@songsid/agend 2.1.0-beta.9 → 2.1.0

package/dist/fleet-manager.js

@@ -5,13 +5,13 @@ import { join, dirname, basename } from "node:path";
 import { fileURLToPath } from "node:url";
 import { getAgendHome, ensureWorkspaceGit } from "./paths.js";
 import { sdNotify } from "./sd-notify.js";
-import yaml from "js-yaml";
+import { isScalar, parseDocument } from "yaml";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 /** Fallback access policy for a channel with no `access:` block — open (no gate). */
 const DEFAULT_OPEN_ACCESS = { mode: "open", allowed_users: [], max_pending_codes: 0, code_expiry_minutes: 0 };
 import { isProbeableRouteTarget } from "./fleet-context.js";
-import { loadFleetConfig, DEFAULT_COST_GUARD, DEFAULT_DAILY_SUMMARY, DEFAULT_INSTANCE_CONFIG } from "./config.js";
+import { loadFleetConfig, loadRawFleetConfig, DEFAULT_COST_GUARD, DEFAULT_DAILY_SUMMARY, DEFAULT_INSTANCE_CONFIG } from "./config.js";
 import { EventLog } from "./event-log.js";
 import { AdapterWorld } from "./adapter-world.js";
 import { CostGuard, formatCents } from "./cost-guard.js";
@@ -19,18 +19,20 @@ import { TmuxManager } from "./tmux-manager.js";
 import { AccessManager } from "./channel/access-manager.js";
 import { IpcClient } from "./channel/ipc-bridge.js";
 import { createAdapter } from "./channel/factory.js";
+import { createBackend } from "./backend/factory.js";
+import { isModelCompatible } from "./backend/types.js";
 import { createLogger } from "./logger.js";
 import { processAttachments } from "./channel/attachment-handler.js";
 import { routeToolCall } from "./channel/tool-router.js";
 import { Scheduler } from "./scheduler/index.js";
 import { DEFAULT_SCHEDULER_CONFIG } from "./scheduler/index.js";
-import { TopicCommands, saveCommandForBackend, parseSaveFilename, SAVE_FILENAME_RE, SAVE_UNSUPPORTED_MSG } from "./topic-commands.js";
+import { TopicCommands, saveCommandForBackend, parseSaveFilename, parsePauseWakeCommand, SAVE_FILENAME_RE, SAVE_UNSUPPORTED_MSG } from "./topic-commands.js";
 import { DailySummary } from "./daily-summary.js";
 import { WebhookEmitter } from "./webhook-emitter.js";
 import { TmuxControlClient } from "./tmux-control.js";
 import { safeHandler } from "./safe-async.js";
 import { RoutingEngine } from "./routing-engine.js";
-import { InstanceLifecycle } from "./instance-lifecycle.js";
+import { InstanceLifecycle, BACKEND_INSTALLATION_INFO, checkBinaryInstalled, } from "./instance-lifecycle.js";
 import { TopicArchiver } from "./topic-archiver.js";
 import { StatuslineWatcher } from "./statusline-watcher.js";
 import { outboundHandlers } from "./outbound-handlers.js";
@@ -39,7 +41,9 @@ import { handleViewRequest, isViewPath } from "./view-api.js";
 import { handleSettingsRequest } from "./settings-api.js";
 import { setLocale, detectLocale, t } from "./locale.js";
 import { handleAgentRequest } from "./agent-endpoint.js";
-import { ClassicChannelManager } from "./classic-channel-manager.js";
+import { ClassicChannelManager, getClassicBackendChoices, isSelectableClassicBackend, readClassicLastActivityAt } from "./classic-channel-manager.js";
+import { readLastInboundAt } from "./daemon.js";
+import { clearPausedMarker } from "./pause-marker.js";
 import { getTmuxSession } from "./config.js";
 export function resolveReplyThreadId(argsThreadId, instanceConfig) {
     if (typeof argsThreadId === "string" && argsThreadId.length > 0) {
@@ -50,6 +54,26 @@ export function resolveReplyThreadId(argsThreadId, instanceConfig) {
     }
     return instanceConfig?.topic_id != null ? String(instanceConfig.topic_id) : undefined;
 }
+/**
+ * Pure warm-cap victim selection (extracted for testability). Given the current
+ * warm (running) instance names and a cap, return the LRU idle instances to evict
+ * so the running count returns to the cap. Skips: the `exclude` instance, any
+ * already-evicting, general instances (never evicted), and non-idle instances
+ * (working/stuck can't be evicted). Oldest last-inbound is evicted first; a
+ * missing timestamp (0) sorts oldest. cap <= 0 (or non-integer) = unlimited → [].
+ */
+export function selectLruEvictions(warm, cap, opts) {
+    if (!Number.isInteger(cap) || cap <= 0)
+        return [];
+    if (warm.length <= cap)
+        return [];
+    const candidates = warm.filter(name => name !== opts.exclude
+        && !opts.isEvicting(name)
+        && !opts.isGeneral(name)
+        && opts.isIdle(name));
+    candidates.sort((a, b) => opts.lastInboundAt(a) - opts.lastInboundAt(b));
+    return candidates.slice(0, warm.length - cap);
+}
 /** Retry cadence for retiring a cancel button whose delete failed (e.g. a DC
  * forum thread the bot momentarily can't reach). 3 retries × 5min = 15min. */
 const CANCEL_BTN_RETRY_INTERVAL_MS = 5 * 60_000;
@@ -58,6 +82,10 @@ const CANCEL_BTN_MAX_RETRIES = 3;
  * buttons no clear trigger reached (e.g. a scheduled/HTTP turn that never called
  * reply). 5min (not the old 2s idle-watch) so Thinking isn't misread as idle. */
 const CANCEL_BTN_IDLE_CHECK_INTERVAL_MS = 5 * 60_000;
+const CLASSIC_BACKEND_SELECTION_TIMEOUT_MS = 60_000;
+const CLASSIC_BACKEND_CALLBACK_PREFIX = "classic-backend:";
+const MODEL_SELECT_CALLBACK_PREFIX = "model-select:";
+const CLI_ENV_TTL_MS = 24 * 60 * 60 * 1000; // /model reads cached CLI env within 24h
 export class FleetManager {
     dataDir;
     children = new Map();
@@ -65,6 +93,9 @@ export class FleetManager {
     /** @deprecated Use lifecycle.daemons — kept for backward compat */
     get daemons() { return this.lifecycle.daemons; }
     fleetConfig = null;
+    rawFleetConfig = {};
+    rawFleetDocument = null;
+    savedFleetConfigSnapshot = null;
     adapter = null;
     worlds = new Map();
     adapters = new Map(); // derived view for backward compat
@@ -95,6 +126,16 @@ export class FleetManager {
     lastActivity = new Map();
     /** Latest pane-derived execution snapshot reported by each daemon. */
     instanceStateCache = new Map();
+    /** CLI pane status overrides; daemon.pid alone only proves FleetManager lives. */
+    instanceProcessStatus = new Map();
+    /** Instances currently being auto-paused by warm_cap, so concurrent checks don't double-evict. */
+    warmCapEvicting = new Set();
+    /** Per-instance tail keeps cross-instance and scheduled deliveries FIFO. */
+    idleGatedDeliveryTails = new Map();
+    /** Non-user work must observe a fresh idle snapshot after the latest delivery. */
+    lastDeliveryAt = new Map();
+    /** State-cache updates wake event-driven idle waiters without busy polling. */
+    instanceIdleWaiters = new Map();
     lastInboundUser = new Map(); // instanceName → last username
     // Active "🛑 Cancel" buttons, tracked per button (keyed by messageId) rather
     // than one-per-instance. A button is retired (deleted, with bounded retry) on
@@ -106,6 +147,9 @@ export class FleetManager {
     topicArchiver;
     controlClient = null;
     classicChannels = null;
+    pendingClassicStarts = new Map();
+    /** In-flight /model selections, keyed by nonce (see handleModelSelection). */
+    pendingModelSelects = new Map();
     // Model failover state
     failoverActive = new Map(); // instance → current failover model
     // IPC reconnect: tracks instances being intentionally stopped (skip reconnect)
@@ -177,9 +221,21 @@ export class FleetManager {
     }
     /** Load fleet.yaml and build routing table */
     loadConfig(configPath) {
+        this.configPath = configPath;
+        const source = existsSync(configPath) ? readFileSync(configPath, "utf-8") : "{}\n";
+        this.rawFleetDocument = parseDocument(source, { keepSourceTokens: true });
+        if (this.rawFleetDocument.errors.length > 0) {
+            throw new Error(`Invalid fleet.yaml: ${this.rawFleetDocument.errors[0].message}`);
+        }
+        this.rawFleetConfig = loadRawFleetConfig(configPath);
         this.fleetConfig = loadFleetConfig(configPath);
+        this.savedFleetConfigSnapshot = structuredClone(this.fleetConfig);
         return this.fleetConfig;
     }
+    /** User-authored fleet.yaml, before defaults are merged into instances. */
+    getRawFleetConfig() {
+        return structuredClone(this.rawFleetConfig);
+    }
     /** Build topic routing table: { topicId -> RouteTarget } */
     buildRoutingTable() {
         if (this.fleetConfig) {
@@ -233,6 +289,52 @@ export class FleetManager {
         return this.classicChannels?.getInstanceByChannel(channelId, adapterId)
             ?? this.routing.resolve(channelId)?.name;
     }
+    /**
+     * Model switching is privileged. Fleet allowlisted admins retain authority in
+     * ClassicBot channels, while ClassicBot's own admin_users may also switch the
+     * model of the channel they administer.
+     */
+    isModelAdmin(userId, channelId, adapterId) {
+        if (this.isFleetAdmin(userId, adapterId))
+            return true;
+        const isClassic = !!this.classicChannels?.getInstanceByChannel(channelId, adapterId);
+        return isClassic && !!this.classicChannels?.isAdmin(userId);
+    }
+    async handlePauseWakeSlash(data, adapterId) {
+        const action = data.command;
+        const classicName = this.classicChannels?.getInstanceByChannel(data.channelId, adapterId);
+        if (classicName) {
+            if (!this.classicChannels?.isAdmin(data.userId)) {
+                await data.respond(t("permission.denied"));
+                return;
+            }
+            await data.respond(await this.topicCommands.runPauseWake(classicName, action));
+            return;
+        }
+        if (!this.isFleetAdmin(data.userId, adapterId)) {
+            await data.respond(t("permission.denied"));
+            return;
+        }
+        const route = this.routing.resolve(data.channelId);
+        if (!route) {
+            await data.respond(t("classic.no_agent"));
+            return;
+        }
+        let target = route.name;
+        if (route.kind === "general") {
+            const requested = typeof data.options?.instance === "string" ? data.options.instance : undefined;
+            if (!requested) {
+                await data.respond(t(`${action}.usage`));
+                return;
+            }
+            if (!this.fleetConfig?.instances[requested]) {
+                await data.respond(t("instance.not_found", requested));
+                return;
+            }
+            target = requested;
+        }
+        await data.respond(await this.topicCommands.runPauseWake(target, action));
+    }
     /** Get the adapter bound to an instance, falling back to primary adapter */
     getAdapterForInstance(name) {
         const worldId = this.instanceWorldBinding.get(name);
@@ -268,19 +370,27 @@ export class FleetManager {
      */
     bindInstanceAdapter(name, adapterId, fromInbound = false) {
         const cfg = this.fleetConfig?.instances[name];
-        if (fromInbound && (cfg?.general_topic || cfg?.channel_id))
-            return;
-        // A classic instance is bound authoritatively at /start. Don't let an inbound
-        // (seen by every same-guild bot) override an existing binding — but if there
-        // is none yet (e.g. after a restart, before v2.1 persistence), allow inbound
-        // to re-establish it so replies don't fall back to the primary bot forever.
