %v", err)
+	}
+	if eff.Model != "ollama-cloud/env-model" || !eff.Enabled || eff.APIKey != "envkey" {
+		t.Errorf("inherited effective = %+v, want the env values", eff)
+	}
+
+	// Override the model only; enabled still inherits env (true).
+	cur, _ := s.GetInstanceSettings(ctx, admin)
+	if _, err := s.UpdateInstanceSettings(ctx, admin, InstanceSettingsPatch{
+		AgentModel: "ollama-cloud/glm-5.2:cloud", Version: cur.Version,
+	}); err != nil {
+		t.Fatalf("update model: %v", err)
+	}
+	eff, _ = s.EffectiveAgent(ctx)
+	if eff.Model != "ollama-cloud/glm-5.2:cloud" {
+		t.Errorf("model = %q, want the DB override", eff.Model)
+	}
+	if !eff.Enabled {
+		t.Error("enabled should still inherit env (true) when unset")
+	}
+
+	// Now override enabled to false explicitly.
+	cur, _ = s.GetInstanceSettings(ctx, admin)
+	no := false
+	if _, err := s.UpdateInstanceSettings(ctx, admin, InstanceSettingsPatch{
+		AgentModel: "ollama-cloud/glm-5.2:cloud", AgentEnabled: &no, Version: cur.Version,
+	}); err != nil {
+		t.Fatalf("update enabled: %v", err)
+	}
+	eff, _ = s.EffectiveAgent(ctx)
+	if eff.Enabled {
+		t.Error("enabled should be the explicit false override now")
+	}
+	if eff.Ready() {
+		t.Error("Ready() should be false when disabled")
+	}
+}
+
+// TestUpdateInstanceSettingsRejectsBadModel: a spec that won't resolve is
+// ErrInvalidInput, before it is stored.
+func TestUpdateInstanceSettingsRejectsBadModel(t *testing.T) {
+	ctx := context.Background()
+	s, admin := settingsTestService(t, "ollama-cloud/x", true, "k")
+	cur, _ := s.GetInstanceSettings(ctx, admin)
+
+	if _, err := s.UpdateInstanceSettings(ctx, admin, InstanceSettingsPatch{
+		AgentModel: "nonesuch/model", Version: cur.Version,
+	}); !errors.Is(err, domain.ErrInvalidInput) {
+		t.Errorf("bad model = %v, want ErrInvalidInput", err)
+	}
+
+	// The rejected write didn't touch the row.
+	after, _ := s.GetInstanceSettings(ctx, admin)
+	if after.Version != cur.Version || after.AgentModel != "" {
+		t.Errorf("a rejected update changed the row: %+v", after)
+	}
+}
+
+// TestInstanceSettingsAdminGate: the read/write operations are admin-gated at the
+// service seam, not just in the handler.
+func TestInstanceSettingsAdminGate(t *testing.T) {
+	ctx := context.Background()
+	s, _ := settingsTestService(t, "ollama-cloud/x", true, "k")
+	member := seedUser(t, s, "[email protected]")
+
+	if _, err := s.GetInstanceSettings(ctx, member); !errors.Is(err, domain.ErrForbidden) {
+		t.Errorf("member GetInstanceSettings = %v, want ErrForbidden", err)
+	}
+	if _, err := s.UpdateInstanceSettings(ctx, member, InstanceSettingsPatch{Version: 1}); !errors.Is(err, domain.ErrForbidden) {
+		t.Errorf("member UpdateInstanceSettings = %v, want ErrForbidden", err)
+	}
+}
@@ -0,0 +1,81 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
+)
+
+// The instance_settings row is seeded by migration 0010 and there is exactly one
+// (CHECK id = 1), so reads never branch on existence and writes never insert.
+
+const instanceSettingsColumns = `agent_model, agent_enabled, version, updated_at`
+
+// scanInstanceSettings reads the single settings row. agent_enabled is a nullable
+// INTEGER (NULL = inherit env), so it is scanned through sql.NullInt64.
+func scanInstanceSettings(s scanner) (*domain.InstanceSettings, error) {
+	var (
+		out     domain.InstanceSettings
+		enabled sql.NullInt64
+	)
+	if err := s.Scan(&out.AgentModel, &enabled, &out.Version, &out.UpdatedAt); err != nil {
+		return nil, err
+	}
+	if enabled.Valid {
+		b := enabled.Int64 != 0
+		out.AgentEnabled = &b
+	}
+	return &out, nil
+}
+
+// GetInstanceSettings returns the single settings row.
+func (d *DB) GetInstanceSettings(ctx context.Context) (*domain.InstanceSettings, error) {
+	s, err := scanInstanceSettings(d.sql.QueryRowContext(ctx,
+		`SELECT `+instanceSettingsColumns+` FROM instance_settings WHERE id = 1`))
+	if errors.Is(err, sql.ErrNoRows) {
+		// The migration seeds this row, so its absence is a broken database, not a
+		// normal "not found" the caller should paper over.
+		return nil, fmt.Errorf("store: instance_settings row missing (migration 0010 not applied?)")
+	}
