Add a live web dashboard, and three settings the fleet had no way to change

.gitignore

@@ -1,4 +1,12 @@
-dist/
+# The dashboard's built SPA is the ONE dist that is committed: internal/serve
+# embeds it with go:embed, so a clean checkout cannot compile without it. Every
+# other dist is build output.
+/dist/
+web/dist/
+# Explicit, because a global gitignore's blanket "dist/" also matches this one
+# and git will not descend into an excluded directory to re-include its files.
+!internal/serve/dist/
+web/node_modules/
 *.log
 .DS_Store
 

AGENTS.md

@@ -20,7 +20,9 @@ Dependency rule (Go-enforced, no cycles): `dialect ← engine ← crq`, `state 
   static `KnownCoReviewers()` list — Codex, Cursor Bugbot, Macroscope — each
   carrying its login, config name, check-run app slug, trigger command, and its
   wording hooks (`ClassifyComment`, `ClassifyCheck`, `ResolvedInSHA`,
-  `FindingDedupeKey`, …). The only place a bot's literal wording may appear.
+  `FindingDedupeKey`, `Price`, …). The only place a bot's literal wording may
+  appear. `pricing.go` holds the vendors' published prices and the per-bot cost
+  estimators behind `PricesCheckedAt` — money is bot knowledge like any other.
 - `internal/gh/` — GitHub REST/GraphQL transport, bot-agnostic. Owns the "GitHub
   REST quota" concept under the name **Throttle** (`ThrottleWait`/`IsThrottled`).
   The only package (besides dialect) allowed to say "rate limit".
@@ -30,18 +32,26 @@ Dependency rule (Go-enforced, no cycles): `dialect ← engine ← crq`, `state 
   credential-safe Git execution, stale-worktree pruning, and mirror migration.
   Owns persistent filesystem and process I/O for checkouts; `crq` supplies only
   configured roots and a current-token resolver.
-- `internal/state/` — persisted schema v4: one `Round` per PR, one global
-  `FireSlot`, the CodeRabbit `AccountQuota`, an `Archive` ring. Round transition
+- `internal/state/` — persisted schema v5: one `Round` per PR, one global
+  `FireSlot`, the CodeRabbit `AccountQuota`, an `Archive` ring, and the
+  per-repository records (`Repos` reviewer overrides incl. `PrimaryOff`,
+  `RepoAutofix`, `Enrolled`). `WriterCaps` is a monotonic integer bumped
+  whenever one of those records starts changing decisions, so a fleet running
+  two binary versions can name the hosts that will ignore a new one. Round transition
   methods, durable tombstones for tidied trigger comments, the CAS store, and
   dashboard rendering. `Round.CoBots` holds per-
   co-reviewer trigger bookkeeping; Codex's entry is **dual-written** to the
   legacy `Codex*` round fields because the fleet shares one state ref across
-  binary versions (`Normalize` folds them back on load). `Round` and `State` also
-  **round-trip unknown JSON members** (`tolerant.go`), so a field a newer binary
-  added survives being read and rewritten by an older one — which is what makes
-  ordinary additions safe without another dual-write or schema bump. Schema v4
-  is the deliberate exception: older v3 clients refuse it, fencing pumping
-  clients that cannot enforce administrative holds.
+  binary versions (`Normalize` folds them back on load). `State`, `Round` and
+  every record NESTED inside them — `FireSlot`, `FleetDefaults`, `SolverSettings`,
+  `RepoReviewers`, `RepoEnrollment`, `HostReport`, `ToolReport` — **round-trip unknown JSON members** (`tolerant.go`), so a
+  field a newer binary added survives being read and rewritten by an older one.
+  Nesting is why each needs its own: the carrier recognises the member by name
+  and hands the whole object to an ordinary decoder, which drops anything inside
+  it. That is what makes ordinary additions safe without another dual-write or
+  schema bump. Schema v4 deliberately fenced older v3 pumping clients that
+  could not enforce administrative holds. Schema v5 similarly fences v4
+  writers that would erase the dispatch scheduler's model and cooldown state.
 - `internal/engine/` — PURE decision logic, `now` passed in, no ctx/gh:
   `DecideFire` (the single fire owner), `Progress` (fired/reviewing round
   transitions), `Completion` (the one "is the round done?"), `BlockingFindings`