-        if (fromInbound && this.classicChannels?.getChannelIdByInstance(name) !== undefined && this.instanceWorldBinding.has(name))
-            return;
+        if (fromInbound) {
+            // Skip inbound-derived binding for any instance that doesn't have an
+            // explicit channel_id — those default to primary adapter deterministically.
+            // This prevents a non-deterministic race where whichever adapter delivers
+            // first after restart wins the binding.
+            if (cfg?.general_topic || cfg?.channel_id)
+                return;
+            if (cfg && !cfg.channel_id)
+                return; // fleet instance without explicit binding → use primary
+            // Classic instance: don't override an existing binding (authoritative from /start)
+            if (this.classicChannels?.getChannelIdByInstance(name) !== undefined && this.instanceWorldBinding.has(name))
+                return;
+        }
         this.instanceWorldBinding.set(name, adapterId);
     }
     getInstanceStatus(name) {
         if (this.lifecycle.isPaused(name))
             return "paused";
+        const processStatus = this.instanceProcessStatus.get(name);
+        if (processStatus)
+            return processStatus;
         const pidPath = join(this.getInstanceDir(name), "daemon.pid");
         if (!existsSync(pidPath))
             return "stopped";
@@ -298,6 +408,9 @@ export class FleetManager {
             return null;
         return this.instanceStateCache.get(name)?.state ?? null;
     }
+    isClassicInstance(name) {
+        return this.classicChannels?.getAll().some(channel => channel.instanceName === name) ?? false;
+    }
     cacheInstanceExecutionState(name, msg) {
         const state = msg.state;
         if (state !== "idle" && state !== "working" && state !== "stuck")
@@ -311,25 +424,223 @@ export class FleetManager {
             observedAt: numberOr(msg.observedAt, now),
             stateChangedAt: numberOr(msg.stateChangedAt, previous?.state === state ? previous.stateChangedAt : now),
         });
+        for (const check of this.instanceIdleWaiters.get(name) ?? [])
+            check();
+        // warm_cap: a fresh transition into idle may free this instance for eviction,
+        // or (more usefully) reveal that the fleet is now over cap. Only fire on the
+        // edge into idle, not on every idle heartbeat.
+        if (state === "idle" && previous?.state !== "idle")
+            this.enforceWarmCap();
     }
-    /** Single delivery facade: wake an auto-paused CLI before sending to daemon IPC. */
-    async deliverToInstance(instanceName, payload) {
+    cacheInstanceProcessStatus(name, status) {
+        if (status === "running") {
+            this.instanceProcessStatus.delete(name);
+            return;
+        }
+        if (status !== "crashed" && status !== "stopped")
+            return;
+        this.instanceProcessStatus.set(name, status);
+        // Never display the last ready prompt as current execution state after its
+        // owning CLI process has exited.
+        this.instanceStateCache.delete(name);
+        for (const check of this.instanceIdleWaiters.get(name) ?? [])
+            check();
+    }
+    /**
+     * Fleet-wide warm cap: if more than `defaults.warm_cap` instances are running,
+     * auto-pause the least-recently-active idle instances until back at the cap.
+     * Never evicts general instances (must stay warm) or working/stuck instances
+     * (only idle). 0/unset = unlimited. wake-before-deliver re-warms any evicted
+     * instance when a message next arrives.
+     *
+     * @param exclude instance to spare (e.g. one just woken to receive a delivery).
+     */
+    enforceWarmCap(exclude) {
+        const cap = this.fleetConfig?.defaults?.warm_cap ?? 0;
+        if (!Number.isInteger(cap) || cap <= 0)
+            return; // 0/invalid = unlimited
+        const warm = [];
+        for (const name of this.daemons.keys()) {
+            if (this.getInstanceStatus(name) === "running")
+                warm.push(name);
+        }
+        if (warm.length <= cap)
+            return;
+        const victims = selectLruEvictions(warm, cap, {
+            exclude,
+            isEvicting: name => this.warmCapEvicting.has(name),
+            isGeneral: name => this.fleetConfig?.instances[name]?.general_topic === true,
+            isIdle: name => this.getInstanceExecutionState(name) === "idle",
+            lastInboundAt: name => readLastInboundAt(this.getInstanceDir(name)) ?? 0,
+        });
+        for (const victim of victims) {
+            this.warmCapEvicting.add(victim);
+            this.logger.info({ instance: victim, warm: warm.length, cap }, "warm_cap exceeded — auto-pausing LRU idle instance");
+            this.lifecycle.pause(victim)
+                .catch(err => this.logger.warn({ err, instance: victim }, "warm_cap auto-pause failed"))
+                .finally(() => this.warmCapEvicting.delete(victim));
+        }
+    }
+    waitForInstanceIdle(instanceName, timeoutMs, idleObservedAfter = 0) {
+        const isReady = () => {
+            const snapshot = this.instanceStateCache.get(instanceName);
+            return snapshot?.state === "idle"
+                && (idleObservedAfter === 0 || snapshot.observedAt > idleObservedAfter);
+        };
+        if (isReady())
+            return Promise.resolve(true);
+        return new Promise(resolve => {
+            let settled = false;
+            const finish = (idle) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timeout);
+                clearInterval(queryTimer);
+                const waiters = this.instanceIdleWaiters.get(instanceName);
+                waiters?.delete(check);
+                if (waiters?.size === 0)
+                    this.instanceIdleWaiters.delete(instanceName);
+                resolve(idle);
+            };
+            const check = () => { if (isReady())
+                finish(true); };
+            const query = () => {
+                const ipc = this.instanceIpcClients.get(instanceName);
+                if (ipc?.connected) {
+                    ipc.send({ type: "query_instance_state", requestId: `idle-gate-${Date.now()}` });
+                }
+                check();
+            };
+            const waiters = this.instanceIdleWaiters.get(instanceName) ?? new Set();
+            waiters.add(check);
+            this.instanceIdleWaiters.set(instanceName, waiters);
+            const timeout = setTimeout(() => finish(false), timeoutMs);
+            const queryTimer = setInterval(query, 1_000);
+            query();
+        });
+    }
+    async deliverWithIdleGate(instanceName, payload, timeoutMs) {
+        let idleObservedAfter = this.lastDeliveryAt.get(instanceName) ?? 0;
         if (this.lifecycle.isPaused(instanceName)) {
+            const wakeStartedAt = Date.now();
             await this.lifecycle.wake(instanceName, 30_000);
+            // Waking added one to the warm count — make room by evicting a different
+            // LRU idle instance (never this one; it's about to work).
+            this.enforceWarmCap(instanceName);
+            // Never satisfy a post-wake gate from a stale pre-pause cache entry.
+            idleObservedAfter = Math.max(idleObservedAfter, wakeStartedAt);
+        }
+        const idle = await this.waitForInstanceIdle(instanceName, timeoutMs, idleObservedAfter);
+        if (!idle) {
+            this.logger.warn({ instanceName, timeoutMs }, "Idle gate timed out; forcing delivery");
         }
         const ipc = this.instanceIpcClients.get(instanceName);
         if (!ipc?.connected)
             throw new Error(`Instance '${instanceName}' IPC is unavailable`);
         ipc.send(payload);
+        this.lastDeliveryAt.set(instanceName, Date.now());
+    }
+    /** Single delivery facade: wake paused CLIs and serialize non-user work behind idle. */
+    async deliverToInstance(instanceName, payload, options = {}) {
+        const meta = payload.meta && typeof payload.meta === "object"
+            ? payload.meta
+            : undefined;
+        const inferredCrossInstance = (typeof meta?.from_instance === "string" && meta.from_instance.length > 0)
+            || meta?.is_cross_instance === true
+            || payload.is_cross_instance === true;
+        const waitForIdle = options.waitForIdle
+            ?? ((options.isCrossInstance ?? inferredCrossInstance) || payload.type === "fleet_schedule_trigger");
+        if (!waitForIdle) {
+            if (this.lifecycle.isPaused(instanceName)) {
+                await this.lifecycle.wake(instanceName, 30_000);
+                this.enforceWarmCap(instanceName); // woke one → evict a different LRU idle if over cap
+            }
+            const ipc = this.instanceIpcClients.get(instanceName);
+            if (!ipc?.connected)
+                throw new Error(`Instance '${instanceName}' IPC is unavailable`);
+            ipc.send(payload);
+            // A cross-instance item arriving before the daemon observes this turn as
+            // working must not trust the stale idle snapshot from before the send.
+            this.lastDeliveryAt.set(instanceName, Date.now());
+            return;
+        }
+        const previous = this.idleGatedDeliveryTails.get(instanceName) ?? Promise.resolve();
+        const delivery = previous.catch(() => { }).then(() => this.deliverWithIdleGate(instanceName, payload, options.idleTimeoutMs ?? 60_000));
+        this.idleGatedDeliveryTails.set(instanceName, delivery);
+        try {
+            await delivery;
+        }
+        finally {
+            if (this.idleGatedDeliveryTails.get(instanceName) === delivery) {
+                this.idleGatedDeliveryTails.delete(instanceName);
+            }
+        }
+    }
+    /** Fleet admin is an explicit config allowlist entry, not merely an open/paired user. */
+    isFleetAdmin(userId, adapterId) {
+        const allowed = this.getChannelConfig(adapterId)?.access?.allowed_users ?? [];
+        return allowed.some(entry => String(entry) === String(userId));
+    }
+    async changeInstancePauseState(name, action) {
+        if (action === "wake") {
+            await this.lifecycle.wake(name, 30_000);
+            this.enforceWarmCap(name); // manual wake still respects the fleet warm cap
+            return "awake";
+        }
+        await this.lifecycle.pause(name);
+        return this.lifecycle.isPaused(name) ? "paused" : "not_idle";
+    }
+    /** Apply a Settings edit to a ClassicBot channel without waiting for the poller. */
+    async restartClassicInstanceFromSettings(instanceName) {
+        if (!this.classicChannels)
+            throw new Error("Classic channel manager not initialized");
+        const wasRunning = this.daemons.has(instanceName);
+        this.classicChannels.reloadFromDisk();
+        this.reregisterClassicChannels();
+        const channel = this.classicChannels.getAll().find(item => item.instanceName === instanceName);
+        if (!channel)
+            throw new Error("Classic channel not found after reload");
+        if (!wasRunning)
+            return;
+        await this.stopInstance(instanceName);
+        await new Promise(resolve => setTimeout(resolve, 250));
+        await this.startClassicInstance(instanceName, this.classicChannels.getBackendByInstance(instanceName, this.fleetConfig?.defaults?.backend), this.classicChannels.getPreTaskCommand(channel.channelId, channel.adapterId), this.classicChannels.getModel(channel.channelId, channel.adapterId, this.fleetConfig?.defaults?.model), this.classicChannels.getAutoPauseAfter(channel.channelId, channel.adapterId, this.fleetConfig?.defaults?.auto_pause_after));
     }
     async startInstance(name, config, topicMode) {
+        if (this.lifecycle.isPaused(name)) {
+            this.logger.info({ name }, "Persisted paused instance — skipping startup");
+            return;
+        }
         if (config.general_topic) {
+            // antigravity (agy) does not read MCP instructions — fleet context and
+            // routing instructions are not injected, so it cannot act as a dispatcher.
