diff --git a/public/lite/clients-en.webp b/public/lite/clients-en.webp
index d94989e..c81ec90 100644
Binary files a/public/lite/clients-en.webp and b/public/lite/clients-en.webp differ
diff --git a/public/lite/clients.webp b/public/lite/clients.webp
index 3091758..e3b3b24 100644
Binary files a/public/lite/clients.webp and b/public/lite/clients.webp differ
diff --git a/public/lite/dry-run-en.webp b/public/lite/dry-run-en.webp
index db78540..be2efb9 100644
Binary files a/public/lite/dry-run-en.webp and b/public/lite/dry-run-en.webp differ
diff --git a/public/lite/dry-run.webp b/public/lite/dry-run.webp
index 0ca6f6c..755b4cd 100644
Binary files a/public/lite/dry-run.webp and b/public/lite/dry-run.webp differ
diff --git a/public/lite/findings-en.webp b/public/lite/findings-en.webp
deleted file mode 100644
index c350445..0000000
Binary files a/public/lite/findings-en.webp and /dev/null differ
diff --git a/public/lite/findings.webp b/public/lite/findings.webp
deleted file mode 100644
index 33dfadd..0000000
Binary files a/public/lite/findings.webp and /dev/null differ
diff --git a/public/lite/keys-en.webp b/public/lite/keys-en.webp
new file mode 100644
index 0000000..4cab5c5
Binary files /dev/null and b/public/lite/keys-en.webp differ
diff --git a/public/lite/keys.webp b/public/lite/keys.webp
new file mode 100644
index 0000000..03d318a
Binary files /dev/null and b/public/lite/keys.webp differ
diff --git a/public/lite/mcp-en.webp b/public/lite/mcp-en.webp
new file mode 100644
index 0000000..9326dbd
Binary files /dev/null and b/public/lite/mcp-en.webp differ
diff --git a/public/lite/mcp.webp b/public/lite/mcp.webp
new file mode 100644
index 0000000..fbf6b09
Binary files /dev/null and b/public/lite/mcp.webp differ
diff --git a/public/lite/menubar-cost.png b/public/lite/menubar-cost.png
deleted file mode 100644
index 50a3134..0000000
Binary files a/public/lite/menubar-cost.png and /dev/null differ
diff --git a/public/lite/menubar-menu-en.webp b/public/lite/menubar-menu-en.webp
new file mode 100644
index 0000000..77a4180
Binary files /dev/null and b/public/lite/menubar-menu-en.webp differ
diff --git a/public/lite/menubar-menu.webp b/public/lite/menubar-menu.webp
new file mode 100644
index 0000000..d710d9b
Binary files /dev/null and b/public/lite/menubar-menu.webp differ
diff --git a/public/lite/menubar-quota.png b/public/lite/menubar-quota.png
deleted file mode 100644
index d3b5ca2..0000000
Binary files a/public/lite/menubar-quota.png and /dev/null differ
diff --git a/public/lite/menubar.png b/public/lite/menubar.png
new file mode 100644
index 0000000..bc2c71a
Binary files /dev/null and b/public/lite/menubar.png differ
diff --git a/public/lite/overview-en.webp b/public/lite/overview-en.webp
index 0a79592..0f6467b 100644
Binary files a/public/lite/overview-en.webp and b/public/lite/overview-en.webp differ
diff --git a/public/lite/overview.webp b/public/lite/overview.webp
index 3982c2c..d82184a 100644
Binary files a/public/lite/overview.webp and b/public/lite/overview.webp differ
diff --git a/public/lite/remote-add-en.webp b/public/lite/remote-add-en.webp
new file mode 100644
index 0000000..c963379
Binary files /dev/null and b/public/lite/remote-add-en.webp differ
diff --git a/public/lite/remote-add.webp b/public/lite/remote-add.webp
new file mode 100644
index 0000000..6e4b377
Binary files /dev/null and b/public/lite/remote-add.webp differ
diff --git a/public/lite/remote-clients-en.webp b/public/lite/remote-clients-en.webp
new file mode 100644
index 0000000..9f08516
Binary files /dev/null and b/public/lite/remote-clients-en.webp differ
diff --git a/public/lite/remote-clients.webp b/public/lite/remote-clients.webp
new file mode 100644
index 0000000..878107b
Binary files /dev/null and b/public/lite/remote-clients.webp differ
diff --git a/public/lite/remote-switcher-en.webp b/public/lite/remote-switcher-en.webp
new file mode 100644
index 0000000..83a3001
Binary files /dev/null and b/public/lite/remote-switcher-en.webp differ
diff --git a/public/lite/remote-switcher.webp b/public/lite/remote-switcher.webp
new file mode 100644
index 0000000..276973b
Binary files /dev/null and b/public/lite/remote-switcher.webp differ
diff --git a/public/lite/requests-en.webp b/public/lite/requests-en.webp
deleted file mode 100644
index 5b92bda..0000000
Binary files a/public/lite/requests-en.webp and /dev/null differ
diff --git a/public/lite/requests.webp b/public/lite/requests.webp
deleted file mode 100644
index b8c62d1..0000000
Binary files a/public/lite/requests.webp and /dev/null differ
diff --git a/public/lite/routing-en.webp b/public/lite/routing-en.webp
new file mode 100644
index 0000000..5a05efa
Binary files /dev/null and b/public/lite/routing-en.webp differ
diff --git a/public/lite/routing.webp b/public/lite/routing.webp
new file mode 100644
index 0000000..4318d8b
Binary files /dev/null and b/public/lite/routing.webp differ
diff --git a/public/lite/security-en.webp b/public/lite/security-en.webp
new file mode 100644
index 0000000..6829747
Binary files /dev/null and b/public/lite/security-en.webp differ
diff --git a/public/lite/security.webp b/public/lite/security.webp
new file mode 100644
index 0000000..0ceb8f3
Binary files /dev/null and b/public/lite/security.webp differ
diff --git a/public/lite/settings-en.webp b/public/lite/settings-en.webp
new file mode 100644
index 0000000..3875009
Binary files /dev/null and b/public/lite/settings-en.webp differ
diff --git a/public/lite/settings.webp b/public/lite/settings.webp
new file mode 100644
index 0000000..5de9b3f
Binary files /dev/null and b/public/lite/settings.webp differ
diff --git a/public/lite/traffic-en.webp b/public/lite/traffic-en.webp
new file mode 100644
index 0000000..9a8ea47
Binary files /dev/null and b/public/lite/traffic-en.webp differ
diff --git a/public/lite/traffic.webp b/public/lite/traffic.webp
new file mode 100644
index 0000000..2b5369d
Binary files /dev/null and b/public/lite/traffic.webp differ
diff --git a/public/lite/upstreams-en.webp b/public/lite/upstreams-en.webp
index 6f90957..982c15b 100644
Binary files a/public/lite/upstreams-en.webp and b/public/lite/upstreams-en.webp differ
diff --git a/public/lite/upstreams.webp b/public/lite/upstreams.webp
index 5f1d291..de2d730 100644
Binary files a/public/lite/upstreams.webp and b/public/lite/upstreams.webp differ
diff --git a/src/components/LiteDownload.astro b/src/components/LiteDownload.astro
index 1cced62..622b31d 100644
--- a/src/components/LiteDownload.astro
+++ b/src/components/LiteDownload.astro
@@ -64,7 +64,7 @@ const look =
 <!--
   Which file. Windows: ARM64 when the browser says arm with 64-bit, x64 for every
   other answer, a failure or a browser without Client Hints. macOS: the one
-  Apple Silicon build, unless Client Hints say x86, which means an Intel Mac,
+  Apple silicon build, unless Client Hints say x86, which means an Intel Mac,
   for which there is no build. An iPad also reports "Macintosh"; touch points
   tell it apart. Linux: the aarch64 AppImage when Client Hints say arm with
   64-bit (or, without them, the User-Agent says aarch64), x86_64 otherwise;
@@ -97,7 +97,7 @@ const look =
         } else if (linux) {
           set(el, el.dataset[arch], el.dataset.labelLinux, arch);
         } else if (arch !== "x86") {
-          set(el, el.dataset.mac, el.dataset.labelMac, "Apple Silicon");
+          set(el, el.dataset.mac, el.dataset.labelMac, "Apple silicon");
         }
       }
     };
diff --git a/src/components/pages/LitePage.astro b/src/components/pages/LitePage.astro
index 010f8b8..b08f2e1 100644
--- a/src/components/pages/LitePage.astro
+++ b/src/components/pages/LitePage.astro
@@ -1,10 +1,13 @@
 ---
 // The /lite product page: ThinkWatch Lite, the desktop app for individual
 // developers on macOS, Windows and Linux. Status copy must stay in line with the Lite
-// README.
+// README; how the copy is checked is described in src/i18n/pages/lite.ts.
 //
 // Each page shows the interface in its own language: the app ships in both,
-// and a screenshot of the other one says little to the reader.
+// and a screenshot of the other one says little to the reader. The images in
+// public/lite come from the Lite repository's docs/screenshots/web: window
+// shots are 2360×1540, the menu 664×1120, the menu bar item 178×64, all at
+// twice the size they are shown at.
 import LiteDownload from "~/components/LiteDownload.astro";
 import Base from "~/layouts/Base.astro";
 import SiteHeader from "~/components/SiteHeader.astro";
@@ -52,6 +55,9 @@ const dmg = { url: assetUrl("-arm64.dmg") ?? latestPage, sha: assetUrl("-arm64.d
 const liteVersion = liteRelease?.tag.replace(/^v/, "") ?? null;
 const installDocsHref = localePath(lang, "/docs/lite/install");
 const sourceDocsHref = localePath(lang, "/docs/lite/run-from-source");
+const remoteDocsHref = localePath(lang, "/docs/lite/remote-core");
+/** Installing and running twcore on a Linux server, in the Core docs */
+const serverDocsHref = localePath(lang, "/docs/core/server-deployment");
 const jsonLd = await liteLd(lang);
 
 const delay = (i: number) => `animation-delay: ${i * 90}ms;`;
@@ -79,14 +85,15 @@ const archLabel = { x64: "x64", arm64: "ARM64" } as const;
           </p>
           <h1
             class:list={[
-              "reveal font-display m-0 text-[var(--color-text)]",
+              "reveal font-display m-0 text-[var(--color-text)] [text-wrap:balance]",
               zh
                 ? "text-[30px] leading-[1.35] sm:text-[40px] lg:text-[48px]"
                 : "text-[36px] leading-[1.1] sm:text-[46px] lg:text-[56px] lg:leading-[1.05]",
             ]}
             style={delay(1)}
           >
-            {c.hero.titleA}<span class="text-shimmer">{c.hero.titleHighlight}</span>
+            {/* Chinese breaks between any two characters: keep the highlighted noun on one line. */}
+            {c.hero.titleA}<span class:list={["text-shimmer", zh && "whitespace-nowrap"]}>{c.hero.titleHighlight}</span>
           </h1>
           <p class="reveal m-0 max-w-[36rem] text-[17px] leading-relaxed text-[#cbd5e1] sm:text-xl sm:leading-normal" style={delay(2)}>
             {c.hero.sub}
@@ -152,29 +159,80 @@ const archLabel = { x64: "x64", arm64: "ARM64" } as const;
       </div>
     </section>
 
+    <section class="border-t border-[var(--color-border-strong)] py-16 sm:py-20 lg:py-24" aria-labelledby="lite-remote">
+      <div class="container-page flex flex-col gap-12 sm:gap-14">
+        <div class="grid items-center gap-8 lg:grid-cols-2 lg:gap-14">
+          <div class="flex min-w-0 flex-col gap-4">
+            <p class:list={[eyebrow, "m-0"]}>{c.remote.eyebrow}</p>
+            <h2 id="lite-remote" class={h2}>{c.remote.title}</h2>
+            {c.remote.body.map((p) => (
+              <p class="m-0 text-base leading-relaxed text-[var(--color-muted)] sm:text-[17px]">{p}</p>
+            ))}
+            <div class="flex flex-wrap items-center gap-x-6 gap-y-2">
+              <a href={serverDocsHref} class={textLink}>{c.remote.serverDocs}</a>
+              <a href={remoteDocsHref} class={textLink}>{c.remote.docs}</a>
+            </div>
+          </div>
+          <img
+            src={shot("remote-add")}
+            width="2360"
+            height="1540"
+            loading="lazy"
+            decoding="async"
+            class={shotClass}
+            alt={c.remote.addAlt}
+          />
+        </div>
+        <div class="grid gap-10 md:grid-cols-2 lg:gap-14">
+          {c.remote.figures.map((figure) => (
+            <figure class="m-0 flex min-w-0 flex-col gap-3">
+              <img
+                src={shot(figure.id)}
+                width="2360"
+                height="1540"
+                loading="lazy"
+                decoding="async"
+                class={shotClass}
+                alt={figure.alt}
+              />
+              <figcaption class="text-[15px] leading-relaxed text-[var(--color-muted)] sm:text-base">{figure.caption}</figcaption>
+            </figure>
+          ))}
+        </div>
+      </div>
+    </section>
+
     <section class="pb-16 sm:pb-20 lg:pb-24" aria-labelledby="lite-menubar">
       <div class="container-page grid items-center gap-8 rounded-2xl border border-[var(--color-border-strong)] p-6 sm:p-10 lg:grid-cols-[minmax(0,1fr)_auto] lg:gap-14">
-        <div class="flex flex-col gap-3">
+        <div class="flex min-w-0 flex-col gap-3">
           <p class:list={[eyebrow, "m-0"]}>{c.menubar.eyebrow}</p>
           <h2 id="lite-menubar" class={h2}>{c.menubar.title}</h2>
+          {/* The menu bar item at its real size: the bitmap is drawn at 2×, 89 × 32 points. */}
+          <img src="/lite/menubar.png" width="178" height="64" loading="lazy" class="my-2 h-auto w-[89px]" alt={c.menubar.chipAlt} />
           <p class="m-0 text-base leading-relaxed text-[var(--color-muted)] sm:text-[17px]">{c.menubar.body}</p>
+          <p class="m-0 text-base leading-relaxed text-[var(--color-muted)] sm:text-[17px]">{c.menubar.notices}</p>
         </div>
-        <div class="flex flex-wrap items-center gap-4">
-          <img src="/lite/menubar-cost.png" width="420" height="64" loading="lazy" class="h-auto w-[420px] max-w-full" alt={c.menubar.costAlt} />
-          <img src="/lite/menubar-quota.png" width="420" height="64" loading="lazy" class="h-auto w-[420px] max-w-full" alt={c.menubar.quotaAlt} />
-        </div>
+        <img
+          src={shot("menubar-menu")}
+          width="664"
+          height="1120"
+          loading="lazy"
+          decoding="async"
+          class="mx-auto h-auto w-[332px] max-w-full"
+          alt={c.menubar.menuAlt}
+        />
       </div>
     </section>
 