+	if err != nil {
+		return nil, fmt.Errorf("store: get instance settings: %w", err)
+	}
+	return s, nil
+}
+
+// UpdateInstanceSettings applies a version-guarded update to the single row,
+// following the same optimistic-concurrency contract as every mutable resource:
+// the updated row on success, (current row, ErrVersionConflict) on a version
+// mismatch. There is no ErrNotFound path — the row always exists.
+//
+// agentEnabled is nil to store SQL NULL (inherit env), or a pointer to store an
+// explicit 0/1.
+func (d *DB) UpdateInstanceSettings(ctx context.Context, s *domain.InstanceSettings) (*domain.InstanceSettings, error) {
+	var enabled any
+	if s.AgentEnabled != nil {
+		enabled = boolToInt(*s.AgentEnabled)
+	}
+	updated, err := scanInstanceSettings(d.sql.QueryRowContext(ctx,
+		`UPDATE instance_settings
+		    SET agent_model = ?, agent_enabled = ?,
+		        version = version + 1,
+		        updated_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now')
+		  WHERE id = 1 AND version = ?
+		  RETURNING `+instanceSettingsColumns,
+		s.AgentModel, enabled, s.Version,
+	))
+	if errors.Is(err, sql.ErrNoRows) {
+		current, gerr := d.GetInstanceSettings(ctx)
+		if gerr != nil {
+			return nil, gerr
+		}
+		return current, domain.ErrVersionConflict
+	}
+	if err != nil {
+		return nil, fmt.Errorf("store: update instance settings: %w", err)
+	}
+	return updated, nil
+}
@@ -0,0 +1,35 @@
+-- Instance settings (#79): the first configuration that lives in the database
+-- rather than the environment.
+--
+-- Until now every preference hung off a garden or object row; this is pansy's
+-- first INSTANCE-level state. A single-row table (CHECK id = 1) is the least
+-- surprising shape for "there is exactly one of these" — a key/value table would
+-- invite typo'd keys and lose the column types.
+--
+-- Only NON-SECRET agent settings live here. OLLAMA_CLOUD_API_KEY stays in the
+-- environment on purpose: a copy in SQLite would land in every backup and in the
+-- blast radius of the undo history. An admin can change WHICH model runs, not
+-- WHOSE account pays for it.
+--
+-- Both agent columns are "inherit from env unless set":
+--   * agent_model = '' means fall back to PANSY_AGENT_MODEL, then the built-in
+--     default. So an instance that never opens Settings behaves exactly as it
+--     did before this migration, and the documented env var keeps working.
+--   * agent_enabled is NULLABLE: NULL means inherit PANSY_AGENT_ENABLED's
+--     behaviour (on when a key is present), 0/1 is an explicit override. A plain
+--     boolean couldn't tell "admin hasn't touched this" from "admin turned it
+--     off", and those must deploy differently.
+--
+-- version drives the same optimistic-concurrency 409 every other mutable row
+-- uses, so two admins editing at once conflict rather than clobber.
+CREATE TABLE instance_settings (
+    id            INTEGER PRIMARY KEY CHECK (id = 1),
+    agent_model   TEXT    NOT NULL DEFAULT '',
+    agent_enabled INTEGER          CHECK (agent_enabled IN (0, 1)),
+    version       INTEGER NOT NULL DEFAULT 1,
+    updated_at    TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%SZ', 'now'))
+);
+
+-- Seed the single row so every read is a plain SELECT with no "does it exist
+-- yet" branch. Inherits everything from the environment out of the box.
+INSERT INTO instance_settings (id, agent_model, agent_enabled) VALUES (1, '', NULL);
@@ -53,6 +53,19 @@ export function AppShell() {
                  {l.label}
                </Link>
              ))}
+            {/* Settings is admin-only, matching the server's requireAdmin gate.
+                A non-admin who typed /settings still gets a 403 from the API — the
+                hidden link is convenience, not the security boundary. */}
+            {user?.isAdmin && (
+              <Link
+                to="/settings"
+                className={navLinkBase}
+                activeProps={{ className: navLinkActive }}
+                inactiveProps={{ className: navLinkInactive }}
+              >
+                Settings
+              </Link>
+            )}
          </div>