+            const backend = config.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code";
+            if (backend === "antigravity") {
+                this.logger.warn({ name }, "antigravity backend does not support MCP instructions — general dispatcher will not work correctly");
+                this.notifyInstanceTopic(name, "⚠️ antigravity backend is not supported for General instances (no MCP instructions injection). Switch to claude-code or kiro-cli.");
+            }
             this.ensureGeneralInstructions(config.working_directory, config.backend);
         }
+        this.instanceProcessStatus.delete(name);
         await this.lifecycle.start(name, config, topicMode);
         // Auto-connect IPC — daemon.start() ensures socket is ready before resolving
         await this.connectIpcToInstance(name);
     }
+    /** Recreate a daemon for a marker-only paused instance after an explicit wake/delivery. */
+    async startPersistedPausedInstance(name) {
+        const topicMode = this.fleetConfig?.channel?.mode === "topic"
+            || !!this.fleetConfig?.channels?.some(channel => channel.mode === "topic");
+        const fleetConfig = this.fleetConfig?.instances[name];
+        if (fleetConfig) {
+            await this.startInstance(name, fleetConfig, topicMode);
+            return;
+        }
+        const channel = this.classicChannels?.getAll().find(item => item.instanceName === name);
+        if (!channel || !this.classicChannels)
+            throw new Error(`Paused instance '${name}' is no longer configured`);
+        await this.startClassicInstance(name, this.classicChannels.getBackendByInstance(name, this.fleetConfig?.defaults?.backend), this.classicChannels.getPreTaskCommand(channel.channelId, channel.adapterId), this.classicChannels.getModel(channel.channelId, channel.adapterId, this.fleetConfig?.defaults?.model), this.classicChannels.getAutoPauseAfter(channel.channelId, channel.adapterId, this.fleetConfig?.defaults?.auto_pause_after));
+    }
     /**
      * Start instances with configurable concurrency and stagger delay.
      * Instances sharing the same working_directory are serialized within a group
@@ -338,8 +649,21 @@ export class FleetManager {
      */
     async startInstancesWithConcurrency(entries, topicMode) {
         const raw = this.fleetConfig?.defaults?.startup;
-        const concurrency = Math.max(1, Math.min(20, raw?.concurrency ?? 10));
+        const explicitConcurrency = raw?.concurrency;
         const staggerMs = Math.max(0, Math.min(30_000, raw?.stagger_delay_ms ?? 500));
+        // Adaptive concurrency: if not explicitly set, estimate from available RAM.
+        // Each instance uses ~300MB (tmux + CLI process + model overhead).
+        const ESTIMATED_MB_PER_INSTANCE = 300;
+        const { freemem } = await import("node:os");
+        let concurrency;
+        if (explicitConcurrency != null) {
+            concurrency = Math.max(1, Math.min(20, explicitConcurrency));
+        }
+        else {
+            const freeMemMB = Math.round(freemem() / (1024 * 1024));
+            concurrency = Math.max(2, Math.min(10, Math.floor(freeMemMB / ESTIMATED_MB_PER_INSTANCE)));
+            this.logger.info({ concurrency, freeMemMB: freeMemMB, totalInstances: entries.length }, "Adaptive startup concurrency");
+        }
         const byWorkDir = new Map();
         for (const [name, config] of entries) {
             const dir = config.working_directory;
@@ -361,6 +685,17 @@ export class FleetManager {
                 if (pendingTimer)
                     return;
                 while (running < concurrency && idx < groups.length) {
+                    // Re-check memory if adaptive (no explicit concurrency set)
+                    if (explicitConcurrency == null && running > 0) {
+                        const nowFreeMB = Math.round(freemem() / (1024 * 1024));
+                        if (nowFreeMB < ESTIMATED_MB_PER_INSTANCE) {
+                            this.logger.warn({ freeMemMB: nowFreeMB, remaining: groups.length - idx }, "Low memory — pausing instance startup");
+                            // Wait and retry in 5s
+                            pendingTimer = true;
+                            setTimeout(() => { pendingTimer = false; startNext(); }, 5000);
+                            return;
+                        }
+                    }
                     const now = Date.now();
                     const elapsed = now - lastStartAt;
                     if (lastStartAt > 0 && elapsed < staggerMs) {
@@ -390,21 +725,53 @@ export class FleetManager {
     async stopInstance(name) {
         this.failoverActive.delete(name);
         this.instanceStateCache.delete(name);
+        this.instanceProcessStatus.delete(name);
+        this.lastDeliveryAt.delete(name);
         return this.lifecycle.stop(name);
     }
     /** Restart a single instance, reloading fleet.yaml first to pick up config changes. */
-    async restartSingleInstance(name) {
+    async restartSingleInstance(name, opts) {
         if (this.configPath) {
             this.loadConfig(this.configPath);
             this.routing.rebuild(this.fleetConfig);
             this.reregisterClassicChannels();
         }
         const config = this.fleetConfig?.instances[name];
-        if (!config)
-            throw new Error(`Instance not found: ${name}`);
-        await this.stopInstance(name);
-        const topicMode = this.fleetConfig?.channel?.mode === "topic";
-        await this.startInstance(name, config, topicMode ?? false);
+        if (config) {
+            await this.stopInstance(name);
+            if (opts?.freshStart)
+                this.writeFreshStartMarker(name);
+            const topicMode = this.fleetConfig?.channel?.mode === "topic";
+            await this.startInstance(name, config, topicMode ?? false);
+            return;
+        }
+        // Classic instance fallback
+        const channelId = this.classicChannels?.getChannelIdByInstance(name);
+        if (channelId) {
+            const fleetBackend = this.fleetConfig?.defaults?.backend;
+            const adapterId = this.classicChannels.getAdapterIdByInstance(name);
+            await this.stopInstance(name);
+            await new Promise(r => setTimeout(r, 1000)); // let tmux clean up
+            if (opts?.freshStart)
+                this.writeFreshStartMarker(name);
+            await this.startClassicInstance(name, this.classicChannels.getBackendByInstance(name, fleetBackend), this.classicChannels.getPreTaskCommand(channelId, adapterId), this.classicChannels.getModel(channelId, adapterId, this.fleetConfig?.defaults?.model), this.classicChannels.getAutoPauseAfter(channelId, adapterId, this.fleetConfig?.defaults?.auto_pause_after));
+            return;
+        }
+        throw new Error(`Instance not found: ${name}`);
+    }
+    /**
+     * Mark an instance so its next daemon start skips session resume. Written AFTER
+     * stop (survives the old daemon's cleanup) and BEFORE start so the respawn reads
+     * it — reuses the crash-state → resumeDisabled path from crash-loop recovery.
+     * One-shot: the daemon deletes it on startup.
+     */
+    writeFreshStartMarker(name) {
+        try {
+            writeFileSync(join(this.getInstanceDir(name), "crash-state.json"), JSON.stringify({ resumeDisabled: true, reason: "pty_error_restart" }));
+        }
+        catch (err) {
+            this.logger.warn({ err, name }, "freshStart: failed to write crash-state marker");
+        }
     }
     /** Load .env file from data dir into process.env */
     loadEnvFile() {
@@ -500,9 +867,11 @@ export class FleetManager {
                 const fleetModel = this.fleetConfig?.defaults?.model;
                 const oldBackends = new Map();
                 const oldModels = new Map();
+                const oldAutoPause = new Map();
                 for (const ch of this.classicChannels.getAll()) {
                     oldBackends.set(ch.instanceName, this.classicChannels.getBackendByInstance(ch.instanceName, fleetBackend));
                     oldModels.set(ch.instanceName, this.classicChannels.getModel(ch.channelId, ch.adapterId, fleetModel));
+                    oldAutoPause.set(ch.instanceName, this.classicChannels.getAutoPauseAfter(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.auto_pause_after));
                 }
                 if (!this.classicChannels.checkReload())
                     return;
@@ -510,14 +879,16 @@ export class FleetManager {
                 for (const ch of this.classicChannels.getAll()) {
                     const newBackend = this.classicChannels.getBackendByInstance(ch.instanceName, fleetBackend);
                     const newModel = this.classicChannels.getModel(ch.channelId, ch.adapterId, fleetModel);
+                    const newAutoPause = this.classicChannels.getAutoPauseAfter(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.auto_pause_after);
                     const backendChanged = oldBackends.get(ch.instanceName) !== newBackend;
                     const modelChanged = oldModels.get(ch.instanceName) !== newModel;
-                    if (this.daemons.has(ch.instanceName) && (backendChanged || modelChanged)) {
+                    const autoPauseChanged = oldAutoPause.get(ch.instanceName) !== newAutoPause;
+                    if (this.daemons.has(ch.instanceName) && (backendChanged || modelChanged || autoPauseChanged)) {
                         this.logger.info({ instanceName: ch.instanceName, backendFrom: oldBackends.get(ch.instanceName), backendTo: newBackend, modelFrom: oldModels.get(ch.instanceName), modelTo: newModel }, "Backend/model changed — restarting");
                         await this.stopInstance(ch.instanceName).catch(() => { });
                         // Small delay to let tmux window clean up
                         await new Promise(r => setTimeout(r, 2000));
-                        await this.startClassicInstance(ch.instanceName, newBackend, this.classicChannels.getPreTaskCommand(ch.channelId, ch.adapterId), newModel).catch(err => this.logger.warn({ err, instanceName: ch.instanceName }, "Failed to restart classic instance"));
+                        await this.startClassicInstance(ch.instanceName, newBackend, this.classicChannels.getPreTaskCommand(ch.channelId, ch.adapterId), newModel, newAutoPause).catch(err => this.logger.warn({ err, instanceName: ch.instanceName }, "Failed to restart classic instance"));
                     }
                 }
             }
@@ -770,7 +1141,7 @@ export class FleetManager {
                 let idx = 0;
                 while (idx < channels.length) {
                     const batch = channels.slice(idx, idx + concurrency);
-                    await Promise.allSettled(batch.map(ch => this.startClassicInstance(ch.instanceName, this.classicChannels.getBackendByInstance(ch.instanceName, fleetBackend), this.classicChannels.getPreTaskCommand(ch.channelId, ch.adapterId), this.classicChannels.getModel(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.model)).catch(err => this.logger.warn({ err, instanceName: ch.instanceName }, "Failed to start classic instance"))));
+                    await Promise.allSettled(batch.map(ch => this.startClassicInstance(ch.instanceName, this.classicChannels.getBackendByInstance(ch.instanceName, fleetBackend), this.classicChannels.getPreTaskCommand(ch.channelId, ch.adapterId), this.classicChannels.getModel(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.model), this.classicChannels.getAutoPauseAfter(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.auto_pause_after)).catch(err => this.logger.warn({ err, instanceName: ch.instanceName }, "Failed to start classic instance"))));
                     idx += concurrency;
                 }
             }
@@ -781,16 +1152,26 @@ export class FleetManager {
             const classicCount = this.classicChannels?.getAll().length ?? 0;
             const total = Object.keys(fleet.instances).length + classicCount;
             const started = this.daemons.size;
-            const failedNames = Object.keys(fleet.instances).filter(n => !this.daemons.has(n));
+            const allNotRunning = Object.keys(fleet.instances).filter(n => !this.daemons.has(n));
+            const pausedNames = allNotRunning.filter(n => this.lifecycle.isPaused(n));
+            const failedNames = allNotRunning.filter(n => !this.lifecycle.isPaused(n));
             const generalName = this.findGeneralInstance();
             const generalThreadId = generalName ? fleet.instances[generalName]?.topic_id : undefined;
