diff --git a/base/web/dream.go b/base/web/dream.go
index d527980e..95681d48 100644
--- a/base/web/dream.go
+++ b/base/web/dream.go
@@ -473,7 +473,7 @@ func init() {
 			}},
 		}, StatsAction(), DreamAction(), DreamTablesAction(), mdb.ImportantHashAction(
 			mdb.SHORT, mdb.NAME, mdb.FIELD, "time,name,icons,repos,binary,template,restart,access",
-			html.BUTTON, kit.JoinWord(PORTAL, DESKTOP, ADMIN, MESSAGE, WORD, STATUS, VIMER, COMPILE, XTERM, DREAM),
+			html.BUTTON, kit.JoinWord(PORTAL, DESKTOP, MESSAGE, ADMIN, WORD, STATUS, VIMER, COMPILE, XTERM, DREAM),
 			ctx.TOOLS, kit.Simple(SPIDE, ROUTE), ONLINE, ice.TRUE,
 		)), Hand: func(m *ice.Message, arg ...string) {
 			if len(arg) == 0 {
diff --git a/base/web/matrix.css b/base/web/matrix.css
index 9bc9a867..736cb23c 100644
--- a/base/web/matrix.css
+++ b/base/web/matrix.css
@@ -22,6 +22,8 @@ fieldset.web.matrix>div.output>table.content div.item div.status div.item:hover
 fieldset.web.matrix>div.output>table.content div.item:hover { background-color:unset; color:unset; }
 fieldset.web.matrix>div.output>table.content div.item.notice { background-color:var(--notice-bg-color); color:var(--notice-fg-color); }
 fieldset.web.matrix>div.output>table.content div.item.danger { background-color:var(--danger-bg-color); color:var(--danger-fg-color); }
+fieldset.web.matrix>div.output>table.content div.item.server { border:var(--notice-bg-color) solid 3px; }
+fieldset.web.matrix>div.output>table.content div.item.master { border:var(--danger-bg-color) solid 3px; }
 fieldset.web.matrix>div.output>table.content div.item.danger div.status div.item { color:var(--danger-fg-color); }
 fieldset.web.matrix>div.output>table.content div.item.notice div.status div.item { color:var(--notice-fg-color); }
 fieldset.web.matrix>div.output>table.content div.item.stop div.title>span { color:var(--disable-fg-color); }
diff --git a/base/web/matrix.go b/base/web/matrix.go
index 4de5d28a..013a3eb1 100644
--- a/base/web/matrix.go
+++ b/base/web/matrix.go
@@ -14,34 +14,29 @@ import (
 	kit "shylinux.com/x/toolkits"
 )
 
-func _matrix_list(m *ice.Message, domain, icon, typ string, fields ...string) (server, icons, types []string) {
+func _matrix_list(m *ice.Message, domain, typ string, meta ice.Maps, fields ...string) (server, icons, types []string) {
 	value := kit.Dict(cli.ParseMake(m.Cmdx(Space(m, domain), cli.RUNTIME)))
-	value[DOMAIN], value[mdb.ICONS], value[mdb.TYPE] = domain, icon, typ
-	button := []ice.Any{}
-	switch typ {
-	case MYSELF:
-		button = []ice.Any{PORTAL, WORD, STATUS, VIMER, COMPILE, DREAM, DESKTOP, ADMIN, OPEN, cli.RUNTIME, XTERM}
-	case SERVER:
-		button = []ice.Any{PORTAL, DESKTOP, ADMIN, OPEN, UPGRADE, DREAM, WORD, STATUS, VIMER, cli.RUNTIME, XTERM}
-	default:
-		button = []ice.Any{PORTAL, DESKTOP, ADMIN, OPEN, COMPILE, DREAM, WORD, STATUS, VIMER, cli.RUNTIME, XTERM}
-	}
+	value[DOMAIN], value[mdb.TYPE] = domain, typ
+	kit.For(meta, func(k, v string) { value[k] = v })
+
+	istech, isdebug := typ == SERVER || kit.IsIn(meta[aaa.ACCESS], aaa.TECH, aaa.ROOT), m.IsDebug()
+	compile := kit.Select("", kit.Select(COMPILE, UPGRADE, typ == SERVER), istech)
+	vimer := kit.Select("", VIMER, istech && isdebug)
+
+	button := []ice.Any{PORTAL, DESKTOP, DREAM, ADMIN, OPEN, compile}
+	kit.If(istech, func() { button = append(button, WORD, STATUS) })
+	kit.If(istech && isdebug, func() { button = append(button, vimer, cli.RUNTIME, XTERM) })
 	m.PushRecord(value, fields...).PushButton(button...)
