@songsid/agend 2.1.12-beta.9 → 2.2.0-alpha.1

package/dist/fleet-manager.js

@@ -1,7 +1,19 @@
+import { SettingsBaselines } from "./settings-baseline.js";
+import { SettingsConfirmationStore } from "./settings-confirmation.js";
+import { SettingsHttpConfirmation } from "./settings-http-confirmation.js";
+import { SettingsControlServer } from "./settings-control.js";
+import { SettingsExecution, settingsRevision, noteSettingsWrite, settingsFileResource, assertSettingsLease, trySettingsLease, waitSettingsLease, settingsUndo, undoSettingsPaths } from "./settings-transaction.js";
+import { performance } from "node:perf_hooks";
+import { gatewayRequestContext } from "./web-request-context.js";
+import { createPublicWebGateway } from "./public-web-gateway.js";
+import { PublicWebLink, publicLinkSettings } from "./public-web-link.js";
+import { TunnelPurposeLane } from "./tunnel/purpose-lane.js";
+import { ManagedTunnel } from "./tunnel/manager.js";
+import { withinBudget } from "./monotonic-budget.js";
 import { measureSyncWork } from "./sync-work-attribution.js";
 import { RuntimeCpuProfiler, ProfileBusyError, profileDuration } from "./runtime-cpu-profile.js";
 import { ProfileControlServer } from "./profile-control.js";
-import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync, accessSync, constants as fsConstants } from "node:fs";
+import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync, accessSync, realpathSync, constants as fsConstants } from "node:fs";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { freemem, totalmem, cpus, homedir } from "node:os";
@@ -34,6 +46,7 @@ import { TmuxManager } from "./tmux-manager.js";
 import { AccessManager } from "./channel/access-manager.js";
 import { IpcClient } from "./channel/ipc-bridge.js";
 import { createAdapter } from "./channel/factory.js";
+import { isWebChannelEcho, WEB_ECHO_PREFIX } from "./web-channel-echo.js";
 import { TelegramAdapter } from "./channel/adapters/telegram.js";
 import { createBackend } from "./backend/factory.js";
 import { readEffortMetadata } from "./backend/effort-metadata.js";
@@ -42,6 +55,7 @@ import { createLogger, rotateLogIfNeeded } from "./logger.js";
 import { processAttachments } from "./channel/attachment-handler.js";
 import { routeToolCall } from "./channel/tool-router.js";
 import { Scheduler } from "./scheduler/index.js";
+import { escapeTelegramHtml, scheduleClock, scheduleRetryLabel } from "./scheduler/retry-label.js";
 import { DEFAULT_SCHEDULER_CONFIG } from "./scheduler/index.js";
 import { TopicCommands, saveCommandForBackend, parseSaveFilename, parsePauseWakeCommand, parseCompactCommand, SAVE_FILENAME_RE, resolveInstanceContext, forgetInstanceContext, readStatuslineModel } from "./topic-commands.js";
 import { DailySummary } from "./daily-summary.js";
@@ -104,14 +118,16 @@ export function applyTaskListCap(tasks, filterAssignee, filterStatus) {
     }
     return tasks;
 }
-import { handleWebRequest, broadcastSseEvent } from "./web-api.js";
+import { handleWebRequest, broadcastSseEvent, SSE_HEARTBEAT_MS } from "./web-api.js";
+import { WebChatHistory, WEB_CHAT_TEXT_MAX, isWebMessageId, newWebMessageId } from "./web-chat-history.js";
+import { publicAttachment, sweepOrphanedUploads, WebFileLedger } from "./web-upload.js";
 import { handleViewRequest, isViewPath } from "./view-api.js";
 import { filterUsageProviders, formatDiscordUsageActivity, getUsageSnapshot, handleUsageRequest, isUsagePath, usageProviderIdForBackend } from "./usage/usage-api.js";
 import { LOGIN_FLOWS, LOGIN_BACKEND_ALIASES } from "./login-flows.js";
 import { LoginSession } from "./login-manager.js";
 import { tightenInstanceDirs } from "./private-dir.js";
 import { decideSlash } from "./slash-authz.js";
-import { commandSpec, decideCommand } from "./command-table.js";
+import { commandSpec, decideCommand, ruleFor } from "./command-table.js";
 import { runVisibilityCommand } from "./cross-instance-notice.js";
 import { UPDATE_COMMAND, installedChannel, isPrereleaseVersion, updateNoticeKey } from "./update-check.js";
 import { LoginController, LOGIN_TOKEN_RESEND_PREFIX, POST_LOGIN_RECOVERY_DEADLINE_MS } from "./login-controller.js";
@@ -126,7 +142,7 @@ import { ClassicChannelManager, getClassicBackendChoices, isSelectableClassicBac
 import { assertExplicitInstanceRemoval } from "./instance-removal.js";
 import { validateFleetConfig } from "./config-validator.js";
 import { isRemovedBackend, removedBackendMessage } from "./backend/removed.js";
-import { presentationState, interactionSummary } from "./interaction-observation.js";
+import { presentationState, interactionSummary, sameInteractionOwner } from "./interaction-observation.js";
 import { readLastInboundAt } from "./daemon.js";
 import { clearPausedMarker, readPausedAt, readPauseReason, writePausedMarker } from "./pause-marker.js";
 import { DEFAULT_WARM_OVERFLOW, WakeCoordinator } from "./wake-coordinator.js";
@@ -136,10 +152,18 @@ import { isFleetStartCommandLine, readProcessCommandLine, releaseProcessFleetLoc
 import { isSetupComplete, markSetupComplete } from "./setup-marker.js";
 import { manualCleanupMessage, reapStaleTunnel } from "./tunnel/lease.js";
 import { buildToolPermissionsNotice } from "./tool-permissions-notice.js";
+import { NeedsYouHub } from "./needs-you-hub.js";
+import { WEB_CHAT_NOTICE, WEB_REMOTE_DOCS_URL, claimNotice, hasWebChat, releaseNotice, upgradeNoticesPath } from "./upgrade-notices.js";
 import { GENERAL_PAUSE_ERROR, isGeneralInstance } from "./general-instance.js";
+import { buildOrgChart } from "./web-org.js";
 import { mayUseTool, resolveToolSet, scheduleOpRefusal, toolForIpcType, toolRefusedMessage, } from "./tool-permissions.js";
-import { decideWebGate, loadOrCreateWebToken, readWebToken } from "./web-auth.js";
+import { authorizeSession, decideWebGate, loadOrCreateWebToken, readWebToken } from "./web-auth.js";
+import { bypassesWebGate, handleAuthRequest, serveSigninPage } from "./auth-api.js";
+import { isWebPageNavigation } from "./web-shell-routes.js";
+import { tokenEpoch, WebSessionStore } from "./web-session.js";
+import { WebLoginCodes, LOGIN_CODE_TTL_MS } from "./web-login.js";
 import { allowedHostNames, applyWebSecurityHeaders, hostnameOf, isHostAllowed, WEB_HOST_REJECTED_MESSAGE } from "./web-host-guard.js";
+import { createPreviewListener, previewAvailability, previewSettings } from "./web-preview.js";
 import { fleetLevelDifferences, fleetLevelSignature } from "./fleet-level-config.js";
 import { checkSelfRestartAllowance, recordSelfRestartAttempt } from "./self-restart-limit.js";
 import { SecretStore } from "./secret-store.js";
@@ -154,6 +178,7 @@ import { mergeBackendOptions, profileKey, profileName, profileOf } from "./class
 import { classifyInstanceChange, CLASSIC_HOT_CONFIG_KEYS, HOT_INSTANCE_CONFIG_KEYS, hotConfigUpdate, } from "./instance-config-impact.js";
 import { formatRestartProgressCompletion, RESTART_PROGRESS_TERMINAL_TIMEOUT_MS, RestartProgress, } from "./restart-progress.js";
 import { launchFullRestartHelper } from "./full-restart.js";
+import { SYSTEMD_RESTART_INDETERMINATE_EXIT_CODE } from "./service-restart-selection.js";
 import { collectRedundantInstanceDefaultPaths } from "./fleet-yaml-slim.js";
 import { StormWindow } from "./storm-window.js";
 import { SpawnGate } from "./spawn-gate.js";
@@ -289,8 +314,42 @@ const MODEL_SELECT_CALLBACK_PREFIX = "model-select:";
 const EFFORT_SELECT_CALLBACK_PREFIX = "effort-select:";
 const INTERACTIVE_ASSIST_CALLBACK_PREFIX = "interactive-assist:";
 const EXIT_RESTART_CALLBACK_PREFIX = "exit-restart:";
+/** #1386: how long a paused instance's marker reason is reused before it is read again (transitions drop it at once). */
+const NEEDS_PAUSE_TTL_MS = 10_000;
 const HANG_CALLBACK_PREFIX = "hang:";
 const CLEAR_CONFIRM_CALLBACK_PREFIX = "clear-confirm:";
+/**
+ * The prompts the web dashboard also offers: the ones about an instance's own health, which a dashboard
+ * user — holding the full-fleet web credential — may answer exactly as a fleet admin on the platform may.
+ * Personal or channel-bound prompts stay where they were asked: a /clear confirmation, login, a Classic
+ * group's approval, tips, and the per-user /model and /effort menus (which are not nonce entries at all).
+ */
+const WEB_MIRRORED_PROMPT_PREFIXES = new Set([
+    HANG_CALLBACK_PREFIX, EXIT_RESTART_CALLBACK_PREFIX, INTERACTIVE_ASSIST_CALLBACK_PREFIX,
+]);
+/**
+ * Where a reply goes on a fleet with no chat platform (web track C4): it is "sent" by being shown in the
+ * web chat, which afterReplyRouted does for every reply. Only what routeToolCall's reply path calls exists
+ * here; the path checks (assertSendable, the file count) are the reply tool's own, run before these.
+ */
+const WEB_ONLY_REPLY_SINK = {
+    type: "web",
+    sendText: async () => ({ chatId: "web", messageId: newWebMessageId() }),
+    sendFile: async () => ({ chatId: "web", messageId: newWebMessageId() }),
+};
+/**
+ * Where an instance-health prompt (hang, clean exit, interactive prompt) is posted on a fleet with no chat platform:
+ * nowhere but the dashboard (#1307 item 6). Posting "succeeds" with an id of its own, so the prompt is armed and
+ * offered on the web exactly as a platform prompt is; there are no platform buttons to edit afterwards, and the
+ * outcome reaches the page through prompt_resolved as for any web-answered prompt.
+ */
+const WEB_ONLY_PROMPT_SINK = {
+    type: "web",
+    notifyAlert: async () => ({ chatId: "web", messageId: newWebMessageId() }),
+    editMessage: async () => { },
+    editMessageRemoveButtons: async () => { },
+    sendText: async () => ({ chatId: "web", messageId: newWebMessageId() }),
+};
 const TIP_DISMISS_CALLBACK_PREFIX = "tip-dismiss:";
 const TIP_UNLOCK_CALLBACK_PREFIX = "tip-unlock:";
 export const LOGIN_CALLBACK_PREFIX = "login:";
@@ -517,6 +576,14 @@ export class FleetManager {
     instanceProgress = new Map();
     /** instanceName → tail of deliveries waiting for its IPC to come back. */
     ipcWaitTails = new Map();
+    webChannelEchoTails = new Map();
+    /**
+     * instanceName → the reservation whose echo callback is currently running.
+     * sendClassicWebEcho fences every per-entry copy against it: no new copy
+     * starts after the ordering budget is gone or the delivery epoch is revoked.
+     * Serialized per instance by the echo tail, so one slot is enough.
+     */
+    webChannelEchoGuards = new Map();
     /** instanceName → restart currently executing; concurrent callers join it. */
     restartsInFlight = new Map();
     /**
@@ -556,6 +623,20 @@ export class FleetManager {
     pendingModelSelects = new Map();
     /** nonce → pending button prompt (hang restart, interactive assist, clean-exit restart). */
     pendingNonceButtons = new Map();
+    /** #1386 "Needs you": the list, its live chat messages and Acknowledge. Started with the fleet (finishStartup). */
+    needsYou = null;
+    /** When the fleet first saw an instance crashed, for its "Needs you" age; cleared when it is not. */
+    needsCrashedAt = new Map();
+    /** Pause reason/time read from the marker, per paused instance; dropped on any attention change of it, and at most
+     *  NEEDS_PAUSE_TTL_MS old — so a recompute does not re-read the file every time (#1386 §4.3). */
+    needsPauseCache = new Map();
+    /**
+     * Clicks that came from the web dashboard (clickWebPrompt). Only that method adds to it, so nothing an
+     * adapter emits — whatever fields its payload carries — can claim a dashboard click's authority.
+     */
+    webPromptClicks = new WeakSet();
+    /** The web clicks consumeNonceCallback actually claimed (the others were refused or lost a race). */
+    webPromptClaims = new WeakSet();
     // Model failover state
     failoverActive = new Map(); // instance → current failover model
     // IPC reconnect: tracks instances being intentionally stopped (skip reconnect)
@@ -609,6 +690,12 @@ export class FleetManager {
     collabInstances = new Set();
     // Health endpoint
     healthServer = null;
+    /** #1306: the preview listener (health_port + 1 by default), and whether it is listening. */
+    previewListener = null;
+    previewListening = false;
+    /** The ports the preview listener was started for, and the inputs it was built from (a reload compares them). */
+    previewPorts = null;
+    previewInputs = "";
     healthPortRetried = false;
     updateCheckTimer = null;
     updateProgressTimer = null;
@@ -641,12 +728,228 @@ export class FleetManager {
     mirrorTimer = null;
     // Web UI: SSE clients + auth token
     sseClients = new Set();
+    /** The web chat's recent messages: what `/ui/history` serves and what a reconnecting SSE stream is sent. */
+    webChatHistory = new WebChatHistory();
+    /** Uploaded files and the files the dashboard may fetch back (uploads, reply attachments). */
+    webFiles = new WebFileLedger();
     /**
      * Read from disk on every access rather than cached at startup: `agend
      * web-token rotate` runs in a separate process, and a cached copy would keep
      * authorizing revoked links and cookies until the fleet restarted.
      */
+    settingsGeneration = 0;
+    settingsRuntimeRevision = 0;
+    settingsConfirmation = null;
+    settingsControl = null;
+    settingsJobSettlements = new Map();
+    classicSettingsOwners = new WeakMap();
+    queueSettingsOperation(job, resources, execution, run) {
+        const generation = this.settingsGeneration;
+        const owned = execution ?? new SettingsExecution({ current: () => !this.shuttingDown && this.settingsGeneration === generation,
+            snapshot: () => [this.settingsRuntimeRevision, this.fleetConfig, settingsRevision(join(this.dataDir, ".env"))] });
+        const done = Promise.resolve().then(async () => {
+            let lease = null, admitted = false;
+            try {
+                lease = await waitSettingsLease(resources, () => owned.current(), performance.now() + owned.remainingMs, owned.owner);
+                owned.assert();
+                admitted = true;
+                await run(owned);
+                if (["applied", "applied_next_use", "reloaded", "restart_required"].includes(job.result) && !owned.completed)
+                    throw new Error("missing_settings_receipt");
+            }
+            catch {
+                job.status = "done";
+                job.finishedAt = Date.now();
+                job.result = admitted ? "rollback_failed" : "rolled_back";
+                job.error = admitted ? "operation did not provide a committed receipt; operator attention required" : "operation was not admitted";
+            }
+            finally {
+                lease?.release();
+                if (!execution)
+                    owned.close();
+                if ("envKey" in job) {
+                    if (this.providerSecretInFlight.get(job.envKey) === job.id)
+                        this.providerSecretInFlight.delete(job.envKey);
+                }
+                else {
+                    if (this.connectionSecretInFlight.get(job.connectionId) === job.id)
+                        this.connectionSecretInFlight.delete(job.connectionId);
+                    if (this.connectionBindingInFlight.get(job.connectionId) === job.id)
+                        this.connectionBindingInFlight.delete(job.connectionId);
+                }
+            }
+        });
+        this.settingsJobSettlements ??= new Map();
+        this.settingsJobSettlements.set(job.id, done);
+        while (this.settingsJobSettlements.size > 128) {
+            const first = this.settingsJobSettlements.keys().next().value;
+            const record = this.providerSecretJobs.get(first) ?? this.connectionSecretJobs.get(first) ?? this.connectionBindingJobs.get(first);
+            if (record?.status !== "done")
+                break;
+            this.settingsJobSettlements.delete(first);
+        }
+    }
+    settingsGate() {
+        if (this.settingsConfirmation)
+            return this.settingsConfirmation;
+        const generation = this.settingsGeneration;
+        const current = () => !this.shuttingDown && this.settingsGeneration === generation;
+        const baselines = new SettingsBaselines({ dataDir: this.dataDir, configPath: () => this.configPath,
+            config: () => this.fleetConfig, current: () => [this.settingsGeneration, this.settingsRuntimeRevision, this.shuttingDown],
+            proof: (kind, target, id, binding, key) => {
+                const map = kind === "provider" ? this.providerSecretChallenges : kind === "binding" ? this.connectionBindingChallenges : this.connectionSecretChallenges;
+                const proof = map.get(id);
+                if (!proof || proof.sessionBinding !== binding || proof.idempotencyKey !== key
+                    || ("specId" in proof ? proof.specId : proof.connectionId) !== target
+                    || proof.generation !== ("envKey" in proof ? this.providerSecretGeneration(proof.envKey) : this.secureConnectionGeneration(target)))
+                    return null;
+                const remainingMs = proof.deadline === undefined ? proof.expiresAt - Date.now() : proof.deadline - performance.now();
+                if (remainingMs <= 0)
+                    return null;
+                const envKey = "envKey" in proof ? proof.envKey : this.secureConnectionChannel(target)?.bot_token_env ?? "";
+                return { key: envKey, secret: "secret" in proof ? proof.secret : "", previous: process.env[envKey], remainingMs,
+                    ...("binding" in proof ? { binding: proof.binding } : {}),
+                    discard: () => { if (map.get(id) === proof)
+                        map.delete(id); if ("secret" in proof)
+                        proof.secret = ""; } };
+            } });
+        const store = new SettingsConfirmationStore({
+            audit: (event, fields) => this.logger.info({ event: `settings_confirmation.${event}`, ...fields }, "Settings confirmation audit"),
+            notify: view => view.state === "pending" ? this.promptSettingsChange(store, view) : Promise.resolve(),
+        });
+        const gate = new SettingsHttpConfirmation(store, {
+            principal: req => {
+                const auth = authorizeSession(req, this.webToken, this.webSessions, { touch: false });
+                if (auth.kind !== "ok" || !current())
+                    return null;
+                const record = auth.session, sessions = this.webSessions, exposure = gatewayRequestContext(req);
+                return { id: record.idHash, label: record.label, source: exposure ? "public_link" : "web_session",
+                    current: () => current() && sessions === this.webSessions && !!this.webToken
+                        && sessions.isCurrent(record, tokenEpoch(this.webToken)) && (!exposure || exposure.isCurrent()) };
+            }, baseline: () => baselines.read(), snapshot: () => baselines.snapshot(),
+            job: async (id) => {
+                const settlement = this.settingsJobSettlements.get(id);
+                if (!settlement)
+                    return false;
+                await settlement;
+                const job = this.providerSecretJobs.get(id) ?? this.connectionSecretJobs.get(id) ?? this.connectionBindingJobs.get(id);
+                return !!job && ["applied", "applied_next_use", "reloaded"].includes(job.result);
+            },
+        });
+        this.settingsConfirmation = gate;
+        return gate;
+    }
+    async promptSettingsChange(store, view) {
+        const generation = this.settingsGeneration;
+        const excluded = new Set(store.affectedConnections(view.id));
+        for (const [name, config] of Object.entries(this.fleetConfig?.instances ?? {})) {
+            if (!config.general_topic)
+                continue;
+            const adapterId = this.getInstanceAdapterId(name), adapter = this.getAdapterForInstance(name);
+            const general = this.daemons.get(name);
+            if (!adapterId || !adapter || !general || excluded.has(adapterId) || !this.hasFleetAdmins(adapterId))
+                continue;
+            const chatId = this.getGroupIdForInstance(name), topic = String(config.topic_id ?? "");
+            if (!chatId || !topic)
+                continue;
+            let retired = false, attached = false;
+            const postingDeadline = performance.now() + Math.min(5000, view.remaining_ms);
+            const current = () => !retired && (attached || performance.now() < postingDeadline) && !this.shuttingDown && this.settingsGeneration === generation
+                && this.fleetConfig?.instances[name]?.general_topic === true
+                && this.daemons.get(name) === general && !this.ipcStoppingInstances.has(name)
+                && this.adapterState.get(adapterId)?.status === "connected"
+                && this.getInstanceAdapterId(name) === adapterId && this.getAdapterForInstance(name) === adapter
+                && this.getGroupIdForInstance(name) === chatId && String(this.fleetConfig?.instances[name]?.topic_id ?? "") === topic
+                && this.hasFleetAdmins(adapterId);
+            if (!current())
+                continue;
+            try {
+                const posted = this.postNonceButtonPromptOrThrow({ prefix: "settings-confirm:", alertType: "clear_confirm",
+                    instanceName: name, adapterId, adapter, chatId, threadId: topic,
+                    message: `🔒 Settings change awaiting fleet-admin confirmation\nSource: ${view.source}\nRequester: ${view.requested_by}\n${view.summary.join("\n")}`,
+                    choices: [{ action: "confirm", label: "Confirm" }, { action: "reject", label: "Reject" }],
+                    expiredText: "Settings confirmation is no longer pending.", timeoutMs: view.remaining_ms,
+                    extra: { pendingChangeId: view.id, confirmationCurrent: current },
+                });
+                void posted.then(nonce => {
+                    if (!retired)
+                        return;
+                    const entry = this.pendingNonceButtons.get(nonce);
+                    if (entry?.pendingChangeId !== view.id)
+                        return;
+                    this.pendingNonceButtons.delete(nonce);
+                    clearTimeout(entry.timer);
+                    void this.retireNonceButtons(entry, entry.messageId ?? "", "Settings confirmation delivery expired.");
+                }, () => { });
+                const nonce = await withinBudget(posted, postingDeadline);
+                attached = true;
+                const retire = () => {
+                    const entry = this.pendingNonceButtons.get(nonce);
+                    if (!entry || entry.pendingChangeId !== view.id)
+                        return;
+                    this.pendingNonceButtons.delete(nonce);
+                    clearTimeout(entry.timer);
+                    void this.retireNonceButtons(entry, entry.messageId ?? "", "Settings confirmation is no longer pending.");
+                };
+                if (!current()) {
+                    retire();
+                    continue;
+                }
+                if (store.attachPrompt(view.id, retire))
+                    return;
+            }
+            catch {
+                retired = true;
+                this.logger.info({ id: view.id, adapterId }, "Settings confirmation prompt unavailable; trying another General or host CLI");
+            }
+        }
+        // No platform confirmation was reachable. Host inspection is still required.
+        this.logger.info({ id: view.id }, "Settings change requires local `agend settings confirm <id>`");
+    }
+    async handleSettingsChangeCallback(data, adapterId, adapter) {
+        const result = this.consumeNonceCallback("settings-confirm:", /^settings-confirm:([0-9a-f]{32}):(confirm|reject)$/, data, adapterId, adapter);
+        if (!result)
+            return false;
+        if (result === "consumed")
+            return true;
+        const { entry, action } = result;
+        try {
+            const view = await this.settingsGate().store.decide(entry.pendingChangeId, action, {
+                label: `fleet admin ${data.userId}`,
+                current: () => entry.confirmationCurrent?.() === true && this.getAdapterForInstance(entry.instanceName) === entry.adapter
+                    && !!data.userId && this.isFleetAdmin(data.userId, entry.adapterId),
+            });
+            await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, view.outcome?.message ?? "Settings change is applying.");
+        }
+        catch {
+            await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, "Settings confirmation rejected or expired.");
+        }
+        return true;
+    }
+    async startSettingsConfirmationControl() {
+        if (this.shuttingDown || this.settingsControl)
+            return;
+        const generation = this.settingsGeneration, control = new SettingsControlServer(this.dataDir, this.settingsGate().store, () => !this.shuttingDown && this.settingsGeneration === generation);
+        this.settingsControl = control;
+        try {
+            await control.listen();
+        }
+        catch (err) {
+            if (this.settingsControl === control)
+                this.settingsControl = null;
+            throw err;
+        }
+    }
     get webToken() { return readWebToken(this.dataDir); }
+    /**
+     * Server-side web sessions (see web-session.ts). Created with the token, not per
+     * request: they are persisted, and a restart must find them again.
+     */
+    webSessions = null;
+    /** Heartbeat of the dashboard's SSE stream; public so a test can shorten it. */
+    sseHeartbeatMs = SSE_HEARTBEAT_MS;
+    /** The dashboard's login codes. Memory only: a code that outlives the process is a code nobody can prove was not copied. */
+    webLoginCodes = null;
     /**
      * Set while a Settings apply job is driving the reconcile. The reconcile
      * stays the single doer; it just says out loud what it is doing to whom, so
@@ -664,7 +967,6 @@ export class FleetManager {
     /** Set when the file on disk and the in-memory config disagree on a
      * startup-only key at startup. See checkStartupSignatureConsistency(). */
     fleetSignatureMismatch = null;
-    viewToken = null;
     healthServerListening = false;
     constructor(dataDir) {
         this.dataDir = dataDir;
@@ -674,7 +976,8 @@ export class FleetManager {
             FleetManager.sighupHandlerInstalled = true;
         }
         this.stormWindow = new StormWindow();
-        this.memoryPressure = new MemoryPressure({ onSample: snapshot => this.reportMemoryPressure(snapshot) });
+        this.memoryPressure = new MemoryPressure({ onSample: snapshot => this.reportMemoryPressure(snapshot),
+            onDarwinUnknown: memory => this.logger.info({ pressureRaw: memory?.darwinPressureRaw ?? null }, "macOS kernel memory pressure unknown — no notice or admission restriction") });
         this.spawnGate = new SpawnGate({
             storm: this.stormWindow,
             memoryPressure: this.memoryPressure,
@@ -706,6 +1009,9 @@ export class FleetManager {
                 if (target)
                     this.wakeCoordinator?.noteDelivered(target);
             }
+            if (event.deliveryId && (event.state === "failed" || event.state === "uncertain" || event.state === "delivered")) {
+                this.needsYou?.poke();
+            }
             if (event.deliveryId && (event.state === "failed" || event.state === "uncertain")) {
                 const row = outbox.get(event.deliveryId);
                 if (row && row.kind !== "delivery_outcome_notice" && row.kind !== "post_restart_outcome_notice") {
@@ -716,7 +1022,7 @@ export class FleetManager {
             }
         });
         outbox.on("generation_recovered", () => this.scheduleDeliveryOutboxPump());
-        this.replyObligationTimer = setInterval(() => this.sweepReplyObligations(), REPLY_OBLIGATION_SWEEP_MS);
+        this.replyObligationTimer = setInterval(() => measureSyncWork("fleet.replyObligationSweep", () => this.sweepReplyObligations()), REPLY_OBLIGATION_SWEEP_MS);
         this.replyObligationTimer.unref?.();
         // #856: the text the target daemon received differs from what was
         // admitted. Transport has never been seen to do this; a warning and the
@@ -728,6 +1034,8 @@ export class FleetManager {
         this.wakeCoordinator.start();
         outbox.on("expired", (event) => {
             this.scheduleDeliveryOutboxPump();
+            if (event.count)
+                this.needsYou?.poke(); // #1386: rows that expired failed — they wait on someone now
             this.wakeCoordinator?.kick();
             if (event.count)
                 this.notifyFleetError(t("delivery.expired", event.count, event.uncertain ?? 0));
@@ -834,7 +1142,8 @@ export class FleetManager {
         }
         this.deliveryPumpTimer = setTimeout(() => {
             this.deliveryPumpTimer = null;
-            void this.runDeliveryOutboxPump();
+            // The pump's body never awaits: the whole run is one synchronous stretch (#1235 attribution).
+            void measureSyncWork("fleet.deliveryPump", () => this.runDeliveryOutboxPump());
         }, Math.max(0, delayMs));
         this.deliveryPumpTimer.unref?.();
     }
@@ -1068,9 +1377,7 @@ export class FleetManager {
         }
         const changed = snapshot.level !== this.memoryLogLevel;
         if (this.memoryPressure.advisoryOnly()) {
-            // macOS (#1256): the sample is kept in the log for calibration, but nothing is sent to a channel.