README.md

@@ -409,8 +409,29 @@ crq hold                                                    # list held PRs
 
 crq tidy <repo> <pr>      # delete crq's own spent review-trigger comments (--dry-run previews)
 
+crq serve                 # ⭐ the live web dashboard (crq serve install enables a reboot-persistent service)
+
+crq cost <repo> <pr>      # what one more review round there would cost, before firing it
+                          # (CRQ_WEEKLY_LIMIT sets the fair-use threshold the dashboard forecasts)
+
+crq fleet                 # the defaults every repository inherits (env → fleet record → repo override)
+crq fleet adopt           # ⭐ record THIS host's settings for the fleet (--dry-run shows the plan)
+crq fleet env <KEY> [<value>|--clear]   # any single setting, by its environment-variable name
+crq fleet set [--bots <a,b>] [--required <a,b>] [--min-interval <dur>] [--weekly-limit <n>]
+              [--autofix-default on|off] [--dry-run]   # --dry-run reports the impact, writes nothing
+
+crq solver <repo>         # models, scope, clarification policy, attempts, forks and prompt
+crq solver set <repo> [--models <first,next,...>] [--severities minor,potential] [--ask uncertain]
+crq solver set <repo> [--effort <e>] [--attempts <n>] [--forks on|off] [--prompt <text>]
+crq solver set <repo> --inherit models,effort,severities,ask,forks,skip-authors # follow the fleet
+crq solver set --fleet [...]                          # the default every repository inherits
+
+crq repos                 # which projects crq reviews, and where each answer comes from
+crq repos add <repo> | crq repos remove <repo> --reason "<why>" | crq repos default <repo>
+
 crq reviewers <repo>      # which bots review this project, and what each costs
 crq reviewers set <repo> [--bots <a,b>] [--required <a,b>] # choose them (either flag alone)
+crq reviewers set <repo> --no-primary | --primary           # CodeRabbit off/on for this project
 crq reviewers clear <repo>                                 # back to the fleet default
 
 crq dismiss <repo> <pr> <finding-id> [...] --reason "<why>"  # account for a finding with no thread
@@ -494,7 +515,7 @@ Set these in `~/.config/crq/env` (sourced automatically) or as environment varia
 | `CRQ_STATE_REF` | `crq-state-v3` | git ref that stores the typed CAS state. The name is fixed; the schema inside it is v4, and a binary that predates a schema **refuses** the payload rather than erasing it — so upgrade every host together |
 | `CRQ_REPOS` | _(all in scope)_ | `autoreview` allowlist — only these `owner/name` repos (comma-separated) |
 | `CRQ_EXCLUDE` | _(none)_ | denylist — crq never reviews, watches or fixes these `owner/name` repos (comma-separated) |
-| `CRQ_AUTOREVIEW_SKIP_AUTHORS` | `dependabot[bot]` | PR authors `autoreview` never enqueues (comma-separated; case and `[bot]` suffix don't matter) — set to empty to auto-review bot PRs too; manual `crq review` is unaffected |
+| `CRQ_AUTOREVIEW_SKIP_AUTHORS` | `dependabot[bot]` | PR authors `autoreview` never enqueues, and the autofix watcher never touches (comma-separated; case and `[bot]` suffix don't matter) — set to empty to auto-review bot PRs too; manual `crq review` is unaffected |
 | `CRQ_AUTOREVIEW_SKIP_MARKER` | `<!-- crq:skip-autoreview -->` | exact PR-body marker that suppresses fleet auto-review; set empty to disable; manual `crq loop` is unaffected |
 | `CRQ_TIDY` | `0` | set to `1` to delete crq's own spent review-trigger comments as rounds progress (`crq tidy` by hand is unaffected) |
 | `CRQ_REQUIRED_BOTS` | `coderabbitai[bot]` | bots that must review the head for convergence (crq waits for all of them) |