          {user ? (
@@ -1,5 +1,12 @@
 import { useEffect, useRef, type ReactNode } from 'react'

+// Tabbable controls inside the dialog, in DOM order. type="hidden" inputs are
+// excluded — they'd match `input:not([disabled])` and, sitting at a boundary,
+// break the wrap math. Hoisted out of the handler so it isn't rebuilt per Tab.
+const FOCUSABLE_SELECTOR =
+  'a[href], button:not([disabled]), textarea:not([disabled]), ' +
+  'input:not([disabled]):not([type="hidden"]), select:not([disabled]), [tabindex]:not([tabindex="-1"])'
+
 /**
 * A centered modal dialog over a dimmed backdrop. Closes on Escape or a backdrop
 * click, unless `busy` (a mutation is in flight) — then it stays put so the
@@ -27,12 +34,57 @@ export function Modal({
  busyRef.current = busy

  useEffect(() => {
-    cardRef.current?.focus()
+    const card = cardRef.current
+    // Remember who opened the dialog so focus can return there on close —
+    // otherwise it lands on <body> and a keyboard user loses their place.
+    const opener = document.activeElement as HTMLElement | null
+    card?.focus()
+
+    const focusable = () =>
+      Array.from(card?.querySelectorAll<HTMLElement>(FOCUSABLE_SELECTOR) ?? [])
+
    function onKey(e: KeyboardEvent) {
-      if (e.key === 'Escape' && !busyRef.current) onCloseRef.current()
+      if (e.key === 'Escape' && !busyRef.current) {
+        onCloseRef.current()
+        return
+      }
+      if (e.key !== 'Tab') return
+      const items = focusable()
+      if (items.length === 0) {
+        e.preventDefault()
+        card?.focus()
+        return
+      }
+      const first = items[0]
+      const last = items[items.length - 1]
+      const active = document.activeElement
+      // If focus is NOT inside the dialog, pull it back in rather than let Tab
+      // escape. This is the robust case that covers focus having fallen to
+      // <body> — a control that was removed (ShareGardenModal's remove-share
+      // button) or disabled while busy — as well as any externally-stolen focus.
+      if (!card || !card.contains(active)) {
+        e.preventDefault()
+        ;(e.shiftKey ? last : first).focus()
+        return
+      }
+      if (e.shiftKey && (active === first || active === card)) {
+        e.preventDefault()
+        last.focus()
+      } else if (!e.shiftKey && active === last) {
+        e.preventDefault()
+        first.focus()
+      }
    }
    document.addEventListener('keydown', onKey)
-    return () => document.removeEventListener('keydown', onKey)
+    return () => {
+      document.removeEventListener('keydown', onKey)
+      // Restore focus to the opener only if it's still in the document — the
+      // delete/clear flows this trap targets often remove the element that
+      // opened the dialog (a garden card, a plop row). A disconnected node's
+      // focus() silently no-ops and leaves focus on <body>, so fall through to
+      // that case explicitly rather than pretend it worked.
+      if (opener && opener.isConnected) opener.focus()
+    }
  }, [])