-            if (changed)
-                this.logger.info({ hostMemory: snapshot }, "Host memory sample (macOS: logged only — no notice, no spawn throttling)");
+            // The sampler logs the unknown kernel value once per lifecycle; no warning/cooldown here.
             this.memoryLogLevel = snapshot.level;
             return;
         }
@@ -1095,7 +1402,10 @@ export class FleetManager {
         if (!escalation && this.memoryNoticeAt !== null && now - this.memoryNoticeAt < 10 * 60_000)
             return;
         const size = (bytes) => bytes === null ? t("memory.unknown") : `${Math.round(bytes / 1024 / 1024)} MiB`;
-        const text = t("memory.pressure", t(snapshot.memory.availableKind === "available" ? "memory.available" : "memory.free", size(snapshot.memory.availableBytes)), size(snapshot.memory.swapFreeBytes), t(snapshot.level === "critical" ? "memory.holding" : "memory.slowing"));
+        const action = t(snapshot.level === "critical" ? "memory.holding" : "memory.slowing");
+        const text = this.memoryPressure.platform === "darwin"
+            ? t("memory.kernel_pressure", snapshot.memory.darwinPressureLevel ?? t("memory.unknown"), size(snapshot.memory.availableBytes), size(snapshot.memory.swapFreeBytes), action)
+            : t("memory.pressure", t(snapshot.memory.availableKind === "available" ? "memory.available" : "memory.free", size(snapshot.memory.availableBytes)), size(snapshot.memory.swapFreeBytes), action);
         if (this.notifyFleetError(text, { throttle: false })) {
             this.memoryNoticeAt = now;
             this.memoryNoticeLevel = snapshot.level;
@@ -1218,6 +1528,7 @@ export class FleetManager {
     }
     finishStartup() {
         this.startupComplete = true;
+        this.startNeedsYou();
         // Resolve whatever a previous run — or a setup host that crashed — left
         // behind. A tunnel nobody is tracking is a public entrance nobody is
         // watching, and the fleet starting is the moment there is finally a process
@@ -1381,6 +1692,7 @@ export class FleetManager {
         const loaded = loadFleetConfig(configPath);
         this.assertProviderSecretEnvKeys(loaded);
         this.rawFleetConfig = raw;
+        this.settingsRuntimeRevision++;
         this.fleetConfig = loaded;
         this.savedFleetConfigSnapshot = structuredClone(this.fleetConfig);
         this.warnAboutRemovedLoginMode(loaded);
@@ -1542,6 +1854,11 @@ export class FleetManager {
                 await data.respond(t("instance.not_found", requested));
                 return;
             }
+            // #754 audit: a General speaks for its own bot's instances only.
+            if (this.getInstanceAdapterId(requested) !== adapterId) {
+                await data.respond(t("instance.other_bot", requested));
+                return;
+            }
             target = requested;
         }
         await data.respond(await this.topicCommands.runPauseWake(target, action));
@@ -2063,6 +2380,9 @@ export class FleetManager {
             // asks "is anyone still reporting", which only the receiver can date.
             receivedAt: now,
         });
+        // The dashboard's "working" line and its Stop button follow the edges, not the heartbeat.
+        if (previous?.state !== state)
+            this.emitSseEvent("activity", { instance: name, state: this.getInstanceExecutionState(name) });
         for (const check of this.instanceIdleWaiters.get(name) ?? [])
             check();
         // warm_cap: a fresh transition into idle may free this instance for eviction,
@@ -2105,6 +2425,16 @@ export class FleetManager {
         this.cancelButtonIdleRetireTimers.set(name, timer);
     }
     cacheInstanceProcessStatus(name, status) {
+        // #1386: every transition into crashed is a new occurrence (a new "Needs you" item), and every other status ends
+        // the previous one — at once, not when the coalesced collector next runs: running then crashed in one IPC chunk is
+        // a second crash (#1398 review r2). The collector still recovers a missed running event.
+        if (status === "crashed") {
+            if (this.instanceProcessStatus.get(name) !== "crashed")
+                this.needsCrashedAt.set(name, Date.now());
+        }
+        else
+            this.needsCrashedAt.delete(name);
+        this.needsYou?.poke();
         if (status === "running") {
             this.instanceProcessStatus.delete(name);
             // A prior crash-loop marker is one-shot.  Successful respawn is the
@@ -2122,7 +2452,8 @@ export class FleetManager {
         this.instanceProcessStatus.set(name, status);
         // Never display the last ready prompt as current execution state after its
         // owning CLI process has exited.
-        this.instanceStateCache.delete(name);
+        if (this.instanceStateCache.delete(name))
+            this.emitSseEvent("activity", { instance: name, state: null });
         for (const check of this.instanceIdleWaiters.get(name) ?? [])
             check();
     }
@@ -2251,11 +2582,11 @@ export class FleetManager {
                 finish(false);
         });
     }
-    async deliverWithIdleGate(instanceName, payload, timeoutMs, deliveryEpoch, noInlineWake = false) {
-        if (this.shuttingDown || !this.isDeliveryEpochCurrent(instanceName, deliveryEpoch))
+    async deliverWithIdleGate(instanceName, payload, timeoutMs, deliveryEpoch, noInlineWake = false, stillCurrent) {
+        if (this.shuttingDown || !this.deliveryCurrent(instanceName, deliveryEpoch, stillCurrent))
             return false;
         await this.holdDeliveryForStorm(instanceName, deliveryEpoch);
-        if (this.shuttingDown || !this.isDeliveryEpochCurrent(instanceName, deliveryEpoch))
+        if (this.shuttingDown || !this.deliveryCurrent(instanceName, deliveryEpoch, stillCurrent))
             return false;
         let idleObservedAfter = this.lastDeliveryAt.get(instanceName) ?? 0;
         if (this.lifecycle.isPaused(instanceName) && noInlineWake) {
@@ -2267,7 +2598,7 @@ export class FleetManager {
         if (this.lifecycle.isPaused(instanceName)) {
             const wakeStartedAt = Date.now();
             await this.explicitWake(instanceName, 30_000);
-            if (!this.isDeliveryEpochCurrent(instanceName, deliveryEpoch))
+            if (!this.deliveryCurrent(instanceName, deliveryEpoch, stillCurrent))
                 return false;
             // Waking added one to the warm count — make room by evicting a different
             // LRU idle instance (never this one; it's about to work).
@@ -2275,23 +2606,23 @@ export class FleetManager {
             // Never satisfy a post-wake gate from a stale pre-pause cache entry.
             idleObservedAfter = Math.max(idleObservedAfter, wakeStartedAt);
         }
-        const idle = await this.waitForInstanceIdle(instanceName, timeoutMs, idleObservedAfter, () => !this.isDeliveryEpochCurrent(instanceName, deliveryEpoch));
-        if (!this.isDeliveryEpochCurrent(instanceName, deliveryEpoch)) {
+        const idle = await this.waitForInstanceIdle(instanceName, timeoutMs, idleObservedAfter, () => !this.deliveryCurrent(instanceName, deliveryEpoch, stillCurrent));
+        if (!this.deliveryCurrent(instanceName, deliveryEpoch, stillCurrent)) {
             this.logger.info({ instanceName }, "Pending delivery dropped by user cancel");
             return false;
         }
         // A server crash can land while waitForInstanceIdle is pending. Re-check
         // immediately before the old timeout path would force text into a boot UI.
         await this.holdDeliveryForStorm(instanceName, deliveryEpoch);
-        if (this.shuttingDown || !this.isDeliveryEpochCurrent(instanceName, deliveryEpoch))
+        if (this.shuttingDown || !this.deliveryCurrent(instanceName, deliveryEpoch, stillCurrent))
             return false;
         if (!idle) {
             this.logger.warn({ instanceName, timeoutMs }, "Idle gate timed out; forcing delivery");
         }
-        const sent = await this.sendWhenConnected(instanceName, payload, deliveryEpoch);
+        const sent = await this.sendWhenConnected(instanceName, payload, deliveryEpoch, stillCurrent);
         if (!sent)
             return false;
-        if (this.isDeliveryEpochCurrent(instanceName, deliveryEpoch)) {
+        if (this.deliveryCurrent(instanceName, deliveryEpoch, stillCurrent)) {
             this.lastDeliveryAt.set(instanceName, Date.now());
         }
         return true;
@@ -2318,8 +2649,8 @@ export class FleetManager {
      * instance, *including* when the socket happens to be up: otherwise a message
      * arriving after the reconnect could overtake one that has been waiting for it.
      */
-    async sendWhenConnected(instanceName, payload, deliveryEpoch = this.getDeliveryEpoch(instanceName)) {
-        if (!this.isDeliveryEpochCurrent(instanceName, deliveryEpoch))
+    async sendWhenConnected(instanceName, payload, deliveryEpoch = this.getDeliveryEpoch(instanceName), stillCurrent) {
+        if (!this.deliveryCurrent(instanceName, deliveryEpoch, stillCurrent))
             return false;
         const queued = this.ipcWaitTails.get(instanceName);
         if (!queued) {
@@ -2330,9 +2661,9 @@ export class FleetManager {
         const attempt = (queued ?? Promise.resolve())
             .catch(() => { })
             .then(() => {
-            if (!this.isDeliveryEpochCurrent(instanceName, deliveryEpoch))
+            if (!this.deliveryCurrent(instanceName, deliveryEpoch, stillCurrent))
                 return false;
-            return this.sendAfterIpcReturns(instanceName, payload, deliveryEpoch);
+            return this.sendAfterIpcReturns(instanceName, payload, deliveryEpoch, stillCurrent);
         });
         // The chain stores a settled-either-way promise so one failed delivery cannot
         // wedge every later one, and so `queued` above is safe to await unguarded.
@@ -2350,11 +2681,11 @@ export class FleetManager {
         }
     }
     /** Poll for the instance's IPC to come back, then send. Throws if it does not. */
-    async sendAfterIpcReturns(instanceName, payload, deliveryEpoch = this.getDeliveryEpoch(instanceName)) {
+    async sendAfterIpcReturns(instanceName, payload, deliveryEpoch = this.getDeliveryEpoch(instanceName), stillCurrent) {
         const deadline = Date.now() + IPC_RECONNECT_GRACE_MS;
         let warned = false;
         for (;;) {
-            if (!this.isDeliveryEpochCurrent(instanceName, deliveryEpoch))
+            if (!this.deliveryCurrent(instanceName, deliveryEpoch, stillCurrent))
                 return false;
             // Re-read every round: a reconnect replaces the IpcClient object entirely,
             // so a cached reference would stay dead forever.
@@ -2371,10 +2702,168 @@ export class FleetManager {
             await new Promise(resolve => setTimeout(resolve, IPC_RECONNECT_POLL_MS));
         }
     }
+    /**
+     * Reserve the display echo before IPC handoff: a fast reply cannot overtake
+     * it. The web request settles admission without awaiting the platform POST.
+     * Only accepted messages send an echo; failures release replies normally.
+     * Each reservation has a 5s total monotonic ordering budget (queue/admission
+     * included). Expiry drops unstarted copies and releases replies. An adapter
+     * request already in flight may land late, but cannot retain the ordering lane.
+     */
+    /**
+     * Post an owner web-chat echo to every ClassicBot channel entry opted in
+     * for `instance` (#1320 part B). Per entry: the channel's own adapter, no
+     * thread, mention suppression on. Returns the number of channels posted
+     * to. Failures are per-entry warn-and-continue — a failed echo never fails
+     * the web send. Entries without `web_echo: true` are never touched.
+     *
+     * Every copy is fenced at start time: an entry whose explicit world is
+     * gone is skipped (only legacy adapterId-less entries fall back to the
+     * primary adapter); when running under a reservation, an exhausted
+     * ordering budget or a revoked delivery epoch stops the loop, and each
+     * entry is re-resolved against current registration so a removed opt-in
+     * or a rebound adapter is never posted through a stale route. A copy
+     * already in flight may still land late — the contract permits that.
+     */
+    async sendClassicWebEcho(instance, text) {
+        const guard = this.webChannelEchoGuards.get(instance);
+        const handled = new Set();
+        let posted = 0;
+        for (;;) {
+            if (guard) {
+                if (performance.now() >= guard.deadlineAt) {
+                    this.logger.warn({ instance, posted }, "Classic web echo stopped: ordering budget exhausted");
+                    break;
+                }
+                if (!this.isDeliveryEpochCurrent(instance, guard.epoch)) {
+                    this.logger.warn({ instance, posted }, "Classic web echo stopped: delivery epoch revoked");
+                    break;
+                }
+            }
+            const entry = (this.classicChannels?.getAll() ?? [])
+                .find(candidate => candidate.instanceName === instance && candidate.webEcho === true
+                && !handled.has(`${candidate.channelId}#${candidate.adapterId ?? ""}`));
+            if (!entry)
+                break;
+            handled.add(`${entry.channelId}#${entry.adapterId ?? ""}`);
+            const worldAdapter = entry.adapterId ? this.worlds.get(entry.adapterId)?.adapter : undefined;
+            if (entry.adapterId && !worldAdapter) {
+                this.logger.warn({ instance, channelId: entry.channelId, adapterId: entry.adapterId }, "Classic web echo skipped: adapter world unavailable");
+                continue;
+            }
+            const adapter = worldAdapter ?? this.adapter;
+            try {
+                if (!adapter?.sendText)
+                    continue;
+                await adapter.sendText(entry.channelId, text, { format: "text", allowedMentions: { parse: [] } });
+                ClassicChannelManager.logMessage(instance, "web-user", text, new Date());
+                posted++;
+            }
+            catch (err) {
+                this.logger.warn({ err, instance, channelId: entry.channelId }, "Classic web echo failed");
+            }
+        }
+        return posted;
+    }
+    reserveWebChannelEcho(instanceName, sendEcho) {
+        const epoch = this.getDeliveryEpoch(instanceName);
+        const deadlineAt = performance.now() + 5_000;
+        let decide;
+        const admission = new Promise(resolve => { decide = resolve; });
+        const queue = this.webChannelEchoTails.get(instanceName)
+            ?? { tail: Promise.resolve(), pending: new Set() };
+        const previous = queue.tail;
+        let resolveDone;
+        const tail = new Promise(resolve => { resolveDone = resolve; });
+        let done = false, expired = false;
+        let timer;
+        let guard;
+        const finish = () => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            queue.pending.delete(entry);
+            if (guard && this.webChannelEchoGuards.get(instanceName) === guard) {
+                this.webChannelEchoGuards.delete(instanceName);
+            }
+            resolveDone();
+        };
+        const entry = { started: false, drop: () => {
+                this.logger.warn({ instanceName }, "Queued web channel echo dropped after ordering timeout");
+                finish();
+            } };
+        const expire = () => {
+            if (done)
+                return;
+            expired = true;
+            this.logger.warn({ instanceName, inFlight: entry.started }, "Web channel echo ordering timed out");
+            finish();
+            // Do not post copies that were queued behind an ambiguous platform send.
+            for (const pending of queue.pending)
+                if (!pending.started)
+                    pending.drop();
+        };
+        const checkDeadline = () => {
+            if (done)
+                return;
+            const remaining = deadlineAt - performance.now();
+            if (remaining <= 0)
+                expire();
+            else
+                timer = setTimeout(checkDeadline, Math.ceil(remaining));
+        };
+        queue.pending.add(entry);
+        queue.tail = tail;
+        this.webChannelEchoTails.set(instanceName, queue);
+        checkDeadline();
+        void Promise.all([previous, admission]).then(([, accepted]) => {
+            if (done)
+                return;
+            if (!accepted || !this.isDeliveryEpochCurrent(instanceName, epoch)) {
+                finish();
+                return;
+            }
+            // A delayed timer callback must not admit an already expired copy.
+            if (performance.now() >= deadlineAt) {
+                expire();
+                return;
+            }
+            entry.started = true;
+            guard = { epoch, deadlineAt };
+            this.webChannelEchoGuards.set(instanceName, guard);
+            let request;
+            try {
+                request = Promise.resolve(sendEcho());
+            }
+            catch (err) {
+                request = Promise.reject(err);
+            }
+            void request.then(() => {
+                if (expired)
+                    this.logger.warn({ instanceName }, "Web channel echo completed late after ordering timeout");
+                finish();
+            }, err => {
+                this.logger.warn({ err, instanceName }, expired
+                    ? "Web channel echo failed late after ordering timeout" : "Web channel echo failed");
+                finish();
+            });
+        });
+        void tail.then(() => {
+            if (this.webChannelEchoTails.get(instanceName) === queue && queue.tail === tail && queue.pending.size === 0) {
+                this.webChannelEchoTails.delete(instanceName);
+            }
+        });
+        return decide;
+    }
     /** Whether this target already has an ordinary non-user delivery in its FIFO. */
     hasPendingIdleGatedDelivery(instanceName) {
         return this.idleGatedDeliveryTails.has(instanceName);
     }
+    /** The running launch's own steer capability (#1405); undefined for a backend without one, or no running Daemon. */
+    instanceLaunchSupportsSteer(instanceName) {
+        return this.daemons.get(instanceName)?.launchSupportsSteer();
+    }
     /** Single delivery facade: wake paused CLIs and serialize non-user work behind idle. */
     async deliverToInstance(instanceName, payload, options = {}) {
         const deliveryEpoch = this.getDeliveryEpoch(instanceName);
@@ -2394,22 +2883,22 @@ export class FleetManager {
                     return false;
                 }
                 await this.explicitWake(instanceName, 30_000);
-                if (!this.isDeliveryEpochCurrent(instanceName, deliveryEpoch))
+                if (!this.deliveryCurrent(instanceName, deliveryEpoch, options.stillCurrent))
                     return false;
                 this.enforceWarmCap(instanceName); // woke one → evict a different LRU idle if over cap
             }
-            const sent = await this.sendWhenConnected(instanceName, deliveryPayload, deliveryEpoch);
+            const sent = await this.sendWhenConnected(instanceName, deliveryPayload, deliveryEpoch, options.stillCurrent);
             if (!sent)
                 return false;
             // A cross-instance item arriving before the daemon observes this turn as
             // working must not trust the stale idle snapshot from before the send.
-            if (this.isDeliveryEpochCurrent(instanceName, deliveryEpoch)) {
+            if (this.deliveryCurrent(instanceName, deliveryEpoch, options.stillCurrent)) {
                 this.lastDeliveryAt.set(instanceName, Date.now());
             }
             return true;
         }
         const previous = this.idleGatedDeliveryTails.get(instanceName) ?? Promise.resolve();
-        const delivery = previous.catch(() => { }).then(() => this.deliverWithIdleGate(instanceName, deliveryPayload, options.idleTimeoutMs ?? 60_000, deliveryEpoch, options.noInlineWake === true));
+        const delivery = previous.catch(() => { }).then(() => this.deliverWithIdleGate(instanceName, deliveryPayload, options.idleTimeoutMs ?? 60_000, deliveryEpoch, options.noInlineWake === true, options.stillCurrent));
         this.idleGatedDeliveryTails.set(instanceName, delivery);
         try {
             return await delivery;
@@ -2420,14 +2909,40 @@ export class FleetManager {
             }
         }
     }
-    /** Fleet admin is an explicit config allowlist entry, not merely an open/paired user. */
+    /**
+     * The fleet-admin list of exactly this adapter (#754): its `access.allowed_users`, read from fleet.yaml. An adapter
+     * id that matches no configured channel and no running adapter has NO list — it is never answered with the primary
+     * channel's, as `getChannelConfig` would. No id at all means the primary adapter, a single-adapter fleet's only one.
+     */
+    adminListOf(adapterId) {
+        const channels = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+        const id = adapterId ?? this.getPrimaryAdapterId();
+        if (!id)
+            return null;
+        const config = channels.find(ch => (ch.id ?? ch.type) === id) ?? this.worlds.get(id)?.channelConfig;
+        return config ? (config.access?.allowed_users ?? []).map(String) : null;
+    }
+    /**
+     * The one fleet-admin gate (#754): is this user an admin of the adapter that OWNS what they are acting on — the
+     * target instance's or General's adapter, never merely the one the request arrived on. An empty list means nobody
+     * (`disabled`, so the reply can say admin commands are off); an unknown adapter means nobody either (`denied`).
+     * Fleet admin is an explicit config entry: a paired or open-mode user is not one.
+     */
+    adminGate(userId, ownerAdapterId) {
+        const list = this.adminListOf(ownerAdapterId);
+        if (!list)
+            return "denied";
+        if (list.length === 0)
+            return "disabled";
+        return list.includes(String(userId)) ? "ok" : "denied";
+    }
+    /** Fleet admin is an explicit config allowlist entry, not merely an open/paired user. See adminGate. */
     isFleetAdmin(userId, adapterId) {
-        const allowed = this.getChannelConfig(adapterId)?.access?.allowed_users ?? [];
-        return allowed.some(entry => String(entry) === String(userId));
+        return this.adminGate(userId, adapterId) === "ok";
     }
     /** Whether this adapter has any fleet admin at all (an empty allowlist means the admin commands are off). */
     hasFleetAdmins(adapterId) {
-        return (this.getChannelConfig(adapterId)?.access?.allowed_users ?? []).length > 0;
+        return (this.adminListOf(adapterId)?.length ?? 0) > 0;
     }
     /**
      * The one question the privileged commands (/update, /doctor, /dashboard, /collab) ask: may THIS caller,
@@ -2437,9 +2952,7 @@ export class FleetManager {
      * type a slash command could `/update` the host.
      */
     fleetAdminGate(userId, adapterId) {
-        if (!this.hasFleetAdmins(adapterId))
-            return "disabled";
-        return this.isFleetAdmin(userId, adapterId) ? "ok" : "denied";
+        return this.adminGate(userId, adapterId);
     }
     runtimeCpuProfiler = null;
     cpuProfileControl = null;
@@ -2478,11 +2991,17 @@ export class FleetManager {
      * this caller speak here at all) and then the COMMAND TABLE (src/command-table.ts — does this command apply
      * in this kind of channel, and which kind of admin does it need). The table can only narrow what the door
      * let through. A command nobody registered is answered, not left to time out.
+     *
+     * The door, the table and the start of the command run in one synchronous stretch (#1399 review): no await between
+     * the check and the act, so the channel's instance cannot be rebound to another bot in between.
      */
     async dispatchSlash(data, adapterId, adapter) {
-        const scope = await this.authorizeSlash(data, adapterId);
-        if (!scope)
+        const door = this.slashDoor(data, adapterId);
+        if ("refusal" in door) {
+            await data.respond(t(door.refusal)).catch(() => { });
             return;
+        }
+        const scope = door.scope;
         const spec = commandSpec(data.command);
         if (!spec) {
             this.logger.info({ command: data.command, adapterId }, "Slash command is not in the command table");
@@ -2644,9 +3163,18 @@ export class FleetManager {
             await this.topicCommands.sendSysInfo(text => data.respond(text), { platform: "discord" });
         }
         else if (data.command === "dashboard") {
-            // Reply is ephemeral (adapter defers non-chat commands ephemerally), so
-            // the web-token-bearing URLs are only visible to the caller.
-            await data.respond(this.topicCommands.getDashboardText());
+            if (String(data.options?.action ?? "").trim().toLowerCase() === "revoke") {
+                const result = this.revokeWebSessions();
+                await data.respond(result.durable ? t("dashboard.revoked", result.count) : t("dashboard.revoked_not_durable", result.count));
+            }
+            else {
+                const owner = this.dashboardOwner(data.userId, adapterId, data.channelId);
+                if (!owner) {
+                    await this.sendLocalDashboard(data, adapterId);
+                    return;
+                }
+                await this.showDashboardMenu(owner, data.respondButtons);
+            }
         }
         else if (data.command === "restart") {
             await this.handleRestartSlash(data, adapterId);
@@ -2702,10 +3230,10 @@ export class FleetManager {
         }
     }
     /**
-     * The door every Discord slash command goes through (src/slash-authz.ts has the rule and the reasoning).
-     * Answers the caller itself when it refuses, so a refused command costs one reply and does nothing else.
+     * The door every Discord slash command goes through (src/slash-authz.ts has the rule and the reasoning): the scope
+     * it lets the command into, or the reply that refuses it. Synchronous, so the dispatch acts on what it judged.
      */
-    async authorizeSlash(data, adapterId) {
+    slashDoor(data, adapterId) {
         const channelId = data.channelId;
         const classic = !!this.classicChannels?.isClassicChannel(channelId, adapterId);
         const fleetTarget = classic ? undefined : this.routing.resolve(channelId);
@@ -2727,21 +3255,28 @@ export class FleetManager {
                 speaker = this.isFleetAdmin(data.userId, adapterId) || (am?.isAllowed(data.userId) ?? false) ? "allowed" : "denied";
             }
         }
+        const spec = commandSpec(data.command);
+        const rule = spec ? ruleFor(spec, commandScope, "discord") : undefined;
         const facts = {
             command: data.command,
             guildId: data.guildId,
             primaryGuildId: String(this.getChannelConfig(adapterId)?.group_id ?? ""),
             scope,
             speaker,
+            // The table's level, plus the fleet-admin modes of a command whose handler decides by its options: /tips with a
+            // mode saves fleet config or unlocks tips; bare /tips only draws one (#1396 review).
+            fleetAdminCommand: (!!rule && "level" in rule && rule.level === "fleet-admin")
+                || (data.command === "tips" && typeof data.options?.mode === "string" && data.options.mode.trim() !== ""),
+            otherBotOwns: !!fleetTarget && !!this.getInstanceAdapterId(fleetTarget.name) && this.getInstanceAdapterId(fleetTarget.name) !== adapterId,
         };
         const decision = decideSlash(facts);
         if (decision.allow)
-            return commandScope;
+            return { scope: commandScope };
         this.logger.info({ command: data.command, reason: decision.reason, adapterId, guildId: data.guildId ?? null, channelId, scope }, "Slash command refused");
-        await data.respond(t(decision.reason === "dm" ? "slash.dm_unsupported"
-            : decision.reason === "wrong-guild" ? "slash.wrong_server"
-                : "not_authorized")).catch(() => { });
-        return null;
+        return { refusal: decision.reason === "dm" ? "slash.dm_unsupported"
+                : decision.reason === "wrong-guild" ? "slash.wrong_server"
+                    : decision.reason === "other-bot" ? "slash.other_bot"
+                        : "not_authorized" };
     }
     /** Phase 2: delivery_worker for a target (instance override → fleet default → wake_only). */
     deliveryWorkerMode(target) {
@@ -2882,8 +3417,39 @@ export class FleetManager {
             reply_completion_guard: this.classicChannels?.getReplyCompletionGuardByInstance(instanceName, this.fleetConfig?.defaults?.reply_completion_guard) ?? true,
         };
     }
+    /** Compensation retains this transaction's exact instance owner across its own transitions. */
+    captureClassicSettingsRestoration(instanceName, changedFields, execution) {
+        const generation = this.settingsGeneration;
+        const receipt = { instanceName, epoch: this.lifecycle.epochOf(instanceName), daemon: this.daemons.get(instanceName) };
+        if (execution)
+            this.classicSettingsOwners.set(execution, receipt);
+        return async () => {
+            const cleanup = new SettingsExecution({ current: () => !this.shuttingDown && this.settingsGeneration === generation
+                    && this.lifecycle.epochOf(instanceName) === receipt.epoch && this.daemons.get(instanceName) === receipt.daemon, snapshot: () => null });
+            this.classicSettingsOwners.set(cleanup, receipt);
+            try {
+                cleanup.assert();
+                await this.restartClassicInstanceFromSettings(instanceName, changedFields, cleanup);
+            }
+            finally {
+                cleanup.close();
+            }
+        };
+    }
     /** Apply a Settings edit to a ClassicBot channel without waiting for the poller. */
-    async restartClassicInstanceFromSettings(instanceName, changedFields = []) {
+    async restartClassicInstanceFromSettings(instanceName, changedFields = [], execution) {
+        return this.lifecycle.runTransition(instanceName, transition => this.restartClassicSettingsOwned(instanceName, changedFields, execution, transition));
+    }
+    async restartClassicSettingsOwned(instanceName, changedFields, execution, transition) {
+        const generation = this.settingsGeneration;
+        const receipt = execution ? this.classicSettingsOwners.get(execution) : undefined;
+        const check = () => {
+            execution?.assert();
+            if (this.shuttingDown || this.settingsGeneration !== generation || receipt &&
+                (receipt.instanceName !== instanceName || receipt.epoch !== this.lifecycle.epochOf(instanceName) || receipt.daemon !== this.daemons.get(instanceName)))
+                throw new Error("Classic restart superseded");
+        };
+        check();
         if (!this.classicChannels)
             throw new Error("Classic channel manager not initialized");
         const wasRunning = this.daemons.has(instanceName);
@@ -2902,9 +3468,21 @@ export class FleetManager {
             this.logger.info({ instanceName, fields: changedFields }, "Classic instance hot config reloaded");
             return;
         }
-        await this.stopInstance(instanceName);
+        const stopping = this.stopInstance(instanceName, transition);
+        // stop() invalidates synchronously in our transition. Keep only that exact acquisition.