             const { createRequire } = await import("node:module");
             const _require = createRequire(import.meta.url);
             const agendVersion = _require("../package.json").version ?? "unknown";
             if (this.adapter && fleet.channel?.group_id) {
-                const text = failedNames.length === 0
-                    ? t("fleet.ready", started, total, agendVersion)
-                    : t("fleet.ready_with_failed", started, total, agendVersion, failedNames.join(", "));
+                let text;
+                if (failedNames.length === 0 && pausedNames.length === 0) {
+                    text = t("fleet.ready", started, total, agendVersion);
+                }
+                else if (failedNames.length === 0) {
+                    text = t("fleet.ready", started, total, agendVersion) + `\n⏸ Paused: ${pausedNames.join(", ")}`;
+                }
+                else {
+                    text = t("fleet.ready_with_failed", started, total, agendVersion, failedNames.join(", "))
+                        + (pausedNames.length > 0 ? `\n⏸ Paused: ${pausedNames.join(", ")}` : "");
+                }
                 this.adapter.sendText(String(fleet.channel.group_id), text, {
                     threadId: generalThreadId != null ? String(generalThreadId) : undefined,
                 }).catch(e => this.logger.warn({ err: e }, "Failed to send fleet start notification"));
@@ -975,6 +1356,10 @@ export class FleetManager {
             await this.handleInboundMessage(msg);
         }, this.logger, "adapter.message"));
         this.adapter.on("callback_query", safeHandler(async (data) => {
+            if (await this.handleClassicBackendSelection(data))
+                return;
+            if (await this.handleModelSelection(data))
+                return;
             if (data.callbackData.startsWith("hang:")) {
                 const parts = data.callbackData.split(":");
                 const action = parts[1];
@@ -1013,13 +1398,15 @@ export class FleetManager {
         // Handle classic bot slash commands (/start, /stop, /chat, /compact, /save, /load)
         this.adapter.on("slash_command", safeHandler(async (data) => {
             if (data.command === "start") {
-                const reply = await this.handleClassicStart(data.channelId, data.channelName, data.userId, data.guildId, adapterId);
-                await data.respond(reply);
+                await this.handleClassicStartSlash(data, adapterId);
             }
             else if (data.command === "stop") {
                 const reply = await this.handleClassicStop(data.channelId, adapterId);
                 await data.respond(reply);
             }
+            else if (data.command === "pause" || data.command === "wake") {
+                await this.handlePauseWakeSlash(data, adapterId);
+            }
             else if (data.command === "chat") {
                 const text = data.text ?? "";
                 if (!text) {
@@ -1075,6 +1462,9 @@ export class FleetManager {
                 const result = await this.topicCommands.sendCompact(name);
                 await data.respond(result);
             }
+            else if (data.command === "model") {
+                await this.handleModelSlash(data, adapterId);
+            }
             else if (data.command === "cancel") {
                 const name = this.resolveSlashTarget(data.channelId, adapterId);
                 if (!name) {
@@ -1192,6 +1582,9 @@ export class FleetManager {
             }
         }, this.logger, "adapter.slash_command"));
         await this.topicCommands.registerBotCommands().catch(e => this.logger.warn({ err: e }, "registerBotCommands failed (non-fatal)"));
+        // Background-probe each backend's CLI env (version/models) → cli-env cache.
+        // Non-blocking: /model & status views read the cache; never delays startup.
+        this.probeCliEnvs();
         this.adapter.on("started", safeHandler((username, userId) => {
             this.logger.info(`Bot @${username} polling started. Ensure no other service is polling this bot token.`);
             const w = this.worlds.values().next().value;
@@ -1258,6 +1651,10 @@ export class FleetManager {
             await this.handleInboundMessage(msg);
         }, this.logger, `adapter[${adapterId}].message`));
         adapter.on("callback_query", safeHandler(async (data) => {
+            if (await this.handleClassicBackendSelection(data))
+                return;
+            if (await this.handleModelSelection(data))
+                return;
             if (data.callbackData.startsWith("hang:")) {
                 const parts = data.callbackData.split(":");
                 const action = parts[1];
@@ -1292,13 +1689,15 @@ export class FleetManager {
         // Slash commands: classic bot + admin commands
         adapter.on("slash_command", safeHandler(async (data) => {
             if (data.command === "start") {
-                const reply = await this.handleClassicStart(data.channelId, data.channelName, data.userId, data.guildId, adapterId);
-                await data.respond(reply);
+                await this.handleClassicStartSlash(data, adapterId);
             }
             else if (data.command === "stop") {
                 const reply = await this.handleClassicStop(data.channelId, adapterId);
                 await data.respond(reply);
             }
+            else if (data.command === "pause" || data.command === "wake") {
+                await this.handlePauseWakeSlash(data, adapterId);
+            }
             else if (data.command === "chat") {
                 const text = data.text ?? "";
                 if (!text) {
@@ -1345,6 +1744,9 @@ export class FleetManager {
                 this.pasteRawToClassicInstance(name, `/chat load ${filename}`);
                 await data.respond(t("save.sent", `/chat load ${filename}`, name));
             }
+            else if (data.command === "model") {
+                await this.handleModelSlash(data, adapterId);
+            }
             else if (data.command === "cancel") {
                 const name = this.resolveSlashTarget(data.channelId, adapterId);
                 if (!name) {
@@ -1555,8 +1957,14 @@ export class FleetManager {
                 else if (msg.type === "fleet_set_description") {
                     this.handleSetDescription(name, msg);
                 }
+                else if (msg.type === "instance_process_state") {
+                    this.cacheInstanceProcessStatus(name, msg.status);
+                }
                 else if (msg.type === "instance_state" || msg.type === "instance_state_response") {
                     this.cacheInstanceExecutionState(name, msg);
+                    if (msg.type === "instance_state_response") {
+                        this.cacheInstanceProcessStatus(name, msg.processStatus);
+                    }
                 }
             }, this.logger, `ipc.message[${name}]`));
             // Ask daemon for any sessions that registered before we connected
@@ -1827,9 +2235,21 @@ export class FleetManager {
                         }
                     }
                     const channelName = msg.username || chatId;
-                    // handleClassicStart binds the instance to this adapter authoritatively.
-                    const reply = await this.handleClassicStart(chatId, channelName, msg.userId, undefined, msg.adapterId);
-                    await msgAdapter?.sendText(chatId, reply);
+                    const requestedBackend = text.slice("/start".length).trim().split(/\s+/, 1)[0] || undefined;
+                    if (requestedBackend) {
+                        // handleClassicStart binds the instance to this adapter authoritatively.
+                        const reply = await this.handleClassicStart(chatId, channelName, msg.userId, undefined, msg.adapterId, requestedBackend);
+                        await msgAdapter?.sendText(chatId, reply);
+                    }
+                    else if (msgAdapter) {
+                        await this.beginClassicBackendSelection({
+                            command: "start",
+                            channelId: chatId,
+                            channelName,
+                            userId: msg.userId,
+                            respond: async (reply) => (await msgAdapter.sendText(chatId, reply)).messageId,
+                        }, msgAdapter);
+                    }
                     return;
                 }
                 // Handle /stop command
@@ -1846,6 +2266,42 @@ export class FleetManager {
                     await msgAdapter?.sendText(chatId, reply);
                     return;
                 }
+                const pauseWake = parsePauseWakeCommand(text);
+                if (pauseWake) {
+                    if (!this.classicChannels.isAdmin(msg.userId)) {
+                        await msgAdapter?.sendText(chatId, t("permission.denied"));
+                        return;
+                    }
+                    const name = this.classicChannels.getInstanceByChannel(chatId, msg.adapterId);
+                    if (!name) {
+                        await msgAdapter?.sendText(chatId, t("classic.no_agent_start"));
+                        return;
+                    }
+                    await msgAdapter?.sendText(chatId, await this.topicCommands.runPauseWake(name, pauseWake.action));
+                    return;
+                }
+                // Handle /model command (admin only)
+                if (text === "/model" || text.startsWith("/model ") || text.startsWith("/model@")) {
+                    if (!this.isModelAdmin(msg.userId, chatId, msg.adapterId)) {
+                        await msgAdapter?.sendText(chatId, t("permission.denied"));
+                        return;
+                    }
+                    const modelName = text.replace(/^\/model(@\S+)?/, "").trim();
+                    const modelInstance = this.classicChannels.getInstanceByChannel(chatId, msg.adapterId);
+                    if (!modelInstance) {
+                        await msgAdapter?.sendText(chatId, t("classic.no_agent_start"));
+                        return;
+                    }
+                    if (modelName) {
+                        await msgAdapter?.sendText(chatId, await this.applyModel(modelInstance, modelName));
+                    }
+                    else if (msgAdapter) {
+                        const fallback = await this.promptModelMenu(modelInstance, msg.userId, chatId, msgAdapter, chatId);
+                        if (fallback)
+                            await msgAdapter.sendText(chatId, fallback);
+                    }
+                    return;
+                }
                 // Handle /compact command (admin only)
                 if (text === "/compact" || text.startsWith("/compact@")) {
                     if (!this.classicChannels.isAdmin(msg.userId)) {
@@ -1979,6 +2435,7 @@ export class FleetManager {
                             user_id: msg.userId,
                             ts: msg.timestamp.toISOString(),
                             thread_id: "",
+                            adapter_id: msg.adapterId,
                             source: msg.source,
                             ...(msg.replyToText ? { reply_to_text: msg.replyToText } : {}),
                             ...extraMeta,
@@ -2071,6 +2528,7 @@ export class FleetManager {
                     user_id: msg.userId,
                     ts: msg.timestamp.toISOString(),
                     thread_id: msg.threadId ?? "",
+                    adapter_id: msg.adapterId,
                     source: msg.source,
                     ...(msg.replyToText ? { reply_to_text: msg.replyToText } : {}),
                     ...extraMeta,
@@ -2227,7 +2685,7 @@ export class FleetManager {
     }
     // ===================== Scheduler =====================
     async handleScheduleTrigger(schedule) {
-        const { target, reply_chat_id, reply_thread_id, message, label, id, source } = schedule;
+        const { target, reply_chat_id, reply_thread_id, message, label, id, source, silent } = schedule;
         const RATE_LIMIT_DEFER_THRESHOLD = 85;
         const rl = this.statuslineWatcher.getRateLimits(target);
         if (rl && rl.five_hour_pct > RATE_LIMIT_DEFER_THRESHOLD) {
@@ -2242,6 +2700,20 @@ export class FleetManager {
             this.logger.info({ target, scheduleId: id, rateLimitPct: rl.five_hour_pct }, "Schedule deferred due to rate limit");
             return;
         }
+        // Silent mode: paste directly to tmux pane — no channel message.