  return (
@@ -235,7 +235,13 @@ export function GardenCanvas({
        className="h-full w-full select-none"
        style={{ touchAction: 'none' }}
        onPointerDown={onCanvasPointerDown}
+        // role="application" tells a screen reader this is an interactive canvas
+        // to operate, not a document to read linearly. The <title> names it, and
+        // objects inside are individually focusable buttons (see ObjectShape).
+        role="application"
+        aria-label={`${garden.name} — garden layout. Tab between objects; Enter selects; arrow keys nudge a selection.`}
      >
+        <title>{garden.name} garden layout</title>
        <g transform={`translate(${viewport.tx} ${viewport.ty}) scale(${viewport.scale})`}>
          {drawnGridCm != null && (
            <>
@@ -1,5 +1,6 @@
-import { memo, type PointerEvent } from 'react'
+import { memo, type KeyboardEvent, type PointerEvent } from 'react'
 import { objectTransform } from './shared'
+import { kindDef, objectDisplayName } from './kinds'
 import type { EditorObject } from './types'

 const DEFAULT_FILL = '#8a8a8a'
@@ -57,11 +58,50 @@ export const ObjectShape = memo(function ObjectShape({
    onSelect(object.id)
  }

+  // Keyboard path into selection (#84): the arrow-key nudge handler already
+  // exists but only ever acted on a pointer selection, so it was unreachable
+  // without a mouse. Enter/Space on a focused object selects it, which is the
+  // step that was missing.
+  function handleKey(e: KeyboardEvent) {
+    if (e.key === 'Enter' || e.key === ' ') {
+      e.preventDefault()
+      e.stopPropagation()
+      onSelect(object.id)
+    }
+  }
+
  const stroke = selected ? '#2f7a3e' : '#00000033'
  const strokeWidth = selected ? 2 : 1

+  // A concise accessible name: the object's label plus its kind's canonical
+  // label, e.g. "North Bed, In-ground" — reusing kindDef so it never diverges
+  // from what the UI shows (an ad-hoc kind.replace() gave "in ground"). The
+  // dimensions aren't included; they need the garden's unit context this
+  // component doesn't hold, so they're a follow-up.
+  const kindLabel = kindDef(object.kind)?.label ?? object.kind
+  const label = `${objectDisplayName(object)}, ${kindLabel}`
+
+  // Keyboard focus needs to be VISIBLE — that's the point of making the canvas
+  // keyboard-reachable. The `object-shape` class carries a :focus-visible rule
+  // (styles/index.css) that draws a dashed ring; :focus-visible means it shows
+  // for keyboard focus but NOT a mouse click, which is exactly what we want. CSS
+  // rather than React state because onFocus on an SVG <g> is unreliable and a
+  // presentation attribute is overridden by any CSS rule.
  return (
-    <g transform={objectTransform(object)} onPointerDown={handleDown} style={{ cursor: 'pointer' }}>
+    <g
+      className="object-shape"
+      transform={objectTransform(object)}
+      onPointerDown={handleDown}
+      onKeyDown={handleKey}
+      role="button"
+      tabIndex={0}
+      aria-label={label}
+      // aria-current, not aria-pressed: selecting an object isn't a toggle (a
+      // toggle is what aria-pressed means). aria-current marks it as the active
+      // item among the objects. Omitted, not "false", when unselected.
+      aria-current={selected || undefined}
+      style={{ cursor: 'pointer' }}
+    >
      {object.shape === 'circle' ? (
        <ellipse
          cx={0}
@@ -13,13 +13,21 @@ import { historyKey } from './history'

 const capabilitiesSchema = z.object({ agent: z.boolean() })

-/** Whether this instance has the assistant configured. Without it the panel
- *  isn't rendered at all — a dead button is worse than no button. */
+export const capabilitiesKey = ['capabilities'] as const
+
+/** Whether the assistant is live RIGHT NOW. Without it the panel isn't rendered
+ *  at all — a dead button is worse than no button.
+ *
+ *  Not `staleTime: Infinity` any more: an admin can turn the assistant on or off
+ *  in Settings (#79), so this must be able to change under a running page. The
+ *  settings save invalidates this key directly; the finite staleTime just means
+ *  another admin's change is picked up on the next focus/remount rather than
+ *  never. */
 export function useCapabilities() {
  return useQuery({
-    queryKey: ['capabilities'] as const,
+    queryKey: capabilitiesKey,
    queryFn: async () => capabilitiesSchema.parse(await api.get('/capabilities')),
-    staleTime: Infinity, // server config; it doesn't change under a running page
+    staleTime: 60_000,
  })
 }

