chore(fleet): sync operator memory, hatch menu dialogs, and watchdog alerts

docs/HATCH-MENU.md

@@ -37,16 +37,23 @@ Static: `permissions.connector_defaults`,
 `permissions.web_access` (`auto_allow`/`always_ask`);
 `permissions.advanced.transparent_proxy|tls_interception|
 sni_mismatch_rejection`, `data_controls.ai_improvement` (`on`/`off`);
-`general.theme` (match/default/blue/purple/pink/orange/green/
-beige/monochrome).
+`general.theme` (avatar/default/blue/purple/pink/orange/green/
+beige/monochrome; `avatar` = "Match my avatar").
 
 Families: `permissions.websites:<host>` (`Allow`/`Ask`/`Deny`),
-`permissions.protocols:<slug>` (`on`/`off`; slugs discovered live,
-e.g. `mcp-sse`, `mcp-streamable`, `agent-skills`, `mcp-apps`,
-`mcp-oauth`).
+`permissions.protocols:<slug>` (`on`/`off`; network primitives
+`outbound-ssh`, `smtp`, `imap-pop3`, `database`, `ftp`, `dns`,
+`other-tcp`, `other-udp` pinned live 2026-10-06, MCP titles kept
+defensively; unique substrings like `ssh` also resolve).
 
 Every `set` verifies in place and reads back through a fresh
 session; readback mismatch reports failure, never partial success.
+Switch commits can land slowly (or on dialog close), so in-flow
+verifies poll and the fresh readback is the source of truth; sets
+that only the readback confirms carry `"readback_only": true`.
+Website Ask/Deny is one-way: the override row leaves the allowed
+list (no add UI), verified by absence; absent hosts read as
+"not in Websites list" (effective: web-access default).
 Caller errors (unknown node/toggle/tab/value) raise `MenuError`
 before any CDP traffic. Transport failures return `{"ok": False}`.