     <section class="bg-[var(--color-surface)] py-16 sm:py-20 lg:py-[88px]" aria-labelledby="lite-built">
       <div class="container-page">
         <h2 id="lite-built" class:list={[eyebrow, "m-0 font-normal"]}>{c.built.eyebrow}</h2>
-        <div class="mt-8 grid items-stretch lg:mt-10 lg:grid-cols-[minmax(0,1fr)_120px_minmax(0,1fr)_120px_minmax(0,1fr)] lg:items-center">
+        <div class="mt-8 grid items-stretch lg:mt-10 lg:grid-cols-[minmax(0,1fr)_216px_minmax(0,1fr)_96px_minmax(0,1fr)] lg:items-center">
           {nodes.map((node, i) => (
             <Fragment>
               {i > 0 && (
                 <div
-                  class="flow-link relative flex items-center justify-center py-2 lg:py-0"
+                  class="flow-link relative flex flex-col items-center justify-center gap-3 py-3 lg:py-0"
                   data-active={i === 1 ? "true" : undefined}
                   aria-hidden={i === 1 ? undefined : "true"}
                 >
@@ -186,10 +244,17 @@ const archLabel = { x64: "x64", arm64: "ARM64" } as const;
                   >
                     {i === 1 && <span class="flow-dot" aria-hidden="true"></span>}
                   </div>
+                  {/* The channel between the app and core: under the line when the nodes sit
+                      side by side, below the vertical line when they are stacked. */}
                   {i === 1 && (
-                    <span class="absolute left-[calc(50%+14px)] font-mono text-xs text-[var(--color-muted)] lg:left-auto lg:top-[calc(50%+8px)]">
-                      {c.built.link}
-                    </span>
+                    <div class="text-center font-mono text-xs leading-relaxed text-[var(--color-muted)] lg:absolute lg:inset-x-2 lg:top-[calc(50%+12px)]">
+                      <p class="m-0 text-[var(--color-text)]">{c.built.link.title}</p>
+                      <ul class="m-0 list-none p-0">
+                        {c.built.link.lines.map((line) => (
+                          <li>{line}</li>
+                        ))}
+                      </ul>
+                    </div>
                   )}
                 </div>
               )}
diff --git a/src/content/docs-lite/en/architecture.md b/src/content/docs-lite/en/architecture.md
index 3785c87..2b9f4aa 100644
--- a/src/content/docs-lite/en/architecture.md
+++ b/src/content/docs-lite/en/architecture.md
@@ -6,18 +6,34 @@ ThinkWatch Lite is an interface to the gateway, not the gateway itself.
 
 ```
 src/              React 19 + Tailwind 4 frontend
-src-tauri/        Tauri 2 shell: supervises core, renders the menu bar
+src-tauri/        Tauri 2 shell: supervises core, renders the menu bar and the tray
+src-tauri/crates/ client setup (tw-adopt) and the configuration scan (tw-scan)
 ```
 
-- **`src-tauri/`** is the Tauri 2 shell. It supervises ThinkWatch Core and renders the menu bar on macOS, the notification-area icon and menu on Windows, and the tray icon and menu on Linux. On macOS, the supervisor integrates with launchd.
+- **`src-tauri/`** is the Tauri 2 shell. It starts ThinkWatch Core and supervises it: a core that exits is restarted, and after repeated failed starts it runs in a safe mode in which only its control plane is up, so that configuration, history and rollback stay available. The shell renders the menu bar on macOS, the notification-area icon and menu on Windows, and the tray icon and menu on Linux, and it delivers system notifications. Launch at login starts the app, which then starts core; core is not registered on its own.
+- **`src-tauri/crates/`** holds `tw-adopt`, which points clients at the gateway and restores them, and `tw-scan`, which scans client configuration for the MCP page. Both act on the computer the app runs on, also while the app is connected to a core on a server.
 - **`src/`** is the frontend, written in React 19 and Tailwind 4.
 
 ## Lite and Core
 
-The gateway is implemented in [ThinkWatch Core](/docs/core). This repository contains no routing, forwarding, or accounting logic. Lite communicates with Core over a unix socket on macOS and Linux, and over a loopback port on Windows; both carry a per-launch credential.
+The gateway is implemented in [ThinkWatch Core](/docs/core). This repository contains no routing, forwarding, or accounting logic.
 
 Routing, forwarding, cost accounting, and redaction are the responsibility of Core. Changes to behaviour on the data path belong in the [ThinkWatch Core repository](https://github.com/ThinkWatchProject/ThinkWatch-Core).
 
+## Control channel
+
+Lite reads and changes everything through Core's control API. How it reaches Core depends on where Core runs:
+
+| Where Core runs | Channel |
+|---|---|
+| The same computer, on macOS or Linux | A unix socket in the data directory |
+| The same computer, on Windows | A loopback TCP port |
+| A server | The server's remote control port, over TCP |
+
+Every channel carries the same HTTP API inside a Noise handshake, `Noise_NNpsk0_25519_ChaChaPoly_BLAKE2s`, whose pre-shared key is `listen.control.key` in Core's `config.yaml`. The handshake encrypts and authenticates the connection in both directions; a program that can reach the socket or the port but does not hold the key cannot control Core. There is no TLS and no certificate. Versions are exchanged in the handshake, and a connection between an app and a core whose versions do not match is refused.
+
+For the core it starts, the app reads the key from the local `config.yaml`. For a core on a server, the key is entered once when the connection is added and kept in a file in the app's data directory that only the current user can read. See [Connecting to a remote core](/docs/lite/remote-core).
+
 ## What the UI must not do
 
 The following rules are mandatory. A change that violates any of them will be returned for revision:
diff --git a/src/content/docs-lite/en/contributing.md b/src/content/docs-lite/en/contributing.md
index 3e0706b..546d872 100644
--- a/src/content/docs-lite/en/contributing.md
+++ b/src/content/docs-lite/en/contributing.md
@@ -13,7 +13,7 @@ gh pr create --base dev --head your-branch
 The following decisions are settled and are not open to change through a pull request:
 
 - **macOS, Windows and Linux, from one tag.** Every release tag produces five files for people to install, each with the gateway inside it and a sha256 beside it: an arm64 disk image for macOS, an x64 and an arm64 installer for Windows, and an x86_64 and an aarch64 AppImage for Linux.
-- **macOS: Apple Silicon only, and not signed by Apple.** The macOS artifact is an arm64 `.app` in a disk image, signed with the project's own self-signed certificate. That certificate does not satisfy Gatekeeper; it exists so that every release has the same signer, which is what lets Homebrew upgrade the app without warning that the signer changed. A universal binary for Intel and a Developer ID signature are both ongoing costs nobody has taken on, so a pull request that adds the notarization step without the account behind it cannot be merged, and neither can one that makes the build fall back to whatever architecture the machine happens to be — that ships a file some users can download and cannot open.
+- **macOS: Apple silicon only, and not signed by Apple.** The macOS artifact is an arm64 `.app` in a disk image, signed with the project's own self-signed certificate. That certificate does not satisfy Gatekeeper; it exists so that every release has the same signer, which is what lets Homebrew upgrade the app without warning that the signer changed. A universal binary for Intel and a Developer ID signature are both ongoing costs nobody has taken on, so a pull request that adds the notarization step without the account behind it cannot be merged, and neither can one that makes the build fall back to whatever architecture the machine happens to be — that ships a file some users can download and cannot open.
 - **Windows: not code-signed.** The installers carry no Authenticode signature, and no certificate will be bought, so SmartScreen warns when a downloaded installer is first run. Updates are verified against the key compiled into the app, the same as on macOS.
 - **Linux: the AppImage only.** No deb, rpm, Flatpak or Snap. The sandboxed formats cannot start the bundled `twcore` or edit client configuration such as `~/.claude`, and the AppImage updates itself without a password. Builds target glibc 2.35 (Ubuntu 22.04) and WebKitGTK 4.1.
 
diff --git a/src/content/docs-lite/en/install.md b/src/content/docs-lite/en/install.md
index 4264d04..6728cfa 100644
--- a/src/content/docs-lite/en/install.md
+++ b/src/content/docs-lite/en/install.md
@@ -1,6 +1,6 @@
 # Install and update
 
-ThinkWatch Lite runs on macOS 12 or later on Apple Silicon, on Windows 10 21H2 or later on x64 or ARM64, and on Linux on x86_64 or aarch64. The gateway, ThinkWatch Core, ships inside the app; nothing else needs to be installed.
+ThinkWatch Lite runs on macOS 12 or later on Apple silicon, on Windows 10 21H2 or later on x64 or ARM64, and on Linux on x86_64 or aarch64. The gateway, ThinkWatch Core, ships inside the app; nothing else needs to be installed.
 
 ## macOS: Homebrew
 
@@ -63,9 +63,9 @@ The tray icon relies on AppIndicator. Ubuntu ships the GNOME extension for it; F
 
 ## Updates
 
-The app looks for a new version shortly after it starts and once a day after that, reading a small manifest and nothing else. It can be turned off in Settings.
+The app looks for a new version two minutes after it starts and once a day after that, reading a small manifest and nothing else. The automatic check can be turned off in Settings › About.
 
-When there is one, a small window says so, and what happens next depends on how the app was installed.
+When the automatic check finds a new version, the app posts a system notification, unless **Notices** in Settings › General is set to **In app only** or **Off**. The notification, the **Install Version** item in the menu bar or tray menu, and **Update to** in Settings › About open the update window; **Check for updates**, in the same menu or in Settings › About, opens it at once when there is a new version. What happens next depends on how the app was installed.
 
 **Downloaded from the releases page on macOS:** one press on the install button does the rest. The app downloads the update, verifies it against a key compiled into itself, waits for the requests the gateway is serving to finish — up to three minutes — then replaces itself and restarts. A task in the middle of a response is not cut off to make room for the update.
 
@@ -73,7 +73,7 @@ When there is one, a small window says so, and what happens next depends on how
 
 **On Linux:** the same single press, and no password is asked for. The app downloads the new AppImage, verifies it against the key compiled into itself, waits for the requests in flight to finish, then replaces its own file and restarts. The AppImage has to be in a folder the user can write to.
 