+        if (receipt && this.lifecycle.epochOf(instanceName) === receipt.epoch + 1 && this.daemons.get(instanceName) === receipt.daemon)
+            receipt.epoch++;
+        await stopping;
+        if (receipt && this.lifecycle.epochOf(instanceName) === receipt.epoch && !this.daemons.has(instanceName))
+            receipt.daemon = undefined;
+        check();
+        const stoppedEpoch = this.lifecycle.epochOf(instanceName);
         await new Promise(resolve => setTimeout(resolve, 250));
-        await this.startClassicInstance(instanceName, this.classicChannels.getBackendByInstance(instanceName, this.fleetConfig?.defaults?.backend), this.classicChannels.getPreTaskCommand(channel.channelId, channel.adapterId), this.classicChannels.getModel(channel.channelId, channel.adapterId, this.fleetConfig?.defaults?.model), this.classicChannels.getAutoPauseAfter(channel.channelId, channel.adapterId, this.fleetConfig?.defaults?.auto_pause_after));
+        check();
+        if (this.lifecycle.epochOf(instanceName) !== stoppedEpoch)
+            throw new Error("Classic restart superseded by stop");
+        await this.startClassicInstance(instanceName, this.classicChannels.getBackendByInstance(instanceName, this.fleetConfig?.defaults?.backend), this.classicChannels.getPreTaskCommand(channel.channelId, channel.adapterId), this.classicChannels.getModel(channel.channelId, channel.adapterId, this.fleetConfig?.defaults?.model), this.classicChannels.getAutoPauseAfter(channel.channelId, channel.adapterId, this.fleetConfig?.defaults?.auto_pause_after), transition, execution);
+        check();
     }
     /** Reload classicBot.yaml once. Kept callable so the periodic production
      * path is covered without relying on fake timers around startAll(). */
@@ -2980,7 +3558,8 @@ export class FleetManager {
      */
     resumePaused = false, 
     /** Phase 2a: the caller's transition, for a start made from inside a restart or wake. */
-    transition) {
+    transition, execution) {
+        execution?.assert();
         // CLI single-instance cold starts bypass startAll. Start diagnostics before
         // any lifecycle/wake work; a shutdown must not revive the stopped sampler.
         if (!this.shuttingDown)
@@ -3039,11 +3618,17 @@ export class FleetManager {
                 this.logger.warn({ err, name, backend }, "Failed to sync worker skills — continuing startup");
             }
         }
-        await this.lifecycle.start(name, config, topicMode, {
-            kind,
-            backend,
-            model: this.resolveInstanceModel(name).display,
-        }, transition);
+        const receipt = execution ? this.classicSettingsOwners.get(execution) : undefined;
+        const identity = { kind, backend, model: this.resolveInstanceModel(name).display };
+        if (receipt) {
+            await this.lifecycle.start(name, config, topicMode, identity, transition, execution, daemon => {
+                // Only this transition's actual publication can acquire its replacement.
+                receipt.daemon = daemon;
+            });
+        }
+        else
+            await this.lifecycle.start(name, config, topicMode, identity, transition, execution);
+        execution?.assert();
         // Only clear a stale process status after a real start succeeded.  Clearing
         // it before lifecycle.start() can turn a crash-loop daemon's dead pane into
         // a falsely running instance when lifecycle.start() returns early.
@@ -3052,6 +3637,7 @@ export class FleetManager {
         // before reaching it, so an await here is not proof the marker was read.
         // Auto-connect IPC — daemon.start() ensures socket is ready before resolving
         await this.connectIpcToInstance(name);
+        execution?.assert();
         this.requestDiscordUsagePresenceRefresh();
     }
     /** Recreate a daemon for a marker-only paused instance after an explicit wake/delivery. */
@@ -3692,10 +4278,11 @@ export class FleetManager {
         }
     }
     /** Load .env file from data dir into process.env */
-    loadEnvFile() {
+    loadEnvFile(owner) {
         const envPath = join(this.dataDir, ".env");
         if (!existsSync(envPath))
             return;
+        assertSettingsLease(settingsFileResource(envPath), owner);
         const content = readFileSync(envPath, "utf-8");
         for (const line of content.split("\n")) {
             const trimmed = line.trim();
@@ -3720,15 +4307,284 @@ export class FleetManager {
         // Creates web.token if absent; the value is then read back per request by
         // the `webToken` getter, so nothing is cached here.
         loadOrCreateWebToken(this.dataDir);
-        this.viewToken = randomBytes(24).toString("hex");
-        const viewTokenPath = join(this.dataDir, "view.token");
-        writeFileSync(viewTokenPath, this.viewToken, { encoding: "utf8", mode: 0o600 });
+        this.initializeWebSessions();
+        // A `view.token` file was written here for a read-only credential that nothing
+        // ever accepted. Older installs still have one; it authorizes nothing, so do
+        // not leave a credential-shaped file lying around.
         try {
-            chmodSync(viewTokenPath, 0o600);
+            rmSync(join(this.dataDir, "view.token"), { force: true });
         }
         catch { /* best effort */ }
         this.healthServerListening = false;
     }
+    initializeWebSessions() {
+        if (!this.webSessions) {
+            this.webSessions = new WebSessionStore({
+                dataDir: this.dataDir,
+                onWarn: message => this.logger.warn(message),
+            });
+        }
+        if (!this.webLoginCodes) {
+            this.webLoginCodes = new WebLoginCodes({
+                onEvent: event => {
+                    if (event === "burned")
+                        this.logger.warn("A web login code was used up by wrong attempts");
+                    else if (event === "breaker-open")
+                        this.logger.warn("Web sign-in paused: too many wrong login codes");
+                },
+            });
+        }
+    }
+    /**
+     * A single-use login code for the dashboard, for a channel only the operator
+     * can read (`/dashboard`). Null while the panel is closed (no web.token).
+     */
+    issueDashboardLogin() {
+        const token = this.webToken;
+        if (!token)
+            return null;
+        this.initializeWebSessions();
+        const issued = this.webLoginCodes.issue({ tier: "admin", epoch: tokenEpoch(token) });
+        return { display: issued.display, expiresAt: issued.expiresAt, ttlMinutes: Math.round(LOGIN_CODE_TTL_MS / 60_000) };
+    }
+    tunnelPurposeLane = null;
+    publicWebLink = null;
+    getTunnelLane() {
+        return this.tunnelPurposeLane ??= new TunnelPurposeLane(new ManagedTunnel({ dataDir: this.dataDir,
+            log: () => this.logger.warn("Managed tunnel cleanup requires attention") }));
+    }
+    publicOwnerCurrent(owner) {
+        if (this.shuttingDown || !this.hasFleetAdmins(owner.adapterId) || !this.isFleetAdmin(owner.userId, owner.adapterId))
+            return false;
+        const configured = (this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : [])).find(ch => (ch.id ?? ch.type) === owner.adapterId);
+        if (!configured || String(configured.group_id ?? "") !== owner.chatId)
+            return false;
+        const world = this.worlds.get(owner.adapterId);
+        if (!world || !owner.binding || world.adapter !== owner.binding || this.adapters.get(owner.adapterId) !== owner.binding)
+            return false;
+        return Object.entries(this.fleetConfig?.instances ?? {}).some(([name, cfg]) => cfg.general_topic
+            && this.getInstanceAdapterId(name) === owner.adapterId && String(this.getGroupIdForInstance(name) ?? "") === owner.chatId
+            && cfg.topic_id?.toString() === owner.threadId);
+    }
+    /** Exact owning General. No primary-adapter or name fallback participates in authorization. */
+    dashboardOwner(userId, adapterId, address, threadId) {
+        const world = this.worlds.get(adapterId);
+        if (!world || !this.hasFleetAdmins(adapterId) || !this.isFleetAdmin(userId, adapterId))
+            return null;
+        for (const [name, cfg] of Object.entries(this.fleetConfig?.instances ?? {})) {
+            if (!cfg.general_topic || this.getInstanceAdapterId(name) !== adapterId)
+                continue;
+            const group = String(this.getGroupIdForInstance(name) ?? "");
+            const topic = cfg.topic_id?.toString();
+            if (!topic)
+                continue;
+            const dc = world.adapter.id === adapterId && world.channelConfig.type === "discord";
+            const matched = dc ? topic === address || (group === address && topic === threadId)
+                : group === address && ((topic === "1" && (threadId === undefined || threadId === "1")) || topic === threadId);
+            if (group && matched)
+                return { userId, adapterId, chatId: group, threadId: topic, binding: world.adapter };
+        }
+        return null;
+    }
+    getPublicWebLink() {
+        this.initializeWebSessions();
+        return this.publicWebLink ??= new PublicWebLink({
+            dataDir: this.dataDir, web: () => this.fleetConfig?.web,
+            permitted: owner => this.publicOwnerCurrent(owner),
+            reserve: id => this.getTunnelLane().reserve("dashboard", id),
+            createGateway: (exposureId, current, open, failed) => createPublicWebGateway({ exposureId, isCurrent: current, isOpen: open, onError: failed,
+                dispatch: (req, res) => this.dispatchWebHttp(req, res, this.fleetConfig?.health_port ?? 19280) }),
+            revoke: id => {
+                this.webLoginCodes?.revokeAudience(id);
+                const result = this.webSessions?.revokeExposure(id);
+                if (result && !result.durable)
+                    this.logger.warn("Public session revocation could not be saved; exposure remains closed");
+            },
+            log: (event, exposureId) => this.logger.info({ event, exposureId }, "Public web link"),
+            onCleanupUnconfirmed: (result, owner) => {
+                this.logger.warn({ pid: result.confirmed ? null : result.pid }, "Public web access closed; tunnel cleanup unconfirmed");
+                const world = this.worlds.get(owner.adapterId);
+                if (world && world.adapter === owner.binding)
+                    void world.adapter.sendText(owner.chatId, t("dashboard.public_cleanup"), { threadId: owner.threadId }).catch(() => { });
+            },
+        });
+    }
+    getPublicWebStatus() {
+        return this.publicWebLink?.status() ?? { state: "closed" };
+    }
+    async confirmPublicWebLogin(info, current) {
+        if (!current() || !this.publicOwnerCurrent(info.owner))
+            throw new Error("public owner unavailable");
+        const adapter = info.owner.binding;
+        await adapter.sendText(info.owner.chatId, t("web.public_login_notice", info.label, info.handle.slice(0, 8)), { threadId: info.owner.threadId, allowedMentions: { parse: [] } });
+        if (!current() || !this.publicOwnerCurrent(info.owner))
+            throw new Error("public owner changed");
+    }
+    /** Telegram's typed command enters through the same strict owner and nonce path as Discord. */
+    async dashboardMenu(msg) {
+        const id = msg.adapterId;
+        const owner = id ? this.dashboardOwner(msg.userId, id, msg.chatId, msg.threadId) : null;
+        if (!owner) {
+            const adapter = id ? this.adapters.get(id) : undefined;
+            await adapter?.sendText(msg.chatId, t("dashboard.public_general"), { threadId: msg.threadId });
+            return;
+        }
+        await this.showDashboardMenu(owner);
+    }
+    async sendLocalDashboard(data, adapterId) {
+        if (this.shuttingDown || !this.hasFleetAdmins(adapterId) || !this.isFleetAdmin(data.userId, adapterId))
+            return;
+        const text = this.topicCommands.getDashboardText();
+        const adapter = this.adapters.get(adapterId);
+        const token = this.webToken;
+        if (!adapter || !token) {
+            await data.respond(text);
+            return;
+        }
+        this.initializeWebSessions();
+        const login = this.webLoginCodes.issue({ epoch: tokenEpoch(token) });
+        const current = () => !this.shuttingDown && this.adapters.get(adapterId) === adapter
+            && this.webToken === token && this.hasFleetAdmins(adapterId) && this.isFleetAdmin(data.userId, adapterId);
+        const privateText = `${text}\n${t("dashboard.code", login.display, Math.round(LOGIN_CODE_TTL_MS / 60_000))}`;
+        const deadline = performance.now() + 10_000;
+        let deliveredByDm = false;
+        try {
+            try {
+                if (!adapter.sendDirect)
+                    throw new Error("DM unavailable");
+                await withinBudget(adapter.sendDirect(data.userId, privateText, { disablePreview: true }), Math.min(deadline, performance.now() + 5_000));
+                deliveredByDm = true;
+            }
+            catch {
+                if (!current())
+                    throw new Error("owner changed");
+                const id = await withinBudget(data.respond(privateText), deadline); // native slash response is already ephemeral
+                if (!id)
+                    throw new Error("private delivery unconfirmed");
+            }
+            if (!current())
+                throw new Error("owner changed");
+            if (deliveredByDm)
+                await withinBudget(data.respond(t("dashboard.private_sent")), deadline);
+        }
+        catch {
+            this.webLoginCodes.revokeIfCurrent(login.issuanceId);
+        }
+    }
+    async showDashboardMenu(owner, respondButtons) {
+        if (!this.publicOwnerCurrent(owner))
+            return;
+        const adapter = owner.binding;
+        const status = this.getPublicWebStatus();
+        const publicAllowed = publicLinkSettings(this.fleetConfig?.web).allowed;
+        const menuText = this.topicCommands.getDashboardText(false, !publicAllowed)
+            + (publicAllowed ? "\n\n" + t("dashboard.public_risk") : "")
+            + "\n" + t("dashboard.public_status", status.state, status.remainingSeconds ?? 0);
+        const choices = [{ action: "local", label: t("dashboard.local") },
+            ...(publicLinkSettings(this.fleetConfig?.web).allowed ? [{ action: "public", label: t("dashboard.public_open") }] : []),
+            ...(status.state !== "closed" ? [{ action: "close", label: t("dashboard.public_close") }] : [])];
+        await this.postNonceButtonPromptOrThrow({
+            prefix: "dashboard:", alertType: "login", instanceName: "dashboard", adapter, adapterId: owner.adapterId,
+            chatId: owner.chatId, threadId: owner.threadId, timeoutMs: 5 * 60_000,
+            message: menuText,
+            choices, expiredText: t("buttons.stale"), extra: { requesterUserId: owner.userId, dashboardOwner: owner, publicExposureId: this.publicWebLink?.exposureId },
+            ...(respondButtons ? { deliver: async (c) => {
+                    const messageId = await respondButtons(menuText, c);
+                    if (!messageId)
+                        throw new Error("menu refused");
+                    return { chatId: owner.chatId, threadId: owner.threadId, messageId };
+                } } : {}),
+        });
+    }
+    async handleDashboardCallback(data, adapterId, adapter) {
+        const claimed = this.consumeNonceCallback("dashboard:", /^dashboard:([0-9a-f]{32}):(local|public|close)$/, data, adapterId, adapter);
+        if (claimed === null)
+            return false;
+        if (claimed === "consumed")
+            return true;
+        const { entry, action } = claimed;
+        const owner = entry.dashboardOwner;
+        if (!owner || !this.publicOwnerCurrent(owner)) {
+            data.ack?.(t("not_authorized"));
+            return true;
+        }
+        if (action === "close") {
+            if (!entry.publicExposureId)
+                return true;
+            const result = await this.publicWebLink?.close("admin close", entry.publicExposureId);
+            if (result?.confirmed === false)
+                data.ack?.(t("dashboard.public_cleanup"));
+            await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t("dashboard.public_closed"));
+            return true;
+        }
+        const send = async (url, exposureId, expiresAt, current = () => this.publicOwnerCurrent(owner)) => {
+            const token = this.webToken;
+            if (!token || !current())
+                return false;
+            this.initializeWebSessions();
+            const issued = this.webLoginCodes.issue({ epoch: tokenEpoch(token), audience: exposureId, owner });
+            const text = t("dashboard.private_link", url, issued.display, Math.round(LOGIN_CODE_TTL_MS / 60_000), expiresAt ? new Date(expiresAt).toISOString() : t("dashboard.local"));
+            const deadline = performance.now() + 10_000;
+            const direct = owner.binding;
+            try {
+                const deliver = async (c = []) => {
+                    try {
+                        if (!direct.sendDirect)
+                            throw new Error("DM unavailable");
+                        return await withinBudget(direct.sendDirect(owner.userId, text, { disablePreview: true, choices: c }), Math.min(deadline, performance.now() + 5_000));
+                    }
+                    catch {
+                        if (direct.type !== "discord" || !data.respondPrivate || !current())
+                            throw new Error("private delivery unavailable");
+                        const sent = await withinBudget(data.respondPrivate(text, c), deadline);
+                        return { ...sent, chatId: owner.chatId, threadId: owner.threadId };
+                    }
+                };
+                if (exposureId)
+                    await withinBudget(this.postNonceButtonPromptOrThrow({
+                        prefix: "dashboard:", alertType: "login", instanceName: "dashboard", adapter: direct, adapterId,
+                        chatId: owner.userId, message: t("dashboard.public_close"), choices: [{ action: "close", label: t("dashboard.public_close") }],
+                        expiredText: t("buttons.stale"), timeoutMs: 5 * 60_000, extra: { requesterUserId: owner.userId, publicExposureId: exposureId, dashboardOwner: owner }, deliver,
+                    }), deadline);
+                else
+                    await deliver();
+                if (!current() || this.webToken !== token)
+                    throw new Error("owner changed");
+                return true;
+            }
+            catch {
+                this.webLoginCodes.revokeIfCurrent(issued.issuanceId);
+                this.logger.info("Dashboard private delivery was not confirmed");
+                return false;
+            }
+        };
+        const ok = action === "public"
+            ? await this.getPublicWebLink().deliver(owner, link => send(link.url, link.exposureId, link.expiresAt, link.isCurrent))
+            : await send(`http://${this.fleetConfig?.hostname || "localhost"}:${this.fleetConfig?.health_port ?? 19280}/signin`);
+        // Only safe, static words enter General; never link, code or platform error text.
+        await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t(ok ? "dashboard.private_sent" : "dashboard.private_failed"));
+        return true;
+    }
+    /** `/dashboard revoke`: sign out every browser and withdraw any unused code. */
+    revokeWebSessions() {
+        this.initializeWebSessions();
+        void this.publicWebLink?.close("dashboard revoke");
+        this.webLoginCodes.revoke();
+        const result = this.webSessions.revokeAll();
+        if (result.durable)
+            this.logger.info({ count: result.count }, "Web sessions revoked (all)");
+        else
+            this.logger.warn({ count: result.count }, "Web sessions revoked in memory only — the session file could not be updated or removed");
+        return result;
+    }
+    /** Called by the sign-in endpoint: a login the operator did not make should be visible to them. */
+    onWebLogin(info) {
+        if (this.fleetConfig?.web?.notify_login === false)
+            return;
+        // The session handle makes each notice distinct: notifyFleetError throttles by text, and a second
+        // sign-in from the same kind of browser is exactly the one the operator most needs to hear about.
+        this.notifyFleetError(t("web.login_notice", info.label, info.surface, info.handle.slice(0, 8)));
+    }
     getDashboardAccess() {
         return { ready: this.healthServerListening, token: this.webToken };
     }
@@ -3801,7 +4657,8 @@ export class FleetManager {
             // ambiguous under systemd because this helper shares the old cgroup.
             if (this.shuttingDown || !this.isOwnedFullRestartMarker(ownedMarker.startedAt, target))
                 return;
-            if (!result.error && (result.code === 0 || result.code === null))
+            // The restart job outlived the helper's wait (systemd still running it): the new fleet settles the marker.
+            if (!result.error && (result.code === 0 || result.code === null || result.code === SYSTEMD_RESTART_INDETERMINATE_EXIT_CODE))
                 return;
             const detail = result.error
                 ? "reload helper failed after launch"
@@ -3937,7 +4794,14 @@ export class FleetManager {
         // anything arriving during it is still part of the stop.
         this.shuttingDown = false;
         this.configPath = configPath;
-        this.loadEnvFile();
+        const settingsGeneration = this.settingsGeneration;
+        const envLease = await waitSettingsLease([settingsFileResource(join(this.dataDir, ".env"))], () => !this.shuttingDown && this.settingsGeneration === settingsGeneration, performance.now() + 30_000);
+        try {
+            this.loadEnvFile(envLease.owner);
+        }
+        finally {
+            envLease.release();
+        }
         this.ensureDeliveryOutbox();
         this.rotateFleetLogs();
         const fleet = this.loadConfig(configPath);
@@ -4024,7 +4888,8 @@ export class FleetManager {
         }
         // Poll classicBot.yaml for external changes every 30s
         this.classicReloadTimer = setInterval(() => {
-            void this.reloadClassicConfigFromDisk();
+            // Attributes the synchronous part, up to the reload's first await (#1235).
+            void measureSyncWork("fleet.classicReload", () => this.reloadClassicConfigFromDisk());
         }, 30_000);
         const costGuardConfig = {
             ...DEFAULT_COST_GUARD,
@@ -4073,6 +4938,8 @@ export class FleetManager {
         // Rotate classic channel chat logs daily (piggyback on daily summary timer)
         this.classicChannels?.rotateLogs();
         this.rotateInboxes();
+        // Web uploads no message took before this restart (#1273).
+        this.sweepOrphanedWebUploads();
         // Auto-create/adopt a general dispatcher — ONLY for the primary adapter.
         const channelConfigs = fleet.channels ?? (fleet.channel ? [fleet.channel] : []);
         this.warnUnboundGeneralChannelIds(fleet);
@@ -4161,7 +5028,7 @@ export class FleetManager {
                 ...DEFAULT_SCHEDULER_CONFIG,
                 ...this.fleetConfig?.defaults.scheduler,
             };
-            this.scheduler = new Scheduler(join(this.dataDir, "scheduler.db"), (schedule, runId) => this.handleScheduleTrigger(schedule, runId), schedulerConfig, (name) => this.fleetConfig?.instances?.[name] != null || !!this.classicChannels?.getAll().some(ch => ch.instanceName === name));
+            this.scheduler = new Scheduler(join(this.dataDir, "scheduler.db"), (schedule, runId, retry) => this.handleScheduleTrigger(schedule, runId, retry), schedulerConfig, (name) => this.fleetConfig?.instances?.[name] != null || !!this.classicChannels?.getAll().some(ch => ch.instanceName === name), (schedule, retry, reason) => this.scheduleRetryDropped(schedule, retry, reason));
             this.scheduler.init();
             this.logger.info("Scheduler initialized");
             // Tips share the daily-report clock but remain an independent internal
@@ -4402,6 +5269,8 @@ export class FleetManager {
                 }
                 await this.sendFleetStartCompletionFallback(String(fleet.channel.group_id), text, generalThreadId != null ? String(generalThreadId) : undefined);
             }
+            // After "fleet ready", so the notice is not the first thing people see of a restart.
+            void this.announceWebChatOnce(agendVersion);
         }
         // Health HTTP endpoint
         this.startHealthServer(fleet.health_port ?? 19280);
@@ -4535,6 +5404,27 @@ export class FleetManager {
             this.logger.info({ deleted }, "Rotated inbox files");
         return deleted;
     }
+    /**
+     * Web uploads no message took before a restart (#1273): removed once older than the upload window. Younger ones
+     * are looked at again when the first comes due (an unref'd timer, so it never holds the process).
+     */
+    sweepOrphanedWebUploads() {
+        // Skip what this process's ledger still holds: those are uploads made since this start, timed by the ledger.
+        // (Compared the way the sweep names files: the inbox directory resolved, the file name as it is.)
+        const owned = new Set([...this.webFiles.ownedPaths()].map(p => { try {
+            return join(realpathSync(dirname(p)), basename(p));
+        }
+        catch {
+            return p;
+        } }));
+        const { deleted, nextDueInMs } = sweepOrphanedUploads(join(getAgendHome(), "workspaces"), Date.now(), undefined, owned);
+        if (deleted > 0)
+            this.logger.info({ deleted }, "Removed web uploads no message took before the restart");
+        if (nextDueInMs !== null) {
+            const t = setTimeout(() => this.sweepOrphanedWebUploads(), Math.max(1_000, nextDueInMs + 1_000));
+            t.unref?.();
+        }
+    }
     /** Start the shared channel adapter(s) for topic mode */
     async startSharedAdapter(fleet) {
         const channelConfigs = fleet.channels ?? (fleet.channel ? [fleet.channel] : []);
@@ -4730,7 +5620,27 @@ export class FleetManager {
         };
     }
     /** Start the primary adapter (backward-compatible, sets this.adapter) */
-    async startSingleAdapter(fleet, channelConfig, onStarted) {
+    async startSingleAdapter(fleet, channelConfig, onStarted, operation) {
+        const id = channelConfig.id ?? channelConfig.type;
+        const lease = trySettingsLease([`connection:${this.dataDir}:${id}`], operation?.owner);
+        if (!lease)
+            throw new Error("connection operation is still running");
+        try {
+            await this.startSingleAdapterOwned(fleet, channelConfig, onStarted, operation ?? { owner: lease.owner, assert: () => { } });
+        }
+        finally {
+            lease.release();
+        }
+    }
+    async startSingleAdapterOwned(fleet, channelConfig, onStarted, operation) {
+        const ownerId = channelConfig.id ?? channelConfig.type, generation = this.settingsGeneration;
+        const check = () => {
+            operation?.assert();
+            assertSettingsLease(`connection:${this.dataDir}:${ownerId}`, operation?.owner);
+            if (this.shuttingDown || this.settingsGeneration !== generation)
+                throw new Error("adapter admission superseded");
+        };
+        check();
         const botToken = process.env[channelConfig.bot_token_env];
         if (!botToken) {
             this.logger.warn({ env: channelConfig.bot_token_env }, "Bot token env not set, skipping shared adapter");
@@ -4741,39 +5651,46 @@ export class FleetManager {
         const accessStatePath = join(accessDir, "access.json");
         const accessManager = new AccessManager(channelConfig.access ?? DEFAULT_OPEN_ACCESS, accessStatePath);
         this.warnIfAccessModeOverridden(accessManager, accessStatePath);
-        this.accessManager = accessManager;
         const inboxDir = join(this.dataDir, "inbox");
         mkdirSync(inboxDir, { recursive: true });
         const adapterId = channelConfig.id ?? channelConfig.type;
-        this.adapter = await createAdapter(channelConfig, {
+        const adapter = await createAdapter(channelConfig, {
             id: adapterId,
             botToken,
             accessManager,
             inboxDir,
             fleetLabel: fleetLabel(this.fleetConfig),
         });
-        const adapter = this.adapter;
+        try {
+            check();
+        }
+        catch (err) {
+            await adapter.stop().catch(() => { });
+            throw err;
+        }
+        this.adapter = adapter;
+        this.accessManager = accessManager;
         const world = new AdapterWorld(adapterId, adapter, accessManager, channelConfig);
         this.worlds.set(adapterId, world);
         this.adapters.set(adapterId, adapter);
         this.bindAdapterHealth(adapter, adapterId);
         const isCurrentAdapter = () => this.adapters.get(adapterId) === adapter;
-        this.adapter.on("message", safeHandler(async (msg) => {
+        adapter.on("message", safeHandler(async (msg) => {
             if (!isCurrentAdapter())
                 return;
             await this.handleInboundMessage(msg);
         }, this.logger, "adapter.message"));
-        this.adapter.on("reaction", safeHandler(async (r) => {
+        adapter.on("reaction", safeHandler(async (r) => {
             if (!isCurrentAdapter())
                 return;
             await this.handleInboundReaction(r);
         }, this.logger, "adapter.reaction"));
-        this.adapter.on("callback_query", safeHandler(async (data) => {
-            await this.receiveAdapterCallback(data, adapterId, this.adapter ?? undefined, isCurrentAdapter);
+        adapter.on("callback_query", safeHandler(async (data) => {
+            await this.receiveAdapterCallback(data, adapterId, adapter, isCurrentAdapter);
         }, this.logger, "adapter.callback_query"));
         this.bindTopicClosedHandler(adapter, adapterId, "adapter.topic_closed");
         // Handle classic bot slash commands (/start, /stop, /chat, /compact, /save, /load)
-        this.adapter.on("slash_command", safeHandler(async (data) => {
+        adapter.on("slash_command", safeHandler(async (data) => {
             if (!isCurrentAdapter())
                 return;
             await this.dispatchSlash(data, adapterId, adapter);
@@ -4783,7 +5700,7 @@ export class FleetManager {
         // Background-probe each backend's CLI env (version/models) → cli-env cache.