+        if (silent) {
+            const ipc = this.instanceIpcClients.get(target);
+            if (ipc) {
+                ipc.send({ type: "raw_paste", content: message });
+                this.scheduler.recordRun(id, "delivered");
+                this.logger.info({ target, scheduleId: id, label }, "Silent schedule injected via raw_paste");
+            }
+            else {
+                this.scheduler.recordRun(id, "instance_offline", "IPC not connected");
+                this.logger.warn({ target, scheduleId: id }, "Silent schedule: IPC not connected, skipping");
+            }
+            return;
+        }
         const schedulerDefaults = this.fleetConfig?.defaults.scheduler;
         const retryCount = schedulerDefaults?.retry_count ?? 3;
         const retryInterval = schedulerDefaults?.retry_interval_ms ?? 30_000;
@@ -2251,7 +2723,7 @@ export class FleetManager {
                     type: "fleet_schedule_trigger",
                     payload: { schedule_id: id, message: `[Scheduled] ${message}`, label },
                     meta: { chat_id: reply_chat_id, thread_id: reply_thread_id, user: "scheduler" },
-                });
+                }, { waitForIdle: true });
                 // A scheduled trigger also puts the instance to work — show a cancel button.
                 void this.sendCancelButton(target);
                 return true;
@@ -2310,6 +2782,7 @@ export class FleetManager {
                 case "fleet_schedule_create": {
                     const params = {
                         cron: payload.cron,
+                        at: payload.at,
                         message: payload.message,
                         source: instanceName,
                         target: payload.target || instanceName,
@@ -2317,6 +2790,7 @@ export class FleetManager {
                         reply_thread_id: meta.thread_id || null,
                         label: payload.label,
                         timezone: payload.timezone,
+                        silent: !!(payload.silent),
                     };
                     result = this.scheduler.create(params);
                     break;
@@ -2437,7 +2911,9 @@ export class FleetManager {
         switch (op) {
             case "create":
                 return this.scheduler.create({
-                    cron: args.cron, message: args.message,
+                    cron: args.cron,
+                    at: args.at,
+                    message: args.message,
                     source: instance, target: args.target || instance,
                     reply_chat_id: "", reply_thread_id: null,
                     label: args.label,
@@ -2693,73 +3169,92 @@ export class FleetManager {
             }
         }, 5 * 60_000);
     }
-    /** Save fleet config back to fleet.yaml */
-    saveFleetConfig() {
+    /**
+     * Patch only values changed in the effective config into the original YAML
+     * document. Unknown keys, explicit overrides and comments remain untouched.
+     */
+    saveFleetConfig(explicitPatches = []) {
         if (!this.fleetConfig || !this.configPath)
             return;
-        const toSave = {};
-        if (this.fleetConfig.project_roots)
-            toSave.project_roots = this.fleetConfig.project_roots;
-        if (this.fleetConfig.channels && this.fleetConfig.channels.length > 0) {
-            toSave.channels = this.fleetConfig.channels;
-        }
-        else if (this.fleetConfig.channel) {
-            toSave.channel = this.fleetConfig.channel;
-        }
-        if (this.fleetConfig.health_port)
-            toSave.health_port = this.fleetConfig.health_port;
-        if (Object.keys(this.fleetConfig.defaults).length > 0)
-            toSave.defaults = this.fleetConfig.defaults;
-        if (this.fleetConfig.teams && Object.keys(this.fleetConfig.teams).length > 0) {
-            toSave.teams = this.fleetConfig.teams;
-        }
-        if (this.fleetConfig.templates && Object.keys(this.fleetConfig.templates).length > 0) {
-            toSave.templates = this.fleetConfig.templates;
-        }
-        if (this.fleetConfig.profiles && Object.keys(this.fleetConfig.profiles).length > 0) {
-            toSave.profiles = this.fleetConfig.profiles;
-        }
-        toSave.instances = {};
-        for (const [name, inst] of Object.entries(this.fleetConfig.instances)) {
-            const serialized = {
-                working_directory: inst.working_directory,
-                topic_id: inst.topic_id,
-            };
-            // Preserve all optional user-configured fields so saveFleetConfig() never silently drops them
-            if (inst.general_topic)
-                serialized.general_topic = true;
-            if (inst.display_name)
-                serialized.display_name = inst.display_name;
-            if (inst.channel_id)
-                serialized.channel_id = inst.channel_id;
-            if (inst.description)
-                serialized.description = inst.description;
-            if (inst.tags?.length)
-                serialized.tags = inst.tags;
-            if (inst.model)
-                serialized.model = inst.model;
-            if (inst.model_failover?.length)
-                serialized.model_failover = inst.model_failover;
-            if (inst.worktree_source)
-                serialized.worktree_source = inst.worktree_source;
-            if (inst.backend)
-                serialized.backend = inst.backend;
-            if (inst.systemPrompt)
-                serialized.systemPrompt = inst.systemPrompt;
-            if (inst.skipPermissions)
-                serialized.skipPermissions = inst.skipPermissions;
-            if (inst.lightweight)
-                serialized.lightweight = inst.lightweight;
-            if (inst.cost_guard)
-                serialized.cost_guard = inst.cost_guard;
-            if (inst.workflow !== undefined)
-                serialized.workflow = inst.workflow;
-            if (inst.agent_mode)
-                serialized.agent_mode = inst.agent_mode;
-            toSave.instances[name] = serialized;
-        }
-        writeFileSync(this.configPath, yaml.dump(toSave, { lineWidth: 120 }));
-        this.logger.info({ path: this.configPath }, "Saved fleet config");
+        if (!this.savedFleetConfigSnapshot)
+            this.savedFleetConfigSnapshot = structuredClone(this.fleetConfig);
+        // Re-read immediately before patching so an unrelated concurrent/manual
+        // edit is retained. Invalid concurrent YAML is never overwritten.
+        const source = existsSync(this.configPath) ? readFileSync(this.configPath, "utf-8") : "{}\n";
+        this.rawFleetDocument = parseDocument(source, { keepSourceTokens: true });
+        if (this.rawFleetDocument.errors.length > 0) {
+            throw new Error(`Refusing to overwrite invalid fleet.yaml: ${this.rawFleetDocument.errors[0].message}`);
+        }
+        this.rawFleetConfig = loadRawFleetConfig(this.configPath);
+        this.patchFleetDocument(this.rawFleetDocument, [], this.savedFleetConfigSnapshot, this.fleetConfig);
+        // Settings edits are expressed against the raw config. Persist them even
+        // when the chosen override equals the inherited effective value, a case
+        // the before/after runtime diff cannot observe.
+        for (const patch of explicitPatches) {
+            if (patch.remove) {
+                this.rawFleetDocument.deleteIn(patch.path);
+            }
+            else {
+                const before = this.rawFleetDocument.getIn(patch.path);
+                this.patchFleetDocument(this.rawFleetDocument, patch.path, before, patch.value);
+            }
+        }
+        const output = String(this.rawFleetDocument);
+        const tempPath = `${this.configPath}.tmp-${process.pid}`;
+        writeFileSync(tempPath, output, "utf-8");
+        if (existsSync(this.configPath))
+            chmodSync(tempPath, statSync(this.configPath).mode);
+        renameSync(tempPath, this.configPath);
+        this.rawFleetConfig = loadRawFleetConfig(this.configPath);
+        this.savedFleetConfigSnapshot = structuredClone(this.fleetConfig);
+        this.logger.info({ path: this.configPath }, "Saved fleet config (lossless patch)");
+    }
+    patchFleetDocument(document, path, before, after) {
+        if (Object.is(before, after))
+            return;
+        if (Array.isArray(before) && Array.isArray(after)) {
+            const shared = Math.min(before.length, after.length);
+            for (let i = 0; i < shared; i++) {
+                this.patchFleetDocument(document, [...path, i], before[i], after[i]);
+            }
+            // Remove from the end so YAML sequence indexes do not shift underneath us.
+            for (let i = before.length - 1; i >= after.length; i--)
+                document.deleteIn([...path, i]);
+            for (let i = shared; i < after.length; i++)
+                document.setIn([...path, i], after[i]);
+            return;
+        }
+        const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+        if (isRecord(before) && isRecord(after)) {
+            const keys = new Set([...Object.keys(before), ...Object.keys(after)]);
+            for (const key of keys) {
+                // `channel` is a derived alias when the raw file uses `channels`.
+                if (path.length === 0 && key === "channel" && this.rawFleetConfig.channels)
+                    continue;
+                // Conversely, `channels` is a normalized alias for a legacy `channel`.
+                // Keep the user's original shape unless the caller explicitly removed
+                // `channel` (the Settings channels endpoint intentionally migrates it).