-**Installed with Homebrew:** the window gives the command to copy, and the app never replaces itself. Homebrew records which version it put in `/Applications`; an app that overwrote it would be written back over by the next `brew upgrade`. The window only appears once the tap carries the new version, so the command always has something to install:
+**Installed with Homebrew:** the window gives the command to copy, and the app never replaces itself. Homebrew records which version it put in `/Applications`; an app that overwrote it would be written back over by the next `brew upgrade`. A Homebrew installation is offered a new version only once the tap carries it, so the command always has something to install:
 
 ```bash
 brew update && brew upgrade --cask thinkwatch-lite
@@ -85,4 +85,5 @@ brew update && brew upgrade --cask thinkwatch-lite
 
 - [Overview](/docs/lite): what the app shows.
 - [Build from source](/docs/lite/run-from-source): run a development build.
+- [Connecting to a remote core](/docs/lite/remote-core): use a gateway that runs on a server.
 - [Architecture](/docs/lite/architecture): the structure of the app and how it communicates with Core.
diff --git a/src/content/docs-lite/en/overview.md b/src/content/docs-lite/en/overview.md
index ba6db5d..6c85eb9 100644
--- a/src/content/docs-lite/en/overview.md
+++ b/src/content/docs-lite/en/overview.md
@@ -1,60 +1,111 @@
 # ThinkWatch Lite
 
-ThinkWatch Lite is a desktop app that runs a local AI API gateway from the macOS menu bar, the Windows notification area or the Linux system tray. It supervises [ThinkWatch Core](/docs/core) and displays its configuration, traffic and cost.
+ThinkWatch Lite is a desktop app that runs a local AI API gateway on macOS, Windows and Linux, from the macOS menu bar, the Windows notification area or the Linux system tray. Claude Code, Codex and other clients of the Anthropic, OpenAI and Gemini APIs send their requests through the gateway, and the app records what each request cost, which upstream served it and why, and which credentials were redacted before it was sent.
 
-Claude Code, Codex CLI and other clients of the Anthropic, OpenAI and Gemini APIs send their requests to the gateway, and Lite shows what each request cost, which upstream served it and why, and what was sent along with it.
+The gateway is [ThinkWatch Core](/docs/core). It runs beside the app on the same computer, or on a Linux server that the app connects to; see [Connecting to a remote core](/docs/lite/remote-core).
 
-> It runs on macOS 12 or later on Apple Silicon, on Windows 10 21H2 or later on x64 or ARM64 and on Linux on x86_64 or aarch64, is [installed](/docs/lite/install) with Homebrew, a disk image, the Windows installer or an AppImage, and updates itself.
+> It runs on macOS 12 or later on Apple silicon, on Windows 10 21H2 or later on x64 or ARM64 and on Linux on x86_64 or aarch64, is [installed](/docs/lite/install) with Homebrew, a disk image, the Windows installer or an AppImage, and updates itself.
+
+## Pages
+
+| Page | Contents |
+|---|---|
+| Overview | Tokens, cost and requests over a period, trends by model, cache, latency and security results |
+| Traffic | Every request, or requests grouped into sessions, with the details of each |
+| Clients | Pointing clients at the gateway, and restoring them |
+| Keys | The gateway keys clients connect with, each with its route and limits |
+| Upstreams | Upstreams, outbound proxies and price sheets |
+| Routing | Routes, rules and groups, auxiliary requests, and the dry run |
+| Security | The security log and the five protections with their rules |
+| MCP | MCP servers, skills and hooks in each client, and the configuration scan |
+| Settings | Connection, language, appearance, menu bar, notifications, listening, retention, updates and uninstall |
 
 ## Usage and cost
 
-Tokens, cost and requests over any period, broken down by model, with the cache hit rate, the net savings from caching and latency percentiles per model.
+Tokens, cost and requests live or over the last 24 hours, 7 days, 30 days or a custom range, each compared with the period before, with a trend by model and the models ranked by usage. The Overview page also reports the cache hit rate and the net savings from caching, time-to-first-byte percentiles by model and by upstream, and what each security protection found in the period.
+
+Measured costs, estimated costs and unpriced requests are kept apart: an estimate, such as the cost of a request whose client disconnected before the response finished, is marked as one, and requests whose model has no price are counted separately instead of being added as zero. Costs follow LiteLLM's public price data, which the gateway refreshes daily, or a custom price sheet.
+
+## Requests and sessions
+
+The Traffic page lists each request with its key, model, upstream, time to first byte, total time, tokens and cost as it arrives. The list can be filtered by key, upstream, failures, unpriced requests or text, and grouped into sessions, so that the requests of one task can be read together.
 
-Measured costs, estimated costs and unpriced requests are reported separately and never added together; usage served by a subscription upstream is counted apart from billed usage. Every request records the price sheet and the date of the prices it was costed with — figures computed from price lists of different dates are not directly comparable.
+A request's details show the rule it matched, the group it went through, each attempt with its status and duration, and any failover to the next upstream. When the client and the upstream use different API formats, the request is converted between Anthropic Messages, OpenAI Chat Completions, OpenAI Responses and Gemini, and the fields that could not be carried over are listed. The details also include the request and response bodies and the usage the cost was calculated from. A finished request can be replayed against another upstream and the two results compared side by side.
+
+Request and response bodies are masked before they are displayed; a secret is never shown in the interface.
 
 ## Routing and failover
 
-Routing rules send requests to an upstream or a group of upstreams by model, key, token count, tools, images and other properties. Every request records the rule it matched, the group it went through and each attempt with its status and duration.
+Each key uses a route. A route's rules are checked in order against the model, the key, the client's API format, input tokens, `max_tokens`, the number of tools, images, extended thinking, streaming and the prompt cache, and the first rule that matches decides: it forwards the request to an upstream or a group, or refuses it with a message.
 
-A dry run evaluates the rules for a given request and shows where it would go, which rules did not match and for what reason. It sends nothing and costs nothing.
+A group picks its upstreams in order, by manual choice, in rotation, by lowest latency or by lowest cost, and moves on to the next when one is unavailable. In rotation, sticky sessions keep each session on one upstream so that its prompt cache stays valid; they are on by default and can be turned off for a group. Auxiliary requests that clients send on their own, such as health checks, warm-ups and title generation, can be answered locally at no cost, passed through, or handled by the routing rules, which can send them to a lower-cost upstream.
+
+A dry run takes a key, a model, a client format and the properties of a request, and shows where the request would go: the rule that matched, why each rule before it did not, the upstreams that would be tried and any format conversion. It sends nothing and costs nothing.
 
 ## Upstreams
 
-API keys, a ChatGPT account signed in from the app (with its usage limits and reset times), relays such as OpenRouter, and local models.
+API-key upstreams such as Anthropic, OpenAI, Gemini, DeepSeek or any compatible endpoint; ChatGPT and Z.ai accounts signed in from the app, with the ChatGPT usage limits and their reset times; relays such as OpenRouter; and local models served by Ollama or another OpenAI-compatible server.
 
-When a client and an upstream speak different API formats, requests are converted between Anthropic Messages, OpenAI Chat Completions, OpenAI Responses and Gemini, and the fields that cannot be carried over are listed. Upstreams can be reached through an outbound proxy and priced with a custom price sheet.
+Upstreams can connect through an outbound HTTP or SOCKS proxy, whose connection and authentication can be checked from the Upstreams page. Each upstream is billed per token or free. Prices come from the default price sheet, LiteLLM's public price data refreshed daily, or from a custom price sheet that applies a multiplier and prices for individual models on top of it.
 
 ## Security
 
-- **Outbound redaction** replaces keys, private keys and connection strings before a request leaves for an untrusted upstream, and restores them in the response.
-- **Tool-call inspection** cuts off the response stream when an upstream returns a tool call carrying a command that would grant code execution.
-- **Config scan** checks client configuration files (skills, hooks, MCP servers) for hidden characters, injected instructions and dangerous commands.
+Five protections apply to every request that passes through the gateway. They are global: the same modes and rules apply to every upstream and every key.
 
-Each runs in Off, Observe or Enforce mode, and all three start in Observe. The Findings page collects the scan results and compares each upstream's last 24 hours with the 30 days before.
+| Protection | What it checks | In Enforce |
+|---|---|---|
+| Outbound redaction | API keys, private keys, JWTs and connection-string passwords in a request before it is sent; internal addresses and domains once their rules are turned on | Replaces them with placeholders and restores them in the response |
+| Tool-call inspection | Tool calls returned by the upstream, against rules for dangerous commands such as downloading and running a script | Cuts off the response, for rules set to cut off |
+| Hidden characters | Unicode tag characters and bidirectional controls in what the client sends, tool results included | Refuses the request |
+| Content filter | Phrases and patterns in what the client sends, tool results included, such as instructions to ignore previous instructions | Refuses the request, for rules set to refuse |
+| Output limit | The length of an answer, in characters | Cuts off the answer at the limit |
 
-Request and response bodies are masked before they are displayed; a secret is never shown in the interface.
+Each protection is Off, Observe or Enforce. Observe detects and records matches without changing the request; it is the initial mode of every protection except the output limit, which starts Off and uses a limit of 100,000 characters once turned on. Built-in rules can be turned off one by one and custom rules added. Every match is listed in the security log with the request it came from.
+
+## MCP servers, skills and hooks
+
+The MCP page lists the MCP servers configured in Claude Code, Claude Desktop, Cursor, Codex, opencode and Zed side by side. Remote and third-party servers are marked, and a server configured differently in two clients can be compared field by field. A server can be copied to another client or removed; the change is shown before it is written, and the original file is backed up.
+
+The page also lists hooks and skills, and scans client configuration, skills, hooks, slash commands, subagents and project instructions for hidden characters, prompt injection, dangerous commands and overly broad permissions. The scan reports what it finds and changes no file. The files are scanned again when they change, and a new finding raises a notification.
 
 ## Client setup
 
-Claude Code, Codex CLI, opencode, Zed and Aider can be pointed at the gateway from the app. The change is shown as a diff before anything is written, the original file is backed up, only the endpoint and key fields change, and the change can be restored at any time. Cursor, Continue and Gemini CLI come with step-by-step instructions.
+Claude Code, Codex, opencode, Zed and Aider can be pointed at the gateway from the app. The change is shown as a diff before anything is written, the original file is backed up, only the endpoint and key fields change, and the change can be restored at any time. Cursor, Continue and Gemini CLI come with step-by-step instructions.
+
+## Keys
+
+Clients connect to the gateway with gateway keys. Connecting a client creates a key for it, so that traffic, cost and limits are attributed to that client. Each key has a route, the set of models its client sees, and an optional concurrency limit. A key can be disabled, except the default key, or rotated; when a key is rotated, the new key is written into the configuration of the client that uses it.
+
+## Menu bar and tray
+
+On macOS, the menu bar shows today's tokens above today's cost. The numbers turn orange when a subscription quota is nearly used up and red once it has run out; the item can also show only the icon or only the numbers. The item is drawn as a bitmap because the menu bar cannot display two lines of text.
+
+Its menu shows the gateway's state and output rate, each subscription quota with its reset time, today's requests, tokens and cost, and the requests in progress, with items to copy the gateway address or the default key, undo the last configuration change, switch connection and check for updates.
 
-## Menu bar and notifications
+On Windows the icon sits in the notification area. Hovering over it shows the gateway's state and today's tokens and cost; a left click opens the main window, and a right click opens the same menu, with quota bars written out as text. On Linux the icon sits in the system tray. Clicking it opens the same menu, with Open ThinkWatch Lite as its first item.
 
-The menu bar shows today's cost and the output rate; for a subscription account it shows the quota used and the time until it resets instead. The item is rendered as a bitmap because the menu bar cannot display two lines of text.
+## Notifications
 
-On Windows the icon sits in the notification area. Hovering over it shows the gateway's state and today's tokens and cost; a left click opens the main window, and a right click opens the same menu, with quota bars written out as text. Notifications are native Windows notifications.
+The following raise a system notification:
 
-On Linux the icon sits in the system tray. Clicking it opens the same menu, with Open ThinkWatch Lite as its first item and quota bars written out as text. Notifications go to the desktop's notification service.
+- the gateway stops forwarding, cannot start or keeps exiting;
+- the connection to a remote core is lost;
+- a subscription quota runs out;
+- an upstream's sign-in expires, an upstream rejects its credential, or a renewed credential cannot be saved to the configuration;
+- an outbound proxy cannot be reached;
+- an edited configuration file fails validation, or a change to the listening address does not take effect;
+- a tool call matches a rule set to cut off;
+- the configuration scan finds new suspicious content.
 
-System notifications report when the gateway stops forwarding, an upstream becomes unreachable, a subscription quota runs out or a credential stops working. One setting decides how all of them are delivered: as a system notification, in the app only, or not at all.
+An upstream that became unreachable is listed in the app without a system notification. A notice is withdrawn once its problem is resolved. One setting decides how all of them are delivered: as system notifications, in the app only, or not at all. System notifications are native on each platform: the macOS notification center, Windows notifications and the Linux desktop's notification service.
 
 ## Interface language
 
-The interface is available in Simplified Chinese and English. It follows the system language by default; another language can be chosen in Settings.
+The interface is available in English and Simplified Chinese. It follows the system language by default; another language can be chosen in Settings.
 
 ## Relationship to ThinkWatch Core
 
-The gateway is implemented in ThinkWatch Core. Lite contains no routing, forwarding or accounting logic and communicates with Core over a unix socket on macOS and Linux and a loopback port on Windows, both carrying a per-launch credential. See [Architecture](/docs/lite/architecture).
+The gateway is implemented in ThinkWatch Core. Lite contains no routing, forwarding or accounting logic. It controls Core over a unix socket on macOS and Linux and a loopback port on Windows, or over a TCP port when it is connected to a core on a server. Every control connection is encrypted and authenticated by a handshake keyed by `listen.control.key` in `config.yaml`. See [Architecture](/docs/lite/architecture) and [Connecting to a remote core](/docs/lite/remote-core).
 
 ## License
 
diff --git a/src/content/docs-lite/en/remote-core.md b/src/content/docs-lite/en/remote-core.md
new file mode 100644
index 0000000..cc2442a
--- /dev/null
+++ b/src/content/docs-lite/en/remote-core.md
@@ -0,0 +1,72 @@
+# Connecting to a remote core
+
+ThinkWatch Lite normally controls the core it starts on the same computer. It can instead connect to ThinkWatch Core running on a server, where `twcore` runs as a systemd service on Linux, and show that server's traffic, cost and configuration in the same pages. Clients anywhere on the network then send their requests to the server's gateway, and the app on a desktop computer shows and changes what the server does.
+
+Installing and configuring the server is described in [Server deployment](/docs/core/server-deployment) in the ThinkWatch Core documentation. This page covers the app's side.
+
+## What the server needs
+
+- `twcore` installed and running, for example as the `twcore` systemd service that the install script sets up;
+- the remote control port open, with the networks the app connects from in `listen.control.remote.allow_from`;
+- the core version that the app requires. When the versions differ, the app shows both; `sudo twcore upgrade --version <version> --restart` on the server, with the version the app shows, installs it whether it is newer or older than the running one.
+
+On a server installed with the script, the port is opened and the key shown with:
+
+```sh
+sudo -u thinkwatch THINKWATCH_HOME=/var/lib/thinkwatch twcore remote enable --allow 192.168.1.0/24
+sudo -u thinkwatch THINKWATCH_HOME=/var/lib/thinkwatch twcore control-key
+```
+
+`twcore control-key` prints the key on its first line, followed by the control port, the server's addresses that listen on it and the allowed networks.
+
+## Adding a connection
+
+1. Open **Settings › Connection** and choose **Add remote connection**.
+2. Enter a name for the connection and the server's **address**, a host name or an IP address.
+3. Enter the **control port**, the value of `listen.control.remote.port` in the server's configuration, chosen at random between 20000 and 32000 when that section was written.
+4. Enter the **key**, the 64 hexadecimal characters that `twcore control-key` printed.
+5. Choose **Test connection**. The app completes the handshake and reports the server's core version and gateway address.
+6. Choose **Save and switch** to connect now, or **Save** to switch later.
+
+When the test fails, the app says why:
+
+| Message | Meaning |
+|---|---|
+| Cannot connect to the address | The address or the port is wrong, a firewall blocks the port, or `listen.control.remote` is not enabled on the server |
+| The server closed the connection | This computer's address is probably not in `listen.control.remote.allow_from` |
+| The key is not correct | The key differs from the server's; `twcore control-key` on the server shows the current one |
+| Version mismatch | The server runs a different core version; run `sudo twcore upgrade --version <version> --restart` on the server with the version the app shows |
+
+## Switching between connections
+
+The app connects to one core at a time. The connection is switched from the menu at the foot of the sidebar, from **Settings › Connection**, or from the **Connection** submenu of the menu bar or tray menu. The app tests a remote connection before switching to it.
+
+While the app is connected to a server, the core on this computer stops once its requests in progress have finished. Its configuration, keys and request history are kept, and switching back to this computer starts it again.
+
+Clients on this computer that point to the local gateway would fail while it is stopped. When there are such clients, the switch offers to point them at the server's gateway instead; the Clients page offers the same afterwards.
+
+**Connect at startup** chooses between the last used connection and this computer. Holding Option on macOS or Alt on Windows while the app opens shows the choice of connection first; on every platform, the choice also appears when the two previous startups did not finish. When the server cannot be reached, the app keeps retrying and shows the connection's state, with the option to switch to this computer; it does not switch back on its own.
+
+## What changes while connected
+
+- **Overview, Traffic, Keys, Upstreams, Routing and Security** show and change the configuration and history of the core on the server.
+- **Clients and MCP** still act on the computer the app runs on: the Clients page points this computer's clients at the server's gateway, and the MCP page checks this computer's MCP servers, skills and hooks. A note at the top of each page says so. Clients on other machines are configured by hand with the server's gateway address and a gateway key.
+- **Settings** is divided into the app on this computer (connection, general settings, about, uninstall) and the configuration on the server (listening, log retention). The remote control port and its key can be changed only on the server.
+- **ChatGPT sign-in** uses a device code: a browser sign-in returns to the machine that runs core, which is the server.
+- `${NAME}` in an upstream's key or headers reads the environment of the core process on the server, and the **system proxy** option means the server's system proxy.
+- The **diagnostics bundle** is not available. The server refuses three things over a remote connection: producing the bundle, stopping core, and changing `listen.control`.
+- If the connection drops, the pages keep showing the state at the moment of the disconnect and cannot be changed until the connection is restored. A system notification reports the disconnect, and the app reconnects on its own.
+
+## Security of the connection
+
+The control connection is encrypted and authenticated by a Noise handshake (`Noise_NNpsk0_25519_ChaChaPoly_BLAKE2s`) whose pre-shared key is `listen.control.key` in the server's `config.yaml`. There is no TLS and no certificate. A program that can reach the port but does not hold the key cannot control core.
+
+The server accepts connections only from the networks in `listen.control.remote.allow_from`, and ignores a source for a minute after five failed handshakes within a minute. The gateway port carries requests in plain HTTP, so both ports should be reachable only from trusted networks; for access from outside, use a VPN or an SSH tunnel rather than exposing the ports.
+
+The app stores the key in a file in its data directory that only the current user can read. Deleting a connection deletes its key and does not affect the server. After `twcore control-key --rotate` on the server, open the connection in **Settings › Connection** and replace the key.
+
+## Next steps
+
+- [Server deployment](/docs/core/server-deployment): install, configure, start and upgrade `twcore` on a Linux server.
+- [Architecture](/docs/lite/architecture): the control channel between the app and Core.
+- [Overview](/docs/lite): what the app shows.
diff --git a/src/content/docs-lite/en/run-from-source.md b/src/content/docs-lite/en/run-from-source.md
index 824df6e..5149973 100644
--- a/src/content/docs-lite/en/run-from-source.md
+++ b/src/content/docs-lite/en/run-from-source.md
@@ -13,10 +13,11 @@ sudo apt install libwebkit2gtk-4.1-dev build-essential curl wget file libxdo-dev
 
 ```bash
 pnpm install
+bash src-tauri/scripts/fetch-core.sh
 pnpm tauri dev
 ```
 
-`pnpm tauri dev` needs no network and downloads nothing: it looks for a `twcore` binary in a sibling `thinkwatch-core` checkout. A development build never updates itself.
+`fetch-core.sh` downloads the `twcore` release that `Cargo.lock` pins, checks its sha256 and places it in `src-tauri/resources/`. Every build needs that file, `pnpm tauri dev` included, because Tauri checks at compile time that the resources the app declares exist; the development build then runs that copy of `twcore`. A development build never updates itself.
 
 ## Build a bundle
 
@@ -24,13 +25,13 @@ pnpm tauri dev
 pnpm tauri build
 ```
 
-On macOS this produces a self-contained `.app`; on Windows, an NSIS installer; on Linux, an AppImage. The `twcore` inside it is downloaded from a ThinkWatch Core release and checksum-verified rather than copied out of a sibling checkout, so which build was distributed is determined by that release and not by the state of a local working copy. Which release is decided by the tag that `Cargo.lock` resolved for `tw-api`, so the protocol mirror compiled into the app and the binary shipped beside it always come from one Core commit.
+On macOS this produces a self-contained `.app`; on Windows, an NSIS installer; on Linux, an AppImage. The build runs `fetch-core.sh` itself, so the `twcore` inside the bundle is always a checksum-verified ThinkWatch Core release rather than a local build, and which build was distributed is determined by that release and not by the state of a working copy. The release is the tag that `Cargo.lock` resolved for `tw-api`, so the protocol mirror compiled into the app and the binary shipped beside it always come from one Core commit.
 
-The macOS bundle is neither signed by a registered Apple developer nor notarized, and it is built for Apple Silicon only. The Windows installer is not code-signed.
+The macOS bundle is neither signed by a registered Apple developer nor notarized, and it is built for Apple silicon only. The Windows installer is not code-signed.
 
 ## Platforms
 
-Releases are built for macOS on Apple Silicon, for Windows on x64 and ARM64, and for Linux on x86_64 and aarch64.
+Releases are built for macOS on Apple silicon, for Windows on x64 and ARM64, and for Linux on x86_64 and aarch64.
 