-	switch typ {
-	case MYSELF:
-		button = []ice.Any{PORTAL, WORD, STATUS, VIMER, COMPILE, MESSAGE, DESKTOP, ADMIN, OPEN, cli.RUNTIME, XTERM}
-	case SERVER:
-		button = []ice.Any{PORTAL, DESKTOP, ADMIN, OPEN, UPGRADE, MESSAGE, WORD, STATUS, VIMER, cli.RUNTIME, XTERM}
-	default:
-		button = []ice.Any{PORTAL, DESKTOP, ADMIN, OPEN, WORD, STATUS, VIMER, cli.RUNTIME, XTERM}
-	}
-	button = append(button, cli.STOP)
+
+	button = []ice.Any{PORTAL, DESKTOP, MESSAGE, ADMIN, OPEN, compile}
+	kit.If(istech, func() { button = append(button, WORD, STATUS) })
+	kit.If(istech && isdebug, func() { button = append(button, vimer, cli.RUNTIME, XTERM, cli.STOP) })
 	m.Cmd(Space(m, domain), DREAM).Table(func(value ice.Maps) {
 		switch value[mdb.TYPE] {
 		case WORKER:
 			value[DOMAIN] = domain
 			kit.If(value[mdb.STATUS] == cli.STOP, func() { value[mdb.ICONS] = nfs.USR_ICONS_ICEBERGS })
-			kit.If(value[mdb.STATUS] == cli.STOP, func() { button = []ice.Any{cli.START, mdb.REMOVE} })
+			kit.If(value[mdb.STATUS] == cli.STOP && istech, func() { button = []ice.Any{cli.START, mdb.REMOVE} })
 			m.PushRecord(value, fields...).PushButton(button...)
 		case SERVER, MASTER:
 			server = append(server, kit.Keys(domain, value[mdb.NAME]))
@@ -111,10 +106,10 @@ func init() {
 			mdb.REMOVE: {Hand: func(m *ice.Message, arg ...string) { _matrix_dream(m, nfs.TRASH); _matrix_dream(m, "") }},
 			cli.START:  {Hand: func(m *ice.Message, arg ...string) { _matrix_dream(m, "") }},
 			cli.STOP:   {Hand: func(m *ice.Message, arg ...string) { _matrix_dream(m, "") }},
-			COMPILE: {Hand: func(m *ice.Message, arg ...string) {
-				_matrix_cmd(m, "", cli.AMD64, cli.LINUX, ice.SRC_MAIN_GO).ProcessHold()
+			UPGRADE: {Hand: func(m *ice.Message, arg ...string) {
+				_matrix_cmd(m, "").Sleep3s()
+				m.ProcessRefresh()
 			}},
-			UPGRADE: {Hand: func(m *ice.Message, arg ...string) { _matrix_cmd(m, "").Sleep3s().ProcessRefresh() }},
 			INSTALL: {Hand: func(m *ice.Message, arg ...string) {
 				if kit.IsIn(m.Cmdv(Space(m, m.Option(DOMAIN)), SPIDE, ice.DEV_IP, CLIENT_HOSTNAME), m.Cmd(tcp.HOST).Appendv(aaa.IP)...) {
 					m.Option(nfs.BINARY, S(m.Option(mdb.NAME)))
@@ -129,7 +124,7 @@ func init() {
 				StreamPushRefreshConfirm(m, m.Trans("refresh for new space ", "刷新列表查看新空间 ")+kit.Keys(m.Option(DOMAIN), m.Option(mdb.NAME)))
 			}},
 		}, ctx.ConfAction(
-			mdb.FIELD, "time,domain,status,type,name,text,icons,repos,binary,module,version",
+			mdb.FIELD, "time,domain,status,type,name,text,icons,repos,binary,module,version,access",
 			ctx.TOOLS, kit.Simple(SPIDE, STATUS, VERSION), ONLINE, ice.TRUE,
 		)), Hand: func(m *ice.Message, arg ...string) {
 			if kit.HasPrefixList(arg, ctx.ACTION) {
@@ -138,11 +133,16 @@ func init() {
 			}
 			GoToast(m, func(toast func(name string, count, total int)) []string {
 				field := kit.Split(mdb.Config(m, mdb.FIELD))
+				space := m.CmdMap(SPACE, mdb.NAME)
 				m.Options("space.timeout", cli.TIME_3s, "dream.simple", ice.TRUE)
-				list, icons, types := _matrix_list(m, "", ice.SRC_MAIN_ICO, MYSELF, field...)
