v1.10.0 Highlights - Service image version picker: from a service's inspect view you can now update to any image version, not just the newest. The "newer version available" hint moved to the top of the inspect and is actionable from any row (u). A picker suggests newer versions with type-to-filter autocomplete, the field is freely editable to pin any existing tag (including an older one), a typed tag is validated against the registry, and downgrades are confirmed with a warning. :latest services keep the single current-digest confirm. Internal - Large TUI refactor (H1): the ~5,600-line ui.go god file is decomposed into a ui struct with methods split across per-concern files (ui_containers.go, ui_volumes.go, ui_networks.go, ui_secrets.go, ui_contexts.go, ui_nodes.go, ui_forwards.go, ui_serviceedit.go, ui_inspect.go). Verified behavior-identical. - Named overlay-size constants + centeredPrompt helper; single cmdContext helper replacing the duplicated ctx==nil guard (L1, L2). - Agent RPC handlers share one authorize() gate for the drain/identity/authorize/ audit/deny sequence (M5).