 ## Next steps
 
diff --git a/src/content/docs-lite/zh-CN/architecture.md b/src/content/docs-lite/zh-CN/architecture.md
index dce55d4..54cc9bb 100644
--- a/src/content/docs-lite/zh-CN/architecture.md
+++ b/src/content/docs-lite/zh-CN/architecture.md
@@ -6,18 +6,34 @@ ThinkWatch Lite 是网关的操作界面，并非网关本身。
 
 ```
 src/              React 19 + Tailwind 4 前端
-src-tauri/        Tauri 2 外壳：托管 core、渲染菜单栏
+src-tauri/        Tauri 2 外壳：托管 core，渲染菜单栏与托盘
+src-tauri/crates/ 客户端接管（tw-adopt）与配置扫描（tw-scan）
 ```
 
-- **`src-tauri/`** 为 Tauri 2 外壳，负责托管 ThinkWatch Core，在 macOS 上渲染菜单栏，在 Windows 上渲染通知区域的图标与菜单，在 Linux 上渲染系统托盘的图标与菜单。在 macOS 上，托管器与 launchd 集成。
+- **`src-tauri/`** 为 Tauri 2 外壳，负责启动并托管 ThinkWatch Core：core 退出后自动重启；连续多次启动失败后进入安全模式，只运行控制面，配置、历史与回滚仍然可用。外壳在 macOS 上渲染菜单栏，在 Windows 上渲染通知区域的图标与菜单，在 Linux 上渲染系统托盘的图标与菜单，并负责发送系统通知。开机启动时启动的是应用本身，再由应用启动 core；core 不单独注册开机启动。
+- **`src-tauri/crates/`** 包含 `tw-adopt` 与 `tw-scan`：前者把客户端指向网关并负责还原，后者为 MCP 页扫描客户端配置。两者都作用于运行应用的这台电脑，应用连接服务器上的 core 时也是如此。
 - **`src/`** 为前端，使用 React 19 与 Tailwind 4 编写。
 
 ## Lite 与 Core
 
-网关由 [ThinkWatch Core](/zh-CN/docs/core) 实现。本仓库不包含路由、转发或计量逻辑，Lite 在 macOS 与 Linux 上通过 unix socket、在 Windows 上通过回环端口与 Core 通信，两者都带一个每次启动生成的凭据。
+网关由 [ThinkWatch Core](/zh-CN/docs/core) 实现。本仓库不包含路由、转发或计量逻辑。
 
 路由、转发、成本核算与脱敏均由 Core 负责。涉及数据通路的行为变更，应提交至 [ThinkWatch Core 仓库](https://github.com/ThinkWatchProject/ThinkWatch-Core)。
 
+## 控制通道
+
+Lite 读取和修改的一切都经由 Core 的控制接口。连接方式取决于 Core 运行在哪里：
+
+| Core 运行在 | 通道 |
+|---|---|
+| 同一台电脑，macOS 或 Linux | 数据目录中的 unix socket |
+| 同一台电脑，Windows | 回环 TCP 端口 |
+| 服务器 | 服务器的远程控制端口（TCP） |
+
+三种通道承载同一套 HTTP 接口，外面包着一次 Noise 握手（`Noise_NNpsk0_25519_ChaChaPoly_BLAKE2s`），预共享密钥是 Core 的 `config.yaml` 中的 `listen.control.key`。握手对连接双向加密与认证：能访问 socket 或端口、但不持有密钥的程序无法控制 Core。整个过程不使用 TLS，也不涉及证书。握手中交换双方版本，应用与 core 版本不一致时连接被拒绝。
+
+对于应用自己启动的 core，应用从本机的 `config.yaml` 读取密钥；对于服务器上的 core，密钥在添加连接时填写一次，保存在应用数据目录中仅当前用户可读的文件里。参见[连接远程 core](/zh-CN/docs/lite/remote-core)。
+
 ## 界面约束
 
 以下规则为强制要求，违反其中任何一条的改动都将被要求修改：
diff --git a/src/content/docs-lite/zh-CN/contributing.md b/src/content/docs-lite/zh-CN/contributing.md
index c7d0533..909ca32 100644
--- a/src/content/docs-lite/zh-CN/contributing.md
+++ b/src/content/docs-lite/zh-CN/contributing.md
@@ -13,7 +13,7 @@ gh pr create --base dev --head your-branch
 以下决定已经确定，不接受相关 PR：
 
 - **macOS、Windows 与 Linux，同一个 tag 发布。** 每个版本的 tag 产出五个供安装的文件，网关都在包内，旁边各附 sha256：macOS 的 arm64 磁盘映像，Windows 的 x64 与 arm64 安装程序，以及 Linux 的 x86_64 与 aarch64 AppImage。
-- **macOS：只面向 Apple Silicon，且未经 Apple 签名。** macOS 的产物是磁盘映像中的 arm64 `.app`，使用项目自己的自签名证书签名。该证书不满足 Gatekeeper 的要求，它的作用是让每个版本的签名者保持一致，Homebrew 升级时才不会提示签名者变更。Intel 的通用二进制和 Developer ID 签名都是持续成本，目前没有人承担，因此只加公证步骤、没有对应账号的 PR 无法合并；让构建回退到本机架构的 PR 同样无法合并——那会发出一个部分用户下载后打不开的文件。
+- **macOS：只面向 Apple silicon，且未经 Apple 签名。** macOS 的产物是磁盘映像中的 arm64 `.app`，使用项目自己的自签名证书签名。该证书不满足 Gatekeeper 的要求，它的作用是让每个版本的签名者保持一致，Homebrew 升级时才不会提示签名者变更。Intel 的通用二进制和 Developer ID 签名都是持续成本，目前没有人承担，因此只加公证步骤、没有对应账号的 PR 无法合并；让构建回退到本机架构的 PR 同样无法合并——那会发出一个部分用户下载后打不开的文件。
 - **Windows：未经代码签名。** 安装程序不带 Authenticode 签名，项目也不会购买证书，因此首次运行下载的安装程序时 SmartScreen 会发出警告。更新包与 macOS 一样，用编译进应用的公钥验签。
 - **Linux：只发布 AppImage。** 不提供 deb、rpm、Flatpak 或 Snap。沙箱格式无法启动随包的 `twcore`，也无法修改 `~/.claude` 等客户端配置；AppImage 自动更新时不需要输入密码。构建以 glibc 2.35（Ubuntu 22.04）与 WebKitGTK 4.1 为底线。
 
diff --git a/src/content/docs-lite/zh-CN/install.md b/src/content/docs-lite/zh-CN/install.md
index 73a0a89..75b26c0 100644
--- a/src/content/docs-lite/zh-CN/install.md
+++ b/src/content/docs-lite/zh-CN/install.md
@@ -1,6 +1,6 @@
 # 安装与更新
 
-ThinkWatch Lite 支持 macOS 12 及以上版本的 Apple Silicon 机型，Windows 10 21H2 及以上版本的 x64 与 ARM64 机型，以及 x86_64 与 aarch64 机型的 Linux。网关 ThinkWatch Core 在应用包内，没有第二样东西要装。
+ThinkWatch Lite 支持 macOS 12 及以上版本的 Apple silicon 机型，Windows 10 21H2 及以上版本的 x64 与 ARM64 机型，以及 x86_64 与 aarch64 机型的 Linux。网关 ThinkWatch Core 随应用一同安装，无需另行安装其他组件。
 
 ## macOS：Homebrew
 
@@ -63,9 +63,9 @@ curl -fsSL https://github.com/ThinkWatchProject/ThinkWatch-Lite/releases/latest/
 
 ## 更新
 
-应用启动后不久检查一次新版本，此后每天检查一次，只读取一份很小的版本清单。可以在「设置」中关闭。
+应用启动两分钟后检查一次新版本，此后每天检查一次，只读取一份很小的版本清单。自动检查可以在「设置 › 关于」中关闭。
 
-有新版本时会弹出一个小窗口，之后的处理方式取决于安装方式。
+自动检查发现新版本时，应用会发送一条系统通知；「设置 › 通用」中的提醒设为「仅在应用内」或「关闭」时不发送。点按这条通知、菜单栏或托盘菜单中的「安装新版本」，或「设置 › 关于」中的「更新到」，都会打开更新窗口；在同一菜单或「设置 › 关于」中选择「检查更新」，发现新版本时也会立即打开它。之后的处理方式取决于安装方式。
 
 **在 macOS 上从 release 页面下载安装的**：点击一次安装按钮，其余步骤自动完成——下载更新包，用编译进应用的公钥验签，等待网关正在处理的请求结束（最多三分钟），然后替换并重新启动。正在输出的任务不会因更新而中断。
 
@@ -73,7 +73,7 @@ curl -fsSL https://github.com/ThinkWatchProject/ThinkWatch-Lite/releases/latest/
 