@@ -153,10 +161,15 @@ export async function streamChat(
    return
  }
  if (!res.ok || !res.body) {
+    // 503 is the assistant being turned off at runtime (#79) — the route exists,
+    // there's just no model behind it. Distinct from a 404, which would mean the
+    // whole endpoint is absent.
    handlers.onError(
-      res.status === 404
-        ? "This instance doesn't have the assistant configured."
-        : 'The assistant is not available right now.',
+      res.status === 503
+        ? "The assistant isn't enabled on this instance."
+        : res.status === 404
+          ? "This instance doesn't have the assistant configured."
+          : 'The assistant is not available right now.',
    )
    return
  }
@@ -0,0 +1,79 @@
+// Instance settings data layer (#79): admin-only, instance-wide configuration.
+//
+// The GET/PATCH return both the stored settings and a read-only "effective" view
+// — what's actually in force after layering the DB over the environment — so the
+// form can say "inheriting ollama-cloud/glm-5.2:cloud from the environment" and
+// whether the API key is present, without the key ever crossing the wire.
+
+import { queryOptions, useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import { z } from 'zod'
+import { ApiError, api } from './api'
+import { capabilitiesKey } from './agent'
+
+export const instanceSettingsSchema = z.object({
+  // '' means "inherit the PANSY_AGENT_MODEL env var".
+  agentModel: z.string(),
+  // null means "inherit PANSY_AGENT_ENABLED"; true/false is an explicit override.
+  agentEnabled: z.boolean().nullable(),
+  version: z.number(),
+  updatedAt: z.string(),
+})
+export type InstanceSettings = z.infer<typeof instanceSettingsSchema>
+
+export const effectiveAgentSchema = z.object({
+  model: z.string(),
+  enabled: z.boolean(),
+  hasApiKey: z.boolean(),
+  agentLive: z.boolean(),
+})
+export type EffectiveAgent = z.infer<typeof effectiveAgentSchema>
+
+export const settingsResponseSchema = z.object({
+  settings: instanceSettingsSchema,
+  effective: effectiveAgentSchema,
+})
+export type SettingsResponse = z.infer<typeof settingsResponseSchema>
+
+export const settingsKey = ['settings'] as const
+
+export const settingsQueryOptions = queryOptions({
+  queryKey: settingsKey,
+  queryFn: async (): Promise<SettingsResponse> =>
+    settingsResponseSchema.parse(await api.get('/settings')),
+})
+
+export function useSettings() {
+  return useQuery(settingsQueryOptions)
+}
+
+export interface SettingsUpdate {
+  agentModel: string
+  agentEnabled: boolean | null
+  version: number
+}
+
+export function useUpdateSettings() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: async (input: SettingsUpdate): Promise<SettingsResponse> =>
+      settingsResponseSchema.parse(await api.patch('/settings', input)),
+    onSuccess: (res) => {
+      qc.setQueryData(settingsKey, res)
+      // The save may have turned the assistant on or off; the editor keys its
+      // chat tab off /capabilities, so make it re-read rather than trust its
+      // cached answer.
+      qc.invalidateQueries({ queryKey: capabilitiesKey })
+    },
+  })
+}
+
+/** If err is a 409 version conflict, return the fresh settings it carries so a
+ *  form can rebase; otherwise null. */
+export function conflictSettings(err: unknown): InstanceSettings | null {
+  if (err instanceof ApiError && err.isConflict && err.body && typeof err.body === 'object') {
+    const current = (err.body as { current?: unknown }).current
+    const parsed = instanceSettingsSchema.safeParse(current)
+    if (parsed.success) return parsed.data
+  }
+  return null
+}
@@ -0,0 +1,164 @@
+import { useEffect, useState } from 'react'
+import { Alert } from '@/components/ui/Alert'
+import { Button } from '@/components/ui/Button'
+import { Select } from '@/components/ui/Select'
+import { TextField } from '@/components/ui/TextField'
+import { toast } from '@/components/ui/toast'
+import { errorMessage } from '@/lib/api'
+import {
+  conflictSettings,
+  useSettings,
+  useUpdateSettings,
+  type EffectiveAgent,
+  type InstanceSettings,
+} from '@/lib/settings'
+import { usePageTitle } from '@/lib/usePageTitle'
+
+// agentEnabled is a tri-state on the wire (null = inherit env, true, false); the
+// form models it as three named choices so "inherit" is a deliberate pick, not
+// an empty control.
+type EnabledChoice = 'inherit' | 'on' | 'off'
+const toChoice = (v: boolean | null): EnabledChoice => (v === null ? 'inherit' : v ? 'on' : 'off')
+const fromChoice = (c: EnabledChoice): boolean | null => (c === 'inherit' ? null : c === 'on')
+
+/** Admin-only instance settings (#79). The one that matters today is the agent
+ *  model; the API key stays in the environment and is only ever reported as
+ *  present/absent, never shown or edited. */
+export function SettingsPage() {
+  usePageTitle('Settings')
+  const settings = useSettings()
+  const update = useUpdateSettings()
+
+  if (settings.isPending) {
+    return <p className="text-sm text-muted">Loading settings…</p>
+  }
+  if (settings.isError) {
+    return <Alert>{errorMessage(settings.error, "Couldn't load settings.")}</Alert>