+				list, icons, types := _matrix_list(m, "", MYSELF, ice.Maps{
+					mdb.ICONS: ice.SRC_MAIN_ICO, aaa.ACCESS: m.Option(ice.MSG_USERROLE),
+				}, field...)
 				kit.For(list, func(domain string, index int, total int) {
 					toast(domain, index, total)
-					_matrix_list(m, domain, icons[index], types[index], field...)
+					_matrix_list(m, domain, types[index], ice.Maps{
+						mdb.ICONS: icons[index], aaa.ACCESS: kit.Format(kit.Value(space[domain], aaa.USERROLE)),
+					}, field...)
 				})
 				m.RewriteAppend(func(value, key string, index int) string {
 					if key == mdb.ICONS && strings.HasPrefix(value, nfs.REQUIRE) && m.Appendv(DOMAIN)[index] != "" {
diff --git a/base/web/matrix.js b/base/web/matrix.js
index f4210377..4529ed5f 100644
--- a/base/web/matrix.js
+++ b/base/web/matrix.js
@@ -27,7 +27,7 @@ Volcanos(chat.ONIMPORT, {
 		return {view: [[html.ITEM, item.type, item.status, can.onimport.style(can, item, list)]], list: [
 			{img: can.misc.Resource(can, item.icons, can.core.Keys(item.domain, item.name)), onclick: cb(web.DESKTOP)}, {view: wiki.TITLE, list: [
 				{text: item.name||item.domain||location.host, onclick: cb(web.OPEN)},
-				item.status != cli.STOP && can.onappend.label(can, item, {version: icon.version, time: icon.compile}),
+				item.status != cli.STOP && can.onappend.label(can, item, {version: icon.version, time: icon.compile, access: "bi bi-file-lock"}),
 				{text: [item.text, "", "status"]},
 				can.onappend.buttons(can, item),
 			]},
diff --git a/core/code/upgrade.go b/core/code/upgrade.go
index a236a74f..257c3754 100644
--- a/core/code/upgrade.go
+++ b/core/code/upgrade.go
@@ -60,7 +60,7 @@ func init() {
 				m.Cmdy(nfs.DIR, dir, "time,size,path,hash").Push(web.ORIGIN, kit.MergeURL2(web.SpideOrigin(m, ice.DEV_IP), uri))
 			})
 			if web.ToastSuccess(m); m.Option(ice.EXIT) == ice.TRUE {
-				defer m.GoSleep(cli.TIME_30s, func() { m.Cmd("", cli.RESTART) })
+				defer m.GoSleep(cli.TIME_30ms, func() { m.Cmd("", cli.RESTART) })
 				web.Toast(m, cli.RESTART)
 			}
 		}},
diff --git a/misc/git/status.go b/misc/git/status.go
index 1809b5a6..1102d13e 100644
--- a/misc/git/status.go
+++ b/misc/git/status.go
@@ -58,6 +58,7 @@ func init() {
 			}},
 			web.DREAM_TABLES: {Hand: func(m *ice.Message, arg ...string) {
 				if !m.IsDebug() || !aaa.IsTechOrRoot(m) || !nfs.Exists(m, path.Join(ice.USR_LOCAL_WORK, m.Option(mdb.NAME), _GIT)) {
+					m.Push(mdb.TEXT, "")
 					return
 				}
 				m.Push(mdb.TEXT, web.DreamStat(m, m.Option(mdb.NAME)))
diff --git a/misc/ssh/relay/relay.go b/misc/ssh/relay/relay.go
index 83b5182a..56ba5d8e 100644
--- a/misc/ssh/relay/relay.go
+++ b/misc/ssh/relay/relay.go
@@ -223,7 +223,7 @@ func (s relay) List(m *ice.Message, arg ...string) *ice.Message {
 			return
 		}
 		m.Push(web.LINK, web.HostPort(m.Message, value[tcp.HOST], value[web.PORTAL]))
-		m.PushButton(s.Portal, s.Desktop, s.Dream, s.Admin, s.Vimer, s.Login, s.Proxy, s.AdminCmd, s.Upgrade, s.Pushbin, s.Xterm, s.Trash, s.Remove)
+		m.PushButton(s.Portal, s.Desktop, s.Dream, s.Admin, s.Vimer, s.Proxy, s.Login, s.AdminCmd, s.Upgrade, s.Pushbin, s.Xterm, s.Trash, s.Remove)
 		kit.If(len(arg) > 0, func() { m.PushQRCode(cli.QRCODE, m.Append(web.LINK)) })
 	})
 	_stats := kit.Dict(MEM, kit.FmtSize(stats[MEM_FREE], stats[MEM_TOTAL]), DISK, kit.FmtSize(stats[DISK_USED], stats[DISK_TOTAL]))