 **Linux 上**：同样点击一次即可，不需要输入密码。应用下载新版本的 AppImage，用编译进应用的公钥验签，等待进行中的请求结束，然后替换自身文件并重新启动。AppImage 须位于当前用户可写的目录中。
 
-**用 Homebrew 安装的**：窗口给出更新命令和复制按钮，应用不会替换自身。Homebrew 记录着它放入 `/Applications` 的版本，应用自行替换后，下一次 `brew upgrade` 会把旧版本写回。这个窗口只在 tap 已包含新版本时才会出现，因此给出的命令一定有可安装的内容：
+**用 Homebrew 安装的**：窗口给出更新命令和复制按钮，应用不会替换自身。Homebrew 记录着它放入 `/Applications` 的版本，应用自行替换后，下一次 `brew upgrade` 会把旧版本写回。通过 Homebrew 安装的应用只在 tap 已包含新版本时才会提示更新，因此给出的命令一定有可安装的内容：
 
 ```bash
 brew update && brew upgrade --cask thinkwatch-lite
@@ -85,4 +85,5 @@ brew update && brew upgrade --cask thinkwatch-lite
 
 - [概览](/zh-CN/docs/lite)：应用展示什么。
 - [从源码构建](/zh-CN/docs/lite/run-from-source)：在本机运行开发版本。
+- [连接远程 core](/zh-CN/docs/lite/remote-core)：使用部署在服务器上的网关。
 - [架构](/zh-CN/docs/lite/architecture)：应用的结构，以及它与 Core 的通信方式。
diff --git a/src/content/docs-lite/zh-CN/overview.md b/src/content/docs-lite/zh-CN/overview.md
index 3f0aa15..c884103 100644
--- a/src/content/docs-lite/zh-CN/overview.md
+++ b/src/content/docs-lite/zh-CN/overview.md
@@ -1,60 +1,111 @@
 # ThinkWatch Lite
 
-ThinkWatch Lite 是运行本地 AI API 网关的桌面应用，常驻 macOS 菜单栏、Windows 通知区域或 Linux 系统托盘。它托管 [ThinkWatch Core](/zh-CN/docs/core)，并展示其配置、流量与费用。
+ThinkWatch Lite 是一款在本机运行 AI API 网关的桌面应用，支持 macOS、Windows 和 Linux，常驻 macOS 菜单栏、Windows 通知区域或 Linux 系统托盘。Claude Code、Codex 以及其他使用 Anthropic、OpenAI、Gemini 接口的客户端经由网关发出请求，应用记录每个请求的费用、由哪个上游处理及其原因，以及发出前被脱敏的密钥。
 
-Claude Code、Codex CLI 等使用 Anthropic、OpenAI、Gemini API 的客户端把请求发给这个网关，Lite 展示每个请求的费用、由哪个上游处理及其原因，以及随请求发出的内容。
+网关本体是 [ThinkWatch Core](/zh-CN/docs/core)。它随应用在本机运行，也可以部署在 Linux 服务器上，由应用远程连接，参见[连接远程 core](/zh-CN/docs/lite/remote-core)。
 
-> 支持 macOS 12 及以上版本的 Apple Silicon 机型、Windows 10 21H2 及以上版本的 x64 与 ARM64 机型，以及 x86_64 与 aarch64 机型的 Linux，可通过 Homebrew、磁盘映像、Windows 安装程序或 AppImage [安装](/zh-CN/docs/lite/install)，并由应用自动更新。
+> 支持 macOS 12 及以上版本的 Apple silicon 机型、Windows 10 21H2 及以上版本的 x64 与 ARM64 机型，以及 x86_64 与 aarch64 机型的 Linux，可通过 Homebrew、磁盘映像、Windows 安装程序或 AppImage [安装](/zh-CN/docs/lite/install)，并由应用自动更新。
+
+## 页面
+
+| 页面 | 内容 |
+|---|---|
+| 概览 | 一段时间内的 token、费用与请求数，按模型的趋势，缓存、延迟与安全检查结果 |
+| 流量 | 逐条请求或按会话归组的请求，以及每个请求的详情 |
+| 客户端 | 把客户端指向网关，以及还原 |
+| 密钥 | 客户端连接网关所用的密钥，及其路由与限制 |
+| 上游 | 上游、出站代理与价目表 |
+| 路由 | 路由、规则与策略组，辅助请求，以及试算 |
+| 安全 | 安全日志，以及五项防护及其规则 |
+| MCP | 各客户端的 MCP 服务器、技能与钩子，以及配置扫描 |
+| 设置 | 连接、语言、外观、菜单栏、提醒、网关监听、日志保留、更新与卸载 |
 
 ## 用量与费用
 
-按任意时间范围统计 token、费用与请求数，按模型分层，并给出缓存命中率、缓存带来的净节省与各模型的延迟分位。
+按实时、24 小时、7 天、30 天或自定义区间统计 token、费用与请求数，并与上一个同等区间对比；按模型分层显示趋势，并按用量列出模型排行。概览页还给出缓存命中率与缓存带来的净节省、按模型和按上游统计的首字节延迟分位，以及各项安全防护在该区间内的检查结果。
+
+实测费用、估算费用与无法计价的请求分别列出：估算的金额（例如客户端在响应结束前断开的请求）会标明是估算，模型没有价格的请求单独计数，不按零计入。费用按网关每日更新的 LiteLLM 公开价格数据计算，也可以使用自定义价目表。
+
+## 请求与会话
 
-实测费用、估算费用与无法计价的请求分别列出，从不相加；订阅制上游的用量单独统计，不计入费用。每个请求都注明计价所用的价目表及其数据日期——基于不同日期价目表算出的数字不可直接比较。
+流量页逐条列出请求的密钥、模型、上游、首字节延迟、总耗时、token 与费用，新请求实时加入。列表可按密钥、上游、失败、无法计价或关键词筛选，也可以按会话归组，把同一项任务的请求放在一起查看。
+
+请求详情给出命中的规则、经过的策略组、每一次尝试的状态与耗时，以及向下一个上游的故障转移。客户端与上游的 API 格式不同时，请求在 Anthropic Messages、OpenAI Chat Completions、OpenAI Responses 与 Gemini 之间自动转换，无法转换的字段会逐一列出。详情中还有请求体、响应体，以及计算费用所依据的用量。已结束的请求可以原样重放到另一个上游，并排对比两次的结果。
+
+请求体与响应体在显示之前即已遮蔽，界面上不会出现密钥原文。
 
 ## 路由与故障转移
 
-路由规则按模型、密钥、token 数、工具、图片等条件，把请求交给某个上游或策略组。每个请求都记录命中的规则、经过的策略组，以及每一次尝试的状态与耗时。
+每把密钥对应一条路由。路由中的规则按顺序与请求的模型、密钥、客户端 API 格式、输入 token、`max_tokens`、工具数量、图片、扩展思考、流式与提示缓存等条件匹配，由第一条命中的规则决定去向：交给某个上游或策略组，或者附带说明直接拒绝。
 
-试算按给定的请求条件逐条匹配规则，说明请求会交给哪个上游、哪些规则未命中及其原因。它不发出请求，也不产生费用。
+策略组按顺序、手动选择、轮询、延迟最低或费用最低选用成员，某个上游不可用时换用下一个。轮询时，会话粘滞使同一会话固定使用同一上游，提示缓存因此持续有效；该选项默认开启，可以按策略组关闭。客户端自行发出的辅助请求（如健康检查、预热、生成标题）可以由网关在本地应答且不产生费用，也可以直接转发，或交给路由规则处理，由规则把它们转给费用更低的上游。
+
+试算按给定的密钥、模型、客户端格式与请求条件，说明请求会被转发到哪里：命中的规则、前面每条规则未命中的原因、将依次尝试的上游，以及途中的格式转换。试算不发出请求，也不产生费用。
 
 ## 上游
 
-支持 API 密钥、在应用内登录的 ChatGPT 账号（显示订阅额度与重置时间）、OpenRouter 等中转服务，以及本机模型。
+支持 Anthropic、OpenAI、Gemini、DeepSeek 等 API 密钥上游与任意兼容端点，在应用内登录的 ChatGPT 与 Z.ai 账号（ChatGPT 显示订阅额度及重置时间），OpenRouter 等中转服务，以及 Ollama 或其他兼容 OpenAI 接口的本机模型服务。
 
-客户端与上游的 API 格式不同时，请求在 Anthropic Messages、OpenAI Chat Completions、OpenAI Responses 与 Gemini 之间自动转换，无法转换的字段会逐一列出。上游可以经出站代理访问，也可以按自定义价目表计价。
+上游可以经 HTTP 或 SOCKS 出站代理连接，代理的连通性与认证可以在上游页检查。每个上游按 token 计费或不计费。价格来自默认价目表（每日更新的 LiteLLM 公开价格数据），也可以使用在其基础上设置倍率与单个模型价格的自定义价目表。
 
 ## 安全
 
-- **出站脱敏**：请求发往不受信任的上游之前，替换其中的密钥、私钥与连接串，并在响应中还原。
-- **工具调用审查**：上游返回的工具调用中出现可直接获得执行权限的命令时，在流中切断。
-- **配置面扫描**：检查客户端配置文件（skill、hook、MCP server）中的隐藏字符、注入内容与危险命令。
+五项防护作用于经过网关的每个请求。防护是全局的：档位与规则对所有上游、所有密钥一致。
+
+| 防护 | 检查什么 | 拦截时 |
+|---|---|---|
+| 出站脱敏 | 请求发出前其中的 API 密钥、私钥、JWT 与连接串口令；开启相应规则后也包括内网地址与内部域名 | 替换为占位符，并在响应中还原 |
+| 工具调用审查 | 上游返回的工具调用，按危险命令规则检查，例如下载并执行脚本 | 切断响应（仅限设为「切断」的规则） |
+| 隐藏字符 | 客户端发来的内容（含工具结果）中的 Unicode 标签字符与双向控制符 | 拒绝请求 |
+| 内容过滤 | 客户端发来的内容（含工具结果）中的词语与模式，例如要求忽略先前指令的语句 | 拒绝请求（仅限设为「拒绝」的规则） |
+| 输出长度 | 单次回答的字符数 | 在上限处切断回答 |
 
-三项防护各有「关闭 / 观察 / 拦截」三档，出厂均为「观察」。「发现」页汇总扫描结果，并对比各上游最近 24 小时与此前 30 天的行为。
+每项防护有关闭、观察、拦截三档。观察只检测并记录命中，不改变请求；除输出长度外，各项防护出厂均为观察。输出长度出厂为关闭，开启后默认上限为 100,000 个字符。内置规则可以逐条停用，也可以添加自定义规则。每一次命中都连同对应的请求记录在安全日志中。
 
-请求体与响应体在上屏之前即已遮蔽，界面上不会出现密钥原文。
+## MCP 服务器、技能与钩子
+
+MCP 页并列显示 Claude Code、Claude Desktop、Cursor、Codex、opencode 与 Zed 中配置的 MCP 服务器，标出远程与第三方服务器；同名服务器在两个客户端中配置不同时，可以逐字段对比。服务器可以复制到其他客户端或移除，写入前显示改动，并完整备份原文件。
+
+该页还列出钩子与技能，并扫描客户端配置、技能、钩子、斜杠命令、subagent 与项目指令，检查隐藏字符、提示注入、危险命令与过宽权限四类问题。扫描只报告，不修改任何文件。这些文件发生变化时会重新扫描，出现新发现时发送提醒。
 
 ## 客户端接管
 
-Claude Code、Codex CLI、opencode、Zed 与 Aider 可以在应用内一键指向网关。写入前先显示改动差异并完整备份原文件，只修改端点与密钥两个字段，随时可以还原。Cursor、Continue 与 Gemini CLI 提供逐步的手动配置说明。
+Claude Code、Codex、opencode、Zed 与 Aider 可以在应用内一键指向网关。写入前先显示改动差异并完整备份原文件，只修改端点与密钥两个字段，随时可以还原。Cursor、Continue 与 Gemini CLI 提供逐步的手动配置说明。
+
+## 密钥
+
+客户端凭网关密钥连接网关。接管客户端时为它单独生成一把密钥，流量、费用与限制因此按客户端区分。每把密钥有各自的路由、客户端可见的模型范围与可选的并发上限。除默认密钥外，密钥可以停用；密钥也可以更换，更换后的新密钥会写入使用它的客户端的配置。
+
+## 菜单栏与托盘
+
+在 macOS 上，菜单栏上行显示今日 token，下行显示今日费用。订阅额度即将用完时数字变为橙色，用完后变为红色；也可以只显示标识或只显示数字。由于菜单栏放不下两行文字，这一块以位图形式绘制。
+
+点开的菜单列出网关状态与输出速率、各订阅额度及其重置时间、今日请求数、token 与费用、进行中的请求，并提供复制网关地址、复制默认密钥、撤销上一次配置修改、切换连接与检查更新等菜单项。
 
-## 菜单栏与系统通知
+Windows 上图标位于通知区域：悬停显示网关状态与今日 token、费用；左键打开主界面，右键打开同一份菜单，其中的额度条改为文字。Linux 上图标位于系统托盘：点击打开同一份菜单，第一项为「打开主界面」。
 
-菜单栏常驻显示今日费用与输出速率；使用订阅账号时改为显示额度用量与重置倒计时。由于菜单栏放不下两行文字，这一块以位图形式渲染。
+## 系统通知
 
-Windows 上图标位于通知区域：悬停显示网关状态与今日 token、费用；左键打开主界面，右键打开同一份菜单，其中的额度条改为文字。系统通知为 Windows 原生通知。
+以下情况会发送系统通知：
 
-Linux 上图标位于系统托盘：点击打开同一份菜单，第一项为「打开主界面」，额度条同样改为文字。系统通知通过桌面环境的通知服务发送。
+- 网关停止转发、无法启动或反复退出；
+- 与远程 core 的连接断开；
+- 订阅额度用完；
+- 上游的登录过期、上游拒绝当前凭据，或续期得到的新凭据未能写回配置；
+- 出站代理无法连接；
+- 手动修改的配置文件未通过校验，或监听地址的修改未能生效；
+- 工具调用命中设为「切断」的规则；
+- 配置扫描发现新的可疑内容。
 
-网关停止转发、上游无法连接、订阅额度用完、凭据失效等情况会发送提醒。提醒方式由一项设置统一决定：系统通知、仅在应用内显示或关闭。
+上游无法连接只在应用内列出，不发送系统通知。问题解除后，对应的提醒随之撤回。提醒方式由一项设置统一决定：系统通知、仅在应用内显示或关闭。系统通知在各平台上均为原生通知：macOS 通知中心、Windows 通知与 Linux 桌面环境的通知服务。
 
 ## 界面语言
 
-界面提供简体中文与英文，默认跟随系统语言，也可以在设置中另选。
+界面提供英文与简体中文，默认跟随系统语言，也可以在设置中另选。
 
 ## 与 ThinkWatch Core 的关系
 
-网关本体在 ThinkWatch Core 中实现。Lite 不包含路由、转发或计费逻辑，在 macOS 与 Linux 上通过 unix socket、在 Windows 上通过回环端口与 Core 通信，两者都带一个每次启动生成的凭据。参见[架构](/zh-CN/docs/lite/architecture)。
+网关本体在 ThinkWatch Core 中实现。Lite 不包含路由、转发或计费逻辑，在 macOS 与 Linux 上通过 unix socket、在 Windows 上通过回环端口控制 Core；连接服务器上的 core 时则通过 TCP 端口。每条控制连接都经过以 `config.yaml` 中 `listen.control.key` 为密钥的握手加密与认证。参见[架构](/zh-CN/docs/lite/architecture)与[连接远程 core](/zh-CN/docs/lite/remote-core)。
 
 ## 许可证
 
diff --git a/src/content/docs-lite/zh-CN/remote-core.md b/src/content/docs-lite/zh-CN/remote-core.md
new file mode 100644
index 0000000..07e9d61
--- /dev/null
+++ b/src/content/docs-lite/zh-CN/remote-core.md
@@ -0,0 +1,72 @@
+# 连接远程 core
+
+ThinkWatch Lite 默认控制它在本机启动的 core，也可以改为连接部署在服务器上的 ThinkWatch Core（在 Linux 上以 systemd 服务运行的 `twcore`），在同样的页面中显示该服务器的流量、费用与配置。此时网络中的客户端把请求发给服务器上的网关，桌面上的应用负责查看和修改服务器的运行情况。
+
+服务器的安装与配置见 ThinkWatch Core 文档中的[服务器部署](/zh-CN/docs/core/server-deployment)。本页说明应用一侧的操作。
+
+## 服务器需要具备的条件
+
+- 已安装并运行 `twcore`，例如安装脚本设置好的 `twcore` systemd 服务；
+- 已开启远程控制端口，并把应用所在的网段写入 `listen.control.remote.allow_from`；
+- core 版本为应用要求的版本。版本不一致时，应用会同时显示两边的版本；在服务器上执行 `sudo twcore upgrade --version <版本号> --restart` 并填入应用显示的版本，即可换成该版本，升级或降级均可。
+
+用安装脚本安装的服务器上，开启端口并查看密钥的命令如下：
+
+```sh
+sudo -u thinkwatch THINKWATCH_HOME=/var/lib/thinkwatch twcore remote enable --allow 192.168.1.0/24
+sudo -u thinkwatch THINKWATCH_HOME=/var/lib/thinkwatch twcore control-key
+```
+
+`twcore control-key` 第一行输出密钥，之后是控制端口、服务器上监听该端口的地址，以及允许连接的网段。
+
+## 添加连接
+
+1. 打开**设置 › 连接**，选择**添加远程连接**。
+2. 填写连接名称，以及服务器的**地址**（主机名或 IP 地址）。
+3. 填写**控制端口**，即服务器配置中 `listen.control.remote.port` 的值；该值在写入这一节配置时从 20000 至 32000 之间随机选定。
+4. 填写**密钥**，即 `twcore control-key` 输出的 64 位十六进制字符。
+5. 选择**测试连接**。应用完成握手，并显示服务器 core 的版本与网关地址。
+6. 选择**保存并切换**立即连接，或选择**保存**以后再切换。
+
+测试失败时，应用会说明原因：
+
+| 提示 | 含义 |
+|---|---|
+| 无法连接到该地址 | 地址或端口有误、防火墙拦截了该端口，或服务器配置中未启用 `listen.control.remote` |
+| 连接被服务器关闭 | 本机地址可能不在 `listen.control.remote.allow_from` 中 |
+| 密钥不正确 | 与服务器上的密钥不一致；在服务器上执行 `twcore control-key` 可查看当前密钥 |
+| 版本不一致 | 服务器上的 core 版本不同；在服务器上执行 `sudo twcore upgrade --version <版本号> --restart`，版本号为应用显示的版本 |
+
+## 切换连接
+
+应用同一时间只连接一个 core。可以在侧栏底部的连接菜单、**设置 › 连接**，或菜单栏与托盘菜单的**连接**子菜单中切换。切换到远程连接之前，应用会先测试该连接。
+
+连接服务器期间，本机的 core 在在途请求结束后停止运行。本机的配置、密钥与请求历史都会保留，切换回本机时 core 重新启动。
+
+本机上指向本地网关的客户端在本地网关停止期间无法使用。存在这类客户端时，切换时可以选择同时把它们改为指向服务器的网关；之后也可以在客户端页完成同样的修改。
+
+**启动时连接**可以选择上次使用的连接或本机。在 macOS 上按住 Option 键、在 Windows 上按住 Alt 键打开应用时，会先显示连接选择；在各个平台上，连续两次启动未能完成时也会先显示连接选择。服务器无法访问时，应用持续重试并显示连接状态，可以手动切换到本机；应用不会自行退回本机。
+
+## 连接期间的变化
+
+- **概览、流量、密钥、上游、路由与安全**显示和修改的是服务器上 core 的配置与历史。
+- **客户端与 MCP**仍作用于运行应用的这台电脑：客户端页把这台电脑上的客户端改为指向服务器的网关，MCP 页检查这台电脑上的 MCP 服务器、技能与钩子。两页顶部都有相应说明。其他机器上的客户端需要手动填写服务器的网关地址与网关密钥。
+- **设置**分为这台电脑上的应用（连接、通用、关于、卸载）与服务器上的配置（网关监听、日志保留）两部分。远程控制端口及其密钥只能在服务器上修改。
+- **ChatGPT 登录**只能使用设备码：浏览器登录完成后会回到运行 core 的机器，也就是服务器。
+- 上游密钥或请求头中的 `${变量名}` 读取的是服务器上 core 进程的环境变量，**系统代理**选项指的是服务器的系统代理。
+- 不提供**诊断包**。经远程连接，服务器拒绝三项操作：生成诊断包、停止 core，以及修改 `listen.control`。
+- 连接中断时，各页面保持断开时的状态，恢复连接之前不可修改。应用会发送系统通知，并自动重新连接。
+
+## 连接的安全性
+
+控制连接经过 Noise 握手（`Noise_NNpsk0_25519_ChaChaPoly_BLAKE2s`）加密与认证，预共享密钥是服务器 `config.yaml` 中的 `listen.control.key`。整个过程不使用 TLS，也不涉及证书。能访问该端口、但不持有密钥的程序无法控制 core。
+
+服务器只接受来自 `listen.control.remote.allow_from` 所列网段的连接；同一来源一分钟内握手失败五次后，服务器在一分钟内忽略该来源。网关端口以明文 HTTP 传输请求，因此两个端口都应只对可信网络开放；需要从外部访问时，应使用 VPN 或 SSH 隧道，而不是直接暴露端口。
+
+应用把密钥保存在数据目录中仅当前用户可读的文件里。删除连接时一并删除其密钥，服务器不受影响。在服务器上执行 `twcore control-key --rotate` 之后，需要在**设置 › 连接**中编辑该连接并更换密钥。
+
+## 下一步
+
+- [服务器部署](/zh-CN/docs/core/server-deployment)：在 Linux 服务器上安装、配置、启动与升级 `twcore`。
+- [架构](/zh-CN/docs/lite/architecture)：应用与 Core 之间的控制通道。
+- [概览](/zh-CN/docs/lite)：应用展示什么。
diff --git a/src/content/docs-lite/zh-CN/run-from-source.md b/src/content/docs-lite/zh-CN/run-from-source.md
index 9111c5f..0cfb030 100644
--- a/src/content/docs-lite/zh-CN/run-from-source.md
+++ b/src/content/docs-lite/zh-CN/run-from-source.md
@@ -13,10 +13,11 @@ sudo apt install libwebkit2gtk-4.1-dev build-essential curl wget file libxdo-dev
 
 ```bash
 pnpm install
+bash src-tauri/scripts/fetch-core.sh
 pnpm tauri dev
 ```
 
-`pnpm tauri dev` 不联网、不下载任何内容：它会在同级的 `thinkwatch-core` 检出目录中寻找 `twcore` 二进制。开发版本不执行自动更新。
+`fetch-core.sh` 下载 `Cargo.lock` 锁定的 `twcore` 发布版本，校验 sha256 后放入 `src-tauri/resources/`。包括 `pnpm tauri dev` 在内，每一次构建都需要这个文件，因为 Tauri 在编译时会检查应用声明的资源文件是否存在；开发版本运行的也是这一份 `twcore`。开发版本不执行自动更新。
 
 ## 打包
 
@@ -24,13 +25,13 @@ pnpm tauri dev
 pnpm tauri build
 ```
 
-在 macOS 上这会产出一个自包含的 `.app`，在 Windows 上产出 NSIS 安装程序，在 Linux 上产出 AppImage。包内的 `twcore` 从 ThinkWatch Core 的 release 下载并校验哈希，而不是从同级检出目录复制，因此分发出去的是哪一个构建由该 release 决定，与本地工作副本的状态无关。用哪个 release 由 `Cargo.lock` 中 `tw-api` 解析到的 tag 决定，因此编译进应用的协议镜像与随包分发的二进制始终来自同一个 Core 提交。
+在 macOS 上这会产出一个自包含的 `.app`，在 Windows 上产出 NSIS 安装程序，在 Linux 上产出 AppImage。打包时会自动运行 `fetch-core.sh`，因此包内的 `twcore` 始终是经过哈希校验的 ThinkWatch Core 发布版本，而不是本地构建的二进制；分发出去的是哪一个构建由该 release 决定，与工作副本的状态无关。所用的 release 是 `Cargo.lock` 中 `tw-api` 解析到的 tag，因此编译进应用的协议镜像与随包分发的二进制始终来自同一个 Core 提交。
 