+  }
+  return <SettingsForm data={settings.data} update={update} />
+}
+
+function SettingsForm({
+  data,
+  update,
+}: {
+  data: { settings: InstanceSettings; effective: EffectiveAgent }
+  update: ReturnType<typeof useUpdateSettings>
+}) {
+  const [model, setModel] = useState(data.settings.agentModel)
+  const [enabled, setEnabled] = useState<EnabledChoice>(toChoice(data.settings.agentEnabled))
+  const [version, setVersion] = useState(data.settings.version)
+  const [error, setError] = useState<string | null>(null)
+
+  // Rebase the form when the query cache updates (e.g. a successful save writes
+  // the new row back), so the version we submit is never stale.
+  useEffect(() => {
+    setVersion(data.settings.version)
+  }, [data.settings.version])
+
+  const eff = data.effective
+
+  const save = () => {
+    setError(null)
+    update.mutate(
+      { agentModel: model.trim(), agentEnabled: fromChoice(enabled), version },
+      {
+        onSuccess: () => toast.info('Settings saved.'),
+        onError: (err) => {
+          const current = conflictSettings(err)
+          if (current) {
+            // Someone else saved first. Adopt their row so the next attempt is
+            // clean, and say so rather than silently discarding this edit.
+            setModel(current.agentModel)
+            setEnabled(toChoice(current.agentEnabled))
+            setVersion(current.version)
+            setError('Someone else changed these settings just now — reloaded their version. Re-apply your change if you still want it.')
+            return
+          }
+          setError(errorMessage(err, "Couldn't save settings."))
+        },
+      },
+    )
+  }
+
+  return (
+    <div className="flex max-w-2xl flex-col gap-6">
+      <div>
+        <h1 className="text-xl font-semibold text-fg">Settings</h1>
+        <p className="mt-1 text-sm text-muted">
+          Instance-wide, admin-only. Changes take effect immediately — no restart.
+        </p>
+      </div>
+
+      <section className="flex flex-col gap-4 rounded-lg border border-border p-4">
+        <div>
+          <h2 className="text-sm font-semibold text-fg">Garden assistant</h2>
+          <p className="mt-1 text-xs text-muted">
+            The model runs against your Ollama Cloud key, which is set in the environment and never
+            shown here.
+          </p>
+        </div>
+
+        <AgentStatus eff={eff} />
+
+        <TextField
+          label="Model"
+          name="agentModel"
+          placeholder={eff.model || 'ollama-cloud/glm-5.2:cloud'}
+          value={model}
+          onChange={(e) => setModel(e.target.value)}
+          hint={
+            model.trim() === ''
+              ? `Empty — inheriting ${eff.model || 'the built-in default'} from the environment.`
+              : 'A majordomo model spec. A comma-separated list is a failover chain.'
+          }
+        />
+
+        <Select
+          label="Enabled"
+          name="agentEnabled"
+          value={enabled}
+          onChange={(e) => setEnabled(e.target.value as EnabledChoice)}
+          options={[
+            { value: 'inherit', label: 'Inherit from environment' },
+            { value: 'on', label: 'On' },
+            { value: 'off', label: 'Off' },
+          ]}
+        />
+      </section>
+
+      {error && <Alert>{error}</Alert>}
+
+      <div className="flex justify-end">
+        <Button onClick={save} disabled={update.isPending}>
+          {update.isPending ? 'Saving…' : 'Save changes'}
+        </Button>
+      </div>
+    </div>
+  )
+}
+
+// AgentStatus surfaces the gap the capabilities endpoint exists for: enabled +
+// a key does not guarantee the assistant is actually running (an unresolvable
+// model leaves it down), and that's precisely what an admin needs to see.
+function AgentStatus({ eff }: { eff: EffectiveAgent }) {
+  const [tone, text] = eff.agentLive
+    ? (['ok', `Live on ${eff.model}`] as const)
+    : !eff.hasApiKey
+      ? (['warn', 'No API key set in the environment — the assistant is off.'] as const)
+      : !eff.enabled
+        ? (['warn', 'Turned off.'] as const)
+        : (['warn', `Configured but not running — check the model (${eff.model}).`] as const)
+
+  return (
+    <div className="flex items-center gap-2 text-sm">
+      <span
+        className={
+          'inline-block h-2 w-2 rounded-full ' + (tone === 'ok' ? 'bg-emerald-500' : 'bg-amber-500')
+        }
+        aria-hidden
+      />
+      <span className={tone === 'ok' ? 'text-fg' : 'text-muted'}>{text}</span>
+    </div>
+  )
+}
@@ -14,6 +14,7 @@ import { GardensPage } from '@/pages/GardensPage'
 import { GardenEditorPage } from '@/pages/GardenEditorPage'
 import { PublicGardenPage } from '@/pages/PublicGardenPage'
 import { PlantsPage } from '@/pages/PlantsPage'
+import { SettingsPage } from '@/pages/SettingsPage'
 import { meQueryOptions } from '@/lib/auth'
 import { queryClient } from '@/lib/queryClient'
 import { safeRedirectPath } from '@/lib/redirect'
@@ -48,6 +49,20 @@ async function requireGuest(context: RouterContext, redirectTo: string) {
  }
 }