         // Non-blocking: /model & status views read the cache; never delays startup.
         this.probeCliEnvs();
-        this.adapter.on("started", safeHandler((username, userId) => {
+        adapter.on("started", safeHandler((username, userId) => {
             if (!isCurrentAdapter())
                 return;
             this.logger.info(`Bot @${username} polling started. Ensure no other service is polling this bot token.`);
@@ -4799,19 +5716,19 @@ export class FleetManager {
                 this.botUserId = userId;
             onStarted?.();
         }, this.logger, "adapter.started"));
-        this.adapter.on("polling_conflict", safeHandler(({ attempt, delay }) => {
+        adapter.on("polling_conflict", safeHandler(({ attempt, delay }) => {
             this.logger.warn(`409 Conflict (attempt ${attempt}), retry in ${delay / 1000}s`);
         }, this.logger, "adapter.polling_conflict"));
-        this.adapter.on("handler_error", safeHandler((err) => {
+        adapter.on("handler_error", safeHandler((err) => {
             this.logger.warn({ err: err instanceof Error ? err.message : String(err) }, "Adapter handler error");
         }, this.logger, "adapter.handler_error"));
-        this.adapter.on("error", (err) => {
+        adapter.on("error", (err) => {
             if (!isCurrentAdapter())
                 return;
             this.logger.error({ err }, "Primary adapter fatal error");
-            this.restartAdapter(this.adapter, adapterId).catch(() => { });
+            this.restartAdapter(adapter, adapterId).catch(() => { });
         });
-        this.adapter.on("new_group_detected", safeHandler(async (data) => {
+        adapter.on("new_group_detected", safeHandler(async (data) => {
             if (!isCurrentAdapter())
                 return;
             const adminMsg = t("alert.bot_added", data.groupTitle, data.groupId, data.source);
@@ -4821,11 +5738,20 @@ export class FleetManager {
                 await this.promptClassicApproval({ generalName: generalId, message: adminMsg, groupId: data.groupId, scope: data.source === "telegram" ? "group" : "guild" });
         }, this.logger, "adapter.new_group_detected"));
         // Start adapter AFTER all event listeners are registered (started event sets botUsername)
-        await this.adapter.start();
-        if (fleet.channel?.group_id) {
-            this.adapter.setChatId(String(fleet.channel.group_id));
+        try {
+            await adapter.start();
+            check();
+            if (!isCurrentAdapter())
+                throw new Error("adapter ownership changed during login");
+        }
+        catch (err) {
+            await this.disposeSettingsAdapter(adapterId, adapter);
+            throw err;
+        }
+        if (channelConfig.group_id) {
+            adapter.setChatId(String(channelConfig.group_id));
         }
-        if (this.discordPresenceTimer && this.adapter.type === "discord") {
+        if (this.discordPresenceTimer && adapter.type === "discord") {
             this.requestDiscordUsagePresenceRefresh();
         }
         this.startTopicCleanupPoller();
@@ -4844,8 +5770,28 @@ export class FleetManager {
         void this.topicCommands.registerBotCommands(channelConfig).catch(e => this.logger.warn({ err: e, adapterId: channelConfig.id ?? channelConfig.type }, "registerBotCommands failed (non-fatal)"));
     }
     /** Start an additional (non-primary) adapter */
-    async startAdditionalAdapter(channelConfig, registerCommands = true, onStarted) {
+    async startAdditionalAdapter(channelConfig, registerCommands = true, onStarted, operation) {
+        const id = channelConfig.id ?? channelConfig.type;
+        const lease = trySettingsLease([`connection:${this.dataDir}:${id}`], operation?.owner);
+        if (!lease)
+            throw new Error("connection operation is still running");
+        try {
+            await this.startAdditionalAdapterOwned(channelConfig, registerCommands, onStarted, operation ?? { owner: lease.owner, assert: () => { } });
+        }
+        finally {
+            lease.release();
+        }
+    }
+    async startAdditionalAdapterOwned(channelConfig, registerCommands = true, onStarted, operation) {
         const adapterId = channelConfig.id ?? channelConfig.type;
+        const ownerId = channelConfig.id ?? channelConfig.type, generation = this.settingsGeneration;
+        const check = () => {
+            operation?.assert();
+            assertSettingsLease(`connection:${this.dataDir}:${ownerId}`, operation?.owner);
+            if (this.shuttingDown || this.settingsGeneration !== generation)
+                throw new Error("adapter admission superseded");
+        };
+        check();
         const botToken = process.env[channelConfig.bot_token_env];
         if (!botToken) {
             this.logger.warn({ env: channelConfig.bot_token_env, adapterId }, "Bot token env not set, skipping adapter");
@@ -4866,6 +5812,13 @@ export class FleetManager {
             registerCommands,
             fleetLabel: fleetLabel(this.fleetConfig),
         });
+        try {
+            check();
+        }
+        catch (err) {
+            await adapter.stop().catch(() => { });
+            throw err;
+        }
         const world = new AdapterWorld(adapterId, adapter, accessManager, channelConfig);
         this.worlds.set(adapterId, world);
         this.adapters.set(adapterId, adapter);
@@ -4922,7 +5875,16 @@ export class FleetManager {
         // at fleet start, on retry, and when Settings rebinds it or rotates its token: all of them start it here (#1191).
         this.registerTelegramCommandsFor(channelConfig);
         // Register lifecycle listeners before login; a fast ready/error must not be lost.
-        await adapter.start();
+        try {
+            await adapter.start();
+            check();
+            if (!isCurrentAdapter())
+                throw new Error("adapter ownership changed during login");
+        }
+        catch (err) {
+            await this.disposeSettingsAdapter(adapterId, adapter);
+            throw err;
+        }
         if (channelConfig.group_id) {
             adapter.setChatId(String(channelConfig.group_id));
         }
@@ -5153,10 +6115,23 @@ export class FleetManager {
             }
         }
     }
+    async disposeSettingsAdapter(id, adapter) {
+        adapter.removeAllListeners();
+        await adapter.stop().catch(() => { });
+        if (this.adapters.get(id) === adapter)
+            this.adapters.delete(id);
+        if (this.worlds.get(id)?.adapter === adapter)
+            this.worlds.delete(id);
+        if (this.adapter === adapter)
+            this.adapter = null;
+    }
     /** Restart a channel adapter after fatal error with infinite retry + 60s cap */
     async restartAdapter(adapter, id) {
-        if (this.adapterRestarting.has(id))
+        if (this.adapterRestarting.has(id) || this.shuttingDown || this.adapters.get(id) !== adapter)
             return;
+        const generation = this.settingsGeneration;
+        const current = () => !this.shuttingDown && this.settingsGeneration === generation && this.adapters.get(id) === adapter;
+        let lease = null;
         this.adapterRestarting.add(id);
         // Reflect reality in adapterState throughout. This loop used to leave the state
         // untouched, so getAdapterStates() — and therefore /health and the dashboard —
@@ -5167,10 +6142,15 @@ export class FleetManager {
         try {
             if (adapter.reconnectGateway) {
                 try {
+                    lease = trySettingsLease([`connection:${this.dataDir}:${id}`]);
+                    if (!lease || !current())
+                        return;
                     // Discord requires a fresh Client after destroy(). Its adapter owns the
                     // single-flight, generation fence and bounded IDENTIFY backoff, so all
                     // watchdog/manual/error triggers must converge here instead of stop/start.
                     await adapter.reconnectGateway(previous?.lastError ?? "fleet adapter restart");
+                    if (!current())
+                        return;
                     this.adapterState.set(id, { status: "connected", retryCount: 0 });
                     if (this.discordPresenceTimer && adapter.type === "discord") {
                         this.requestDiscordUsagePresenceRefresh();
@@ -5178,7 +6158,7 @@ export class FleetManager {
                     this.logger.info({ id }, "Adapter gateway rebuilt successfully");
                 }
                 catch (err) {
-                    if (!this.ipcStoppingInstances.has("__fleet_stopping__")) {
+                    if (current() && !this.ipcStoppingInstances.has("__fleet_stopping__")) {
                         this.adapterState.set(id, {
                             status: "failed",
                             retryCount: previous?.retryCount ?? 0,
@@ -5189,15 +6169,22 @@ export class FleetManager {
                 return;
             }
             for (let attempt = 1;; attempt++) {
-                if (this.ipcStoppingInstances.has("__fleet_stopping__"))
+                if (!current() || this.ipcStoppingInstances.has("__fleet_stopping__"))
                     return;
                 const delay = attempt <= 3 ? 5000 * Math.pow(2, attempt - 1) : 60_000; // 5s, 10s, 20s, then 60s
                 await new Promise(r => setTimeout(r, delay));
-                if (this.ipcStoppingInstances.has("__fleet_stopping__"))
+                if (!current() || this.ipcStoppingInstances.has("__fleet_stopping__"))
+                    return;
+                lease = trySettingsLease([`connection:${this.dataDir}:${id}`]);
+                if (!lease)
                     return;
                 try {
                     await adapter.stop().catch(() => { });
+                    if (!current())
+                        return;
                     await adapter.start();
+                    if (!current())
+                        return;
                     this.logger.info({ id, attempt }, "Adapter restarted successfully");
                     this.adapterState.set(id, { status: "connected", retryCount: 0 });
                     if (this.discordPresenceTimer && adapter.type === "discord") {
@@ -5206,18 +6193,23 @@ export class FleetManager {
                     return;
                 }
                 catch (err) {
+                    if (!current())
+                        return;
                     this.adapterState.set(id, {
                         status: "retrying",
                         retryCount: attempt,
                         lastError: err?.message ?? String(err),
                     });
                 }
+                lease.release();
+                lease = null;
                 if (attempt % 10 === 0) {
                     this.logger.warn({ id, attempt }, "Adapter restart still failing");
                 }
             }
         }
         finally {
+            lease?.release();
             this.adapterRestarting.delete(id);
         }
     }
@@ -5442,12 +6434,29 @@ export class FleetManager {
     /**
      * #1346: whether this copy may claim the shared dedup key for
      * command-like text. Fleet topics resolve an owning adapter and only its
-     * copy proceeds; anything else (classic targets, unknown routing, no
-     * identity) passes through to the existing handling.
+     * copy proceeds. Classic targets and unknown routing keep their existing
+     * handling. At the receiving Telegram world's own forum root, an explicit
+     * suffix requires a known matching username before dedup; present-thread
+     * copies retain their permissive handling when that identity is unknown.
      */
     isOwnerCommandCopy(msg, threadId) {
-        if (!msg.adapterId || threadId === undefined)
+        if (!msg.adapterId)
             return true;
+        const suffix = msg.text?.trim().match(/^\/[\w-]+@(\S+)/)?.[1];
+        if (threadId === undefined) {
+            // General at the forum root belongs to the receiving world. Prove an
+            // explicit suffix before shared dedup, even when there is no message id.
+            // Classic/private/foreign-forum copies retain their own dispatch rules.
+            const channels = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+            const channel = channels.find(ch => (ch.id ?? ch.type) === msg.adapterId)
+                ?? this.worlds.get(msg.adapterId)?.channelConfig;
+            if (msg.source === "telegram" && channel?.type === "telegram"
+                && channel.group_id != null && String(channel.group_id) === msg.chatId && suffix) {
+                const username = this.worlds.get(msg.adapterId)?.botUsername;
+                return !!username && suffix.toLowerCase() === username.toLowerCase();
+            }
+            return true;
+        }
         const target = this.resolveInboundTarget(msg, threadId);
         if (!target || target.kind === "classic")
             return true;
@@ -5460,7 +6469,6 @@ export class FleetManager {
         // Telegram classic branch.
         // Hyphenated aliases count too (e.g. /install-cli): Telegram command
         // names cannot contain "-", but typed aliases can.
-        const suffix = msg.text?.trim().match(/^\/[\w-]+@(\S+)/)?.[1];
         if (suffix && owner) {
             const ownerUser = this.worlds.get(owner)?.botUsername;
             if (ownerUser && suffix.toLowerCase() !== ownerUser.toLowerCase())
@@ -5477,6 +6485,32 @@ export class FleetManager {
         });
     }
     async handleInboundMessage(msg) {
+        // Platform author identity is the authority. This runs before routing,
+        // collab/commands/access/dedup and does not depend on any echo setting/ACK.
+        const fleetBotIds = new Set();
+        for (const world of this.worlds.values()) {
+            if (world.adapter.type !== msg.source)
+                continue;
+            const id = world.adapter.getBotUserId?.() ?? world.botUserId;
+            if (id)
+                fleetBotIds.add(id);
+        }
+        if (isWebChannelEcho(msg.text ?? "", msg.userId, fleetBotIds))
+            return;
+        const configured = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+        const identitiesPending = configured.some(channel => {
+            if (channel.type !== msg.source)
+                return false;
+            const world = this.worlds.get(channel.id ?? channel.type);
+            return !(world?.adapter.getBotUserId?.() ?? world?.botUserId);
+        });
+        // Startup/rebuild can receive a replay before another configured world's
+        // authenticated ID is ready. Quarantine only bot-flagged prefix candidates;
+        // humans keep flowing, and no unknown author is labelled a fleet account.
+        if (identitiesPending && msg.isBotMessage === true && (msg.text ?? "").startsWith(WEB_ECHO_PREFIX)) {
+            this.logger.debug({ source: msg.source, adapterId: msg.adapterId }, "Web echo candidate quarantined while bot identities are pending");
+            return;
+        }
         const threadId = this.inboundRouteThreadId(msg);
         this.logger.debug({ source: msg.source, chatId: msg.chatId, threadId, userId: msg.userId, isBotMessage: msg.isBotMessage, textLen: (msg.text ?? "").length, text: (msg.text ?? "").slice(0, 80) }, "handleInboundMessage entry");
         // Ownership and per-adapter filtering both run before the dedup claim below.
@@ -5537,7 +6571,8 @@ export class FleetManager {
         // per-adapter keys — first-/start-contact onboarding needs every copy
         // to flow — so only fleet targets are judged here; the in-handler gates
         // (owner entry check, Discord ignore) cover classic instead.
-        if (msg.messageId && /^\/\w/.test(msg.text?.trim() ?? "") && !this.isOwnerCommandCopy(msg, threadId)) {
+        if ((msg.messageId || (msg.source === "telegram" && threadId === undefined))
+            && /^\/\w/.test(msg.text?.trim() ?? "") && !this.isOwnerCommandCopy(msg, threadId)) {
             this.logger.debug({ adapterId: msg.adapterId, threadId }, "Non-owner command copy — skipping before dedup claim");
             return;
         }
@@ -5604,42 +6639,12 @@ export class FleetManager {
                 }
                 // Handle /start command
                 if (text === "/start" || text.startsWith("/start ")) {
-                    if (isPrivateChat) {
-                        if (!this.classicChannels.isUserAllowed(msg.userId)) {
-                            const generalId = this.findGeneralInstance(msg.adapterId);
-                            if (generalId) {
-                                this.notifyInstanceTopic(generalId, t("alert.unauth_user_private", msg.username, msg.userId, msg.source));
-                            }
-                            await msgAdapter?.sendText(chatId, t("classic.not_allowed_user"));
-                            return;
-                        }
-                    }
-                    else {
-                        if (!this.classicChannels.isGroupAllowed(chatId)) {
-                            // Notify admin about new group wanting access
-                            const groupTitle = msg.chatTitle || chatId;
-                            const adminMsg = t("alert.new_group", groupTitle, chatId, msg.username, msg.userId, msg.source);
-                            const generalId = this.findGeneralInstance(msg.adapterId);
-                            if (generalId) {
-                                await this.promptClassicApproval({
-                                    // Guarded by isGroupAllowed → this belongs in allowed_groups,
-                                    // NOT allowed_guilds; writing the latter would change the file
-                                    // without unblocking the group.
-                                    generalName: generalId, message: adminMsg, groupId: String(chatId),
-                                    scope: "group", userId: msg.userId,
-                                });
-                            }
-                            await msgAdapter?.sendText(chatId, t("classic.access_requested"));
-                            return;
-                        }
-                        if (!this.classicChannels.isAdmin(msg.userId)) {
-                            await msgAdapter?.sendText(chatId, t("classic.admin_only_start"));
-                            const generalId = this.findGeneralInstance(msg.adapterId);
-                            if (generalId) {
-                                this.notifyInstanceTopic(generalId, t("alert.start_not_admin", msg.username, msg.userId, msg.source, chatId));
-                            }
-                            return;
-                        }
+                    // All new starts, including explicit backend and later chooser callbacks,
+                    // share validateClassicStart. Existing channels are recognized first.
+                    const blocker = this.validateClassicStart(chatId, msg.userId, undefined, msg.adapterId);
+                    if (blocker) {
+                        await msgAdapter?.sendText(chatId, blocker);
+                        return;
                     }
                     const channelName = msg.username || chatId;
                     const requestedBackend = text.slice("/start".length).trim().split(/\s+/, 1)[0] || undefined;
@@ -5675,7 +6680,8 @@ export class FleetManager {
                 }
                 const pauseWake = parsePauseWakeCommand(text);
                 if (pauseWake) {
-                    if (!this.classicChannels.isAdmin(msg.userId)) {
+                    // Channel-admin, as on Discord (#754): a fleet admin of this bot or a ClassicBot admin.
+                    if (!this.isModelAdmin(msg.userId, chatId, msg.adapterId)) {
                         await msgAdapter?.sendText(chatId, t("permission.denied"));
                         return;
                     }
@@ -5703,7 +6709,7 @@ export class FleetManager {
                         await msgAdapter?.sendText(chatId, await this.applyModel(modelInstance, modelName));
                     }
                     else if (msgAdapter) {
-                        const fallback = await this.promptModelMenu(modelInstance, msg.userId, chatId, msgAdapter, chatId);
+                        const fallback = await this.promptModelMenu(modelInstance, msg.userId, chatId, msgAdapter, chatId, undefined, msg.adapterId);
                         if (fallback)
                             await msgAdapter.sendText(chatId, fallback);
                     }
@@ -5712,7 +6718,8 @@ export class FleetManager {
                 // Handle /compact command (admin only)
                 const classicCompact = parseCompactCommand(text);
                 if (classicCompact) {
-                    if (!this.classicChannels.isAdmin(msg.userId)) {
+                    // Channel-admin, as on Discord (#754): a fleet admin of this bot or a ClassicBot admin.
+                    if (!this.isModelAdmin(msg.userId, chatId, msg.adapterId)) {
                         await msgAdapter?.sendText(chatId, t("cmd.admin_required", "/compact"));
                         return;
                     }
@@ -5804,7 +6811,8 @@ export class FleetManager {
                 }
                 // Handle /save command (admin only)
                 if (text === "/save" || text.startsWith("/save ") || text.startsWith("/save@")) {
-                    if (!this.classicChannels.isAdmin(msg.userId)) {
+                    // Channel-admin, as on Discord (#754): a fleet admin of this bot or a ClassicBot admin.
+                    if (!this.isModelAdmin(msg.userId, chatId, msg.adapterId)) {
                         await msgAdapter?.sendText(chatId, t("cmd.admin_required", "/save"));
                         return;
                     }
@@ -5919,8 +6927,8 @@ export class FleetManager {
                     this.logger.info(`${msg.username} → ${generalInstance}: ${(text ?? "").slice(0, 100)}`);
                     this.eventLog?.logActivity("message", msg.username, (text ?? "").slice(0, 200), generalInstance);
                     this.emitSseEvent("message", {
-                        instance: generalInstance, sender: msg.username,
-                        text: (text ?? "").slice(0, 2000), ts: new Date().toISOString(),
+                        instance: generalInstance, sender: msg.username, role: "user",
+                        text: (text ?? "").slice(0, WEB_CHAT_TEXT_MAX), ts: new Date().toISOString(),
                     });
                     this.trackInboundMsg(generalInstance, msg);
                     void this.sendCancelButton(generalInstance);
@@ -6033,8 +7041,8 @@ export class FleetManager {
         this.logger.info(`${msg.username} → ${instanceName}: ${(text ?? "").slice(0, 100)}`);
         this.eventLog?.logActivity("message", msg.username, (text ?? "").slice(0, 200), instanceName);
         this.emitSseEvent("message", {
-            instance: instanceName, sender: msg.username,
-            text: (text ?? "").slice(0, 2000), ts: new Date().toISOString(),
+            instance: instanceName, sender: msg.username, role: "user",
+            text: (text ?? "").slice(0, WEB_CHAT_TEXT_MAX), ts: new Date().toISOString(),
         });
         this.trackInboundMsg(instanceName, msg);
         void this.sendCancelButton(instanceName);
@@ -6086,6 +7094,34 @@ export class FleetManager {
      * their fleet is organised. Both stay theirs — this only makes sure they are
      * not discovered by an agent failing at three in the morning.
      */
+    /**
+     * #1366: the first time a fleet runs 2.2 or later, tell each chat platform's General — once — that its agents can
+     * now be talked to from a browser. Claimed in upgrade-notices.json before the send, released if the send fails.
+     * Platforms with nowhere to post fleet notices (no group, or a Discord fleet with no General channel) are skipped
+     * and not recorded, so they are told once they have one.
+     */
+    async announceWebChatOnce(version) {
+        if (!hasWebChat(version))
+            return;
+        const path = upgradeNoticesPath(this.dataDir);
+        for (const [adapterId, world] of this.worlds) {
+            if (this.shuttingDown)
+                return;
+            const target = this.fleetNoticeTarget(adapterId);
+            if (!target)
+                continue;
+            if (!claimNotice(path, WEB_CHAT_NOTICE, adapterId))
+                continue;
+            try {
+                await world.adapter.sendText(target.chatId, t("upgrade.web_chat", WEB_REMOTE_DOCS_URL), target.opts);
+                this.logger.info({ adapterId, notice: WEB_CHAT_NOTICE }, "Announced web chat in General");
+            }
+            catch (err) {
+                const released = releaseNotice(path, WEB_CHAT_NOTICE, adapterId);
+                this.logger.warn({ err, adapterId, released }, "Could not announce web chat in General — will try at the next start");
+            }
+        }
+    }
     announceToolPermissionsChange() {
         try {
             const thirtyDaysAgo = new Date(Date.now() - 30 * 864e5).toISOString().slice(0, 19).replace("T", " ");
@@ -6150,7 +7186,10 @@ export class FleetManager {
             respond(null, permitted.message);
             return;
         }
-        if (this.worlds.size === 0) {
+        // A fleet with no chat platform at all is driven from the web dashboard alone: a reply has nowhere
+        // else to go, and "retry shortly" would have the agent retry forever. It goes to the web chat.
+        const webOnlyReply = tool === "reply" && this.worlds.size === 0 && this.isWebOnlyFleet();
+        if (this.worlds.size === 0 && !webOnlyReply) {
             respond(null, "Channel adapters are not ready — retry shortly");
             return;
         }
@@ -6178,7 +7217,8 @@ export class FleetManager {
         }
         const outAdapter = contextWorld?.adapter
             ?? this.getAdapterForInstance(senderInstanceName ?? instanceName)
-            ?? this.adapter;
+            ?? this.adapter
+            ?? (webOnlyReply ? WEB_ONLY_REPLY_SINK : null);
         if (!outAdapter) {
             respond(null, "No adapter available");
             return;
@@ -6206,6 +7246,28 @@ export class FleetManager {
         // still in flight and about to succeed. One real send, everyone gets its
         // outcome; a genuinely failed send clears the entry so a retry passes.
         if (tool === "reply") {
+            // Registered synchronously before a web message is handed to this CLI.
+            // This waits only on display ordering, never on the web delivery itself.
+            const echoTail = this.webChannelEchoTails.get(instanceName)?.tail;
+            if (echoTail) {
+                const replyClient = this.instanceIpcClients.get(instanceName);
+                const bindingName = senderInstanceName ?? instanceName;
+                const binding = this.getAdapterForInstance(bindingName);
+                const bindingGroup = this.getGroupIdForInstance(bindingName);
+                const bindingTopic = this.fleetConfig?.instances[bindingName]?.topic_id;
+                await echoTail;
+                // A replacement daemon must not receive this old tool's response or
+                // publish its reply after the new async ordering boundary.
+                if (this.instanceIpcClients.get(instanceName) !== replyClient)
+                    return;
+                if (this.getAdapterForInstance(bindingName) !== binding
+                    || this.getGroupIdForInstance(bindingName) !== bindingGroup
+                    || this.fleetConfig?.instances[bindingName]?.topic_id !== bindingTopic
+                    || (contextAdapterId && this.worlds.get(contextAdapterId)?.adapter !== outAdapter)) {
+                    respond(null, "Channel binding changed while waiting for the web echo");
+                    return;
+                }
+            }
             // Stickers (#1226) are checked before anything is sent: a refused one is the reply's error, not a gap.
             const stickerProblem = await this.replyStickerProblem(outAdapter, args, threadId, contextAdapterId ?? this.getInstanceAdapterId(senderInstanceName ?? instanceName));
             if (stickerProblem) {
@@ -6238,6 +7300,14 @@ export class FleetManager {
                         this.logger.warn({ err, instanceName }, "Reply delivered but post-delivery bookkeeping failed");
                     }
                 }
+                else if (!error && result != null && outAdapter === WEB_ONLY_REPLY_SINK) {
+                    // A daemon status line skips the bookkeeping, but on a web-only fleet the web chat is the only
+                    // place anyone could read it.
+                    this.emitSseEvent("message", {
+                        instance: instanceName, sender: senderSessionName ?? instanceName, role: "status",
+                        text: String(args.text ?? "").slice(0, WEB_CHAT_TEXT_MAX), ts: new Date().toISOString(),
+                    });
+                }
             };
             if (routeToolCall(outAdapter, tool, args, threadId, respondAndRecord)) {
                 return;
@@ -6266,6 +7336,15 @@ export class FleetManager {
         }
     }
     /** Side effects of a routed reply: cancel-button lifecycle, logs, SSE, chat log. */
+    /** No chat platform is configured at all: the web dashboard is the fleet's only surface. */
+    isWebOnlyFleet() {
+        const config = this.fleetConfig;
+        return config != null && !config.channel && !(config.channels?.length);
+    }
+    /** On a fleet with no chat platform, the dashboard is where an instance-health prompt is posted (#1307 item 6). */
+    webOnlyPromptPlace() {
+        return this.worlds.size === 0 && this.isWebOnlyFleet() ? { adapter: WEB_ONLY_PROMPT_SINK, adapterId: "web", chatId: "web" } : null;
+    }
     afterReplyRouted(instanceName, args, senderSessionName) {
         // A reply is NOT proof the turn is over (#410) — but it is not proof of
         // more work either. Split the difference: an instance that is clearly
@@ -6283,10 +7362,20 @@ export class FleetManager {
         this.reactDone(instanceName);
         const replyTo = this.lastInboundUser.get(instanceName) ?? "user";
         this.logger.info(`${instanceName} → ${replyTo}: ${(args.text ?? "").slice(0, 100)}`);
+        // Files the agent attached are shown in the web chat too: registered for fetching by id (the path
+        // already passed the reply tool's sendability check, and is resolved once more here), never by path.
+        const replyFiles = Array.isArray(args.files) ? args.files.filter((f) => typeof f === "string") : [];
+        const attachments = replyFiles
+            .map(path => this.webFiles.registerServed({ path, instance: instanceName }))
+            .filter((f) => f !== null)
+            .map(publicAttachment);
+        // The one place a delivered agent reply reaches the web chat: the server marks it `agent` (#1306) — the only
+        // role that may get HTML preview cards. Never inferred from the sender name or the text.
         this.emitSseEvent("message", {
-            instance: instanceName, sender: senderSessionName ?? instanceName,
-            text: (args.text ?? "").slice(0, 2000),
+            instance: instanceName, sender: senderSessionName ?? instanceName, role: "agent",
+            text: (args.text ?? "").slice(0, WEB_CHAT_TEXT_MAX),
             ts: new Date().toISOString(),
+            ...(attachments.length ? { attachments } : {}),
         });
         // Log bot reply to classic instance chat-log
         const isClassic = this.classicChannels?.getChannelIdByInstance(instanceName) !== undefined;
@@ -6295,22 +7384,57 @@ export class FleetManager {
         }
     }
     // ===================== Scheduler =====================
-    async handleScheduleTrigger(schedule, stableRunId = randomUUID()) {
-        const { target, reply_chat_id, reply_thread_id, message, label, id, source, silent } = schedule;
+    async handleScheduleTrigger(schedule, stableRunId = randomUUID(), retry) {
+        const { target, reply_chat_id, reply_thread_id, label, id, source, silent } = schedule;
+        // #1426: the retry of a deferred occurrence says so in every status it records.
+        const runStatus = (status) => (retry ? `deferred → ${status} (retry)` : status);
         const RATE_LIMIT_DEFER_THRESHOLD = 85;
         const rl = this.statuslineWatcher.getRateLimits(target);
-        if (rl && rl.five_hour_pct > RATE_LIMIT_DEFER_THRESHOLD) {
-            this.scheduler.recordRun(id, "deferred", `5hr rate limit at ${rl.five_hour_pct}%`);
+        // A reading whose window has reset describes a window that no longer exists: claude-code rewrites statusline.json
+        // only when it renders, so an idle instance keeps its last percentage long after the reset (#1426).
+        const nowMs = Date.now();
+        const windowCurrent = rl != null && (rl.five_hour_resets_at_ms === null || nowMs < rl.five_hour_resets_at_ms);
+        if (rl && windowCurrent && rl.five_hour_pct > RATE_LIMIT_DEFER_THRESHOLD) {
+            const resetsAtMs = rl.five_hour_resets_at_ms;
+            if (retry) {
+                // The window it waited for reset, and a new one is over the threshold again: deferred again — given up.