-macOS 产物未经 Apple 注册开发者签名，也未公证，且只面向 Apple Silicon 构建。Windows 安装程序未经代码签名。
+macOS 产物未经 Apple 注册开发者签名，也未公证，且只面向 Apple silicon 构建。Windows 安装程序未经代码签名。
 
 ## 平台
 
-发布版本面向 Apple Silicon 的 macOS、x64 与 ARM64 的 Windows，以及 x86_64 与 aarch64 的 Linux。
+发布版本面向 Apple silicon 的 macOS、x64 与 ARM64 的 Windows，以及 x86_64 与 aarch64 的 Linux。
 
 ## 下一步
 
diff --git a/src/content/docs/_meta.ts b/src/content/docs/_meta.ts
index 8a5b02d..62da1ad 100644
--- a/src/content/docs/_meta.ts
+++ b/src/content/docs/_meta.ts
@@ -135,8 +135,8 @@ export const products: Product[] = [
     base: "/docs/lite",
     editUrl: "https://github.com/ThinkWatchProject/thinkwatch.github.io/tree/main/src/content/docs-lite",
     tagline: {
-      en: "The desktop app for a local AI API gateway on macOS, Windows and Linux: what it shows, how to install it, and how it is built.",
-      "zh-CN": "运行本地 AI API 网关的 macOS、Windows 与 Linux 桌面应用：它展示什么、怎么安装、怎么构建。",
+      en: "The desktop app for a local AI API gateway on macOS, Windows and Linux: what it shows, how to install it, how to connect it to a core on a server, and how it is built.",
+      "zh-CN": "在本机运行 AI API 网关的 macOS、Windows 与 Linux 桌面应用：展示的内容、安装方法、连接服务器上的 core 的方法，以及构建方式。",
     },
     docs: [
       overview(),
@@ -150,6 +150,16 @@ export const products: Product[] = [
           "zh-CN": "通过 Homebrew、磁盘映像、Windows 安装程序或 Linux AppImage 安装，隔离属性与 SmartScreen 的处理，以及各种安装方式如何更新。",
         },
       },
+      {
+        slug: "remote-core",
+        label: { en: "Connecting to a remote core", "zh-CN": "连接远程 core" },
+        locales: both,
+        group: "getStarted",
+        summary: {
+          en: "Connect the app to ThinkWatch Core on a server: what the server needs, the steps in the app, what changes while connected, and how the connection is secured.",
+          "zh-CN": "让应用连接部署在服务器上的 ThinkWatch Core：服务器需要具备的条件、应用中的操作步骤、连接期间的变化，以及连接如何加密。",
+        },
+      },
       {
         slug: "run-from-source",
         label: { en: "Build from source", "zh-CN": "从源码构建" },
@@ -166,8 +176,8 @@ export const products: Product[] = [
         locales: both,
         group: "concepts",
         summary: {
-          en: "A Tauri 2 shell and a React 19 frontend that supervise Core and communicate with it over a unix socket on macOS and Linux and a loopback port on Windows.",
-          "zh-CN": "Tauri 2 外壳与 React 19 前端，负责托管 Core，在 macOS 与 Linux 上通过 unix socket、在 Windows 上通过回环端口与其通信。",
+          en: "A Tauri 2 shell and a React 19 frontend that supervise Core and control it over a unix socket on macOS and Linux, a loopback port on Windows or a TCP port on a server, each with an encrypted handshake.",
+          "zh-CN": "Tauri 2 外壳与 React 19 前端，负责托管 Core，在 macOS 与 Linux 上通过 unix socket、在 Windows 上通过回环端口、连接服务器时通过 TCP 端口控制它，每种通道都经过加密握手。",
         },
       },
       {
diff --git a/src/i18n/pages/license.ts b/src/i18n/pages/license.ts
index cbbbb72..6957d69 100644
--- a/src/i18n/pages/license.ts
+++ b/src/i18n/pages/license.ts
@@ -8,8 +8,8 @@ const links = {
   licensingMd: "https://github.com/ThinkWatchProject/ThinkWatch/blob/main/LICENSING.md",
   liteLicense: "https://github.com/ThinkWatchProject/ThinkWatch-Lite/blob/main/LICENSE",
   coreLicense: "https://github.com/ThinkWatchProject/ThinkWatch-Core/blob/main/LICENSE",
-  sales: "mailto:hello@thinkwat.ch",
-  salesLabel: "hello@thinkwat.ch",
+  sales: "mailto:fylorn@outlook.com",
+  salesLabel: "fylorn@outlook.com",
 } as const;
 
 const tierNumbers = [
diff --git a/src/i18n/pages/lite.ts b/src/i18n/pages/lite.ts
index 40f9edd..bf7e578 100644
--- a/src/i18n/pages/lite.ts
+++ b/src/i18n/pages/lite.ts
@@ -1,102 +1,170 @@
-// Copy for the /lite product page. Facts come from the ThinkWatch Lite README:
-// released for macOS on Apple Silicon (Homebrew or a disk image) and for
-// Windows on x64 and ARM64 (an unsigned installer) and for Linux on x86_64 and
-// aarch64 (an AppImage), updated by the app itself.
+// Copy for the /lite product page.
+//
+// Product claims are checked against the code, not against other copy: the
+// five protections and their initial modes against ThinkWatch Core
+// (crates/tw-config/src/security.rs), which notices become system
+// notifications against the app (src-tauri/src/notices/rules.rs), and what
+// changes while the app is connected to a remote core against src/connection.
+//
+// Screenshots come from the ThinkWatch Lite repository (`pnpm shots`, output in
+// docs/screenshots/web), copied into public/lite under the same names. Each
+// alt text describes the image it belongs to; when an image is replaced, its
+// alt text changes with it.
+
+const overviewAlt = {
+  en: "The Overview page for the last 7 days: 83.1M tokens, $68.11 in cost including $0.441 estimated and 13 unpriced requests, and 1,339 requests of which 11 failed, each compared with the prior 7 days; a token trend stacked by model with the periods that had failures marked; and the models ranked by tokens",
+  "zh-CN":
+    "概览页（最近 7 天）：token 83.1M、费用 $68.11（含估算 $0.441，13 条无法计价）、请求 1,339 次（失败 11 次），均与上一个 7 天对比；按模型分层的 token 趋势，并标出存在失败的时段；以及按 token 排序的模型列表",
+} as const;
 