+// requireAdmin: authenticated AND admin. A non-admin who navigates to /settings
+// is sent to /gardens rather than shown a page whose API calls would 403. This
+// is convenience routing, not the security boundary — the server's requireAdmin
+// is authoritative.
+async function requireAdmin(context: RouterContext, path: string) {
+  const me = await context.queryClient.ensureQueryData(meQueryOptions)
+  if (!me) {
+    throw redirect({ to: '/login', search: { redirect: path } })
+  }
+  if (!me.isAdmin) {
+    throw redirect({ to: '/gardens' })
+  }
+}
+
 const indexRoute = createRoute({
  getParentRoute: () => rootRoute,
  path: '/',
@@ -109,6 +124,13 @@ const plantsRoute = createRoute({
  component: PlantsPage,
 })

+const settingsRoute = createRoute({
+  getParentRoute: () => rootRoute,
+  path: 'settings',
+  beforeLoad: ({ context, location }) => requireAdmin(context, location.href),
+  component: SettingsPage,
+})
+
 // Public read-only garden by share token. Deliberately has NO beforeLoad auth
 // guard, so a logged-out visitor viewing a shared link is never redirected to
 // /login or OIDC.
@@ -125,6 +147,7 @@ const routeTree = rootRoute.addChildren([
  gardensRoute,
  gardenEditorRoute,
  plantsRoute,
+  settingsRoute,
  publicGardenRoute,
 ])

@@ -28,6 +28,19 @@
    font-family: var(--font-sans);
    -webkit-font-smoothing: antialiased;
  }
+
+  /* Keyboard focus on a canvas object (#84). :focus-visible shows the ring for
+     keyboard focus but not a mouse click; the dashed accent ring distinguishes
+     "focused" from the solid ring that marks "selected". A CSS rule overrides
+     the shape's inline stroke presentation attributes. */
+  .object-shape {
+    outline: none;
+  }
+  .object-shape:focus-visible :is(rect, ellipse) {
+    stroke: var(--color-accent-strong);
+    stroke-width: 2;
+    stroke-dasharray: 5 4;
+  }
 }

 /* Dark theme: override the same tokens so utilities recolor automatically. */