+                if (retry.resets_at_ms !== null && nowMs >= retry.resets_at_ms) {
+                    if (this.scheduler.endRetry(retry))
+                        this.scheduleRetryDropped(schedule, retry, "deferred_again");
+                    return;
+                }
+                // No reset time to wait for yet (or a new one learnt): look again later, within the deadline.
+                const later = this.scheduler.postponeRetry(retry, resetsAtMs, nowMs);
+                if ("dropped" in later)
+                    this.scheduleRetryDropped(schedule, later.retry, later.dropped);
+                else
+                    this.logger.info({ target, scheduleId: id, runId: stableRunId, dueAt: new Date(later.due_at_ms).toISOString() }, "Schedule retry still rate limited — looking again later");
+                return;
+            }
+            const pending = this.scheduler.deferForRetry(schedule, stableRunId, { deferredPct: rl.five_hour_pct, resetsAtMs, nowMs });
+            const dueAt = "dropped" in pending ? null : pending.due_at_ms;
+            this.scheduler.recordRun(id, "deferred", `5hr rate limit at ${rl.five_hour_pct}%`
+                + (dueAt !== null ? `; retry at ${new Date(dueAt).toISOString()}` : ""));
             this.eventLog?.insert(target, "schedule_deferred", {
                 schedule_id: id,
                 label,
                 five_hour_pct: rl.five_hour_pct,
+                retry_at: dueAt !== null ? new Date(dueAt).toISOString() : null,
             });
             this.webhookEmitter?.emit("schedule_deferred", target, { schedule_id: id, label, five_hour_pct: rl.five_hour_pct });
-            this.notifyInstanceTopic(target, t("schedule.deferred", label ?? id, rl.five_hour_pct));
-            this.logger.info({ target, scheduleId: id, rateLimitPct: rl.five_hour_pct }, "Schedule deferred due to rate limit");
+            this.notifyInstanceTopic(target, dueAt !== null
+                ? t("schedule.deferred_retry", label ?? id, rl.five_hour_pct, scheduleClock(dueAt, schedule.timezone))
+                : t("schedule.deferred", label ?? id, rl.five_hour_pct));
+            this.logger.info({ target, scheduleId: id, rateLimitPct: rl.five_hour_pct, retryAt: dueAt }, "Schedule deferred due to rate limit");
+            if ("dropped" in pending)
+                this.scheduleRetryDropped(schedule, pending.retry, pending.dropped);
             return;
         }
+        // #1426: the retry runs now — removed first, so a crash from here loses it rather than running it twice.
+        if (retry && !this.scheduler.endRetry(retry))
+            return;
+        // The agent sees it is a retry, and of what (a silent schedule pastes its raw command unchanged).
+        const message = retry && !silent ? `${scheduleRetryLabel(retry, schedule.timezone)}\n${schedule.message}` : schedule.message;
         // Silent mode: paste directly to tmux pane — no channel message.
         if (silent) {
             // The outbox commit is the schedule's durable acceptance point. The run
@@ -6336,7 +7460,7 @@ export class FleetManager {
                     schedule_run_id: stableRunId,
                 },
             });
-            this.scheduler.recordRun(id, "queued", `durable raw_paste delivery_id=${admitted.delivery.deliveryId}`);
+            this.scheduler.recordRun(id, runStatus("queued"), `durable raw_paste delivery_id=${admitted.delivery.deliveryId}`);
             this.logger.info({ target, scheduleId: id, runId: stableRunId, deliveryId: admitted.delivery.deliveryId, duplicate: !admitted.inserted }, "Silent schedule durably admitted as raw_paste");
             this.scheduleDeliveryOutboxPump();
             return;
@@ -6344,7 +7468,12 @@ export class FleetManager {
         const schedulerDefaults = this.fleetConfig?.defaults.scheduler;
         const retryCount = schedulerDefaults?.retry_count ?? 3;
         const retryInterval = schedulerDefaults?.retry_interval_ms ?? 30_000;
+        // #1426: a retry is only good until its deadline (the next occurrence or the cap) — through the idle wait and up to
+        // the IPC hand-off itself, not just when it starts.
+        const retryCurrent = retry ? () => Date.now() < retry.deadline_ms : undefined;
         const deliver = async () => {
+            if (retryCurrent && !retryCurrent())
+                return "past-deadline";
             try {
                 // A schedule has no live inbound adapter context. Seed the daemon with
                 // the target instance's configured world so replies use its persona
@@ -6361,7 +7490,7 @@ export class FleetManager {
                 if (foreignWorld) {
                     this.logger.warn({ scheduleId: id, target, foreignWorld, targetWorld: adapterId, chatId: reply_chat_id }, "Schedule reply target belongs to another channel world — not seeding chat context; the instance keeps its own last known chat");
                 }
-                await this.deliverToInstance(target, {
+                const handed = await this.deliverToInstance(target, {
                     type: "fleet_schedule_trigger",
                     payload: { schedule_id: id, message: `[Scheduled] ${message}`, label },
                     meta: {
@@ -6372,7 +7501,9 @@ export class FleetManager {
                         user: "scheduler",
                         ...(adapterId ? { adapter_id: adapterId } : {}),
                     },
-                }, { waitForIdle: true });
+                }, { waitForIdle: true, ...(retryCurrent ? { stillCurrent: retryCurrent } : {}) });
+                if (handed === false && retryCurrent && !retryCurrent())
+                    return "past-deadline";
                 // A scheduled trigger also puts the instance to work — show a cancel button.
                 void this.sendCancelButton(target);
                 return true;
@@ -6382,22 +7513,35 @@ export class FleetManager {
                 return false;
             }
         };
-        if (await deliver()) {
-            this.scheduler.recordRun(id, "delivered");
+        const pastDeadline = () => {
+            this.scheduleRetryDropped(schedule, retry, retry.deadline_kind === "next_occurrence" ? "superseded" : "expired");
+        };
+        const first = await deliver();
+        if (first === "past-deadline") {
+            pastDeadline();
+            return;
+        }
+        if (first) {
+            this.scheduler.recordRun(id, runStatus("delivered"));
             if (source !== target)
                 this.notifySourceTopic(schedule);
             return;
         }
         for (let i = 0; i < retryCount; i++) {
             await new Promise((r) => setTimeout(r, retryInterval));
-            if (await deliver()) {
-                this.scheduler.recordRun(id, "delivered");
+            const again = await deliver();
+            if (again === "past-deadline") {
+                pastDeadline();
+                return;
+            }
+            if (again) {
+                this.scheduler.recordRun(id, runStatus("delivered"));
                 if (source !== target)
                     this.notifySourceTopic(schedule);
                 return;
             }
         }
-        this.scheduler.recordRun(id, "instance_offline", `retry ${retryCount}x failed`);
+        this.scheduler.recordRun(id, runStatus("instance_offline"), `retry ${retryCount}x failed`);
         this.notifyScheduleFailure(schedule);
     }
     /**
@@ -6477,6 +7621,38 @@ export class FleetManager {
             threadId: schedule.reply_thread_id ?? undefined,
         }).catch((err) => this.logger.error({ err }, "Failed to send schedule failure notification"));
     }
+    /**
+     * #1426: a deferred occurrence's retry will not run — superseded by the next occurrence, deferred again, or its wait
+     * capped. Recorded as `deferred → skipped (…)`, and said in the schedule's own chat with its admins @mentioned:
+     * this is the case that used to be a silently lost day.
+     */
+    scheduleRetryDropped(schedule, retry, reason) {
+        const why = { superseded: "superseded", deferred_again: "deferred again", expired: "expired" }[reason];
+        this.scheduler?.recordRun(schedule.id, `deferred → skipped (${why})`, `run ${retry.run_id} deferred at ${retry.deferred_pct}%`);
+        this.eventLog?.insert(schedule.target, "schedule_retry_dropped", { schedule_id: schedule.id, label: schedule.label, run_id: retry.run_id, reason });
+        this.logger.warn({ scheduleId: schedule.id, target: schedule.target, runId: retry.run_id, reason }, "Deferred schedule occurrence will not run");
+        const reasonText = reason === "superseded"
+            ? t("schedule.retry_reason_superseded", scheduleClock(retry.deadline_ms, schedule.timezone))
+            : reason === "deferred_again" ? t("schedule.retry_reason_deferred_again")
+                : t("schedule.retry_reason_expired", Math.round(Scheduler.RETRY_MAX_WAIT_MS / 60_000));
+        const adapter = this.scheduleSourceAdapter(schedule);
+        if (!adapter) {
+            this.notifyInstanceTopic(schedule.target, t("schedule.retry_dropped", "", schedule.label ?? schedule.id, scheduleClock(Date.parse(retry.run_id) || retry.deferred_at_ms, schedule.timezone), retry.deferred_pct, reasonText).trimStart());
+            return;
+        }
+        const admins = this.adminListOf(adapter.id) ?? [];
+        const html = adapter.type === "telegram";
+        const mention = admins.map(adminId => adapter.type === "discord" ? `<@${adminId}>`
+            : html ? `<a href="tg://user?id=${encodeURIComponent(adminId)}">admin</a>` : "").filter(Boolean).join(" ");
+        const due = scheduleClock(Date.parse(retry.run_id) || retry.deferred_at_ms, schedule.timezone);
+        const text = html
+            ? t("schedule.retry_dropped", mention, escapeTelegramHtml(schedule.label ?? schedule.id), due, retry.deferred_pct, escapeTelegramHtml(reasonText))
+            : t("schedule.retry_dropped", mention, schedule.label ?? schedule.id, due, retry.deferred_pct, reasonText);
+        adapter.sendText(schedule.reply_chat_id, text.trimStart(), {
+            threadId: schedule.reply_thread_id ?? undefined,
+            ...(html ? { format: "html" } : {}),
+        }).catch((err) => this.logger.error({ err }, "Failed to send the deferred-schedule escalation"));
+    }
     /**
      * The typed IPC messages, all through one door.
      *
@@ -7353,6 +8529,7 @@ export class FleetManager {
      * non-identity instance leaves are canonicalized to inheritance afterward.
      */
     saveFleetConfig(explicitPatches = []) {
+        this.publicWebLink?.refresh();
         if (!this.fleetConfig || !this.configPath)
             return;
         if (!this.savedFleetConfigSnapshot)
@@ -7398,6 +8575,7 @@ export class FleetManager {
                 this.rawFleetDocument.deleteIn(parentPath);
             }
         }
+        noteSettingsWrite(this.configPath, this.savedFleetConfigSnapshot, this.fleetConfig);
         const output = String(this.rawFleetDocument);
         if (redundantPaths.length > 0)
             this.writeFleetConfigBackup(source);
@@ -7440,9 +8618,18 @@ export class FleetManager {
         renameSync(tempPath, backupPath);
     }
     patchFleetDocument(document, path, before, after) {
-        if (Object.is(before, after))
+        if (Object.is(before, after) || JSON.stringify(before) === JSON.stringify(after))
             return;
         if (Array.isArray(before) && Array.isArray(after)) {
+            // Connection deltas are indexed only while the stable identities still
+            // match. Never apply a stale manager's edit to a reordered world.
+            if (path.length === 1 && path[0] === "channels") {
+                const fresh = document.getIn(path)?.toJSON?.() ?? document.getIn(path);
+                const ids = (items) => items.map(item => item?.id ?? item?.type);
+                if (Array.isArray(fresh) && JSON.stringify(ids(fresh)) !== JSON.stringify(ids(before))) {
+                    throw new Error("Connection order changed; reload before saving");
+                }
+            }
             const shared = Math.min(before.length, after.length);
             for (let i = 0; i < shared; i++) {
                 this.patchFleetDocument(document, [...path, i], before[i], after[i]);
@@ -7498,42 +8685,66 @@ export class FleetManager {
             }
         }
     }
-    async removeInstance(name, authorization) {
+    getSettingsConfigPath() { return this.configPath; }
+    async removeInstance(name, authorization, execution) {
+        if (execution)
+            return this.lifecycle.runTransition(name, transition => this.removeInstanceOwned(name, authorization, execution, transition));
+        return this.removeInstanceOwned(name, authorization);
+    }
+    async removeInstanceOwned(name, authorization, execution, transition) {
+        execution?.assert();
         assertExplicitInstanceRemoval(authorization);
-        // Drop cached pane context — the map is keyed by instance name and nothing
-        // else evicted deleted entries, so it grew for the life of the process.
-        forgetInstanceContext(name);
-        // Clean up schedules (scheduler is fleet-level, not lifecycle-level)
-        const config = this.fleetConfig?.instances[name];
-        if (this.scheduler && config?.topic_id) {
-            const count = this.scheduler.deleteByInstanceOrThread(name, String(config.topic_id));
-            if (count > 0) {
-                this.logger.info({ name, count }, "Cleaned up schedules for deleted instance");
-            }
-        }
-        // Clean up team memberships
-        if (this.fleetConfig?.teams) {
-            for (const [teamName, team] of Object.entries(this.fleetConfig.teams)) {
-                const idx = team.members.indexOf(name);
-                if (idx !== -1) {
-                    team.members.splice(idx, 1);
-                    this.logger.info({ team: teamName, instance: name }, "Removed deleted instance from team");
+        const beforeRemoval = () => {
+            // Drop cached pane context — the map is keyed by instance name and nothing
+            // else evicted deleted entries, so it grew for the life of the process.
+            forgetInstanceContext(name);
+            // Clean up schedules (scheduler is fleet-level, not lifecycle-level)
+            const config = this.fleetConfig?.instances[name];
+            if (this.scheduler && config?.topic_id) {
+                const count = this.scheduler.deleteByInstanceOrThread(name, String(config.topic_id));
+                if (count > 0) {
+                    this.logger.info({ name, count }, "Cleaned up schedules for deleted instance");
                 }
-                if (team.members.length === 0) {
-                    delete this.fleetConfig.teams[teamName];
-                    this.logger.info({ team: teamName }, "Deleted empty team");
+            }
+            // Clean up team memberships
+            if (this.fleetConfig?.teams) {
+                for (const [teamName, team] of Object.entries(this.fleetConfig.teams)) {
+                    const idx = team.members.indexOf(name);
+                    if (idx !== -1) {
+                        team.members.splice(idx, 1);
+                        this.logger.info({ team: teamName, instance: name }, "Removed deleted instance from team");
+                    }
+                    if (team.members.length === 0) {
+                        delete this.fleetConfig.teams[teamName];
+                        this.logger.info({ team: teamName }, "Deleted empty team");
+                    }
                 }
             }
-        }
+        };
+        if (execution)
+            execution.mutate(beforeRemoval);
+        else
+            beforeRemoval();
         // Capture instance dir BEFORE lifecycle.remove, which deletes the instance
         // from fleetConfig. (The backend would be unresolvable afterwards.)
         const instanceDirToClean = this.getInstanceDir(name);
-        await this.lifecycle.remove(name, authorization);
+        if (execution)
+            await this.lifecycle.remove(name, authorization, execution, transition);
+        else
+            await this.lifecycle.remove(name, authorization);
+        // A later same-name registration owns its files and caches.
+        if (this.fleetConfig?.instances[name] || this.daemons.has(name))
+            return;
+        execution?.assert();
         // Clean up per-instance tracking maps so they don't grow unbounded
         // as instances are created and deleted over the lifetime of the fleet.
         this.lastActivity.delete(name);
         this.lastInboundUser.delete(name);
         this.rateLimitWarnedAt.delete(name);
+        // Its web chat goes with it (only after the removal succeeded): a later instance of the same name
+        // must not be shown the old one's conversation, and deleted names must not pile up.
+        this.webChatHistory.forget(name);
+        this.webFiles.forget(name);
         // Clean up statusline watcher + instance directory
         this.statuslineWatcher.unwatch(name);
         // instanceDirToClean and effectiveBackend are captured before lifecycle.remove
@@ -7552,6 +8763,7 @@ export class FleetManager {
         // short home that would otherwise be inherited by a later same-name instance.
         try {
             const { CodexBackend } = await import("./backend/codex.js");
+            execution?.assert();
             const shortHome = CodexBackend.shortHomeFor(instanceDirToClean);
             if (existsSync(shortHome))
                 rmSync(shortHome, { recursive: true, force: true });
@@ -7559,6 +8771,7 @@ export class FleetManager {
         catch (err) {
             this.logger.debug({ err, name }, "Codex short home cleanup failed");
         }
+        execution?.complete();
     }
     startStatuslineWatcher(name) {
         if (this.lifecycle.isPaused(name))
@@ -7643,8 +8856,13 @@ export class FleetManager {
         const listEmojis = adapter.listGuildEmojis.bind(adapter);
         let servers;
         try {
+            // This authenticated metadata picker is not a start/admission path. Keep
+            // its existing empty-list inventory so existing channels' emoji settings
+            // do not disappear when new-start access changes (#1418).
+            const guildList = this.classicChannels?.getDefaults().allowed_guilds;
+            const unrestrictedInventory = !!this.classicChannels && (!Array.isArray(guildList) || guildList.length === 0);
             servers = adapter.listMemberGuilds
-                ? (await adapter.listMemberGuilds()).filter(g => g.primary || (this.classicChannels?.isGuildAllowed(g.id) ?? false))
+                ? (await adapter.listMemberGuilds()).filter(g => g.primary || unrestrictedInventory || (this.classicChannels?.isGuildAllowed(g.id) ?? false))
                 : [{ id: "", name: "", primary: true }];
         }
         catch (e) {
@@ -8202,6 +9420,12 @@ export class FleetManager {
         return reactionForm(resolved.platform, kind === "photo" ? resolved.photo : resolved.attachment);
     }
     reactMessageStatus(instanceName, chatId, messageId, status, threadId, receivedAt) {
+        // A message the web user sent is no message on any platform: there is nothing to react on, and an id
+        // like web-… would only fail there. Its ticks are the dashboard's (web track C3).
+        if (isWebMessageId(messageId)) {
+            this.reportWebDelivery(instanceName, messageId, status);
+            return;
+        }
         // React via the adapter BOUND to this instance — NOT the first discord world.
         // Otherwise, in a same-channel/same-guild multi-bot setup, the inbound 👀
         // (bound bot) and the delivery/confirm reactions (some other bot) come from
@@ -8224,6 +9448,14 @@ export class FleetManager {
         const key = `${adapterId}:${chatId}:${threadId ?? ""}:${messageId}`;
         this.queueDeliveryStatusReaction(adapter, key, chatId, messageId, statusEmoji, threadId, status, status === "received" ? receivedAt : undefined);
     }
+    /** One delivery report for a web user's message: recorded with it, and sent to the pages when it moved. */
+    reportWebDelivery(instanceName, messageId, status) {
+        if (status !== "queued" && status !== "processing" && status !== "delivered" && status !== "failed")
+            return;
+        const m = this.webChatHistory.setDelivery(instanceName, messageId, status);
+        if (m)
+            this.emitSseEvent("delivery", { instance: instanceName, messageId, delivery: m.delivery });
+    }
     /**
      * Apply a terminal delivery verdict. On Telegram the built-in delivered is
      * 👀 and failed is 👎; Discord shows ✅/❌ — both configurable (#1005).
@@ -8736,6 +9968,7 @@ export class FleetManager {
         // install-backend-menu.test.ts and classic-approve-buttons.test.ts.
         const nonce = randomBytes(16).toString("hex");
         const entry = {
+            nonce,
             prefix: opts.prefix,
             instanceName: opts.instanceName,
             adapterId: opts.adapterId,
@@ -8743,6 +9976,7 @@ export class FleetManager {
             chatId: opts.chatId,
             threadId: opts.threadId,
             expiredText: opts.expiredText,
+            createdAt: Date.now(),
             ...opts.extra,
         };
         entry.timer = setTimeout(() => {
@@ -8750,6 +9984,7 @@ export class FleetManager {
             if (pending !== entry)
                 return;
             this.pendingNonceButtons.delete(nonce);
+            this.webPromptGone(entry, entry.expiredText);
             if (entry.messageId && entry.adapter.editMessageRemoveButtons) {
                 entry.adapter.editMessageRemoveButtons(entry.chatId, entry.messageId, entry.expiredText, entry.threadId).catch(err => this.logger.debug({ err, instanceName: entry.instanceName, prefix: entry.prefix }, "Failed to expire button prompt"));
             }
@@ -8757,11 +9992,12 @@ export class FleetManager {
         entry.timer.unref?.();
         this.pendingNonceButtons.set(nonce, entry);
         try {
-            const sent = await opts.adapter.notifyAlert(opts.chatId, {
+            const choices = opts.choices.map(c => ({ id: `${opts.prefix}${nonce}:${c.action}`, label: c.label }));
+            const sent = opts.deliver ? await opts.deliver(choices) : await opts.adapter.notifyAlert(opts.chatId, {
                 type: opts.alertType,
                 instanceName: opts.instanceName,
                 message: opts.message,
-                choices: opts.choices.map(c => ({ id: `${opts.prefix}${nonce}:${c.action}`, label: c.label })),
+                choices,
             }, opts.threadId ? { threadId: opts.threadId } : undefined);
             // Bind the nonce to the provider's canonical delivery address, not the
             // logical routing input. Telegram, for example, represents General as
@@ -8775,6 +10011,16 @@ export class FleetManager {
                 entry.threadId = sent.threadId;
             }
             entry.messageId = sent.messageId;
+            // Offered on the dashboard only once it is live on the platform (a failed post is disarmed above),
+            // and only if nothing claimed or expired it meanwhile.
+            if (WEB_MIRRORED_PROMPT_PREFIXES.has(opts.prefix) && this.pendingNonceButtons.get(nonce) === entry) {
+                entry.web = {
+                    text: opts.message,
+                    actions: opts.choices.map(c => ({ id: c.action, label: c.label })),
+                    expiresAt: Date.now() + (opts.timeoutMs ?? NONCE_BUTTON_TIMEOUT_MS),
+                };
+                this.emitSseEvent("prompt", { instance: entry.instanceName, nonce, ...entry.web });
+            }
             return nonce;
         }
         catch (err) {
@@ -8827,13 +10073,18 @@ export class FleetManager {
         // Bind the capability to the exact message/world that created it. Telegram
         // keyboards are visible to everyone, so mutating actions require fleet admin;
         // a Tip acknowledgement only records that the shared content was read.
-        const isAuthorized = data.userId
-            ? pending.allowAnyUser
-                ? true
-                : pending.authChannelId
-                    ? this.isModelAdmin(data.userId, pending.authChannelId, callbackAdapterId)
-                    : this.isFleetAdmin(data.userId, callbackAdapterId)
-            : false;
+        // A dashboard click carries the full-fleet web session (checked by the web gate before it got here),
+        // and is good only for a prompt that was offered on the dashboard.
+        const fromWeb = this.webPromptClicks.has(data);
+        const isAuthorized = fromWeb
+            ? pending.web !== undefined
+            : data.userId
+                ? pending.allowAnyUser
+                    ? true
+                    : pending.authChannelId
+                        ? this.isModelAdmin(data.userId, pending.authChannelId, callbackAdapterId)
+                        : this.isFleetAdmin(data.userId, callbackAdapterId)
+                : false;
         const mismatchedFields = [];
         if (pending.adapterId !== callbackAdapterId)
             mismatchedFields.push("adapterId");
@@ -8845,6 +10096,8 @@ export class FleetManager {
             mismatchedFields.push("messageId");
         if (!isAuthorized)
             mismatchedFields.push("authorization");
+        if (pending.requesterUserId && pending.requesterUserId !== data.userId)
+            mismatchedFields.push("requester");
         if (mismatchedFields.length > 0) {
             // Deliberately does NOT consume the nonce: the real admin can still click.
             this.logger.warn({
@@ -8862,6 +10115,10 @@ export class FleetManager {
         this.pendingNonceButtons.delete(match[1]);
         if (pending.timer)
             clearTimeout(pending.timer);
+        if (fromWeb)
+            this.webPromptClaims.add(data);
+        // The dashboard's copy goes now; the outcome line follows from retireNonceButtons.
+        this.webPromptGone(pending);
         return { entry: pending, action: match[2] };
     }
     /** Collapse a consumed prompt's buttons into a final status line. */
@@ -8900,12 +10157,18 @@ export class FleetManager {
     }
     /** Routes a click to the handler that owns its prefix; false when none does. */
     async dispatchAdapterCallback(data, adapterId, adapter) {
+        if (this.needsYou?.handleCallback(data, adapterId))
+            return true;
         if (await this.handleTipDismiss(data, adapterId, adapter))
             return true;
         if (await this.handleTipUnlock(data, adapterId, adapter))
             return true;
         if (await this.handleLoginBackendSelect(data, adapterId, adapter))
             return true;
+        if (await this.handleSettingsChangeCallback(data, adapterId, adapter))
+            return true;
+        if (await this.handleDashboardCallback(data, adapterId, adapter))
+            return true;
         if (await this.handleClassicApproval(data, adapterId, adapter))
             return true;
         if (this.handleRetiredPromptButton(data, adapterId, adapter))
@@ -8922,19 +10185,246 @@ export class FleetManager {
             return true;
         if (await this.handleClassicBackendSelection(data))
             return true;
-        if (await this.handleModelSelection(data))
+        if (await this.handleModelSelection(data, adapterId))
             return true;
-        if (await this.handleEffortSelection(data))
+        if (await this.handleEffortSelection(data, adapterId))
             return true;
         if (await this.handleHangPrompt(data, adapterId, adapter))
             return true;
         if (data.callbackData.startsWith("cancel:")) {
-            this.handleCancelClick(data.callbackData.slice("cancel:".length), adapter ?? null, data);
+            this.handleCancelClick(data.callbackData.slice("cancel:".length), adapter ?? null, data, adapterId);
             return true;
         }
-        return false;
+        return false;
+    }
+    /**
+     * A prompt the dashboard was offered is no longer open (answered on either surface, expired, or its
+     * instance stopped): every page drops its buttons, and shows `outcome` when there is one.
+     */
+    webPromptGone(entry, outcome) {
+        if (!entry.web || !entry.nonce)
+            return;
+        this.emitSseEvent("prompt_resolved", { instance: entry.instanceName, nonce: entry.nonce, ...(outcome ? { outcome } : {}) });
+    }
+    // ── #1386 "Needs you" ─────────────────────────────────────────────────────────────────────────────────
+    /** The interaction wait an instance is in now, as a comparable key: which daemon/spawn owns it, and its episode. */
+    interactionWaitKey(name) {
+        const snapshot = this.getInstanceInteraction(name);
+        if (!snapshot)
+            return { owner: null, episode: null };
+        const o = snapshot.owner;
+        return { owner: o ? `${o.bootId}:${o.spawnGeneration}:${o.launchAttempt}:${o.launchFenceEpoch}` : null, episode: snapshot.episode };
+    }
+    /** An instance's interaction observation, pause or wake changed (relayed by the lifecycle): recompute now, not at the tick. */
+    onAttentionChanged(name) {
+        this.needsPauseCache.delete(name);
+        this.needsYou?.poke();
+    }
+    /** The list for the web: every world's items, and those of instances with no world (#1386 §5.0). */
+    needsYouItems() {
+        return this.needsYou?.webItems() ?? [];
+    }
+    /**
+     * #1389: the org chart's structure for the web — the instances the dashboard lists (getUiStatus's names), General,
+     * fleet.yaml's teams, each instance's description and thread link. Read on demand; the live state rides the stream.
+     */
+    orgChart() {
+        const config = this.fleetConfig;
+        const fleetNames = Object.keys(config?.instances ?? {});
+        const classic = new Map((this.classicChannels?.getAll() ?? []).filter(ch => !fleetNames.includes(ch.instanceName)).map(ch => [ch.instanceName, ch]));
+        return buildOrgChart({
+            names: [...fleetNames, ...classic.keys()],
+            instances: Object.fromEntries([
+                ...fleetNames.map(name => [name, config?.instances[name]]),
+                ...[...classic].map(([name, ch]) => [name, { description: ch.description }]),
+            ]),
+            teams: config?.teams,
+            isGeneral: name => !classic.has(name) && isGeneralInstance(config, name),
+            isClassic: name => classic.has(name),
+            place: name => {
+                const world = this.worlds.get(this.getInstanceAdapterId(name) ?? "");
+                return world ? { type: world.type, ...(world.groupId ? { groupId: world.groupId } : {}) } : undefined;
+            },
+            // fleet.yaml's topic only. A ClassicBot room has none here, so no link: its channel may sit in any allowed
+            // guild, not necessarily its world's group.
+            topic: name => {
+                const topic = config?.instances[name]?.topic_id;
+                return topic != null ? String(topic) : undefined;
+            },
+        });
+    }
+    /** The web's Acknowledge (any item; a signed-in session is fleet-admin level). */
+    acknowledgeNeedsItem(id, principal) {
+        if (!this.needsYou)
+            return { status: 409, message: t("needs.ack_already") };
+        return this.needsYou.webAcknowledge(id, principal);
+    }
+    needsYouInstances() {
+        const names = new Set(Object.keys(this.fleetConfig?.instances ?? {}));
+        for (const ch of this.classicChannels?.getAll() ?? [])
+            names.add(ch.instanceName);
+        const out = [];
+        for (const name of names) {
+            // Crashed only by the authoritative reconciliation: a daemon that recovered while its "running" IPC event was
+            // missed is running (getInstanceStatus clears the stale cache — before the presentation below reads it). Every
+            // observation that is not crashed forgets the crash time, so a later crash is a new item (#1398 review).