 export const liteCopy = {
   en: {
     meta: {
-      title: "ThinkWatch Lite — A local AI gateway for macOS, Windows and Linux",
+      title: "ThinkWatch Lite — Local AI API gateway for macOS, Windows and Linux",
       description:
-        "A desktop app for individual developers that reports what Claude Code and Codex sessions cost, where each request was routed, and what was sent with it. macOS 12 or later on Apple Silicon, installed with Homebrew or a disk image; Windows 10 21H2 or later on x64 or ARM64, installed with an installer; Linux on x86_64 or aarch64, as an AppImage. MIT License.",
+        "Desktop app for a local AI API gateway on macOS, Windows and Linux. Shows what Claude Code, Codex and other OpenAI and Anthropic clients cost, where each request was routed and what was redacted, and can connect to ThinkWatch Core on a server. MIT License.",
     },
     hero: {
       eyebrow: "ThinkWatch Lite · For individual developers",
-      titleA: "A local AI gateway ",
+      titleA: "A local AI API gateway ",
       titleHighlight: "for macOS, Windows and Linux",
-      sub: "Claude Code, Codex CLI and other clients of the Anthropic, OpenAI and Gemini APIs send their requests to a gateway on your own machine, and Lite shows what each request cost, which upstream served it and why, and what was sent along with it.",
-      ctaSecondary: "Other platforms and ways to install",
-      shotAlt:
-        "The usage overview: tokens, cost and requests, a 24-hour trend stacked by model, the leaderboard by model and the cache hit rate",
+      sub: "Claude Code, Codex and other clients of the Anthropic, OpenAI and Gemini APIs send their requests through a local gateway, and the app records what each request cost, which upstream served it and why, and which credentials were redacted before it was sent. The gateway can also run on a server; the app then connects to it over an encrypted control channel.",
+      ctaSecondary: "Other platforms and installation methods",
+      shotAlt: overviewAlt.en,
     },
     status: {
       badge: "Available",
-      body: "macOS 12 or later on Apple Silicon, installed with Homebrew or a disk image. Windows 10 21H2 or later on x64 or ARM64, installed with an installer. Ubuntu 22.04, Debian 12, Fedora 36 or later on x86_64 or aarch64, as an AppImage. On every platform, the app updates itself.",
+      body: "macOS 12 or later on Apple silicon, installed with Homebrew or a disk image. Windows 10 21H2 or later on x64 or ARM64, installed with an installer. Ubuntu 22.04, Debian 12, Fedora 36 or later on x86_64 or aarch64, as an AppImage. The interface is in English and Simplified Chinese, and the app updates itself; a Homebrew installation is updated through Homebrew.",
     },
     features: {
-      eyebrow: "What it shows",
+      eyebrow: "Features by page",
       items: [
         {
           id: "overview",
           title: "Usage and cost",
-          body: "Tokens, cost and requests over any period, broken down by model, with the cache hit rate, the net savings from caching and latency percentiles. Measured costs, estimated costs and unpriced requests stay separate and are never added together, and usage served by a subscription is counted apart from billed usage.",
-          alt: "The usage overview: tokens, cost and requests, a 24-hour trend stacked by model, the leaderboard by model and the cache hit rate",
+          body: "Tokens, cost and requests live or for the last 24 hours, 7 days, 30 days or a custom range, each compared with the period before, with a trend by model and the models ranked by usage. The page also reports the cache hit rate and the net savings from caching, time-to-first-byte percentiles by model and by upstream, and what each security protection found. Measured and estimated costs are marked as such, and requests without a price are counted separately rather than as zero.",
+          alt: overviewAlt.en,
+        },
+        {
+          id: "traffic",
+          title: "Requests and sessions",
+          body: "Every request with its key, model, upstream, time to first byte, total time, tokens and cost, listed as it arrives and filtered by key, upstream, failures, unpriced requests or text; requests can also be grouped into sessions. A request's details show the rule it matched, every attempt and any failover, the conversion between API formats with the fields that could not be carried over, the request and response bodies with credentials masked, and the usage its cost was calculated from. A finished request can be replayed against another upstream and the results compared side by side.",
+          alt: "The Traffic page: the latest requests with their key, model, upstream, latency, tokens and cost, among them one in progress, requests converted between API formats, one with two credentials redacted, one blocked, one answered locally, and failed and canceled requests",
         },
         {
-          id: "requests",
+          id: "clients",
+          title: "Client setup",
+          body: "Claude Code, Codex, opencode, Zed and Aider are pointed at the gateway from the app. Each change is shown as a diff before it is written, the original file is backed up, only the endpoint and the key are changed, and any client can be restored. Cursor, Continue and Gemini CLI come with step-by-step instructions. Each client's requests over the last 24 hours are listed beside it.",
+          alt: "The Clients page: Claude Code and Codex in use, each with its own key and its requests over the last 24 hours; opencode not connected; Cursor set up by hand and in use; Continue and Gemini CLI not set up; Zed and Aider not detected",
+        },
+        {
+          id: "keys",
+          title: "A key for each client",
+          body: "Clients connect with gateway keys, and connecting a client creates a key for it, so that traffic and cost are attributed to that client. Each key has its own route, the set of models its client sees, an optional concurrency limit, and its requests and cost over the last 24 hours. A key can be disabled or rotated; a rotated key is written into the configuration of the client that uses it.",
+          alt: "The Keys page: four keys, default, claude-code, codex and cursor, with the client each belongs to, its route, the models its client sees, and its requests and cost over the last 24 hours",
+        },
+        {
+          id: "upstreams",
+          title: "Upstreams and prices",
+          body: "API-key upstreams such as Anthropic, OpenAI, Gemini, DeepSeek or any compatible endpoint; ChatGPT and Z.ai accounts signed in from the app, with the ChatGPT usage limits and their reset times; relays such as OpenRouter; and local models served by Ollama. When a client and an upstream use different API formats, requests are converted between Anthropic Messages, OpenAI Chat Completions, OpenAI Responses and Gemini. Upstreams can connect through an outbound proxy. Costs follow LiteLLM's public prices, refreshed daily, or a custom price sheet with a multiplier and prices for individual models.",
+          alt: "The Upstreams page: seven upstreams, including Anthropic, a relay priced with a discounted price sheet, a ChatGPT Plus account with 58% of its 5-hour limit used, OpenRouter through a proxy, DeepSeek, Gemini and a local Ollama, each with its billing, its requests and cost over 24 hours and its median time to first byte; tabs for proxies and price sheets",
+        },
+        {
+          id: "routing",
           title: "Routing and failover",
-          body: "Every request records the rule it matched, the group it went through and each attempt with its status and duration. When a client and an upstream speak different API formats, the request is converted between Anthropic Messages, OpenAI Chat Completions, OpenAI Responses and Gemini, and the fields that could not be carried over are listed.",
-          alt: "The traffic page with a request open: it went to openrouter and was converted from Anthropic Messages to OpenAI Chat Completions, and the field that could not be carried over, messages.content.thinking, is listed as dropped",
+          body: "Each key uses a route, whose rules are checked in order against the model, the client's API format, input tokens, max_tokens, tools, images, extended thinking and other properties of a request. A rule forwards the request to an upstream or a group, or refuses it. A group picks its upstreams in order, by manual choice, in rotation, by lowest latency or by lowest cost, and moves on to the next when one is unavailable; in rotation, sticky sessions, on by default, keep each session on one upstream so that its prompt cache stays valid. Auxiliary requests that clients send on their own, such as title generation or warm-up, can be answered locally.",
+          alt: "The Routing page: a map of how four keys lead through three routes and the groups main and budget to seven upstreams, with one rule refusing requests; below it, each route with its keys and its rules in order",
         },
         {
           id: "dry-run",
-          title: "A dry run before the traffic",
-          body: "The dry run evaluates the rules for a given request and shows where it would go and why — which rules did not match and for what reason — without sending anything and without cost.",
-          alt: "A routing dry run: the first two rules did not match and say why, the third one did, and the request goes to a group that tries two upstreams in order",
+          title: "Dry run",
+          body: "A dry run takes a key, a model, a client format and the properties of a request, and shows where the request would go: the rule that matched and why the rules before it did not, each upstream that would be tried, and any format conversion on the way. Nothing is sent and no cost is incurred.",
+          alt: "A routing dry run for the cursor key requesting claude-sonnet-5 in the OpenAI Chat Completions format: the gemini rule did not match because the model must be gemini-*, the catch-all rule matched, and the request goes to the budget group, ordered by lowest cost, which tries relay and then anthropic, each with a conversion from OpenAI Chat Completions to Anthropic Messages",
         },
         {
-          id: "upstreams",
-          title: "Upstreams of every kind",
-          body: "API keys, a ChatGPT account signed in from the app with its usage limits, relays such as OpenRouter, and local models. Upstreams can be reached through an outbound proxy and priced with a custom price sheet.",
-          alt: "The upstream list: API-key upstreams, a ChatGPT account on Plus with 34% of its 5-hour quota used, OpenRouter through a proxy, DeepSeek, Gemini and a local Ollama, each with its 24-hour requests, cost and time to first byte",
+          id: "security",
+          title: "Five security protections",
+          body: "Five protections apply to every request through the gateway, the same for every upstream and key. Outbound redaction finds API keys, private keys, JWTs and connection-string passwords in a request; tool-call inspection checks the tool calls an upstream returns for dangerous commands; hidden characters and the content filter check what a client sends, tool results included, for invisible Unicode and prompt-injection phrases; the output limit measures the length of an answer. Each protection is set to Off, Observe or Enforce. Observe records matches without changing anything and is the initial setting for all but the output limit, which starts off. Enforce acts on a match: redaction replaces the credentials before the request is sent and restores them in the response, a dangerous tool call or an answer over the limit is cut off, and a request carrying hidden characters or a phrase set to be refused is refused. Built-in rules can be turned off one by one, custom rules can be added, and every match appears in the security log.",
+          alt: "The Security page log: redaction and tool-call inspection enforcing, hidden characters and the content filter observing, the output limit off, and eight matches in the last 24 hours, including an AWS access key ID replaced, a download-and-run command cut off, a custom customer-id rule, Unicode tag characters hidden in a tool result, and a prompt-injection phrase recorded",
         },
         {
-          id: "findings",
-          title: "What leaves the machine",
-          body: "Secrets are replaced before a request reaches an untrusted upstream and restored in the response; tool calls that would grant code execution are cut off mid-stream; client configuration files are scanned for hidden characters and dangerous commands. Each defense runs in off, observe or enforce mode.",
-          alt: "Scan results: a hook that downloads and runs a remote script, zero-width characters hidden in a skill, an upstream whose share of high-risk responses is rising, and the MCP servers each client has configured",
+          id: "mcp",
+          title: "MCP servers, skills and hooks",
+          body: "The MCP servers configured in Claude Code, Claude Desktop, Cursor, Codex, opencode and Zed appear side by side, with remote and third-party servers marked and differences between clients highlighted; a server can be copied to another client or removed, with the change shown before it is written. Hooks and skills are listed as well. Client configuration, skills, hooks, slash commands, subagents and project instructions are scanned for hidden characters, prompt injection, dangerous commands and overly broad permissions. Findings are reported without changing any file, and a new finding raises a system notification.",
+          alt: "The MCP page: five MCP servers across Claude Code, Claude Desktop, Cursor, Codex, opencode and Zed, with context7 and linear marked as third-party remote servers and github marked as configured differently between clients; one high, one medium and one low finding from 11 scanned files",
         },
         {
-          id: "clients",
-          title: "Clients in one click",
-          body: "Claude Code, Codex CLI, opencode, Zed and Aider are pointed at the gateway from the app. The change is shown as a diff before anything is written, the original file is backed up, and it can be restored at any time.",
-          alt: "The clients page: Claude Code and Codex CLI pointed at the gateway with requests already received from both, opencode not yet connected, and the clients that have to be configured by hand",
+          id: "settings",
+          title: "Settings and languages",
+          body: "The interface is available in English and Simplified Chinese and follows the system language unless another is chosen. Settings also cover the connection to a local or remote core, the appearance, what the menu bar item shows, launch at login, notifications, the gateway's listening address and the networks allowed to reach it, how long request records and bodies are kept, updates, and a full uninstall that restores every connected client and turns off launch at login.",
+          alt: "The Settings page: connections to this Mac, which is current, and to two remote cores, homelab and build-server; the connection used at startup; the interface language set to follow the system; the appearance; and what the menu bar item shows",
+        },
+      ],
+    },
+    remote: {
+      eyebrow: "Remote core",
+      title: "ThinkWatch Core on a server",
+      body: [
+        "The gateway can also run on a Linux server, where twcore runs as a systemd service and serves clients across the network. The app connects to it through the server's remote control port and shows that server's traffic, cost and configuration in the same pages.",
+        "A connection is added in Settings › Connection with the server's address, its control port and the key that twcore control-key prints. Before switching to a connection, the app tests it: it completes the handshake and compares versions, since the server has to run the core version the app requires; when they differ, sudo twcore upgrade --version <version> --restart on the server installs that version, newer or older. The app connects to one core at a time; while it is connected to a server, the core on the local computer stops and its data is kept. The Clients and MCP pages still act on the computer the app runs on, and the Clients page can point that computer's clients at the server's gateway.",
+        "Every control connection, local or remote, is encrypted and authenticated by a Noise handshake keyed by listen.control.key in config.yaml; no certificates are involved. The app keeps connection keys in a file in its data directory that only the current user can read.",
+      ],
+      serverDocs: "Server deployment guide",
+      docs: "Connecting to a remote core",
+      addAlt:
+        "Adding a remote connection: the name homelab, the address 192.168.1.40, control port 24817 and the key, with a successful test that reports core 0.49.0 and the gateway at 192.168.1.40:8788",
+      figures: [
+        {
+          id: "remote-switcher",
+          caption: "Connections are switched from the foot of the sidebar.",
+          alt: "The connection menu at the foot of the sidebar while connected to homelab: this Mac with its local core stopped, homelab selected, build-server, and entries to add or manage connections",
+        },
+        {
+          id: "remote-clients",
+          caption: "The Clients page changes the clients on this computer.",
+          alt: "The Clients page while connected to homelab, with a note that it changes the client configuration on this Mac to point at homelab's gateway at 192.168.1.40:8788 and does not affect clients on the server",
         },
       ],
     },
     menubar: {
-      eyebrow: "Always visible",
-      title: "Fifty pixels in the menu bar",