+                if (path.length === 0 && key === "channels" && this.rawFleetConfig.channel && !this.rawFleetConfig.channels && after.channel !== undefined)
+                    continue;
+                this.patchFleetDocument(document, [...path, key], before[key], after[key]);
+            }
+            return;
+        }
+        if (after === undefined) {
+            document.deleteIn(path);
+        }
+        else if (path.length === 0) {
+            document.contents = document.createNode(after);
+        }
+        else {
+            const currentNode = document.getIn(path, true);
+            if (isScalar(currentNode) && (after === null || typeof after !== "object")) {
+                currentNode.value = after;
+            }
+            else {
+                document.setIn(path, after);
+            }
+        }
     }
     async removeInstance(name) {
         // Clean up schedules (scheduler is fleet-level, not lifecycle-level)
@@ -2800,6 +3295,8 @@ export class FleetManager {
         }
     }
     startStatuslineWatcher(name) {
+        if (this.lifecycle.isPaused(name))
+            return;
         this.statuslineWatcher.watch(name);
     }
     stopStatuslineWatcher(name) {
@@ -3645,13 +4142,25 @@ When users create specialized instances, suggest these configurations:
                 const inboxDir = join(getAgendHome(), "workspaces", instanceName, "inbox");
                 mkdirSync(inboxDir, { recursive: true });
                 const dest = join(inboxDir, basename(tmpPath));
+                // Copy to destination — failure means this attachment is skipped
                 try {
-                    renameSync(tmpPath, dest);
-                }
-                catch {
                     copyFileSync(tmpPath, dest);
+                }
+                catch (copyErr) {
+                    try {
+                        unlinkSync(dest);
+                    }
+                    catch { } // clean partial
+                    this.logger.warn({ err: copyErr.message, instanceName, dest }, "Attachment copy failed — skipping");
+                    continue;
+                }
+                // Cleanup source — failure is non-fatal (dest already valid)
+                try {
                     unlinkSync(tmpPath);
                 }
+                catch (cleanupErr) {
+                    this.logger.debug({ tmpPath, err: cleanupErr.message }, "Orphan tmp not cleaned");
+                }
                 const savedKind = att.kind === "sticker" ? "photo" : att.kind;
                 paths.push(dest);
                 if (paths.length === 1)
@@ -3684,6 +4193,7 @@ When users create specialized instances, suggest these configurations:
             user_id: msg.userId,
             ts: msg.timestamp.toISOString(),
             thread_id: msg.threadId ?? "",
+            ...(msg.adapterId ? { adapter_id: msg.adapterId } : {}),
             source: msg.source,
             ...extraMeta,
             ...(msg.replyToText ? { reply_to_text: msg.replyToText } : {}),
@@ -3725,23 +4235,457 @@ When users create specialized instances, suggest these configurations:
         ipc.send({ type: "raw_paste", content: text });
         this.logger.info({ instanceName, text: text.slice(0, 100) }, "Raw paste sent to classic instance");
     }
+    /** Resolve the backend name configured for an instance (fleet or classic). */
+    backendNameForInstance(instanceName) {
+        const fleetCfg = this.fleetConfig?.instances[instanceName];
+        if (fleetCfg?.backend)
+            return fleetCfg.backend;
+        const classic = this.classicChannels?.getChannelIdByInstance(instanceName) !== undefined
+            ? this.classicChannels?.getBackendByInstance(instanceName, this.fleetConfig?.defaults?.backend)
+            : undefined;
+        return classic ?? this.fleetConfig?.defaults?.backend ?? "claude-code";
+    }
+    cliEnvPath(backend) {
+        return join(getAgendHome(), "cli-env", `${backend.replace(/[^A-Za-z0-9._-]/g, "_")}.json`);
+    }
+    /** Read the cached CLI env for a backend, or null if missing/stale/unparseable. */
+    readCliEnv(backend) {
+        try {
+            const env = JSON.parse(readFileSync(this.cliEnvPath(backend), "utf-8"));
+            if (typeof env?.probedAt === "number" && Date.now() - env.probedAt < CLI_ENV_TTL_MS)
+                return env;
+        }
+        catch { /* missing / stale / corrupt */ }
+        return null;
+    }
+    /** Resolve the model currently configured for a fleet or ClassicBot instance. */
+    currentModelForInstance(instanceName) {
+        const fleetInstance = this.fleetConfig?.instances[instanceName];
+        if (fleetInstance) {
+            const fleetModel = fleetInstance.model ?? this.fleetConfig?.defaults?.model;
+            if (fleetModel?.trim())
+                return fleetModel.trim();
+        }
+        const classic = this.classicChannels?.getAll().find(ch => ch.instanceName === instanceName);
+        if (classic) {
+            const classicModel = this.classicChannels?.getModel(classic.channelId, classic.adapterId, this.fleetConfig?.defaults?.model);
+            if (classicModel?.trim())
+                return classicModel.trim();
+        }
+        const cachedModel = this.readCliEnv(this.backendNameForInstance(instanceName))?.currentModel;
+        return cachedModel?.trim() || "default";
+    }
+    modelChoiceLabel(option, currentModel) {
+        const label = option.description ? `${option.label} — ${option.description}` : option.label;
+        return option.id === currentModel ? `✓ ${label}` : label;
+    }
+    /** Probe one backend's CLI env and cache it. Best-effort; never throws. */
+    async probeBackend(backend) {
+        try {
+            const be = createBackend(backend, join(getAgendHome(), "cli-env"));
+            if (!be.probeCLIEnv)
+                return null;
+            const probed = await be.probeCLIEnv({ workingDirectory: "", instanceDir: join(getAgendHome(), "cli-env"), instanceName: `probe-${backend}`, mcpServers: {} });
+            const env = { backend, probedAt: Date.now(), ...probed };
+            const path = this.cliEnvPath(backend);
+            mkdirSync(dirname(path), { recursive: true });
+            writeFileSync(path, JSON.stringify(env, null, 2));
+            return env;
+        }
+        catch (err) {
+            this.logger.warn({ err, backend }, "CLI env probe failed");
+            return null;
+        }
+    }
+    /** Background-probe every distinct backend in use at startup (non-blocking). */
+    probeCliEnvs() {
+        const backends = new Set();
+        if (this.fleetConfig?.defaults?.backend)
+            backends.add(this.fleetConfig.defaults.backend);
+        for (const inst of Object.values(this.fleetConfig?.instances ?? {}))
+            if (inst.backend)
+                backends.add(inst.backend);
+        for (const ch of this.classicChannels?.getAll() ?? [])
+            if (ch.backend)
+                backends.add(ch.backend);
+        if (backends.size === 0)
+            backends.add("claude-code");
+        for (const b of backends)
+            void this.probeBackend(b);
+    }
+    /** Best-effort model list for `/model`: cached CLI env first, else live probe. Never throws. */
+    async getModelOptions(instanceName, refresh = false) {
+        const backendName = this.backendNameForInstance(instanceName);
+        if (!refresh) {
+            const cached = this.readCliEnv(backendName);
+            if (cached && cached.models.length)
+                return cached.models;
+        }
+        // Cache miss / stale / forced refresh → probe live (also refreshes the cache).
+        const env = await this.probeBackend(backendName);
+        return env?.models ?? [];
+    }
+    /** `/model` slash handler (admin only). No arg → DC menu; `/model <name>` → apply directly. */
+    async handleModelSlash(data, adapterId) {
+        if (!this.isModelAdmin(data.userId, data.channelId, adapterId)) {
+            await data.respond(t("permission.denied"));
+            return;
+        }
+        const name = this.resolveSlashTarget(data.channelId, adapterId);
+        if (!name) {
+            await data.respond(t("classic.no_agent"));
+            return;
+        }
+        const requested = (typeof data.options?.name === "string" ? data.options.name.trim() : "")
+            || (data.text?.trim() ?? "");
+        const isRefresh = requested === "--refresh" || requested === "refresh";
+        if (requested && !isRefresh) {
+            await data.respond(await this.applyModel(name, requested));
+            return;
+        }
+        // No arg (or --refresh) → menu. Menu is DC-only this round (respondChoices); TG uses `/model <name>`.
+        if (!data.respondChoices) {
+            await data.respond("Usage: /model <name> — e.g. /model sonnet");
+            return;
+        }
+        const options = await this.getModelOptions(name, isRefresh);
+        if (options.length === 0) {
+            await data.respond(`No model list available for ${name}. Type \`/model <name>\` to set one directly.`);
+            return;
+        }
+        const currentModel = this.currentModelForInstance(name);
+        const nonce = randomBytes(6).toString("hex");
+        const choices = options.slice(0, 25).map(o => ({
+            id: `${MODEL_SELECT_CALLBACK_PREFIX}${nonce}:${o.id}`,
+            label: this.modelChoiceLabel(o, currentModel),
+        }));
+        const timer = setTimeout(() => this.pendingModelSelects.delete(nonce), CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
+        timer.unref?.();
+        this.pendingModelSelects.set(nonce, { instanceName: name, model: "", userId: data.userId, channelId: data.channelId, timer, respond: data.respond });
+        try {
+            await data.respondChoices(`Current model: **${currentModel}**\nSelect a new model:`, choices);
+        }
+        catch (err) {
+            this.pendingModelSelects.delete(nonce);
+            clearTimeout(timer);
+            this.logger.warn({ err, instanceName: name }, "model menu failed");
+            await data.respond("Usage: /model <name> — e.g. /model sonnet");
+        }
+    }
+    /**
+     * Show a TG inline-keyboard model-selection menu. Reuses the same
+     * pendingModelSelects coordinator as the DC Select Menu path.
+     * Returns null on success (menu shown), or a fallback string to send.
+     */
+    async promptModelMenu(instanceName, userId, channelId, adapter, chatId, threadId) {
+        const options = await this.getModelOptions(instanceName);
+        if (options.length === 0) {
+            return `No model list available for ${instanceName}. Use \`/model <name>\` to set one directly.`;
+        }
+        const currentModel = this.currentModelForInstance(instanceName);
+        const nonce = randomBytes(6).toString("hex");
+        const choices = options.slice(0, 25).map(o => ({
+            id: `${MODEL_SELECT_CALLBACK_PREFIX}${nonce}:${o.id}`,
+            label: this.modelChoiceLabel(o, currentModel),
+        }));
+        const respond = async (text) => {
+            await adapter.sendText(chatId, text, { threadId });
+            return undefined;
+        };
+        const timer = setTimeout(() => {
+            const p = this.pendingModelSelects.get(nonce);
+            if (p) {
+                this.pendingModelSelects.delete(nonce);
+                p.respond("⏰ Model selection expired.").catch(() => { });
+            }
+        }, CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
+        timer.unref?.();
+        this.pendingModelSelects.set(nonce, { instanceName, model: "", userId, channelId, timer, respond, adapter, adapterChatId: chatId, adapterThreadId: threadId });
+        try {
+            const menuMessageId = await adapter.promptUser(chatId, `Current model: ${currentModel}\nSelect a new model:`, choices, { threadId });
+            const pending = this.pendingModelSelects.get(nonce);
+            if (pending)
+                pending.menuMessageId = menuMessageId;
+            return null; // menu shown
+        }
+        catch (err) {
+            this.pendingModelSelects.delete(nonce);
+            clearTimeout(timer);
+            this.logger.warn({ err, instanceName }, "TG model menu failed");
+            return `Usage: /model <name> — e.g. /model sonnet`;
+        }
+    }
+    /** Consume a `/model` selection callback. Returns true for all model-select ids (incl. stale). */
+    async handleModelSelection(data) {
+        if (!data.callbackData.startsWith(MODEL_SELECT_CALLBACK_PREFIX))
+            return false;
+        const match = data.callbackData.match(/^model-select:([0-9a-f]+):(.+)$/);
+        if (!match)
+            return true;
+        const pending = this.pendingModelSelects.get(match[1]);
+        if (!pending)
+            return true;
+        // Only the admin who opened the menu, in the same channel, may consume it.
+        if (data.userId && data.userId !== pending.userId)
+            return true;
+        const cbChannel = data.threadId ?? data.chatId;
+        if (cbChannel !== pending.channelId && data.chatId !== pending.channelId)
+            return true;
+        this.pendingModelSelects.delete(match[1]);
+        clearTimeout(pending.timer);
+        const model = match[2];
+        // Send immediate "⏳ Switching..." feedback, then apply in background.
+        const progressText = `⏳ Switching ${pending.instanceName} to \`${model}\`…`;
+        let progressMsgId;
+        if (pending.adapter && pending.adapterChatId) {
+            // TG path: turn the original menu into the progress message. This both
+            // removes its inline keyboard and gives the final result a stable message
+            // to edit, avoiding a stale selectable menu above a separate status post.