+            const crashed = this.instanceProcessStatus.get(name) === "crashed" && this.getInstanceStatus(name) === "crashed";
+            if (crashed) {
+                if (!this.needsCrashedAt.has(name))
+                    this.needsCrashedAt.set(name, Date.now());
+            }
+            else
+                this.needsCrashedAt.delete(name);
+            const p = this.instancePresentation(name);
+            const wait = p.interaction ? this.interactionWaitKey(name) : null;
+            let pauseReason = null, pausedAt = null;
+            if (this.lifecycle.isPaused(name)) {
+                const now = performance.now();
+                let cached = this.needsPauseCache.get(name);
+                if (!cached || now - cached.readAt >= NEEDS_PAUSE_TTL_MS) {
+                    const dir = this.getInstanceDir(name);
+                    cached = { reason: readPauseReason(dir), pausedAt: readPausedAt(dir), readAt: now };
+                    this.needsPauseCache.set(name, cached);
+                }
+                ({ reason: pauseReason, pausedAt } = cached);
+            }
+            else {
+                this.needsPauseCache.delete(name);
+            }
+            out.push({
+                name, state: p.state ?? undefined,
+                interaction: p.interaction ? { kind: p.interaction.kind, owner: wait?.owner ?? null, episode: p.interaction.episode, since: p.interaction.since } : null,
+                interactionSummary: p.interaction_summary ?? null,
+                pauseReason, pausedAt,
+                crashedAt: crashed ? (this.needsCrashedAt.get(name) ?? null) : null,
+            });
+        }
+        return out;
+    }
+    needsYouPrompts() {
+        const out = [];
+        for (const [nonce, e] of this.pendingNonceButtons) {
+            if (!e.web || !WEB_MIRRORED_PROMPT_PREFIXES.has(e.prefix))
+                continue;
+            out.push({
+                nonce, prefix: e.prefix, instance: e.instanceName, text: e.web.text, actions: e.web.actions,
+                createdAt: e.createdAt ?? Date.now(), adapterId: e.adapterId, chatId: e.chatId,
+                ...(e.threadId !== undefined ? { threadId: e.threadId } : {}), ...(e.messageId ? { messageId: e.messageId } : {}),
+                ...(e.assistFor ? { assistFor: e.assistFor } : {}),
+            });
+        }
+        return out;
+    }
+    /**
+     * Shutdown: detach the hub first — nothing reaches it from here on, and the next startAll (finishStartup) builds a
+     * fresh one; the old one's late ACKs are fenced by its own stop (#1398 review) — then let it retire its live
+     * messages, bounded so a platform that does not answer cannot hold the shutdown.
+     */
+    stopNeedsYou() {
+        const hub = this.needsYou;
+        this.needsYou = null;
+        if (!hub)
+            return undefined;
+        return Promise.race([hub.stop(), new Promise(resolve => setTimeout(resolve, 5_000).unref?.())]);
+    }
+    startNeedsYou() {
+        if (this.needsYou)
+            return;
+        const ownerOf = (instance) => {
+            const owner = this.getInstanceAdapterId(instance);
+            return owner !== undefined && this.worlds.has(owner) ? owner : undefined;
+        };
+        this.needsYou = new NeedsYouHub({
+            dataDir: this.dataDir,
+            now: () => Date.now(),
+            mono: () => performance.now(),
+            setTimer: (fn, ms) => { const h = setTimeout(fn, ms); h.unref?.(); return h; },
+            clearTimer: h => clearTimeout(h),
+            prompts: () => this.needsYouPrompts(),
+            instances: () => this.needsYouInstances(),
+            deliveries: since => (this.deliveryOutbox?.isOpen ? this.deliveryOutbox.needsAttention(since) : []).map(d => ({
+                deliveryId: d.deliveryId, state: d.state, source: d.sourceInstance, target: d.targetInstance, kind: d.kind,
+                finishedAt: Date.parse(d.finishedAt) || 0,
+            })),
+            ownerOf,
+            worlds: () => [...this.worlds.values()].map((w) => ({
+                id: w.id, adapter: w.adapter, place: { type: w.type, ...(w.groupId ? { groupId: w.groupId } : {}) },
+            })),
+            noticeTarget: world => {
+                const target = this.fleetNoticeTarget(world);
+                return target ? { chatId: target.chatId, ...(target.opts.threadId !== undefined ? { threadId: String(target.opts.threadId) } : {}) } : null;
+            },
+            instanceTopic: instance => {
+                const topic = this.fleetConfig?.instances[instance]?.topic_id;
+                if (topic != null)
+                    return String(topic);
+                return this.classicChannels?.getChannelIdByInstance(instance) ?? undefined;
+            },
+            isFleetAdmin: (userId, world) => this.isFleetAdmin(userId, world),
+            fleetAdmins: world => (this.getChannelConfig(world)?.access?.allowed_users ?? []).map(String),
+            emitSse: (event, data) => this.emitSseEvent(event, data),
+            acknowledge: (deliveryId, by) => {
+                if (!this.deliveryOutbox?.isOpen)
+                    throw new Error("the delivery outbox is not open");
+                return this.deliveryOutbox.acknowledge(deliveryId, by);
+            },
+            settings: () => ({
+                liveMessage: this.fleetConfig?.needs_you?.live_message !== false,
+                dm: this.fleetConfig?.needs_you?.dm === true,
+            }),
+            stopping: () => this.shuttingDown,
+            t: (key, ...args) => t(key, ...args),
+            log: (level, message, extra) => this.logger[level](extra ?? {}, message),
+        });
+        this.needsYou.start();
+    }
+    /** The prompts open on the dashboard right now (a page that loads after one was posted asks for them). */
+    listWebPrompts() {
+        const open = [];
+        for (const [nonce, e] of this.pendingNonceButtons) {
+            if (e.web)
+                open.push({ instance: e.instanceName, nonce, ...e.web });
+        }
+        return open;
+    }
+    /**
+     * A click on a prompt in the web dashboard (web track C4). It is the platform click, made by the
+     * dashboard: the same handler, the same single claim (whoever answers first — here or on Telegram —
+     * wins), and the platform's buttons collapse to the outcome exactly as for a click there.
+     *
+     * The caller has passed the /ui gate (session, same origin, CSRF). Here: the prompt must be one offered
+     * on the dashboard, about the instance the page named, and the action one of its own buttons.
+     */
+    async clickWebPrompt(instance, nonce, action) {
+        if (!/^[0-9a-f]{32}$/.test(nonce) || !/^[a-z][a-z-]{0,23}$/.test(action))
+            return { status: 400, error: "Malformed prompt answer" };
+        const entry = this.pendingNonceButtons.get(nonce);
+        // Unknown is the same answer as answered or expired: the page drops the buttons either way.
+        if (!entry || !entry.web)
+            return { status: 409, error: "This prompt is no longer open" };
+        if (entry.instanceName !== instance)
+            return { status: 403, error: "This prompt belongs to another instance" };
+        if (!entry.web.actions.some(a => a.id === action))
+            return { status: 400, error: "Not one of this prompt's answers" };
+        let notice;
+        const data = {
+            callbackData: `${entry.prefix}${nonce}:${action}`,
+            // The exact place the prompt lives, so the platform-side binding checks hold as for a click there.
+            chatId: entry.chatId,
+            threadId: entry.threadId,
+            messageId: entry.messageId ?? "",
+            userId: "web-user",
+            ack: n => { if (notice === undefined && n)
+                notice = n; },
+        };
+        this.webPromptClicks.add(data);
+        await this.dispatchAdapterCallback(data, entry.adapterId, entry.adapter);
+        if (this.webPromptClaims.has(data))
+            return { status: 200 };
+        return { status: 409, error: notice ?? "This prompt is no longer open" };
     }
     async retireNonceButtons(pending, messageId, text) {
+        this.webPromptGone(pending, text);
         try {
             if (!pending.adapter.editMessageRemoveButtons)
                 throw new Error("adapter cannot remove prompt buttons");
@@ -9045,7 +10535,8 @@ export class FleetManager {
             message: t("tips.advanced.unlock_prompt"),
             choices: [{ action: "unlock", label: t("tips.advanced.unlock") }],
             expiredText: t("tips.advanced.expired"),
-            extra: { allowAnyUser: true },
+            // No allowAnyUser: unlocking changes a persistent setting, which typed and slash `/tips advanced on` reserve for a
+            // fleet admin (#754 audit) — the default nonce check (fleet admin of the clicking adapter) applies.
             timeoutMs: TIP_BUTTON_TIMEOUT_MS,
         });
         return nonce !== null;
@@ -9202,9 +10693,69 @@ export class FleetManager {
             await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("clear.cancelled", pending.instanceName));
             return true;
         }
-        await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("clear.clearing", pending.instanceName));
+        // The nonce was claimed synchronously. Keep the exact owner across platform
+        // retirement awaits; a replacement with the same name is not this clear's
+        // target, and a role granted at claim time may be revoked while editing.
+        const ipc = this.instanceIpcClients.get(pending.instanceName);
+        const daemon = this.daemons.get(pending.instanceName);
+        const epoch = this.getDeliveryEpoch(pending.instanceName);
+        const groupId = this.getChannelConfig(callbackAdapterId)?.group_id;
+        // Object identity survives a resident daemon's respawn/freeze, and stop
+        // invalidates its lifecycle epoch before the queued work replaces objects.
+        // These reads are cached and synchronous; they never probe the pane.
+        const readOwner = () => {
+            try {
+                const owner = daemon?.getInteractionSnapshot?.()?.owner;
+                if (!owner || typeof owner.bootId !== "string" || !owner.bootId
+                    || ![owner.spawnGeneration, owner.launchAttempt, owner.launchFenceEpoch]
+                        .every(n => Number.isSafeInteger(n) && n >= 0))
+                    return null;
+                return { ...owner };
+            }
+            catch {
+                return null;
+            }
+        };
+        const readLifecycleEpoch = () => {
+            try {
+                const value = this.lifecycle?.epochOf(pending.instanceName);
+                return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : null;
+            }
+            catch {
+                return null;
+            }
+        };
+        const owner = readOwner(), lifecycleEpoch = readLifecycleEpoch();
+        const current = () => {
+            const currentOwner = readOwner();
+            try {
+                return !this.shuttingDown
+                    && !!data.userId && !!pending.authChannelId
+                    && !this.webPromptClicks.has(data) // clear is deliberately not web-mirrored
+                    && this.worlds.get(callbackAdapterId)?.adapter === pending.adapter
+                    && this.commandChannelStillTargets(pending.instanceName, pending.authChannelId, callbackAdapterId, pending.chatId)
+                    && this.isModelAdmin(data.userId, pending.authChannelId, callbackAdapterId)
+                    && (this.classicChannels?.getInstanceByChannel(pending.authChannelId, callbackAdapterId) === pending.instanceName
+                        ? pending.adapter.type !== "telegram" || pending.chatId === pending.authChannelId
+                        : String(this.getChannelConfig(callbackAdapterId)?.group_id ?? "") === pending.chatId)
+                    && this.getChannelConfig(callbackAdapterId)?.group_id === groupId
+                    && this.daemons.get(pending.instanceName) === daemon
+                    && this.instanceIpcClients.get(pending.instanceName) === ipc
+                    && owner !== null && currentOwner !== null && sameInteractionOwner(owner, currentOwner)
+                    && lifecycleEpoch !== null && readLifecycleEpoch() === lifecycleEpoch
+                    && this.isDeliveryEpochCurrent(pending.instanceName, epoch);
+            }
+            catch {
+                return false;
+            } // unavailable authority cannot admit a clear
+        };
+        const admitted = current();
+        await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, admitted ? t("clear.clearing", pending.instanceName) : t("menu.click_stale"));
         try {
-            const result = await this.topicCommands.sendClear(pending.instanceName);
+            // sendClear sends its first IPC synchronously; no await separates this
+            // final check from that effect. Uncertainty/throw never reaches IPC.
+            const result = admitted && current()
+                ? await this.topicCommands.sendClear(pending.instanceName) : t("menu.click_stale");
             await pending.adapter.editMessage(pending.chatId, pending.messageId ?? data.messageId, result, pending.threadId);
         }
         catch (err) {
@@ -9237,9 +10788,11 @@ export class FleetManager {
     async retirePendingNoncePrompts(budgetMs = NONCE_RETIRE_BUDGET_MS) {
         const entries = [...this.pendingNonceButtons.values()];
         this.pendingNonceButtons.clear();
-        for (const entry of entries)
+        for (const entry of entries) {
             if (entry.timer)
                 clearTimeout(entry.timer);
+            this.webPromptGone(entry, entry.expiredText);
+        }
         const collapses = entries
             .filter(entry => entry.messageId && entry.adapter.editMessageRemoveButtons)
             .map(entry => entry.adapter.editMessageRemoveButtons(entry.chatId, entry.messageId, entry.expiredText, entry.threadId).catch(err => this.logger.debug({ err, instanceName: entry.instanceName, prefix: entry.prefix }, "Failed to retire button prompt during shutdown")));
@@ -9260,6 +10813,7 @@ export class FleetManager {
             this.pendingNonceButtons.delete(nonce);
             if (entry.timer)
                 clearTimeout(entry.timer);
+            this.webPromptGone(entry, entry.expiredText);
             if (entry.messageId && entry.adapter.editMessageRemoveButtons) {
                 entry.adapter.editMessageRemoveButtons(entry.chatId, entry.messageId, entry.expiredText, entry.threadId)
                     .catch(err => this.logger.debug({ err, instanceName, prefix: entry.prefix }, "Failed to collapse prompt during instance stop"));
@@ -9271,6 +10825,16 @@ export class FleetManager {
      * same-world General topic where an administrator can make the choice. */
     async notifyNormalExit(instanceName) {
         this.notifyInstanceTopic(instanceName, t("exit.instance_notice", instanceName));
+        const web = this.webOnlyPromptPlace();
+        if (web) {
+            await this.postNonceButtonPrompt({
+                prefix: EXIT_RESTART_CALLBACK_PREFIX, alertType: "exit_restart", instanceName, ...web,
+                message: t("exit.general_notice", instanceName),
+                choices: [{ action: "restart", label: t("exit.restart") }, { action: "ignore", label: t("exit.ignore") }],
+                expiredText: t("exit.expired", instanceName),
+            });
+            return;
+        }
         const worldId = this.getInstanceAdapterId(instanceName);
         const generalName = this.findGeneralInstance(worldId);
         if (!generalName) {
@@ -9349,6 +10913,20 @@ export class FleetManager {
             this.logger.warn({ instanceName }, "Interactive prompt has no General topic notification target");
             return;
         }
+        const label = this.interactivePromptLabel(kind);
+        const prompt = {
+            prefix: INTERACTIVE_ASSIST_CALLBACK_PREFIX, alertType: "interactive_prompt", instanceName,
+            message: t("interactive.general_notice", instanceName, label),
+            choices: [{ action: "confirm", label: t("interactive.confirm") }, { action: "cancel", label: t("interactive.cancel") }],
+            expiredText: t("interactive.expired", instanceName),
+            extra: { generalName, promptKind: kind, assistFor: this.interactionWaitKey(instanceName) },
+        };
+        // No chat platform: the dashboard is where it is asked; Confirm still asks General to help.
+        const web = this.webOnlyPromptPlace();
+        if (web) {
+            await this.postNonceButtonPrompt({ ...prompt, ...web });
+            return;
+        }
         const adapterId = this.getInstanceAdapterId(generalName);
         const adapter = this.getAdapterForInstance(generalName);
         const chatId = this.getGroupIdForInstance(generalName);
@@ -9358,23 +10936,7 @@ export class FleetManager {
             this.logger.warn({ instanceName, generalName, adapterId, chatId }, "Cannot address interactive prompt assistance controls");
             return;
         }
-        const label = this.interactivePromptLabel(kind);
-        await this.postNonceButtonPrompt({
-            prefix: INTERACTIVE_ASSIST_CALLBACK_PREFIX,
-            alertType: "interactive_prompt",
-            instanceName,
-            adapter,
-            adapterId,
-            chatId,
-            threadId,
-            message: t("interactive.general_notice", instanceName, label),
-            choices: [
-                { action: "confirm", label: t("interactive.confirm") },
-                { action: "cancel", label: t("interactive.cancel") },
-            ],
-            expiredText: t("interactive.expired", instanceName),
-            extra: { generalName, promptKind: kind },
-        });
+        await this.postNonceButtonPrompt({ ...prompt, adapter, adapterId, chatId, threadId });
     }
     /**
      * Offer a one-tap re-login next to an auth alert.
@@ -9542,8 +11104,33 @@ export class FleetManager {
      * concern was real — a second click must not fire a second interrupt key at an
      * instance that has already started a new turn.
      */
-    handleCancelClick(instanceName, adapter, data) {
-        if (this.hasCancelButton(instanceName)) {
+    handleCancelClick(instanceName, adapter, data, adapterId) {
+        // #754 audit: the click names its instance in its own callback data, and Telegram delivers clicks from anyone in
+        // the chat. So it may interrupt only when it comes through the instance's owning adapter (the one that posts its
+        // buttons) from someone that adapter lets speak — and, on a live button, only that instance's own message.
+        const owner = this.getInstanceAdapterId(instanceName);
+        const live = this.cancelButtons.get(data.messageId);
+        // Where the click came from: a live button's own message (and topic), or — when the fleet has no entry for the
+        // message (a button being replaced, or forgotten across a restart) — the instance's destination as it is NOW, so a
+        // button left behind in a channel the instance has since moved from, or a click from an unrelated chat, does not
+        // cancel it (#1396 review).
+        const dest = this.cancelButtonDestination(instanceName);
+        const atDestination = !!owner && (live
+            ? live.instanceName === instanceName && live.chatId === data.chatId
+                && (live.threadId == null || this.clickAtDestination({ chatId: live.chatId, threadId: live.threadId }, data, owner))
+            : !!dest && this.clickAtDestination(dest, data, owner));
+        // Who may press it: in a ClassicBot chat, anyone there — exactly who a typed /cancel there answers, since ClassicBot
+        // traffic is not admitted by the fleet's access policy (#1396 review); elsewhere someone the owning adapter lets speak.
+        const classic = this.classicChannels?.getChannelIdByInstance(instanceName) !== undefined;
+        const access = owner ? this.worlds.get(owner)?.accessManager ?? (owner === this.getPrimaryAdapterId() ? this.accessManager : null) : null;
+        const speaker = !!data.userId && !!owner
+            && (classic || this.isFleetAdmin(data.userId, owner) || !!access?.isAllowed(data.userId));
+        if (!owner || adapterId !== owner || !speaker || !atDestination) {
+            this.logger.warn({ instanceName, adapterId, owner, userId: data.userId, live: !!live, atDestination }, "Refused cancel click: not this instance's button where it is now, or not someone its adapter lets speak");
+            data.ack?.(t("buttons.not_allowed"));
+            return;
+        }
+        if (live) {
             this.cancelInstance(instanceName);
             return;
         }
@@ -9561,6 +11148,28 @@ export class FleetManager {
         adapter?.editMessage(data.chatId, data.messageId, t("cancel.button_stale", instanceName), data.threadId)
             .catch(() => { });
     }
+    /** Where an instance's cancel button is posted — and so the only place a click on it can come from. */
+    cancelButtonDestination(instanceName) {
+        const groupId = this.getGroupIdForInstance(instanceName) || undefined;
+        const topicId = this.fleetConfig?.instances[instanceName]?.topic_id;
+        // Fleet topic instance.
+        if (topicId != null && groupId)
+            return { chatId: String(groupId), threadId: String(topicId) };
+        // Classic instance: channelId from the classic manager; General / flat fallback: the group (no thread).
+        const chatId = this.classicChannels?.getChannelIdByInstance(instanceName) ?? (groupId ? String(groupId) : undefined);
+        return chatId ? { chatId } : null;
+    }
+    /**
+     * A click came from this destination. A Discord click names the guild as its chat and the channel as its thread; a
+     * Telegram click names the chat and topic, with the General topic as thread 1 or none at all.
+     */
+    clickAtDestination(dest, data, ownerAdapterId) {
+        const telegram = this.getChannelConfig(ownerAdapterId)?.type === "telegram";
+        const thread = (id) => (telegram && (id === undefined || id === "1") ? undefined : id);
+        if (thread(dest.threadId) !== undefined)
+            return data.chatId === dest.chatId && thread(data.threadId) === thread(dest.threadId);
+        return (thread(data.threadId) ?? data.chatId) === dest.chatId;
+    }
     hasCancelButton(instanceName) {
         for (const e of this.cancelButtons.values()) {
             if (e.instanceName === instanceName)
@@ -9610,20 +11219,7 @@ export class FleetManager {
         const adapterId = this.getInstanceAdapterId(instanceName);
         const groupId = this.getGroupIdForInstance(instanceName) || undefined;
         const topicId = this.fleetConfig?.instances[instanceName]?.topic_id;
-        let chatId;
-        let threadId;
-        if (topicId != null && groupId) {
-            // Fleet topic instance.
-            chatId = String(groupId);
-            threadId = String(topicId);
-        }
-        else {
-            // Classic instance: channelId from the classic manager.
-            chatId = this.classicChannels?.getChannelIdByInstance(instanceName);
-            // General / flat fallback: post to the group (no thread).
-            if (!chatId && groupId)
-                chatId = String(groupId);
-        }
+        const { chatId, threadId } = this.cancelButtonDestination(instanceName) ?? {};
         if (!chatId) {
             // A button that cannot be addressed must say so — this exact silence is how
             // "the cancel button sometimes never appears" stayed unreported-in-logs.
@@ -10131,6 +11727,10 @@ export class FleetManager {
         daemon.sendEscape().catch(e => this.logger.warn({ err: e, instanceName }, "sendEscape failed"));
         this.lastInboundMsg.delete(instanceName);
         this.clearCancelButton(instanceName);
+        // The queued web messages were just dropped with the rest: their ticks say so, on every page.
+        for (const m of this.webChatHistory.cancelPending(instanceName)) {
+            this.emitSseEvent("delivery", { instance: instanceName, messageId: m.messageId, delivery: m.delivery });
+        }
         return true;
     }
     getDeliveryEpoch(instanceName) {
@@ -10139,6 +11739,10 @@ export class FleetManager {
     isDeliveryEpochCurrent(instanceName, deliveryEpoch) {
         return deliveryEpoch === this.getDeliveryEpoch(instanceName);
     }
+    /** The delivery epoch, and the caller's own fence when it gave one (DeliveryOptions.stillCurrent, #1426). */
+    deliveryCurrent(instanceName, deliveryEpoch, stillCurrent) {
+        return this.isDeliveryEpochCurrent(instanceName, deliveryEpoch) && (stillCurrent?.() ?? true);
+    }
     /** Invalidate work queued before a user cancel and wake idle-gate waiters. */
     cancelPendingDeliveries(instanceName) {
         const next = this.getDeliveryEpoch(instanceName) + 1;
@@ -10174,6 +11778,7 @@ export class FleetManager {
                 isClaimCurrent: claim => this.loginWindow.isCurrent(claim),
                 windowBusyMessage: () => this.loginWindow.busyMessage(),
                 tunnelDataDir: () => this.dataDir,
+                reserveTunnel: owner => this.getTunnelLane().reserve("login", owner),
                 // Throws when the prompt cannot be posted: the controller tells the
                 // user so instead of leaving "Starting…" as the last word (#1133).
                 postButtons: async ({ prefix, instanceName, chat, message, choices, expiredText }) => {
@@ -10299,7 +11904,7 @@ export class FleetManager {
             this.notifyInstanceTopic(opts.generalName, opts.message);
             return;
         }
-        const choices = [{ action: "allow", label: t("classic.approve_group") }];
+        const choices = [{ action: "allow", label: t(opts.scope === "user" ? "classic.approve_user" : "classic.approve_group") }];
         if (opts.userId)
             choices.push({ action: "allow-admin", label: t("classic.approve_group_admin") });
         choices.push({ action: "ignore", label: t("classic.approve_ignore") });
@@ -10314,7 +11919,7 @@ export class FleetManager {
             message: opts.message,
             choices,
             expiredText: t("buttons.stale"),
-            extra: { classicGroupId: opts.groupId, classicUserId: opts.userId, classicScope: opts.scope },
+            extra: { classicGroupId: opts.groupId, classicUserId: opts.userId, classicScope: opts.scope, classicReplyTo: opts.replyTo },
         });
     }
     /**
@@ -10334,15 +11939,27 @@ export class FleetManager {
             return;
         }
         const scope = entry.classicScope ?? "guild";
-        const access = scope === "group" ? classic.allowGroup(groupId) : classic.allowGuild(groupId);
+        const access = scope === "user" ? classic.allowUser(groupId)
+            : scope === "group" ? classic.allowGroup(groupId) : classic.allowGuild(groupId);
         const admin = adminUserId ? classic.addAdminUser(adminUserId) : null;
-        const lines = [t(access === "added" ? "classic.approve_done_group"
-                : access === "already" ? "classic.approve_done_group_already"
-                    : "classic.approve_done_group_open", groupId)];
+        const lines = [t(access === "added" ? "classic.approve_done_group" : "classic.approve_done_group_already", groupId)];
         if (admin) {
             lines.push(t(admin === "added" ? "classic.approve_done_admin" : "classic.approve_done_admin_already", adminUserId ?? ""));
         }
         this.notifyInstanceTopic(entry.instanceName, lines.join("\n"));
+        await this.notifyClassicRequester(entry, "classic.request_allowed");
+    }
+    async notifyClassicRequester(entry, key) {
+        const reply = entry.classicReplyTo;
+        // Do not use a replaced bot or guess a new recipient after adapter rebuild.
+        if (!reply || this.worlds.get(reply.adapterId)?.adapter !== reply.adapter)
+            return;
+        try {
+            await reply.adapter.sendText(reply.chatId, t(key));
+        }
+        catch (err) {
+            this.logger.warn({ err, adapterId: reply.adapterId, scope: entry.classicScope }, "Could not notify Classic access requester");
+        }
     }
     /** Consume a ClassicBot approval button. */
     async handleClassicApproval(data, callbackAdapterId, receivingAdapter) {
@@ -10356,6 +11973,7 @@ export class FleetManager {
         const userId = entry.classicUserId;
         if (action === "ignore") {
             await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t("classic.approve_ignored", groupId));
+            await this.notifyClassicRequester(entry, "classic.request_ignored");
             return true;
         }
         const grantAdmin = action === "allow-admin" && !!userId;
@@ -10804,7 +12422,23 @@ export class FleetManager {
     }
     /** Push an SSE event to all connected Web UI clients. */
     emitSseEvent(event, data) {
-        broadcastSseEvent(this.sseClients, event, data, (err) => this.logger.debug({ err }, "SSE client write failed; evicting"));
+        // #1386: a prompt opened or closed, or an instance's state moved — "Needs you" may have changed.
+        if (event === "prompt" || event === "prompt_resolved" || event === "activity")
+            this.needsYou?.poke();
+        const onError = (err) => this.logger.debug({ err }, "SSE client write failed; evicting");
+        if (event === "message" && data && typeof data === "object") {
+            // A chat message: record it, and send it WITH its id so a reconnecting stream can ask for what it missed.
+            const m = data;
+            const recorded = this.webChatHistory.record({
+                instance: String(m.instance ?? ""), sender: String(m.sender ?? ""), text: String(m.text ?? ""), ts: String(m.ts ?? new Date().toISOString()),
+                attachments: Array.isArray(m.attachments) ? m.attachments : undefined,
+                messageId: typeof m.messageId === "string" ? m.messageId : undefined,
+                role: typeof m.role === "string" ? m.role : undefined,
+            });
+            broadcastSseEvent(this.sseClients, event, recorded, onError, this.webChatHistory.cursorOf(recorded));
+            return;
+        }
+        broadcastSseEvent(this.sseClients, event, data, onError);
     }
     listClaimedTasks(assignee) {
         try {
@@ -10815,8 +12449,9 @@ export class FleetManager {
         }
     }
     async sendHangNotification(instanceName, unchangedForMs) {
-        const adapter = this.getAdapterForInstance(instanceName) ?? this.adapter;
-        const adapterId = this.getInstanceAdapterId(instanceName);
+        const web = this.webOnlyPromptPlace(); // no chat platform: asked on the dashboard (#1307 item 6)
+        const adapter = web?.adapter ?? this.getAdapterForInstance(instanceName) ?? this.adapter;
+        const adapterId = web?.adapterId ?? this.getInstanceAdapterId(instanceName);
         // Same three-way addressing as sendCancelButton: fleet topic → group+thread,
         // Classic → its own channel (Classic instances are absent from
         // fleetConfig.instances, so the topic path can never address them), else the
@@ -10826,7 +12461,10 @@ export class FleetManager {
         const groupId = this.getGroupIdForInstance(instanceName) || undefined;
         let chatId;
         let threadId;
-        if (topicId != null && groupId) {
+        if (web) {
+            chatId = web.chatId;
+        }
+        else if (topicId != null && groupId) {
             chatId = String(groupId);
             threadId = String(topicId);
         }
@@ -11774,7 +13412,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             return done(cachedModel.trim(), "cli-default");
         // Say WHY it's unresolved: no fresh probe yet vs. the CLI not exposing a default
         // (e.g. claude-code's default is account-side, opencode's is provider-side).
