diff --git a/AGENTS.md b/AGENTS.md
index 77bff91..6ee03a1 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -589,6 +589,26 @@ Two things measured while wiring it up, both of which changed the code:
differing bytes and read as "the install did nothing" -- the bytes were in the copy. Check
`FlashSlot.path`, not the path you handed in.
+Upstream's side of this, read out of UVStudio's own `js/flash.js` rather than guessed:
+`MSG_APP_INFO 0x0730/0x0731`, `MSG_APP_ERASE 0x0732/0x0733`, `MSG_APP_WRITE 0x0734/0x0735`,
+`MSG_APP_VALIDATE 0x0736/0x0737` -- the same framing as the firmware slots, one family further
+along -- and the same constants this page uses (`APP_SLOT_COUNT 16`, `APP_IMG_OFFSET 0x1000`,
+`APP_HDR_SIZE 64`, `APP_MAGIC 0x31504146`). Two details from there are worth having: UVStudio
+uses only slots 0..7 and **labels them 1..8**, and it writes the header **last**, because the
+header carries the committed flag and a partial write must never validate. This page writes a
+whole slot at once, which has the same property for free.
+
+The firmware confirmed the whole thing itself. The Labs build answers `0x0730` (app info) over
+USART, so an installed `Beam.app` was queried on the radio, not just read back from the file:
+
+ 0x0730 slot 0 -> status 0
+ raw 0000 | 46415031 01000101 4c040000 5860970d 0000 0108 | 4265616d 0000
+ FAP1 hdr1 abi1 api1 1100 CRC 0x0d976058 flags 0x0801 "Beam"
+
+That is the header this page installed, echoed by the running firmware, so the region, the
+offset, the layout and the bytes are right. Slots 1 and 2 answered `status 2` with unrelated
+data, which is the overlap the install guard exists for.
+
## The keypad: two real bugs, both fixed
The old note here said "keys reach the firmware but the UI does not react" and
diff --git a/AGENTS.zh-CN.md b/AGENTS.zh-CN.md
index 0cffa63..5c9598a 100644
--- a/AGENTS.zh-CN.md
+++ b/AGENTS.zh-CN.md
@@ -476,6 +476,23 @@ BroadcastFM）。上游是用 UVStudio 通过 WebSerial 装进去的；在我们
以免正在运行的模拟器脚下的文件被改写。第一版测试断言原文件变了，看到 0 字节差异，读起来像
"安装什么都没做" —— 其实字节在副本里。要检查 `FlashSlot.path`，不是你传进去的路径。
+上游那一侧不用猜，直接读 UVStudio 自己的 `js/flash.js`：`MSG_APP_INFO 0x0730/0x0731`、
+`MSG_APP_ERASE 0x0732/0x0733`、`MSG_APP_WRITE 0x0734/0x0735`、`MSG_APP_VALIDATE 0x0736/0x0737`
+—— 与固件槽位同一套帧格式、再往后一族 —— 以及与本页相同的常量（`APP_SLOT_COUNT 16`、
+`APP_IMG_OFFSET 0x1000`、`APP_HDR_SIZE 64`、`APP_MAGIC 0x31504146`）。从那里得到两个细节值得记住：
+UVStudio **只用槽 0..7 并显示为 1..8**；而且它**最后才写头** —— 因为头里带着 committed 标志，
+写一半绝不能通过校验。本页一次写整个槽，这个性质是白送的。
+
+而整件事最后由**固件自己**确认了。Labs 版会在 USART 上回答 `0x0730`（应用信息），所以装好的
+`Beam.app` 是**在电台上被问出来的**，不只是从文件里读回来的：
+
+ 0x0730 slot 0 -> status 0
+ raw 0000 | 46415031 01000101 4c040000 5860970d 0000 0108 | 4265616d 0000
+ FAP1 hdr1 abi1 api1 1100 CRC 0x0d976058 flags 0x0801 "Beam"
+
+这就是本页写进去的那个头，被运行中的固件原样念了回来 —— 所以区域、偏移、布局、字节都是对的。
+槽 1 和槽 2 回答 `status 2` 加无关数据，那正是"安装守护"要防的那块重叠区。
+
## 键盘：两个真 bug，都已修复
这里原来的笔记写的是"按键到达了固件但界面不反应"，并且归咎于机器模型。结果发现有**两个
diff --git a/tools/webui.py b/tools/webui.py
index fa4d0fa..3b2043c 100644
--- a/tools/webui.py
+++ b/tools/webui.py
@@ -942,7 +942,7 @@ def render_index(scale: int) -> str:
-the Labs edition's apps live in the same external flash (16 slots
- from 0x102000, the firmware's menu lists the first eight). Pick a .app for a slot to
+ from 0x102000; the firmware's menu lists the first eight, numbered 1..8). Pick a .app for a slot to
install it — no serial port and no browser permission are involved
app ' + s.slot + (s.slot < 8 ? '' : ' (after the menu)') +
+ // Upstream and the firmware's own menu number the eight usable slots 1..8, while the
+ // region has sixteen: slot 0 is "1" there, so show them the same way.
+ tr.innerHTML = '