+            const menuMessageId = pending.menuMessageId ?? data.messageId;
+            if (menuMessageId && pending.adapter.editMessageRemoveButtons) {
+                try {
+                    await pending.adapter.editMessageRemoveButtons(pending.adapterChatId, menuMessageId, progressText, pending.adapterThreadId);
+                    progressMsgId = menuMessageId;
+                }
+                catch { /* fall back to a new progress message */ }
+            }
+            if (!progressMsgId) {
+                try {
+                    const sent = await pending.adapter.sendText(pending.adapterChatId, progressText, { threadId: pending.adapterThreadId });
+                    progressMsgId = sent.messageId;
+                }
+                catch { /* non-fatal */ }
+            }
+        }
+        else {
+            // DC path: respond immediately with progress text
+            await pending.respond(progressText).catch(() => { });
+        }
+        // Apply model in background — don't await here (keeps callback handler fast)
+        void (async () => {
+            const result = await this.applyModel(pending.instanceName, model);
+            if (pending.adapter && pending.adapterChatId) {
+                if (progressMsgId) {
+                    pending.adapter.editMessage(pending.adapterChatId, progressMsgId, result, pending.adapterThreadId).catch(() => {
+                        pending.adapter.sendText(pending.adapterChatId, result, { threadId: pending.adapterThreadId }).catch(() => { });
+                    });
+                }
+                else {
+                    pending.adapter.sendText(pending.adapterChatId, result, { threadId: pending.adapterThreadId }).catch(() => { });
+                }
+            }
+            else {
+                await pending.respond(result).catch(() => { });
+            }
+        })();
+        return true;
+    }
+    /** Apply a model to an instance: runtime paste (claude-code) or persist + restart (others). */
+    async applyModel(instanceName, model) {
+        const backendName = this.backendNameForInstance(instanceName);
+        let strategy = "restart";
+        try {
+            strategy = createBackend(backendName, this.getInstanceDir(instanceName)).getModelSwitchStrategy?.(model) ?? "restart";
+        }
+        catch { /* default restart */ }
+        const warn = isModelCompatible(backendName, model) ? "" : `⚠️ "${model}" doesn't match ${backendName}'s usual pattern — passing through anyway.\n`;
+        if (strategy === "runtime") {
+            if (!this.instanceIpcClients.get(instanceName))
+                return `${warn}❌ ${instanceName} is not running.`;
+            this.pasteRawToClassicInstance(instanceName, `/model ${model}`);
+            return `${warn}✅ Switched ${instanceName} to \`${model}\` (runtime).`;
+        }
+        // restart: persist the model so the respawned CLI launches with it.
+        let persisted = false;
+        if (this.fleetConfig?.instances[instanceName]) {
+            this.fleetConfig.instances[instanceName].model = model;
+            this.saveFleetConfig();
+            persisted = true;
+        }
+        else if (this.classicChannels?.setModelByInstance(instanceName, model)) {
+            persisted = true;
+        }
+        if (!persisted)
+            return `${warn}❌ Could not set model for ${instanceName}.`;
+        await this.restartSingleInstance(instanceName);
+        return `${warn}✅ Set ${instanceName} to \`${model}\` and restarted.`;
+    }
     /** Read recent chat log for agent context */
     getRecentChatLog(instanceName, maxLines = 10) {
         const logDir = ClassicChannelManager.chatLogDir(instanceName);
-        const today = new Date().toISOString().slice(0, 10);
+        // Use local timezone for date — must match logMessage's write path
+        const tz = process.env.TZ || Intl.DateTimeFormat().resolvedOptions().timeZone;
+        const today = new Date().toLocaleString("sv-SE", { timeZone: tz, hour12: false }).slice(0, 10);
         const logFile = join(logDir, `${today}.log`);
         try {
             if (!existsSync(logFile))
                 return undefined;
             const lines = readFileSync(logFile, "utf-8").trim().split("\n");
-            return lines.slice(-maxLines).join("\n");
+            // The triggering message is written before forwardToClassicInstance runs
+            // and is included separately under [User message]. Exclude that newest
+            // log entry so the agent does not receive the same message twice. A chat
+            // message may span physical lines, so remove from its timestamped entry
+            // header rather than blindly dropping only the final continuation line.
+            const entryHeader = /^\[\d{4}-\d{2}-\d{2}T[^\]]+\] <.*> /;
+            let currentEntryStart = lines.length - 1;
+            while (currentEntryStart > 0 && !entryHeader.test(lines[currentEntryStart])) {
+                currentEntryStart--;
+            }
+            lines.splice(currentEntryStart);
+            if (lines.length === 0 || maxLines <= 0)
+                return undefined;
+            return lines.slice(-maxLines).join("\n") || undefined;
         }
         catch {
             return undefined;
         }
     }
+    /** Return a user-facing blocker without mutating ClassicBot state. */
+    validateClassicStart(channelId, userId, guildId, adapterId) {
+        if (!this.classicChannels)
+            return "Classic channel manager not initialized.";
+        if (guildId && !this.classicChannels.isGuildAllowed(guildId)) {
+            const generalId = this.findGeneralInstance(adapterId);
+            if (generalId)
+                this.notifyInstanceTopic(generalId, t("alert.unauth_guild", guildId, userId));
+            return t("classic.not_authorized_guild");
+        }
+        if (this.classicChannels.isClassicChannel(channelId, adapterId))
+            return t("classic.already_active");
+        if (this.routing.resolve(channelId))
+            return t("classic.topic_bound");
+        return undefined;
+    }
+    isBackendInstalled(backend) {
+        const installation = BACKEND_INSTALLATION_INFO[backend];
+        return !!installation && checkBinaryInstalled(installation.binary);
+    }
+    getMissingBackendWarning(backend) {
+        if (!backend)
+            return undefined;
+        const installation = BACKEND_INSTALLATION_INFO[backend];
+        if (!installation || this.isBackendInstalled(backend))
+            return undefined;
+        return t("classic.backend_not_installed", backend, installation.binary, installation.install);
+    }
+    /** Handle Discord's required static slash choice, warning before a likely startup failure. */
+    async handleClassicStartSlash(data, adapterId) {
+        const requestedBackend = typeof data.options?.backend === "string" ? data.options.backend : undefined;
+        if (!requestedBackend) {
+            // beta.31 made this option required. Discord can briefly retain the old
+            // command schema client-side, however, so stale clients may still submit
+            // `/start` without it. Do not resurrect the legacy 60-second component
+            // menu in that case: fail immediately and make the user invoke the newly
+            // registered command, which guarantees an explicit backend choice.
+            await data.respond(t("classic.backend_required"));
+            return;
+        }
+        const warning = this.getMissingBackendWarning(requestedBackend);
+        // Keep the deferred ephemeral response useful even if daemon startup later
+        // fails because the executable is absent. This is advisory, not a gate.
+        if (warning)
+            await data.respond(warning);
+        const reply = await this.handleClassicStart(data.channelId, data.channelName, data.userId, data.guildId, adapterId, requestedBackend);
+        await data.respond(warning ? `${warning}\n\n${reply}` : reply);
+    }
+    /** Present platform-native backend choices, then start on selection or timeout. */
+    async beginClassicBackendSelection(data, adapter) {
+        const adapterId = adapter.id;
+        const blocker = this.validateClassicStart(data.channelId, data.userId, data.guildId, adapterId);
+        if (blocker) {
+            await data.respond(blocker);
+            return;
+        }
+        const nonce = randomBytes(6).toString("hex");
+        const choices = getClassicBackendChoices().map(choice => ({
+            id: `${CLASSIC_BACKEND_CALLBACK_PREFIX}${nonce}:${choice.id}`,
+            label: `${this.isBackendInstalled(choice.id) ? "✅" : "❌"} ${choice.label}`,
+        }));
+        const complete = data.respondChoices
+            ? async (text) => { await data.respond(text); }
+            : async (text, messageId) => {
+                if (messageId && adapter.editMessageRemoveButtons) {
+                    try {
+                        await adapter.editMessageRemoveButtons(data.channelId, messageId, text);
+                        return;
+                    }
+                    catch { /* fall back to a new message */ }
+                }
+                await data.respond(text);
+            };
+        const timer = setTimeout(() => {
+            // Timeout: cancel the selection — do NOT fall back to default.
+            const p = this.pendingClassicStarts.get(nonce);
+            if (p) {
+                this.pendingClassicStarts.delete(nonce);
+                p.complete(t("classic.selection_expired"), p.messageId).catch(() => { });
+            }
+        }, CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
+        timer.unref?.();
+        const pending = {
+            channelId: data.channelId,
+            channelName: data.channelName,
+            userId: data.userId,
+            guildId: data.guildId,
+            adapterId,
+            timer,
+            complete,
+        };
+        this.pendingClassicStarts.set(nonce, pending);
+        try {
+            pending.messageId = data.respondChoices
+                ? await data.respondChoices(t("classic.choose_backend"), choices)
+                : await adapter.promptUser(data.channelId, t("classic.choose_backend"), choices);
+        }
+        catch (err) {
+            // A menu transport failure should not make /start unusable: consume the
+            // pending request and immediately use the configured default.
+            this.logger.warn({ err, channelId: data.channelId, adapterId }, "Classic backend menu failed; using default");
+            await this.finishClassicBackendSelection(nonce);
+        }
+    }
+    /** Consume a selection callback. Returns true for all ClassicBot callback IDs, including stale ones. */
+    async handleClassicBackendSelection(data) {
+        if (!data.callbackData.startsWith(CLASSIC_BACKEND_CALLBACK_PREFIX))
+            return false;
+        const match = data.callbackData.match(/^classic-backend:([0-9a-f]+):(.+)$/);
+        if (!match)
+            return true;
+        const pending = this.pendingClassicStarts.get(match[1]);
+        if (!pending)
+            return true;
+        // Telegram keyboards are visible to everyone in a group. Only the user who
+        // issued /start may consume the pending selection.
+        if (data.userId && data.userId !== pending.userId)
+            return true;
+        const callbackChannelId = data.threadId ?? data.chatId;
+        if (callbackChannelId !== pending.channelId && data.chatId !== pending.channelId)
+            return true;
+        await this.finishClassicBackendSelection(match[1], match[2]);
+        return true;
+    }
+    /** Atomically claim one pending request so timeout/click races create at most one instance. */
+    async finishClassicBackendSelection(nonce, backend) {
+        const pending = this.pendingClassicStarts.get(nonce);
+        if (!pending)
+            return;
+        this.pendingClassicStarts.delete(nonce);
+        clearTimeout(pending.timer);
+        const selectedBackend = isSelectableClassicBackend(backend) ? backend : undefined;
+        const effectiveBackend = selectedBackend
+            ?? this.classicChannels?.getDefaults().backend
+            ?? this.fleetConfig?.defaults?.backend
+            ?? "claude-code";
+        const warning = this.getMissingBackendWarning(effectiveBackend);
+        // Show the warning before starting so it survives a missing-binary startup
+        // failure. The selected backend is still attempted as requested.