-        return done("default", "unresolved", cliEnv ? "this CLI does not report a default" : "not probed yet");
+        return done("default", "unresolved", cliEnv ? "this CLI does not report a default" : "detected when it starts");
     }
     /** Human-readable effective model, e.g. `auto (default)`. Used by /ctx. */
     modelDisplayForInstance(instanceName) {
@@ -12061,7 +13699,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }));
         const timer = setTimeout(() => this.pendingEffortSelects.delete(nonce), CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
         timer.unref?.();
-        this.pendingEffortSelects.set(nonce, { instanceName: name, userId: data.userId, channelId: data.channelId, timer, respond: data.respond });
+        this.pendingEffortSelects.set(nonce, { instanceName: name, userId: data.userId, channelId: data.channelId, adapterId, timer, respond: data.respond });
         try {
             await data.respondChoices(t("effort.menu", this.effortMenuHeader(name)), choices);
         }
@@ -12073,7 +13711,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
     }
     /** TG inline-keyboard effort menu. Returns null on success, else a fallback string. */
-    async promptEffortMenu(instanceName, userId, channelId, adapter, chatId, threadId) {
+    async promptEffortMenu(instanceName, userId, channelId, adapter, chatId, threadId, adapterId) {
         const levels = this.effortLevelsFor(instanceName);
         if (levels.length === 0) {
             return t("effort.unsupported", this.backendNameForInstance(instanceName));
@@ -12096,7 +13734,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             }
         }, CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
         timer.unref?.();
-        this.pendingEffortSelects.set(nonce, { instanceName, userId, channelId, timer, respond, adapter, adapterChatId: chatId, adapterThreadId: threadId });
+        this.pendingEffortSelects.set(nonce, { instanceName, userId, channelId, adapterId, timer, respond, adapter, adapterChatId: chatId, adapterThreadId: threadId });
         try {
             const menuMessageId = await adapter.promptUser(chatId, t("effort.menu", this.effortMenuHeader(instanceName)), choices, { threadId });
             const pending = this.pendingEffortSelects.get(nonce);
@@ -12112,7 +13750,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
     }
     /** Consume an `/effort` selection callback. Mirrors handleModelSelection. */
-    async handleEffortSelection(data) {
+    async handleEffortSelection(data, adapterId) {
         if (!data.callbackData.startsWith(EFFORT_SELECT_CALLBACK_PREFIX))
             return false;
         const match = data.callbackData.match(/^effort-select:([0-9a-f]+):(.+)$/);
@@ -12121,11 +13759,16 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const pending = this.pendingEffortSelects.get(match[1]);
         if (!pending)
             return true;
-        if (data.userId && data.userId !== pending.userId)
-            return true;
+        // The admin who opened the menu, through the adapter that posted it, in the same channel — and still an admin
+        // when they click (#754 audit): the menu lives for a minute, and a click carries its own callback data.
         const cbChannel = data.threadId ?? data.chatId;
-        if (cbChannel !== pending.channelId && data.chatId !== pending.channelId)
+        if (!data.userId || data.userId !== pending.userId
+            || (pending.adapterId !== undefined && pending.adapterId !== adapterId)
+            || (cbChannel !== pending.channelId && data.chatId !== pending.channelId)
+            || !this.menuClickStillCurrent(pending.instanceName, data.userId, pending.channelId, adapterId, pending.adapterChatId)) {
+            data.ack?.(t("buttons.admin_only"));
             return true;
+        }
         this.pendingEffortSelects.delete(match[1]);
         clearTimeout(pending.timer);
         const level = match[2];
@@ -12157,7 +13800,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         void (async () => {
             let result;
             try {
-                result = await this.applyEffort(pending.instanceName, level);
+                // Asked again after the progress edit awaited above: the instance may have moved, or the admin lost admin.
+                result = this.menuClickStillCurrent(pending.instanceName, data.userId, pending.channelId, adapterId, pending.adapterChatId)
+                    ? await this.applyEffort(pending.instanceName, level) : t("menu.click_stale");
             }
             catch (err) {
                 this.logger.error({ err, instance: pending.instanceName, level }, "Effort switch failed");
@@ -12214,7 +13859,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const choices = this.modelMenuChoices(name, nonce, options, currentModel);
         const timer = setTimeout(() => this.pendingModelSelects.delete(nonce), CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
         timer.unref?.();
-        this.pendingModelSelects.set(nonce, { instanceName: name, model: "", userId: data.userId, channelId: data.channelId, timer, respond: data.respond, respondChoices: data.respondChoices });
+        this.pendingModelSelects.set(nonce, { instanceName: name, model: "", userId: data.userId, channelId: data.channelId, adapterId, timer, respond: data.respond, respondChoices: data.respondChoices });
         try {
             await data.respondChoices(t("model.menu", `**${currentDisplay}**`), choices);
         }
@@ -12230,7 +13875,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      * pendingModelSelects coordinator as the DC Select Menu path.
      * Returns null on success (menu shown), or a fallback string to send.
      */
-    async promptModelMenu(instanceName, userId, channelId, adapter, chatId, threadId) {
+    async promptModelMenu(instanceName, userId, channelId, adapter, chatId, threadId, adapterId) {
         const options = await this.getModelOptions(instanceName);
         if (options.length === 0) {
             return t("model.list_unavailable", instanceName);
@@ -12250,7 +13895,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             }
         }, CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
         timer.unref?.();
-        this.pendingModelSelects.set(nonce, { instanceName, model: "", userId, channelId, timer, respond, adapter, adapterChatId: chatId, adapterThreadId: threadId });
+        this.pendingModelSelects.set(nonce, { instanceName, model: "", userId, channelId, adapterId, timer, respond, adapter, adapterChatId: chatId, adapterThreadId: threadId });
         try {
             const menuMessageId = await adapter.promptUser(chatId, t("model.menu", currentDisplay), choices, { threadId });
             const pending = this.pendingModelSelects.get(nonce);
@@ -12379,8 +14024,40 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             await pending.respond(t("model.usage")).catch(() => { });
         }
     }
+    /**
+     * A /model or /effort menu click may still act (#1396 review): the instance is still owned by the adapter the click
+     * came through (it may have been rebound since the menu opened) and the clicker is still that channel's admin. Asked
+     * when the click is claimed and again right before the change is applied.
+     */
+    menuClickStillCurrent(instanceName, userId, channelId, adapterId, sourceChatId) {
+        return this.commandChannelStillTargets(instanceName, channelId, adapterId, sourceChatId)
+            && this.isModelAdmin(userId, channelId, adapterId);
+    }
+    /** Current source-to-target mapping, including same-adapter topic moves. */
+    commandChannelStillTargets(instanceName, channelId, adapterId, sourceChatId) {
+        if (this.getInstanceAdapterId(instanceName) !== adapterId)
+            return false;
+        const classic = this.classicChannels?.getInstanceByChannel(channelId, adapterId);
+        if (classic !== undefined)
+            return classic === instanceName;
+        // Read the current config rather than relying on a pre-reload route cache.
+        const targets = Object.entries(this.fleetConfig?.instances ?? {}).filter(([name, cfg]) => cfg.topic_id != null && String(cfg.topic_id) === channelId && this.getInstanceAdapterId(name) === adapterId);
+        // A duplicate within one world is ambiguous (the slash table keeps the
+        // last registration). Never authorize an old menu via the first match.
+        if (targets.length > 1)
+            return false;
+        const channel = this.getChannelConfig(adapterId);
+        if (targets.length === 1)
+            return targets[0][0] === instanceName
+                && (channel?.type !== "telegram" || sourceChatId !== undefined
+                    && channel.group_id != null && String(channel.group_id) === sourceChatId);
+        // Root General menus carry the group address, not the logical topic id.
+        return channel?.type === "telegram" && channel.group_id != null && String(channel.group_id) === channelId
+            && this.fleetConfig?.instances[instanceName]?.general_topic === true
+            && this.findGeneralInstance(adapterId) === instanceName;
+    }
     /** Consume a `/model` selection callback. Returns true for all model-select ids (incl. stale). */
-    async handleModelSelection(data) {
+    async handleModelSelection(data, adapterId) {
         if (!data.callbackData.startsWith(MODEL_SELECT_CALLBACK_PREFIX))
             return false;
         const match = data.callbackData.match(/^model-select:([0-9a-f]+):(.+)$/);
@@ -12389,12 +14066,16 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const pending = this.pendingModelSelects.get(match[1]);
         if (!pending)
             return true;
-        // Only the admin who opened the menu, in the same channel, may consume it.
-        if (data.userId && data.userId !== pending.userId)
-            return true;
+        // The admin who opened the menu, through the adapter that posted it, in the same channel — and still an admin
+        // when they click (#754 audit): the menu lives for a minute, and a click carries its own callback data.
         const cbChannel = data.threadId ?? data.chatId;
-        if (cbChannel !== pending.channelId && data.chatId !== pending.channelId)
+        if (!data.userId || data.userId !== pending.userId
+            || (pending.adapterId !== undefined && pending.adapterId !== adapterId)
+            || (cbChannel !== pending.channelId && data.chatId !== pending.channelId)
+            || !this.menuClickStillCurrent(pending.instanceName, data.userId, pending.channelId, adapterId, pending.adapterChatId)) {
+            data.ack?.(t("buttons.admin_only"));
             return true;
+        }
         this.pendingModelSelects.delete(match[1]);
         clearTimeout(pending.timer);
         const model = match[2];
@@ -12444,7 +14125,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         void (async () => {
             let result;
             try {
-                result = await this.applyModel(pending.instanceName, model);
+                // Asked again after the progress edit awaited above: the instance may have moved, or the admin lost admin.
+                result = this.menuClickStillCurrent(pending.instanceName, data.userId, pending.channelId, adapterId, pending.adapterChatId)
+                    ? await this.applyModel(pending.instanceName, model) : t("menu.click_stale");
             }
             catch (err) {
                 this.logger.error({ err, instance: pending.instanceName, model }, "Model switch failed");
@@ -12638,30 +14321,58 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const adapter = (adapterId ? this.worlds.get(adapterId)?.adapter : undefined) ?? this.adapter;
         return adapter?.type === "telegram" ? `${key}.telegram` : key;
     }
+    /** Approval is a system notification: General's agent need not be running. */
+    findClassicApprovalGeneral(adapterId) {
+        const generals = Object.entries(this.fleetConfig?.instances ?? {}).filter(([, cfg]) => cfg.general_topic === true);
+        return (adapterId ? generals.find(([name, cfg]) => (cfg.channel_id ?? this.getInstanceAdapterId(name)) === adapterId) : undefined)?.[0]
+            ?? generals[0]?.[0];
+    }
     /** Return a user-facing blocker without mutating ClassicBot state. */
     validateClassicStart(channelId, userId, guildId, adapterId) {
-        if (!this.classicChannels)
+        const classic = this.classicChannels;
+        if (!classic)
             return t("classic.manager_unavailable");
-        if (guildId && !this.classicChannels.isGuildAllowed(guildId)) {
-            const generalId = this.findGeneralInstance(adapterId);
-            if (generalId) {
-                // Fire-and-forget, exactly as the notifyInstanceTopic it replaces: this
-                // function's return value is the rejection shown to the user, and it
-                // must not wait on posting buttons into the General topic.
-                void this.promptClassicApproval({
-                    generalName: generalId,
-                    message: t("alert.unauth_guild", guildId, userId),
-                    groupId: String(guildId),
-                    scope: "guild",
-                    userId: userId ? String(userId) : undefined,
-                }).catch(err => this.logger.warn({ err, guildId }, "Classic approval prompt failed"));
-            }
-            return t("classic.not_authorized_guild");
-        }
-        if (this.classicChannels.isClassicChannel(channelId, adapterId))
+        // Admission applies only to NEW channels. Revoking a start grant never
+        // blocks an existing agent's chat or changes its registration.
+        if (classic.isClassicChannel(channelId, adapterId))
             return t(this.classicStartKey("classic.already_active", adapterId));
         if (this.routing.resolve(channelId))
             return t("classic.topic_bound");
+        const adapter = (adapterId ? this.worlds.get(adapterId)?.adapter : undefined) ?? this.adapter;
+        // Discord DMs remain unsupported, including direct calls outside the slash door.
+        if (!guildId && adapter?.type === "discord")
+            return t("slash.dm_unsupported");
+        // C is distinct from fleet admin. Only C bypasses new-channel admission.
+        if (classic.isAdmin(userId))
+            return undefined;
+        const scope = guildId ? "guild" : channelId.startsWith("-") ? "group" : "user";
+        const targetId = guildId ?? (scope === "user" ? userId : channelId);
+        const allowed = scope === "guild" ? classic.isGuildAllowed(targetId)
+            : scope === "group" ? classic.isGroupAllowed(targetId) : classic.isUserAllowed(targetId);
+        if (!allowed) {
+            const generalName = this.findClassicApprovalGeneral(adapterId);
+            if (generalName) {
+                const message = scope === "guild" ? t("alert.unauth_guild", targetId, userId)
+                    : scope === "group" ? t("alert.new_group", channelId, targetId, userId, userId, "telegram")
+                        : t("alert.unauth_user_private", userId, userId, "telegram");
+                void this.promptClassicApproval({
+                    generalName, message, groupId: String(targetId), scope, userId,
+                    replyTo: adapter ? { adapterId: adapter.id, adapter, chatId: channelId } : undefined,
+                }).catch(err => this.logger.warn({ err, scope }, "Classic approval prompt failed"));
+            }
+            else {
+                this.logger.warn({ adapterId, scope }, "Classic access request has no running General");
+            }
+            return t("classic.access_requested");
+        }
+        // Preserve the existing group start role. Allow only grants the group;
+        // Allow+admin also gives the requester permission to start there.
+        if (scope === "group") {
+            const generalName = this.findClassicApprovalGeneral(adapterId);
+            if (generalName)
+                this.notifyInstanceTopic(generalName, t("alert.start_not_admin", userId, userId, "telegram", channelId));
+            return t("classic.admin_only_start");
+        }
         return undefined;
     }
     isBackendInstalled(backend) {
@@ -12688,6 +14399,11 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             await data.respond(t("classic.backend_required"));
             return;
         }
+        const blocker = this.validateClassicStart(data.channelId, data.userId, data.guildId, adapterId);
+        if (blocker) {
+            await data.respond(blocker);
+            return;
+        }
         const warning = this.getMissingBackendWarning(requestedBackend);
         // Keep the deferred ephemeral response useful even if daemon startup later
         // fails because the executable is absent. This is advisory, not a gate.
@@ -12793,7 +14509,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         await pending.complete(warning ? `${warning}\n\n${reply}` : reply, pending.messageId);
     }
     /** Start a classic channel instance with lightweight config */
-    async startClassicInstance(instanceName, backend, preTaskCommand, model, autoPauseAfter, transition) {
+    async startClassicInstance(instanceName, backend, preTaskCommand, model, autoPauseAfter, transition, execution) {
+        execution?.assert();
         if (this.daemons.has(instanceName))
             return;
         const workDir = join(getAgendHome(), "workspaces", instanceName);
@@ -12831,7 +14548,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 + "fix it in classicBot.yaml; it will not start on another login");
         }
         const topicMode = this.fleetConfig?.channel?.mode === "topic";
-        await this.startInstance(instanceName, config, topicMode, "classic", false, transition);
+        if (execution)
+            await this.startInstance(instanceName, config, topicMode, "classic", false, transition, execution);
+        else
+            await this.startInstance(instanceName, config, topicMode, "classic", false, transition);
     }
     /** Handle /start slash command — register classic channel */
     async handleClassicStart(channelId, channelName, userId, guildId, adapterId, backend) {
@@ -12893,6 +14613,16 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // because we asked it to. Set synchronously — doStopAll runs to its first
         // await in the same tick as the signal handler, so no event can slip in.
         this.shuttingDown = true;
+        this.settingsGeneration++;
+        this.settingsConfirmation?.store.close();
+        this.settingsConfirmation = null;
+        const settingsControl = this.settingsControl;
+        this.settingsControl = null;
+        const settingsControlStopped = settingsControl?.close();
+        const publicStopped = this.publicWebLink?.close("fleet shutdown");
+        // #1386: every live "Needs you" message says the fleet stopped (capabilities revoked first) — while the
+        // adapters can still edit. Bounded: a platform that does not answer must not hold the shutdown.
+        const needsStopped = this.stopNeedsYou();
         const profileStopped = this.runtimeCpuProfiler?.shutdown("fleet shutdown");
         this.ipcStoppingInstances.add("__fleet_stopping__");
         // Release held delivery promises before awaiting daemon shutdown, then
@@ -12922,7 +14652,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // A login/install window is a dedicated tmux server with its own TTL
         // timer and HTTP listener living in THIS process: without an explicit
         // shutdown it would outlive us as an owner-less login CLI (sol B3).
+        await publicStopped;
         await profileStopped;
+        await needsStopped;
+        await settingsControlStopped;
         await this.cpuProfileControl?.close();
         this.cpuProfileControl = null;
         await this.shutdownLoginWindows();
@@ -13049,6 +14782,11 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.healthServer.close();
             this.healthServer = null;
         }
+        this.stopPreviewListener();
+        // The store writes lastSeen at most once a minute; what that debounce is still holding — and any
+        // write that failed and is still owed — is paid now, so a restart neither shortens the idle window
+        // nor revives a session that was revoked while the disk was refusing writes.
+        this.webSessions?.flush();
         this.eventLog?.close();
         const pidPath = join(this.dataDir, "fleet.pid");
         try {
@@ -13269,6 +15007,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.routing.rebuild(this.fleetConfig);
         this.reregisterClassicChannels();
         this.scheduler?.reload();
+        this.reconcilePreviewListener();
+        this.publicWebLink?.refresh();
         const newInstances = this.fleetConfig.instances;
         const topicMode = this.fleetConfig?.channel?.mode === "topic";
         // Only what a fresh process can adopt, and only relative to the signature
@@ -13696,7 +15436,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const challengeKey = `${input.sessionBinding}:api_key:${spec.id}:${spec.envKey}:${input.idempotencyKey}`;
         const existingId = this.providerSecretChallengesByKey.get(challengeKey);
         const existing = existingId ? this.providerSecretChallenges.get(existingId) : undefined;
-        if (existing && existing.expiresAt > Date.now()) {
+        if (existing && (existing.deadline === undefined ? existing.expiresAt > Date.now() : existing.deadline > performance.now())) {
             return { ok: true, verification_id: existing.id, expires_at: existing.expiresAt, spec_id: spec.id, activation: spec.activation };
         }
         if (existingId)
@@ -13718,7 +15458,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             generation: this.providerSecretGeneration(spec.envKey),
             operation: "provider-secret.apply",
             idempotencyKey: input.idempotencyKey,
-            expiresAt,
+            expiresAt, deadline: performance.now() + SECRET_CHALLENGE_TTL_MS,
             secret: input.secret,
         };
         this.providerSecretChallenges.set(challenge.id, challenge);
@@ -13745,7 +15485,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
         const challenge = this.providerSecretChallenges.get(input.verificationId);
         const spec = providerSecretSpec(input.specId);
-        if (!challenge || challenge.expiresAt <= Date.now()) {
+        if (!challenge || (challenge.deadline === undefined ? challenge.expiresAt <= Date.now() : challenge.deadline <= performance.now())) {
             if (challenge)
                 this.providerSecretChallenges.delete(input.verificationId);
             return { error: "verification expired; verify the secret again" };
@@ -13772,7 +15512,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.providerSecretJobs.set(job.id, job);
         this.providerSecretJobSession.set(job.id, input.sessionBinding);
         this.providerSecretInFlight.set(spec.envKey, job.id);
-        queueMicrotask(() => void this.runProviderSecretApply(job, challenge.secret));
+        this.queueSettingsOperation(job, [settingsFileResource(join(this.dataDir, ".env"))], input.execution, execution => this.runProviderSecretApply(job, challenge.secret, execution));
         return { job, reused: false };
     }
     startProviderApiKeyApply(input) {
@@ -13786,7 +15526,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     getProviderApiKeyApply(jobId, sessionBinding) {
         return this.getProviderSecretApply(jobId, sessionBinding);
     }
-    async runProviderSecretApply(job, secret) {
+    async runProviderSecretApply(job, secret, execution) {
         const spec = providerSecretSpec(job.specId);
         const allowed = new Set([
             ...PROVIDER_SECRET_SPECS.map(item => item.envKey),
@@ -13801,18 +15541,25 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 throw new Error("provider secret is not configured");
             // Construct inside the transaction: symlink/permission refusal must
             // settle the job as a safe failure, not escape the queued microtask.
-            store = new SecretStore(join(this.dataDir, ".env"), allowed);
-            before = store.write(job.envKey, secret);
-            wrote = true;
-            process.env[job.envKey] = secret;
+            store = new SecretStore(join(this.dataDir, ".env"), allowed, { owner: execution?.owner });
+            const write = () => { before = store.write(job.envKey, secret); wrote = true; process.env[job.envKey] = secret; };
+            if (execution)
+                execution.mutate(write);
+            else
+                write();
             if (spec.activation === "reload_hook" && spec.reloadHookId) {
                 await this.runProviderSecretReloadHook(spec.reloadHookId, secret, previousProcessValue);
+                execution?.assert();
                 job.result = "reloaded";
             }
             else {
                 job.result = "applied_next_use";
             }
-            this.providerSecretGenerations.set(job.envKey, this.providerSecretGeneration(job.envKey) + 1);
+            const commit = () => { this.providerSecretGenerations.set(job.envKey, this.providerSecretGeneration(job.envKey) + 1); };
+            if (execution)
+                execution.commit(commit);
+            else
+                commit();
             job.status = "done";
             job.finishedAt = Date.now();
         }
@@ -13820,12 +15567,22 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             const safe = safeSecretError(err, secret);
             this.logger.warn({ specId: job.specId, reason: safe }, "Provider API-key apply failed");
             try {
+                // Memory and disk have separate receipts: a host-edited file must
+                // remain, but cannot strand our owned process value or hook snapshot.
+                if (wrote && process.env[job.envKey] === secret) {
+                    if (previousProcessValue === undefined)
+                        delete process.env[job.envKey];
+                    else
+                        process.env[job.envKey] = previousProcessValue;
+                }
+                if (spec?.reloadHookId && this.providerSecretHotSnapshots.get(spec.reloadHookId) === secret) {
+                    if (previousProcessValue === undefined)
+                        this.providerSecretHotSnapshots.delete(spec.reloadHookId);
+                    else
+                        this.providerSecretHotSnapshots.set(spec.reloadHookId, previousProcessValue);
+                }
                 if (wrote && before && store)
-                    store.restore(before);
-                if (previousProcessValue === undefined)
-                    delete process.env[job.envKey];
-                else
-                    process.env[job.envKey] = previousProcessValue;
+                    store.restoreIfCurrent(before);
                 // SecretStore.write is itself transactional; when it fails before a
                 // snapshot is returned there is no new value to roll back. Report the
                 // truthful no-op rather than claiming rollback_failed.
@@ -13842,7 +15599,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             job.finishedAt = Date.now();
         }
         finally {
-            this.providerSecretInFlight.delete(job.envKey);
+            if (this.providerSecretInFlight.get(job.envKey) === job.id)
+                this.providerSecretInFlight.delete(job.envKey);
             secret = "";
         }
     }
@@ -13861,10 +15619,12 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 await hook(_next, before);
         }
         catch (err) {
-            if (before === undefined)
-                this.providerSecretHotSnapshots.delete(hookId);
-            else
-                this.providerSecretHotSnapshots.set(hookId, before);
+            if (this.providerSecretHotSnapshots.get(hookId) === _next) {
+                if (before === undefined)
+                    this.providerSecretHotSnapshots.delete(hookId);
+                else
+                    this.providerSecretHotSnapshots.set(hookId, before);
+            }
             throw err;
         }
     }
@@ -13919,7 +15679,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const key = `${input.sessionBinding}:${input.connectionId}:${input.idempotencyKey}`;
         const existingId = this.connectionBindingChallengesByKey.get(key);
         const existing = existingId ? this.connectionBindingChallenges.get(existingId) : undefined;
-        if (existing && existing.expiresAt > Date.now()) {
+        if (existing && (existing.deadline === undefined ? existing.expiresAt > Date.now() : existing.deadline > performance.now())) {
             return { ok: true, verification_id: existing.id, expires_at: existing.expiresAt, binding: existing.binding, probe: existing.probe };
         }
         if (existingId)
@@ -13948,7 +15708,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             generation: afterGeneration,
             operation: "binding.apply",
             idempotencyKey: input.idempotencyKey,
-            expiresAt,
+            expiresAt, deadline: performance.now() + SECRET_CHALLENGE_TTL_MS,
             binding,
             probe,
         };
@@ -13971,7 +15731,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 return { job, reused: true };
         }
         const challenge = this.connectionBindingChallenges.get(input.verificationId);
-        if (!challenge || challenge.expiresAt <= Date.now()) {
+        if (!challenge || (challenge.deadline === undefined ? challenge.expiresAt <= Date.now() : challenge.deadline <= performance.now())) {
             this.connectionBindingChallenges.delete(input.verificationId);
             return { error: "binding verification expired; verify the binding again" };
         }
@@ -13996,7 +15756,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.connectionBindingJobs.set(job.id, job);
         this.connectionBindingJobSession.set(job.id, input.sessionBinding);
         this.connectionBindingInFlight.set(input.connectionId, job.id);
-        queueMicrotask(() => void this.runConnectionBindingApply(job, challenge.binding));
+        this.queueSettingsOperation(job, [`connection:${this.dataDir}:${job.connectionId}`], input.execution, execution => this.runConnectionBindingApply(job, challenge.binding, execution));
         return { job, reused: false };
     }
     getConnectionBindingApply(jobId, sessionBinding) {
@@ -14004,9 +15764,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             return null;
         return this.connectionBindingJobs.get(jobId) ?? null;
     }
-    async runConnectionBindingApply(job, binding) {
+    async runConnectionBindingApply(job, binding, execution) {
         try {
-            await this.rebuildAdapterForBinding(job.connectionId, binding);
+            await this.rebuildAdapterForBinding(job.connectionId, binding, execution);
             job.result = "applied";
         }
         catch (err) {
@@ -14020,11 +15780,17 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         finally {
             job.status = "done";
             job.finishedAt = Date.now();
-            this.connectionBindingInFlight.delete(job.connectionId);
+            if (this.connectionBindingInFlight.get(job.connectionId) === job.id)
+                this.connectionBindingInFlight.delete(job.connectionId);
         }
     }
     /** Stop, rebuild and wait for a new adapter before committing YAML binding. */
-    async rebuildAdapterForBinding(connectionId, binding) {
+    async rebuildAdapterForBinding(connectionId, binding, execution) {
+        const generation = this.settingsGeneration;
+        const current = () => !this.shuttingDown && this.settingsGeneration === generation;
+        const check = () => { execution?.assert(); if (!current())
+            throw new Error("adapter operation superseded"); };
+        check();
         const channel = this.secureConnectionChannel(connectionId);
         if (!channel || !this.fleetConfig)
             throw new Error("connection not found");
@@ -14034,19 +15800,24 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const oldPrimary = this.adapter;
         const oldAccess = this.accessManager;
         const oldState = this.adapterState.get(connectionId);
-        const oldChannel = structuredClone(channel);
+        const beforeBinding = structuredClone(this.fleetConfig);
+        const bindingPath = this.fleetConfig.channels
+            ? ["channels", String(this.fleetConfig.channels.indexOf(channel))] : ["channel"];
+        const bindingFields = [[...bindingPath, "group_id"],
+            ...(binding.general_channel_id !== undefined ? [[...bindingPath, "options", "general_channel_id"]] : [])];
+        let bindingUndo = [];
         const primary = this.getPrimaryAdapterId() === connectionId;
         if (primary && this.sessionPruneTimer) {
             clearInterval(this.sessionPruneTimer);
             this.sessionPruneTimer = null;
         }
         let fresh;
-        let persistedBinding = false;
         try {
             this.adapterState.set(connectionId, { status: "retrying", retryCount: oldState?.retryCount ?? 0 });
             if (oldAdapter) {
                 oldAdapter.removeAllListeners();
                 await oldAdapter.stop().catch(() => { });
+                check();
                 if (this.adapters.get(connectionId) === oldAdapter)
                     this.adapters.delete(connectionId);
                 if (this.worlds.get(connectionId)?.adapter === oldAdapter)
@@ -14058,21 +15829,23 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             const started = new Promise(resolve => { startedResolve = resolve; });
             const onStarted = () => { startedResolve?.(); };
             if (primary)
-                await this.startSingleAdapter(this.fleetConfig, candidate, onStarted);
+                await this.startSingleAdapter(this.fleetConfig, candidate, onStarted, execution);
             else
-                await this.startAdditionalAdapter(candidate, true, onStarted);
+                await this.startAdditionalAdapter(candidate, true, onStarted, execution);
+            check();
             fresh = this.adapters.get(connectionId);
             if (!fresh)
                 throw new Error("new adapter did not start");
-            const deadline = Date.now() + 15_000;
+            const deadline = performance.now() + 15_000;
             if (!fresh.getHealthSnapshot) {
                 let timer;
                 const timeout = new Promise((_, reject) => {
-                    timer = setTimeout(() => reject(new Error("new adapter did not become ready")), Math.max(1, deadline - Date.now()));
+                    timer = setTimeout(() => reject(new Error("new adapter did not become ready")), Math.max(1, deadline - performance.now()));
                     timer.unref?.();
                 });
                 try {
                     await Promise.race([started, timeout]);
+                    check();
                 }
                 finally {
                     if (timer)
@@ -14080,11 +15853,12 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 }
             }
             else {
-                while (Date.now() < deadline) {
+                while (performance.now() < deadline) {
                     const health = fresh.getHealthSnapshot?.();
                     if (health?.status === "connected" || this.adapterState.get(connectionId)?.status === "connected")
                         break;
                     await new Promise(resolve => setTimeout(resolve, 100));
+                    check();
                 }
                 const health = fresh.getHealthSnapshot?.();
                 if (health && health.status !== "connected" && this.adapterState.get(connectionId)?.status !== "connected") {
@@ -14095,67 +15869,88 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 fresh.setChatId(String(candidate.group_id));
             // Commit only after the replacement adapter is ready. No allowlist,
             // topic, instance or schedule fields are touched here.