-      body: "Today's cost and the output rate stay in the menu bar; for a subscription account, the quota used and the time until it resets take their place. On Windows the icon sits in the notification area: hovering over it shows today's tokens and cost, a left click opens the main window and a right click opens the menu. On Linux it sits in the system tray and opens the same menu. System notifications report a gateway that stopped forwarding, an upstream that became unreachable, a quota that ran out or a credential that stopped working.",
-      costAlt: "Menu bar item: today's cost $24.72, output at 47 tokens per second",
-      quotaAlt: "Menu bar item: 34% of the subscription quota used, resets in 2 hours",
+      eyebrow: "Outside the main window",
+      title: "Menu bar, tray and notifications",
+      body: "On macOS, the menu bar item shows today's tokens and cost, which turn orange when a subscription quota is nearly used up and red once it has run out; it can also show only the icon or only the numbers. Its menu lists the gateway's state and output rate, each subscription quota with its reset time, today's requests, tokens and cost, and the requests in progress, with actions to copy the gateway address or the default key, undo the last configuration change and switch connection. On Windows the icon sits in the notification area and on Linux in the system tray, with the same menu in text form.",
+      notices:
+        "System notifications report a gateway that stopped forwarding, a lost connection to a remote core, a subscription quota that ran out, a credential that expired, was rejected or could not be saved, an unreachable proxy, configuration that did not take effect, a tool call that matched a rule set to cut off, and suspicious content newly found in client configuration. An unreachable upstream is listed in the app without a system notification. One setting sends these notices as system notifications, keeps them in the app, or turns them off.",
+      chipAlt: "The menu bar item: the ThinkWatch mark with today's 13.3M tokens above today's cost, $9.34",
+      menuAlt:
+        "The menu bar menu: the gateway running at 127.0.0.1:8788 at 64 tokens per second; the chatgpt quota at 58% of its 5-hour window, resetting in 2 hours, and 31% of its weekly window, resetting in 3 days; today's 204 requests with 4 failed, 13.3M tokens and $9.34 in cost; one Claude Code request in progress; and items to copy the gateway address or the default key, undo the last configuration change, open the app, switch connection, open settings and check for updates",
     },
     built: {
       eyebrow: "Architecture",
       lite: {
         title: "ThinkWatch Lite",
-        body: "A Tauri 2 shell with a React 19 window. Supervises Core and renders the menu bar, or the tray menu on Windows and Linux.",
+        body: "A Tauri 2 shell with a React 19 window. It starts and supervises the local core or connects to a core on a server, and renders the menu bar on macOS and the tray menu on Windows and Linux.",
+      },
+      link: {
+        title: "Control channel",
+        lines: ["Unix socket · macOS, Linux", "Loopback port · Windows", "TCP port · remote core", "Encrypted handshake on each"],
       },
-      link: "local socket",
       core: {
         title: "ThinkWatch Core",
-        body: "The gateway: routing, forwarding, and accounting. Lite contains none of this logic.",
+        body: "The gateway, twcore: routing, forwarding, format conversion, cost accounting and the security protections. It runs beside the app or as a systemd service on a Linux server; Lite contains none of this logic.",
       },
       upstreams: {
         title: "Upstreams",
-        body: "The Anthropic, OpenAI and Gemini APIs, and any configured providers and relays.",
+        body: "The Anthropic, OpenAI and Gemini APIs, accounts signed in from the app, relays and local models.",
       },
     },
     install: {
       eyebrow: "Install",
-      title: "One download, gateway included",
+      title: "Installation on macOS, Windows and Linux",
       brewNote: "The gateway ships inside the app; nothing else needs to be installed.",
-      macLabel: "macOS 12 or later · Apple Silicon",
+      macLabel: "macOS 12 or later · Apple silicon",
       winLabel: "Windows 10 21H2 or later · x64 or ARM64",
-      dmgTitle: "Or a disk image",
+      dmgTitle: "Disk image",
       dmgBody:
-        "Check it against its sha256 after downloading. The app is not signed by a registered Apple developer, so macOS quarantines a downloaded copy until the attribute is removed — or until Open Anyway is chosen in System Settings › Privacy & Security.",
-      dmgDownload: "Download the disk image (Apple Silicon)",
+        "Check it against its sha256 after downloading. The app is not signed by a registered Apple developer, so macOS quarantines a downloaded copy until the attribute is removed, or until Open Anyway is chosen in System Settings › Privacy & Security.",
+      dmgDownload: "Download the disk image (Apple silicon)",
       releases: "All releases",
       winTitle: "Windows installer",
       winBody:
@@ -110,7 +178,7 @@ export const liteCopy = {
       linuxLabel: "Ubuntu 22.04, Debian 12, Fedora 36 or later · x86_64 or aarch64",
       linuxScript:
         "The script downloads the AppImage for the machine's architecture, checks its sha256, installs it as ~/Applications/ThinkWatch-Lite.AppImage and starts it.",
-      linuxTitle: "Or the AppImage",
+      linuxTitle: "AppImage",
       linuxBody:
         "Check it against its sha256, allow it to run (chmod +x, or “Allow executing file as program” in the file manager's Properties) and open it. Keep it in a folder the user can write to, such as ~/Applications, so that it can update itself. The first launch adds ThinkWatch Lite to the application menu.",
       linuxDownload: { x86_64: "Download the AppImage (x86_64)", aarch64: "Download the AppImage (aarch64)" },
@@ -129,97 +197,151 @@ export const liteCopy = {
   },
   "zh-CN": {
     meta: {
-      title: "ThinkWatch Lite — 适用于 macOS、Windows 与 Linux 的本地 AI 网关",
+      title: "ThinkWatch Lite — 适用于 macOS、Windows 与 Linux 的本地 AI API 网关",
       description:
-        "面向个人开发者的桌面应用，展示 Claude Code 与 Codex 会话的费用、每个请求的路由，以及随请求发出的内容。支持 macOS 12 及以上版本的 Apple Silicon 机型，可通过 Homebrew 或磁盘映像安装；支持 Windows 10 21H2 及以上版本的 x64 与 ARM64 机型，通过安装程序安装；支持 x86_64 与 aarch64 机型的 Linux，以 AppImage 发布。采用 MIT 许可证。",
+        "在本机运行 AI API 网关的桌面应用，支持 macOS、Windows 与 Linux。记录 Claude Code、Codex 以及其他使用 OpenAI、Anthropic 接口的客户端每个请求的费用、所用的上游与发出前被脱敏的密钥，也可以连接部署在服务器上的 ThinkWatch Core。采用 MIT 许可证。",
     },
     hero: {
       eyebrow: "ThinkWatch Lite · 面向个人开发者",
       titleA: "适用于 macOS、Windows 与 Linux 的",
-      titleHighlight: "本地 AI 网关",
-      sub: "Claude Code、Codex CLI 等使用 Anthropic、OpenAI、Gemini API 的客户端把请求发给本机上的网关，Lite 展示每个请求的费用、由哪个上游处理及其原因，以及随请求发出的内容。",
+      titleHighlight: "本地 AI API 网关",
+      sub: "Claude Code、Codex 以及其他使用 Anthropic、OpenAI、Gemini 接口的客户端经由本机的网关发出请求，应用记录每个请求的费用、由哪个上游处理及其原因，以及发出前被脱敏的密钥。网关也可以部署在服务器上，此时应用通过加密的控制通道连接服务器上的 ThinkWatch Core。",
       ctaSecondary: "其他平台与安装方式",
-      shotAlt:
-        "ThinkWatch Lite 的用量概览：token、费用与请求数，按模型分层的 24 小时趋势，模型排行与缓存命中率",
+      shotAlt: overviewAlt["zh-CN"],
     },
     status: {
       badge: "已发布",
-      body: "支持 macOS 12 及以上版本的 Apple Silicon 机型，可通过 Homebrew 或磁盘映像安装；支持 Windows 10 21H2 及以上版本的 x64 与 ARM64 机型，通过安装程序安装；支持 Ubuntu 22.04、Debian 12、Fedora 36 及以上版本的 x86_64 与 aarch64 机型，以 AppImage 发布。各平台均由应用自动更新。",
+      body: "支持 macOS 12 及以上版本的 Apple silicon 机型，可通过 Homebrew 或磁盘映像安装；支持 Windows 10 21H2 及以上版本的 x64 与 ARM64 机型，通过安装程序安装；支持 Ubuntu 22.04、Debian 12、Fedora 36 及以上版本的 x86_64 与 aarch64 机型，以 AppImage 发布。界面提供英文与简体中文；应用自动更新，通过 Homebrew 安装的由 Homebrew 更新。",
     },
     features: {
-      eyebrow: "界面",
+      eyebrow: "各页功能",
       items: [
         {
           id: "overview",
           title: "用量与费用",
-          body: "按任意时间范围统计 token、费用与请求数，按模型分层，并给出缓存命中率、缓存带来的净节省与延迟分位。实测费用、估算费用与无法计价的请求分别列出，从不相加；订阅制上游的用量单独统计。",
-          alt: "ThinkWatch Lite 的用量概览：token、费用与请求数，按模型分层的 24 小时趋势，模型排行与缓存命中率",
+          body: "按实时、24 小时、7 天、30 天或自定义区间统计 token、费用与请求数，并与上一个同等区间对比；按模型分层显示趋势，并按用量列出模型排行。页面还给出缓存命中率与缓存带来的净节省、按模型和按上游统计的首字节延迟分位，以及各项安全防护的检查结果。实测与估算的费用分别标明，无法计价的请求单独计数，不按零计入。",
+          alt: overviewAlt["zh-CN"],
+        },
+        {
+          id: "traffic",
+          title: "请求与会话",
+          body: "逐条列出请求的密钥、模型、上游、首字节延迟、总耗时、token 与费用，新请求实时加入，可按密钥、上游、失败、无法计价或关键词筛选，也可以按会话归组。请求详情给出命中的规则、每一次尝试与故障转移、API 格式转换及无法转换的字段、遮蔽凭据后的请求体与响应体，以及计算费用所依据的用量。已结束的请求可以原样重放到另一个上游，并排对比结果。",
+          alt: "流量页：最近的请求及其密钥、模型、上游、延迟、token 与费用，其中有一条进行中的请求、经格式转换的请求、脱敏 2 处凭据的请求、被拦截的请求、本地应答的请求，以及失败和已取消的请求",
+        },
+        {
+          id: "clients",
+          title: "客户端接管",
+          body: "Claude Code、Codex、opencode、Zed 与 Aider 可以在应用内一键指向网关。写入前先显示改动差异，原文件完整备份，只修改端点与密钥，随时可以还原。Cursor、Continue 与 Gemini CLI 提供逐步的手动配置说明。每个客户端旁列出其最近 24 小时的请求。",
+          alt: "客户端页：Claude Code 与 Codex 已接管，各用一把密钥，并列出最近 24 小时的请求；opencode 尚未接管；Cursor 已手动配置并在使用；Continue 与 Gemini CLI 尚未配置；Zed 与 Aider 未检测到",
+        },
+        {
+          id: "keys",
+          title: "每个客户端一把密钥",
+          body: "客户端凭网关密钥连接网关。接管客户端时为它单独生成一把密钥，流量与费用因此按客户端区分。每把密钥有各自的路由、客户端可见的模型范围、可选的并发上限，以及最近 24 小时的请求数与费用。密钥可以停用或更换，更换后的新密钥会写入使用它的客户端的配置。",
+          alt: "密钥页：default、claude-code、codex、cursor 四把密钥，列出各自所属的客户端、路由、可见模型，以及最近 24 小时的请求数与费用",
+        },
+        {
+          id: "upstreams",
+          title: "上游与价目表",
+          body: "支持 Anthropic、OpenAI、Gemini、DeepSeek 等 API 密钥上游与任意兼容端点，在应用内登录的 ChatGPT 与 Z.ai 账号（ChatGPT 显示订阅额度及重置时间），OpenRouter 等中转服务，以及 Ollama 提供的本机模型。客户端与上游的 API 格式不同时，请求在 Anthropic Messages、OpenAI Chat Completions、OpenAI Responses 与 Gemini 之间自动转换。上游可以经出站代理连接。费用按每日更新的 LiteLLM 公开价格计算，也可以使用设有倍率与单个模型价格的自定义价目表。",
+          alt: "上游页：七个上游，包括 Anthropic、按折扣价目表计价的中转、5 小时额度已用 58% 的 ChatGPT Plus 账号、经代理访问的 OpenRouter、DeepSeek、Gemini 与本机 Ollama，以及各自的计费方式、24 小时请求数与费用和首字节延迟中位数；另有代理与价目表两个标签",
         },
         {
-          id: "requests",
+          id: "routing",
           title: "路由与故障转移",
-          body: "每个请求都记录命中的规则、经过的策略组，以及每一次尝试的状态与耗时。客户端与上游的 API 格式不同时，请求在 Anthropic Messages、OpenAI Chat Completions、OpenAI Responses 与 Gemini 之间自动转换，无法转换的字段会逐一列出。",
-          alt: "流量页与一条请求的详情：请求转发至 openrouter，由 Anthropic Messages 转换为 OpenAI Chat Completions，无法转换的字段 messages.content.thinking 列为已丢弃",
+          body: "每把密钥对应一条路由，路由中的规则按顺序与请求的模型、客户端 API 格式、输入 token、max_tokens、工具、图片、扩展思考等条件匹配。规则把请求交给某个上游或策略组，或者直接拒绝。策略组按顺序、手动选择、轮询、延迟最低或费用最低选用成员，某个上游不可用时换用下一个；轮询时默认开启会话粘滞，同一会话固定使用同一上游，提示缓存因此持续有效。客户端自行发出的辅助请求（如生成标题、预热）可以由网关在本地应答。",
+          alt: "路由页：从四把密钥经三条路由与 main、budget 两个策略组到七个上游的链路图，其中一条规则直接拒绝请求；下方逐条列出每条路由的密钥与规则",
         },
         {
           id: "dry-run",
-          title: "改规则之前先试算",
-          body: "试算按给定的请求条件逐条匹配规则，说明请求会交给哪个上游、哪些规则未命中及其原因。不发出请求，也不产生费用。",
-          alt: "路由试算：前两条规则未命中及其原因，第三条规则命中，请求转发至策略组并按顺序尝试两个上游",
+          title: "路由试算",
+          body: "试算按给定的密钥、模型、客户端格式与请求条件，说明请求会被转发到哪里：命中的规则、前面各条规则未命中的原因、将依次尝试的上游，以及途中的格式转换。不发出请求，也不产生费用。",
+          alt: "路由试算：cursor 密钥以 OpenAI Chat Completions 格式请求 claude-sonnet-5；gemini 规则因模型须为 gemini-* 而未命中，catch-all 规则命中，请求交给按费用最低排序的 budget 策略组，依次尝试 relay 与 anthropic，两者都将 OpenAI Chat Completions 转换为 Anthropic Messages",
         },
         {
-          id: "upstreams",
-          title: "各种形态的上游",
-          body: "支持 API 密钥、在应用内登录并显示订阅额度的 ChatGPT 账号、OpenRouter 等中转服务，以及本机模型。上游可以经出站代理访问，也可以按自定义价目表计价。",
-          alt: "上游列表：API 密钥上游、ChatGPT 账号（Plus，5 小时额度已用 34%）、经代理访问的 OpenRouter、DeepSeek、Gemini 与本机 Ollama，以及各自 24 小时的请求数、费用与首字节延迟",
+          id: "security",
+          title: "五项安全防护",
+          body: "五项防护作用于经过网关的每个请求，对所有上游与密钥一致：出站脱敏查找请求中的 API 密钥、私钥、JWT 与连接串口令；工具调用审查检查上游返回的工具调用中的危险命令；隐藏字符与内容过滤检查客户端发来的内容（含工具结果）中的不可见 Unicode 字符与提示注入语句；输出长度衡量单次回答的长度。每项防护可设为关闭、观察或拦截。观察只记录命中，不改变请求；除输出长度出厂为关闭外，其余各项出厂均为观察。拦截时，出站脱敏在请求发出前替换凭据并在响应中还原，危险的工具调用与超出上限的回答被切断，含隐藏字符或命中「拒绝」规则的请求被拒绝。内置规则可以逐条停用，也可以添加自定义规则，所有命中都记录在安全日志中。",
+          alt: "安全页日志：出站脱敏与工具调用审查处于拦截，隐藏字符与内容过滤处于观察，输出长度关闭；最近 24 小时 8 次命中，包括已替换的 AWS 访问密钥 ID、已切断的下载即执行命令、自定义规则 customer-id 的命中、工具结果中隐藏的 Unicode 标签字符，以及记录在案的提示注入语句",
         },
         {
-          id: "findings",
-          title: "出去的是什么",
-          body: "请求发往不受信任的上游之前替换其中的密钥，并在响应中还原；上游返回的危险工具调用在流中被切断；客户端配置文件中的隐藏字符与危险命令会被扫描出来。三项防护各有关闭、观察、拦截三档。",
-          alt: "扫描结果：hook 中下载并执行远程脚本的命令、skill 中隐藏的零宽字符、某上游高危响应的比例上升，以及各客户端配置的 MCP server",
+          id: "mcp",
+          title: "MCP 服务器、技能与钩子",
+          body: "Claude Code、Claude Desktop、Cursor、Codex、opencode 与 Zed 中配置的 MCP 服务器并列显示，标出远程与第三方服务器以及各客户端之间不一致的配置；服务器可以复制到其他客户端或移除，写入前显示改动。钩子与技能同样逐一列出。客户端配置、技能、钩子、斜杠命令、subagent 与项目指令会被扫描，检查隐藏字符、提示注入、危险命令与过宽权限四类问题。扫描只报告、不修改任何文件，出现新发现时发送系统通知。",
+          alt: "MCP 页：五个 MCP 服务器在 Claude Code、Claude Desktop、Cursor、Codex、opencode 与 Zed 中的配置情况，context7 与 linear 标为第三方远程服务器，github 标为各客户端配置不一致；共扫描 11 个文件，发现高、中、低风险各一项",
         },
         {
-          id: "clients",
-          title: "客户端一键接管",
-          body: "Claude Code、Codex CLI、opencode、Zed 与 Aider 可以在应用内一键指向网关。写入前先显示改动差异并完整备份原文件，随时可以还原。",
-          alt: "客户端页：已接管并收到请求的 Claude Code 与 Codex CLI、尚未接管的 opencode，以及需手动配置的客户端",
+          id: "settings",
+          title: "设置与界面语言",
+          body: "界面提供英文与简体中文，默认跟随系统语言，也可以另选。设置页还包括连接本机或远程 core、外观、菜单栏显示内容、开机启动、提醒方式、网关的监听地址与允许访问的网段、请求记录与正文的保留时长、自动更新，以及完全卸载（还原所有已接管的客户端并关闭开机启动）。",
+          alt: "设置页：连接列表中的本机（当前）与 homelab、build-server 两个远程 core，启动时使用的连接，跟随系统的界面语言，外观，以及菜单栏的显示内容",
+        },
+      ],
+    },
+    remote: {
+      eyebrow: "连接远程 core",
+      title: "服务器上的 ThinkWatch Core",
+      body: [
+        "网关也可以部署在 Linux 服务器上：twcore 作为 systemd 服务运行，为网络中的客户端提供网关。应用通过服务器的远程控制端口连接它，在同样的页面中显示该服务器的流量、费用与配置。",
+        "在「设置 › 连接」中添加连接，填写服务器地址、控制端口，以及在服务器上执行 twcore control-key 得到的密钥。切换到某个连接之前，应用先测试该连接：完成握手并核对版本，服务器上的 core 须为应用要求的版本；版本不一致时，在服务器上执行 sudo twcore upgrade --version <版本号> --restart 即可换成该版本，升级或降级均可。应用同一时间只连接一个 core；连接服务器期间，本机的 core 停止运行，本机数据保留。客户端页与 MCP 页始终作用于运行应用的这台电脑，客户端页可以把这台电脑上的客户端改为指向服务器的网关。",
+        "无论本机还是远程，每条控制连接都经过以 config.yaml 中 listen.control.key 为密钥的 Noise 握手加密与认证，不涉及证书。连接密钥保存在应用数据目录中仅当前用户可读的文件里。",
+      ],
+      serverDocs: "服务器部署指南",
+      docs: "连接远程 core",
+      addAlt:
+        "添加远程连接：名称 homelab、地址 192.168.1.40、控制端口 24817 与密钥，测试连接成功，显示 core 0.49.0 与网关地址 192.168.1.40:8788",
+      figures: [
+        {
+          id: "remote-switcher",
+          caption: "在侧栏底部切换连接。",
+          alt: "连接到 homelab 时侧栏底部的连接菜单：本机（本地 core 已停止）、已选中的 homelab、build-server，以及添加和管理连接的入口",
+        },
+        {
+          id: "remote-clients",
+          caption: "客户端页修改的是这台电脑上的客户端。",
+          alt: "连接到 homelab 时的客户端页，顶部说明此处修改的是这台 Mac 上的客户端配置，使其指向 homelab 的网关 192.168.1.40:8788，服务器上的客户端不受影响",
         },
       ],
     },
     menubar: {
-      eyebrow: "常驻可见",
-      title: "菜单栏上的五十像素",
-      body: "菜单栏常驻显示今日费用与输出速率；使用订阅账号时，改为显示额度用量与重置倒计时。Windows 上图标位于通知区域：悬停显示今日 token 与费用，左键打开主界面，右键打开菜单。Linux 上图标位于系统托盘，点击打开同一份菜单。网关停止转发、上游无法连接、订阅额度用完、凭据失效等情况会发送系统通知。",
-      costAlt: "菜单栏：今日费用 $24.72，输出速率 47 token/秒",
-      quotaAlt: "菜单栏：订阅额度已用 34%，2 小时后重置",
+      eyebrow: "主窗口之外",
+      title: "菜单栏、托盘与系统通知",
+      body: "在 macOS 上，菜单栏显示今日 token 与费用；订阅额度即将用完时数字变为橙色，用完后变为红色；也可以只显示标识或只显示数字。点开的菜单列出网关状态与输出速率、各订阅额度及其重置时间、今日请求数、token 与费用、进行中的请求，并提供复制网关地址、复制默认密钥、撤销上一次配置修改、切换连接等操作。Windows 上图标位于通知区域，Linux 上位于系统托盘，菜单内容相同，以文字呈现。",
+      notices:
+        "网关停止转发、与远程 core 的连接断开、订阅额度用完、凭据过期、被拒绝或未能保存、代理无法连接、配置未能生效、工具调用命中「切断」规则，以及客户端配置中出现新的可疑内容时，应用会发送系统通知。上游无法连接只在应用内列出，不发送系统通知。提醒方式由一项设置统一决定：系统通知、仅在应用内显示或关闭。",
+      chipAlt: "菜单栏：ThinkWatch 标识，右侧上行为今日 token 13.3M，下行为今日费用 $9.34",
+      menuAlt:
+        "菜单栏菜单：网关运行中，地址 127.0.0.1:8788，输出 64 token/秒；chatgpt 的 5 小时额度已用 58%、2 小时后重置，每周额度已用 31%、3 天后重置；今日请求 204 次（失败 4 次）、token 13.3M、费用 $9.34；一条 Claude Code 请求进行中；以及复制网关地址、复制默认密钥、撤销上一次配置修改、打开主界面、连接、设置、检查更新等菜单项",
     },
     built: {
       eyebrow: "架构",
       lite: {
         title: "ThinkWatch Lite",
-        body: "Tauri 2 外壳与 React 19 窗口。负责托管 Core 并渲染菜单栏，或 Windows 与 Linux 上的托盘菜单。",
+        body: "Tauri 2 外壳与 React 19 窗口。负责启动并托管本机的 core，或连接服务器上的 core；在 macOS 上渲染菜单栏，在 Windows 与 Linux 上渲染托盘菜单。",
+      },
+      link: {
+        title: "控制通道",
+        lines: ["unix socket · macOS、Linux", "回环端口 · Windows", "TCP 端口 · 远程 core", "均经加密握手"],
       },
-      link: "本地 socket",
       core: {
         title: "ThinkWatch Core",
-        body: "网关本体，负责路由、转发与成本核算。Lite 不包含这些逻辑。",
+        body: "网关本体 twcore，负责路由、转发、格式转换、成本核算与安全防护。它随应用在本机运行，也可以作为 systemd 服务运行在 Linux 服务器上；Lite 不包含这些逻辑。",
       },
       upstreams: {
         title: "上游服务",
-        body: "Anthropic、OpenAI 与 Gemini API，以及已配置的服务商和中转站。",
+        body: "Anthropic、OpenAI 与 Gemini API，在应用内登录的账号，以及中转服务与本机模型。",
       },
     },
     install: {
       eyebrow: "安装",
-      title: "一次安装，网关随应用一起装好",
-      brewNote: "网关在应用包内，没有第二样东西要装。",
-      macLabel: "macOS 12 及以上 · Apple Silicon",
+      title: "在 macOS、Windows 与 Linux 上安装",
+      brewNote: "网关随应用一同安装，无需另行安装其他组件。",
+      macLabel: "macOS 12 及以上 · Apple silicon",
       winLabel: "Windows 10 21H2 及以上 · x64 或 ARM64",
-      dmgTitle: "也可以用磁盘映像",
+      dmgTitle: "磁盘映像",
       dmgBody:
         "下载后与 sha256 校验值核对。应用未经 Apple 注册开发者签名，macOS 会为下载的副本添加隔离属性，移除该属性后即可打开；也可以在首次打开被拒绝后，在「系统设置 › 隐私与安全性」中点击「仍要打开」。",
-      dmgDownload: "下载磁盘映像（Apple Silicon）",
+      dmgDownload: "下载磁盘映像（Apple silicon）",
       releases: "全部版本",
       winTitle: "Windows 安装程序",
       winBody:
@@ -233,7 +355,7 @@ export const liteCopy = {
       linuxLabel: "Ubuntu 22.04、Debian 12、Fedora 36 及以上 · x86_64 或 aarch64",
       linuxScript:
         "脚本下载与本机架构对应的 AppImage，核对 sha256 后安装为 ~/Applications/ThinkWatch-Lite.AppImage 并启动。",
-      linuxTitle: "也可以直接下载 AppImage",
+      linuxTitle: "AppImage",
       linuxBody:
         "下载后与 sha256 校验值核对，允许其执行（chmod +x，或在文件管理器的「属性」中勾选「允许作为程序执行文件」），然后打开。AppImage 应放在当前用户可写的目录中（如 ~/Applications），以便自动更新。首次启动时会把 ThinkWatch Lite 添加到应用菜单。",
       linuxDownload: { x86_64: "下载 AppImage（x86_64）", aarch64: "下载 AppImage（aarch64）" },