+        if (warning)
+            await pending.complete(warning, pending.messageId);
+        const reply = await this.handleClassicStart(pending.channelId, pending.channelName, pending.userId, pending.guildId, pending.adapterId, selectedBackend);
+        await pending.complete(warning ? `${warning}\n\n${reply}` : reply, pending.messageId);
+    }
     /** Start a classic channel instance with lightweight config */
-    async startClassicInstance(instanceName, backend, preTaskCommand, model) {
+    async startClassicInstance(instanceName, backend, preTaskCommand, model, autoPauseAfter) {
         if (this.daemons.has(instanceName))
             return;
         const workDir = join(getAgendHome(), "workspaces", instanceName);
@@ -3753,41 +4697,34 @@ When users create specialized instances, suggest these configurations:
             lightweight: true,
             ...(backend ? { backend } : {}),
             ...(model ? { model } : {}),
+            ...(autoPauseAfter !== undefined ? { auto_pause_after: autoPauseAfter } : {}),
             ...(preTaskCommand ? { pre_task_command: preTaskCommand } : {}),
         };
         const topicMode = this.fleetConfig?.channel?.mode === "topic";
         await this.startInstance(instanceName, config, topicMode);
     }
     /** Handle /start slash command — register classic channel */
-    async handleClassicStart(channelId, channelName, userId, guildId, adapterId) {
-        if (!this.classicChannels)
+    async handleClassicStart(channelId, channelName, userId, guildId, adapterId, backend) {
+        const blocker = this.validateClassicStart(channelId, userId, guildId, adapterId);
+        if (blocker)
+            return blocker;
+        const classicChannels = this.classicChannels;
+        if (!classicChannels)
             return "Classic channel manager not initialized.";
-        if (guildId && !this.classicChannels.isGuildAllowed(guildId)) {
-            const generalId = this.findGeneralInstance();
-            if (generalId) {
-                this.notifyInstanceTopic(generalId, t("alert.unauth_guild", guildId, userId));
-            }
-            return t("classic.not_authorized_guild");
-        }
-        // Per-bot check: a second bot may /start in the same channel (own agent).
-        if (this.classicChannels.isClassicChannel(channelId, adapterId))
-            return t("classic.already_active");
-        // Classic no longer lives in the routing engine, so this only guards against
-        // a fleet topic-mode instance colliding with the channel.
-        if (this.routing.resolve(channelId))
-            return t("classic.topic_bound");
-        const instanceName = this.classicChannels.deriveInstanceName(channelName || channelId, channelId, adapterId);
-        this.classicChannels.register(channelId, adapterId, instanceName, channelName || channelId, userId);
+        const instanceName = classicChannels.deriveInstanceName(channelName || channelId, channelId, adapterId);
+        clearPausedMarker(this.getInstanceDir(instanceName));
+        const selectedBackend = isSelectableClassicBackend(backend) ? backend : undefined;
+        classicChannels.register(channelId, adapterId, instanceName, channelName || channelId, userId, selectedBackend);
         // Bind this classic instance to the bot that started it (authoritative), so
         // replies/cancel go out through that bot even though every same-guild bot
         // also sees the channel's messages.
         if (adapterId)
             this.bindInstanceAdapter(instanceName, adapterId);
-        await this.startClassicInstance(instanceName, this.classicChannels.getBackend(channelId, adapterId, this.fleetConfig?.defaults?.backend), this.classicChannels.getPreTaskCommand(channelId, adapterId), this.classicChannels.getModel(channelId, adapterId, this.fleetConfig?.defaults?.model));
+        await this.startClassicInstance(instanceName, classicChannels.getBackend(channelId, adapterId, this.fleetConfig?.defaults?.backend), classicChannels.getPreTaskCommand(channelId, adapterId), classicChannels.getModel(channelId, adapterId, this.fleetConfig?.defaults?.model), classicChannels.getAutoPauseAfter(channelId, adapterId, this.fleetConfig?.defaults?.auto_pause_after));
         this.reregisterClassicChannels();
         // Auto-enable collab for Discord classic channels (TG uses @mention directly without collab mode)
-        if (guildId && !this.classicChannels.isCollab(channelId, adapterId)) {
-            this.classicChannels.toggleCollab(channelId, adapterId);
+        if (guildId && !classicChannels.isCollab(channelId, adapterId)) {
+            classicChannels.toggleCollab(channelId, adapterId);
         }
         this.logger.info({ channelId, adapterId, instanceName, userId }, "Classic channel started");
         return t("classic.started");
@@ -3801,6 +4738,7 @@ When users create specialized instances, suggest these configurations:
             return t("classic.no_agent");
         this.instanceWorldBinding.delete(ch.instanceName);
         await this.stopInstance(ch.instanceName).catch(err => this.logger.warn({ err, instanceName: ch.instanceName }, "Failed to stop classic instance"));
+        clearPausedMarker(this.getInstanceDir(ch.instanceName));
         this.reregisterClassicChannels();
         this.logger.info({ channelId, adapterId, instanceName: ch.instanceName }, "Classic channel stopped");
         return t("classic.stopped");
@@ -3844,6 +4782,9 @@ When users create specialized instances, suggest these configurations:
             clearInterval(this.classicReloadTimer);
             this.classicReloadTimer = null;
         }
+        for (const pending of this.pendingClassicStarts.values())
+            clearTimeout(pending.timer);
+        this.pendingClassicStarts.clear();
         this.topicArchiver.stop();
         this.scheduler?.shutdown();
         // Stop instances in parallel batches to avoid long sequential waits.
@@ -4138,7 +5079,7 @@ When users create specialized instances, suggest these configurations:
                 let idx = 0;
                 while (idx < channels.length) {
                     const batch = channels.slice(idx, idx + concurrency);
-                    await Promise.allSettled(batch.map(ch => this.startClassicInstance(ch.instanceName, this.classicChannels.getBackendByInstance(ch.instanceName, fleetBackend), this.classicChannels.getPreTaskCommand(ch.channelId, ch.adapterId), this.classicChannels.getModel(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.model)).catch(err => this.logger.warn({ err, instanceName: ch.instanceName }, "Failed to start classic instance"))));
+                    await Promise.allSettled(batch.map(ch => this.startClassicInstance(ch.instanceName, this.classicChannels.getBackendByInstance(ch.instanceName, fleetBackend), this.classicChannels.getPreTaskCommand(ch.channelId, ch.adapterId), this.classicChannels.getModel(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.model), this.classicChannels.getAutoPauseAfter(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.auto_pause_after)).catch(err => this.logger.warn({ err, instanceName: ch.instanceName }, "Failed to start classic instance"))));
                     idx += concurrency;
                 }
             }
@@ -4150,13 +5091,23 @@ When users create specialized instances, suggest these configurations:
         if (groupId && this.adapter) {
             const total = Object.keys(fleet.instances).length;
             const started = this.daemons.size;
-            const failedNames = Object.keys(fleet.instances).filter(n => !this.daemons.has(n));
+            const allNotRunning2 = Object.keys(fleet.instances).filter(n => !this.daemons.has(n));
+            const pausedNames2 = allNotRunning2.filter(n => this.lifecycle.isPaused(n));
+            const failedNames = allNotRunning2.filter(n => !this.lifecycle.isPaused(n));
             const { createRequire } = await import("node:module");
             const _require2 = createRequire(import.meta.url);
             const agendVersion2 = _require2("../package.json").version ?? "unknown";
-            const restartText = failedNames.length === 0
-                ? t("fleet.ready", started, total, agendVersion2)
-                : t("fleet.ready_with_failed", started, total, agendVersion2, failedNames.join(", "));
+            let restartText;
+            if (failedNames.length === 0 && pausedNames2.length === 0) {
+                restartText = t("fleet.ready", started, total, agendVersion2);
+            }
+            else if (failedNames.length === 0) {
+                restartText = t("fleet.ready", started, total, agendVersion2) + `\n⏸ Paused: ${pausedNames2.join(", ")}`;
+            }
+            else {
+                restartText = t("fleet.ready_with_failed", started, total, agendVersion2, failedNames.join(", "))
+                    + (pausedNames2.length > 0 ? `\n⏸ Paused: ${pausedNames2.join(", ")}` : "");
+            }
             await this.adapter.sendText(String(groupId), restartText, notifyOpts)
                 .catch(e => this.logger.warn({ err: e }, "Failed to post restart completion notification"));
             // Notify each instance's channel — staggered to avoid rate limit storm
@@ -4368,8 +5319,31 @@ When users create specialized instances, suggest these configurations:
             // Fleet API (enriched for agent board)
             if (req.method === "GET" && req.url === "/api/fleet") {
                 const sysInfo = this.getSysInfo();
-                const enriched = sysInfo.instances.map(inst => {
+                const fleetInstances = sysInfo.instances.map(inst => ({ ...inst, classic: false }));
+                const fleetNames = new Set(fleetInstances.map(inst => inst.name));
+                const classicInstances = (this.classicChannels?.getAll() ?? [])
+                    .filter(channel => !fleetNames.has(channel.instanceName))
+                    .map(channel => ({
+                    name: channel.instanceName,
+                    status: this.getInstanceStatus(channel.instanceName),
+                    state: this.getInstanceExecutionState(channel.instanceName),
+                    ipc: this.instanceIpcClients.has(channel.instanceName),
+                    costCents: this.costGuard?.getDailyCostCents(channel.instanceName) ?? 0,
+                    rateLimits: this.statuslineWatcher.getRateLimits(channel.instanceName) ?? null,
+                    classic: true,
+                    classicName: channel.name,
+                    channelId: channel.channelId,
+                    adapterId: channel.adapterId ?? null,
+                }));
+                const enriched = [...fleetInstances, ...classicInstances].map(inst => {
                     const config = this.fleetConfig?.instances[inst.name];
+                    const persistedInboundAt = readLastInboundAt(this.getInstanceDir(inst.name));
+                    const lastActivity = inst.classic
+                        ? Math.max(persistedInboundAt ?? 0, readClassicLastActivityAt(this.dataDir, inst.name) ?? 0) || null
+                        : (persistedInboundAt ?? this.lastActivityMs(inst.name)) || null;
+                    const backend = inst.classic
+                        ? this.classicChannels?.getBackendByInstance(inst.name, this.fleetConfig?.defaults.backend) ?? "claude-code"
+                        : config?.backend ?? "claude-code";
                     // Find claimed tasks for this instance
                     let currentTask = null;
                     try {
@@ -4382,11 +5356,13 @@ When users create specialized instances, suggest these configurations:
                     }
                     return {
                         ...inst,
-                        description: config?.description ?? null,
-                        backend: config?.backend ?? "claude-code",
+                        description: config?.description ?? ("classicName" in inst ? inst.classicName : null),
+                        backend,
                         tool_set: config?.tool_set ?? "full",
                         general_topic: config?.general_topic ?? false,
-                        lastActivity: this.lastActivityMs(inst.name) || null,
+                        // User activity is persisted by the daemon, so both the board and
+                        // auto-pause retain an accurate age across fleet restarts.
+                        lastActivity,
                         currentTask,
                         idle: this.getInstanceIdle(inst.name),
                         state: this.getInstanceExecutionState(inst.name),