-            channel.group_id = String(binding.group_id);
-            if (binding.general_channel_id !== undefined) {
-                const options = { ...(channel.options ?? {}) };
-                if (binding.general_channel_id === null)
-                    delete options.general_channel_id;
-                else
-                    options.general_channel_id = String(binding.general_channel_id);
-                if (Object.keys(options).length === 0)
-                    delete channel.options;
-                else
-                    channel.options = options;
+            const commit = () => {
+                channel.group_id = String(binding.group_id);
+                if (binding.general_channel_id !== undefined) {
+                    const options = { ...(channel.options ?? {}) };
+                    if (binding.general_channel_id === null)
+                        delete options.general_channel_id;
+                    else
+                        options.general_channel_id = String(binding.general_channel_id);
+                    if (Object.keys(options).length === 0)
+                        delete channel.options;
+                    else
+                        channel.options = options;
+                }
+                try {
+                    this.saveFleetConfig();
+                }
+                finally {
+                    bindingUndo = settingsUndo(this.configPath, beforeBinding, this.fleetConfig, bindingFields);
+                }
+                this.routing.rebuild(this.fleetConfig);
+                this.reregisterClassicChannels();
+                this.adapterState.set(connectionId, { status: "connected", retryCount: 0 });
+            };
+            if (execution)
+                execution.commit(commit);
+            else {
+                check();
+                commit();
             }
-            this.saveFleetConfig();
-            persistedBinding = true;
-            this.routing.rebuild(this.fleetConfig);
-            this.reregisterClassicChannels();
-            this.adapterState.set(connectionId, { status: "connected", retryCount: 0 });
         }
         catch (err) {
+            let rollbackError;
+            try {
+                if (bindingUndo.length) {
+                    const disk = undoSettingsPaths(this.configPath, loadRawFleetConfig(this.configPath), bindingUndo);
+                    const runtime = undoSettingsPaths(this.configPath, this.fleetConfig, bindingUndo);
+                    if (disk.conflicts || runtime.conflicts)
+                        throw new Error("binding rollback conflict; newer configuration retained");
+                    noteSettingsWrite(this.configPath, this.fleetConfig, runtime.value);
+                    this.fleetConfig = runtime.value;
+                    this.saveFleetConfig(bindingFields.map(path => {
+                        let value = disk.value;
+                        for (const key of path)
+                            value = value?.[key];
+                        return { path, value, ...(value === undefined ? { remove: true } : {}) };
+                    }));
+                }
+            }
+            catch (restoreErr) {
+                rollbackError = restoreErr;
+            }
             if (fresh && fresh !== oldAdapter)
                 await fresh.stop().catch(() => { });
-            // Restore only the binding object in memory; unrelated connection and
-            // instance state remains exactly as it was before the attempt.
-            for (const key of Object.keys(channel)) {
-                if (!(key in oldChannel))
-                    delete channel[key];
-            }
-            Object.assign(channel, oldChannel);
-            this.adapters.delete(connectionId);
-            this.worlds.delete(connectionId);
-            this.adapterState.delete(connectionId);
-            if (oldAdapter) {
-                try {
-                    const onStarted = () => { };
-                    if (primary)
-                        await this.startSingleAdapter(this.fleetConfig, oldChannel, onStarted);
-                    else
-                        await this.startAdditionalAdapter(oldChannel, true, onStarted);
-                    this.adapterState.set(connectionId, oldState ?? { status: "connected", retryCount: 0 });
-                }
-                catch (restoreErr) {
-                    throw new Error(`binding rollback failed: ${safeSecretError(restoreErr)}`);
+            if (this.adapters.get(connectionId) === fresh || this.adapters.get(connectionId) === oldAdapter) {
+                this.adapters.delete(connectionId);
+                if (this.worlds.get(connectionId)?.adapter === fresh || this.worlds.get(connectionId)?.adapter === oldAdapter)
+                    this.worlds.delete(connectionId);
+                if (primary && (this.adapter === fresh || this.adapter === oldAdapter))
+                    this.adapter = null;
+            }
+            if (current()) {
+                const retained = this.secureConnectionChannel(connectionId);
+                if (retained) {
+                    const cleanup = { owner: execution?.owner ?? Symbol("adapter-cleanup"), assert: () => { if (!current())
+                            throw new Error("cleanup superseded"); } };
+                    try {
+                        if (primary)
+                            await this.startSingleAdapter(this.fleetConfig, retained, () => { }, cleanup);
+                        else
+                            await this.startAdditionalAdapter(retained, true, () => { }, cleanup);
+                        if (!current())
+                            throw new Error("cleanup superseded");
+                        this.routing.rebuild(this.fleetConfig);
+                        this.reregisterClassicChannels();
+                    }
+                    catch (restoreErr) {
+                        throw new Error(`binding rollback failed: ${safeSecretError(restoreErr)}`);
+                    }
                 }
             }
-            else {
-                if (primary)
-                    this.adapter = oldPrimary;
-                if (oldWorld)
-                    this.worlds.set(connectionId, oldWorld);
-                if (oldAdapter)
-                    this.adapters.set(connectionId, oldAdapter);
-                this.accessManager = oldAccess;
-            }
-            // The binding is committed to YAML before routing is rebuilt.  If the
-            // post-commit rebuild fails, restore the durable document as well as the
-            // in-memory channel; otherwise a reload would resurrect the failed
-            // binding that the running fleet just rolled back.
-            if (persistedBinding)
-                this.saveFleetConfig();
-            this.routing.rebuild(this.fleetConfig);
-            this.reregisterClassicChannels();
+            if (rollbackError)
+                throw new Error(`binding rollback failed: ${safeSecretError(rollbackError)}`);
             throw err;
         }
     }
@@ -14170,7 +15965,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const challengeKey = `${input.sessionBinding}:${input.connectionId}:${input.idempotencyKey}`;
         const existingId = this.connectionSecretChallengesByKey.get(challengeKey);
         const existing = existingId ? this.connectionSecretChallenges.get(existingId) : undefined;
-        if (existing && existing.expiresAt > Date.now()) {
+        if (existing && (existing.deadline === undefined ? existing.expiresAt > Date.now() : existing.deadline > performance.now())) {
             return { ok: true, verification_id: existing.id, expires_at: existing.expiresAt };
         }
         if (existingId)
@@ -14192,7 +15987,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             generation: this.secureConnectionGeneration(input.connectionId),
             operation: "secret.apply",
             idempotencyKey: input.idempotencyKey,
-            expiresAt,
+            expiresAt, deadline: performance.now() + SECRET_CHALLENGE_TTL_MS,
             secret: input.secret,
         };
         this.connectionSecretChallenges.set(challenge.id, challenge);
@@ -14222,7 +16017,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             }
         }
         const challenge = this.connectionSecretChallenges.get(input.verificationId);
-        if (!challenge || challenge.expiresAt <= Date.now()) {
+        if (!challenge || (challenge.deadline === undefined ? challenge.expiresAt <= Date.now() : challenge.deadline <= performance.now())) {
             this.connectionSecretChallenges.delete(input.verificationId);
             return { error: "verification expired; verify the secret again" };
         }
@@ -14256,7 +16051,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.connectionSecretJobs.set(job.id, job);
         this.connectionSecretJobSession.set(job.id, input.sessionBinding);
         this.connectionSecretInFlight.set(input.connectionId, job.id);
-        queueMicrotask(() => void this.runConnectionSecretApply(job, challenge.secret));
+        this.queueSettingsOperation(job, [settingsFileResource(join(this.dataDir, ".env")), `connection:${this.dataDir}:${job.connectionId}`], input.execution, execution => this.runConnectionSecretApply(job, challenge.secret, execution));
         return { job, reused: false };
     }
     getConnectionSecretApply(jobId, sessionBinding) {
@@ -14264,7 +16059,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             return null;
         return this.connectionSecretJobs.get(jobId) ?? null;
     }
-    async runConnectionSecretApply(job, secret) {
+    async runConnectionSecretApply(job, secret, execution) {
         const channel = this.secureConnectionChannel(job.connectionId);
         const envKey = channel?.bot_token_env;
         const allowed = new Set((this.fleetConfig?.channels
@@ -14272,6 +16067,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             .map(item => item.bot_token_env));
         let before = null;
         let oldToken;
+        let store;
+        const generation = this.settingsGeneration;
         let replaced = false;
         try {
             if (!channel || !envKey || !allowed.has(envKey))
@@ -14281,14 +16078,21 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 .filter(item => item.bot_token_env === envKey);
             if (owners.length !== 1)
                 throw new Error("secret key is shared by multiple connections");
-            const store = new SecretStore(join(this.dataDir, ".env"), allowed);
-            before = store.write(envKey, secret);
-            replaced = true;
-            oldToken = process.env[envKey];
-            process.env[envKey] = secret;
-            const generation = this.secureConnectionGeneration(job.connectionId) + 1;
-            this.connectionSecretGenerations.set(job.connectionId, generation);
-            const applied = await this.rebuildAdapterForSecret(job.connectionId, channel);
+            store = new SecretStore(join(this.dataDir, ".env"), allowed, { owner: execution?.owner });
+            const write = () => {
+                before = store.write(envKey, secret);
+                replaced = true;
+                oldToken = process.env[envKey];
+                process.env[envKey] = secret;
+                this.connectionSecretGenerations.set(job.connectionId, this.secureConnectionGeneration(job.connectionId) + 1);
+            };
+            if (execution)
+                execution.mutate(write);
+            else
+                write();
+            const applied = await this.rebuildAdapterForSecret(job.connectionId, channel, false, execution);
+            execution?.assert();
+            execution?.complete(); // Linearize success inside the runner, before its promise settles.
             if (!applied) {
                 job.result = "restart_required";
                 job.status = "done";
@@ -14308,16 +16112,21 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             }
             else {
                 try {
-                    const store = new SecretStore(join(this.dataDir, ".env"), new Set([envKey]));
-                    store.restore(before);
-                    if (oldToken === undefined)
-                        delete process.env[envKey];
-                    else
-                        process.env[envKey] = oldToken;
+                    store.restoreIfCurrent(before);
+                    if (process.env[envKey] === secret) {
+                        if (oldToken === undefined)
+                            delete process.env[envKey];
+                        else
+                            process.env[envKey] = oldToken;
+                    }
                     // Build a fresh adapter from the restored token. If the old adapter
                     // was stopped already, this is the only safe way to return to the
                     // previous runtime without claiming a disk-only rollback succeeded.
-                    const restored = await this.rebuildAdapterForSecret(job.connectionId, channel, true);
+                    const cleanup = { owner: execution?.owner ?? Symbol("secret-cleanup"), assert: () => {
+                            if (this.shuttingDown || this.settingsGeneration !== generation)
+                                throw new Error("secret cleanup superseded");
+                        } };
+                    const restored = await this.rebuildAdapterForSecret(job.connectionId, this.secureConnectionChannel(job.connectionId) ?? channel, true, cleanup);
                     if (!restored)
                         throw new Error("adapter rollback did not become connected");
                     job.result = "rolled_back";
@@ -14332,13 +16141,19 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             job.finishedAt = Date.now();
         }
         finally {
-            this.connectionSecretInFlight.delete(job.connectionId);
+            if (this.connectionSecretInFlight.get(job.connectionId) === job.id)
+                this.connectionSecretInFlight.delete(job.connectionId);
             // Do not retain the token after the apply (success or rollback).
             secret = "";
         }
     }
     /** Stop the old provider client and construct a new one from process.env. */
-    async rebuildAdapterForSecret(connectionId, channel, force = false) {
+    async rebuildAdapterForSecret(connectionId, channel, force = false, execution) {
+        const generation = this.settingsGeneration;
+        const current = () => !this.shuttingDown && this.settingsGeneration === generation;
+        const check = () => { execution?.assert(); if (!current())
+            throw new Error("adapter operation superseded"); };
+        check();
         const old = this.adapters.get(connectionId);
         if (!old && !force)
             return false; // The secret is valid on disk; the next start adopts it.
@@ -14352,6 +16167,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         if (old) {
             old.removeAllListeners();
             await old.stop().catch(() => { });
+            check();
             if (this.adapters.get(connectionId) === old)
                 this.adapters.delete(connectionId);
             if (this.worlds.get(connectionId)?.adapter === old)
@@ -14363,13 +16179,14 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const started = new Promise(resolve => { startedResolve = resolve; });
         const onStarted = () => { startedResolve?.(); };
         if (primary)
-            await this.startSingleAdapter(this.fleetConfig, channel, onStarted);
+            await this.startSingleAdapter(this.fleetConfig, channel, onStarted, execution);
         else
-            await this.startAdditionalAdapter(channel, true, onStarted);
+            await this.startAdditionalAdapter(channel, true, onStarted, execution);
+        check();
         const fresh = this.adapters.get(connectionId);
         if (!fresh)
             throw new Error("new adapter did not start");
-        const deadline = Date.now() + 15_000;
+        const deadline = performance.now() + 15_000;
         // Telegram has no gateway health snapshot. Its start() method launches the
         // grammY polling loop in the background, so completion of start() is not a
         // connected signal. The adapter's `started` event is emitted only after the
@@ -14377,11 +16194,12 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         if (!fresh.getHealthSnapshot) {
             let timer;
             const timeout = new Promise((_, reject) => {
-                timer = setTimeout(() => reject(new Error("new adapter did not emit started before deadline")), Math.max(1, deadline - Date.now()));
+                timer = setTimeout(() => reject(new Error("new adapter did not emit started before deadline")), Math.max(1, deadline - performance.now()));
                 timer.unref?.();
             });
             try {
                 await Promise.race([started, timeout]);
+                check();
             }
             finally {
                 if (timer)
@@ -14390,11 +16208,12 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.adapterState.set(connectionId, { status: "connected", retryCount: 0 });
             return true;
         }
-        while (Date.now() < deadline) {
+        while (performance.now() < deadline) {
             const health = fresh.getHealthSnapshot?.();
             if (health?.status === "connected" || this.adapterState.get(connectionId)?.status === "connected")
                 return true;
             await new Promise(resolve => setTimeout(resolve, 100));
+            check();
         }
         throw new Error("new adapter did not become connected");
     }
@@ -14801,14 +16620,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.rejectedHostsLogged.add(name);
         this.logger.warn({ host: name }, "Web request refused: Host is not allowed (add it to web.allowed_hosts if this is a proxy you run)");
     }
-    startHealthServer(port) {
-        this.startedAt = Date.now();
-        this.healthServerListening = false;
-        this.healthPortRetried = false;
-        // Defensive for direct/unit callers; normal startup initializes these before adapters.
-        if (!this.webToken || !this.viewToken)
-            this.initializeWebAuthTokens();
-        this.healthServer = createServer((req, res) => {
+    /** Shared handler dispatcher; gateway admission is enforced by its separate listener. */
+    dispatchWebHttp(req, res, port) {
+        try {
             res.setHeader("Content-Type", "application/json");
             // No Referer to a tunnel host, an upstream proxy, or any page linked from
             // the panel — the dashboard URL is itself a credential-bearing address.
@@ -14820,7 +16634,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             // Before any route, /health and /agent included: loopback binding does not
             // stop DNS rebinding, and the Host the browser sends is the one thing a
             // rebinding page cannot change.
-            if (!isHostAllowed(req.headers.host, allowedHostNames(this.fleetConfig))) {
+            if (!gatewayRequestContext(req) && !isHostAllowed(req.headers.host, allowedHostNames(this.fleetConfig))) {
                 this.noteRejectedHost(req.headers.host);
                 res.writeHead(403);
                 res.end(JSON.stringify({ error: WEB_HOST_REJECTED_MESSAGE }));
@@ -14835,43 +16649,32 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 res.end();
                 return;
             }
-            // Public health probe — no auth required.
-            if (req.method === "GET" && req.url === "/health") {
-                // fallthrough to existing handler below
-            }
-            else if (req.method === "POST" && req.url === "/agent") {
-                // /agent handles its own instance-level auth via X-Agend-Instance-Token
-            }
-            else if (isViewPath(new URL(req.url ?? "/", `http://localhost:${port}`).pathname)) {
-                // /view routes accept the read-only view.token (or web.token) and do
-                // their own per-method auth in view-api.ts — skip the web-token gate.
-            }
-            else if (isUsagePath(new URL(req.url ?? "/", `http://localhost:${port}`).pathname)) {
-                // /api/ai-usage is read-only GET data for the /view Usage panel — open
-                // like the other /view data routes (usage-api.ts rejects non-GET).
+            // Public: the health probe, /agent (instance-token auth of its own), the
+            // sign-in surface, and /view's reads unless web.view_access says otherwise.
+            if (bypassesWebGate(req, requestPath, this.fleetConfig, p => !gatewayRequestContext(req) && (isViewPath(p) || isUsagePath(p)))) {
+                // fall through to the handlers below
             }
             else {
                 // All other endpoints require a session cookie or an X-Agend-Token
-                // header; a `?token=` in the URL is only redeemed for a cookie on a GET.
+                // header; a `?token=` in the URL is not a credential.
                 // /ui/* will also re-check in web-api.ts, which is harmless.
                 const parsedUrl = new URL(req.url ?? "/", `http://localhost:${port}`);
-                const decision = decideWebGate(req, parsedUrl, this.webToken);
+                const decision = decideWebGate(req, parsedUrl, this.webToken, this.webSessions);
                 if (decision.kind === "reject") {
+                    // A browser navigating to a panel with no cookie gets the sign-in page,
+                    // not a JSON error: a SameSite=Strict cookie is not sent on a link
+                    // followed from a chat app, and the page can tell "no session" from "cookie
+                    // not sent" by asking from inside the site. API callers still get JSON.
+                    if (decision.reason === "no-credential" && req.method === "GET"
+                        && String(req.headers.accept ?? "").includes("text/html")
+                        && isWebPageNavigation(requestPath)) {
+                        serveSigninPage(res, 401);
+                        return;
+                    }
                     res.writeHead(decision.status);
                     res.end(JSON.stringify({ error: decision.message }));
                     return;
                 }
-                if (decision.kind === "exchange") {
-                    res.setHeader("Set-Cookie", decision.setCookie);
-                    res.setHeader("Location", decision.location);
-                    // A cached redirect would replay a Set-Cookie for a rotated token.
-                    res.setHeader("Cache-Control", "no-store");
-                    res.writeHead(302);
-                    // Browsers follow the Location; a script that does not gets told why
-                    // its URL token stopped being echoed back as data.
-                    res.end(JSON.stringify({ redirect: decision.location }));
-                    return;
-                }
             }
             if (req.method === "GET" && req.url === "/health") {
                 const health = this.getFleetHealth();
@@ -14971,12 +16774,14 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                             ...this.instancePresentation(inst.name),
                         };
                     });
-                    res.setHeader("Access-Control-Allow-Origin", "*");
+                    if (!gatewayRequestContext(req))
+                        res.setHeader("Access-Control-Allow-Origin", "*");
                     res.writeHead(200);
                     res.end(JSON.stringify({
                         ...sysInfo,
                         version: this.currentVersion,
                         instances: enriched,
+                        publicLink: this.getPublicWebStatus(),
                     }));
                 }
                 catch (err) {
@@ -15001,7 +16806,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                     sinceIso = new Date(Date.now() - val * unit).toISOString();
                 }
                 const rows = this.eventLog?.listActivity({ since: sinceIso, limit: parseInt(limitParam, 10) }) ?? [];
-                res.setHeader("Access-Control-Allow-Origin", "*");
+                if (!gatewayRequestContext(req))
+                    res.setHeader("Access-Control-Allow-Origin", "*");
                 res.writeHead(200);
                 res.end(JSON.stringify(rows));
                 return;
@@ -15091,17 +16897,52 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             }
             // ── Web UI endpoints (delegated to web-api.ts) ─────
             const url = new URL(req.url ?? "/", `http://localhost:${port}`);
-            if (handleViewRequest(req, res, url, this))
-                return;
-            if (handleUsageRequest(req, res, url, this))
-                return;
-            if (handleSettingsRequest(req, res, url, this))
-                return;
-            if (handleWebRequest(req, res, url, this))
+            // A handler that throws synchronously answers this request with a 500; it must never reach the process's
+            // uncaughtException handler, which stops the whole fleet (#1252 review: one file name did that).
+            try {
+                if (handleAuthRequest(req, res, url, this))
+                    return;
+                if (handleViewRequest(req, res, url, this))
+                    return;
+                if (handleUsageRequest(req, res, url, this))
+                    return;
+                const settingsNext = (request, response, address) => handleSettingsRequest(request, response, address, this)
+                    || handleWebRequest(request, response, address, this);
+                if (this.settingsGate().handle(req, res, url, settingsNext))
+                    return;
+                if (settingsNext(req, res, url))
+                    return;
+            }
+            catch (err) {
+                this.logger.error({ err: err?.message, path: url.pathname }, "Web request handler threw");
+                if (!res.headersSent) {
+                    res.writeHead(500);
+                    res.end(JSON.stringify({ error: "internal error" }));
+                }
+                else
+                    res.destroy();
                 return;
+            }
             res.writeHead(404);
             res.end(JSON.stringify({ error: "not found" }));
-        });
+        }
+        catch {
+            if (!res.headersSent) {
+                res.writeHead(400);
+                res.end(JSON.stringify({ error: "invalid request" }));
+            }
+            else
+                res.destroy();
+        }
+    }
+    startHealthServer(port) {
+        this.startedAt = Date.now();
+        this.healthServerListening = false;
+        this.healthPortRetried = false;
+        // Defensive for direct/unit callers; normal startup initializes these before adapters.
+        if (!this.webToken || !this.webSessions)
+            this.initializeWebAuthTokens();
+        this.healthServer = createServer((req, res) => this.dispatchWebHttp(req, res, port));
         const markListening = (afterTakeover = false) => {
             this.healthServerListening = true;
             this.logger.info({ port }, afterTakeover
@@ -15112,6 +16953,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             // `/dashboard` and `agend web` are the ways to get an authorized link.
             this.logger.info({ url: `http://localhost:${port}/ui` }, "Web UI available (open it with /dashboard or `agend web`)");
             this.logger.info({ url: `http://localhost:${port}/view` }, "Web View available");
+            // #1306: the preview listener starts once the web listener is bound — its frame-ancestors name the real port.
+            const bound = this.healthServer?.address();
+            this.startPreviewListener(port, bound && typeof bound === "object" ? bound.port : port);
         };
         this.healthServer.on("error", (err) => {
             this.healthServerListening = false;
@@ -15165,6 +17009,74 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         });
         this.healthServer.listen(port, "127.0.0.1", () => markListening());
     }
+    /**
+     * #1306: the preview listener, beside the web listener and closed with it. When it cannot listen (the port is
+     * taken, web.preview: false), cards show Source and Download only; nothing else changes.
+     */
+    startPreviewListener(requestedPort, boundPort) {
+        this.stopPreviewListener();
+        this.previewPorts = { requested: requestedPort, bound: boundPort };
+        this.previewInputs = this.previewInputsSignature();
+        // web.preview is hot; web.preview_port and web.preview_origin are startup-only (STARTUP_ONLY_FLEET_KEYS): they
+        // come from the configuration this process started on, so a reload that changes them reports "restart required"
+        // and a hot re-enable never half-applies them.
+        const started = (this.startupFleetConfig ?? this.fleetConfig)?.web;
+        const settings = previewSettings({ preview: this.fleetConfig?.web?.preview, preview_port: started?.preview_port, preview_origin: started?.preview_origin }, requestedPort);
+        if (!settings.enabled)
+            return;
+        if (settings.port === null) {
+            this.logger.warn({ health_port: requestedPort }, "No port for the HTML preview listener (health_port is the highest port) — set web.preview_port; previews are off");
+            return;
+        }
+        const listener = createPreviewListener({ settings, healthPort: boundPort, config: this.fleetConfig });
+        this.previewListener = listener;
+        listener.server.on("error", (err) => {
+            if (this.previewListener !== listener)
+                return;
+            this.logger.warn({ code: err.code, port: settings.port }, "Preview listener unavailable; HTML previews are off");
+            this.previewListening = false;
+            this.previewListener = null;
+        });
+        // An optional listener never takes the fleet down: a port Node refuses outright throws here, synchronously.
+        try {
+            listener.server.listen(settings.port, "127.0.0.1", () => { if (this.previewListener === listener)
+                this.previewListening = true; });
+        }
+        catch (err) {
+            this.logger.warn({ err: err.message, port: settings.port }, "Preview listener cannot listen; HTML previews are off");
+            this.previewListening = false;
+            this.previewListener = null;
+        }
+    }
+    /** What a reload may change hot: web.preview, and the dashboard names (the shim's allow-list and frame-ancestors). */
+    previewInputsSignature() {
+        const c = this.fleetConfig;
+        return JSON.stringify({ p: c?.web?.preview ?? null, h: c?.hostname ?? null, a: c?.web?.allowed_hosts ?? null });
+    }
+    /**
+     * After a config reload: web.preview true→false stops the listener at once (/ui then offers no origin, boot or
+     * frame-src), false→true starts it, and a change of dashboard names rebuilds it (a new boot id). preview_port and
+     * preview_origin are not adopted here: they are startup-only, and the reload reports "restart required".
+     */
+    reconcilePreviewListener() {
+        if (!this.previewPorts || this.previewInputsSignature() === this.previewInputs)
+            return;
+        this.logger.info({}, "HTML preview settings changed — rebuilding the preview listener");
+        this.startPreviewListener(this.previewPorts.requested, this.previewPorts.bound);
+    }
+    stopPreviewListener() {
+        this.previewListening = false;
+        this.previewListener?.close();
+        this.previewListener = null;
+    }
+    /** For one /ui load: the preview origin it may frame, and the listener's boot id (see web-preview.ts). */
+    previewForUi(hostHeader, secure) {
+        const listener = this.previewListening ? this.previewListener : null;
+        const decided = previewAvailability(listener ? listener.settings : null, hostHeader, secure, listener ? listener.origins : undefined);
+        if (!listener && this.fleetConfig?.web?.preview !== false)
+            decided.reason = "Previews are not available on this fleet right now.";
+        return { ...decided, boot: listener ? listener.bootId : null };
+    }
     getUiStatus() {
         return measureSyncWork("fleet.uiStatus", () => this.getUiStatusSync());
     }
@@ -15221,6 +17133,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 name,
                 display_name: display_name || undefined,
                 status: this.getInstanceStatus(name),
+                // `state` (presentation: may be awaiting_input) and `execution_state` (working / idle / stuck, or null —
+                // what the dashboard's activity events carry) come from instancePresentation (#1212).
                 context_pct,
                 cost,
                 model,
@@ -15233,6 +17147,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         });
         return {
             instances,
+            publicLink: this.getPublicWebStatus(),
             uptime: Math.floor((Date.now() - this.startedAt) / 1000),
         };
     }