@songsid/agend 2.1.2-beta.15 → 2.1.2-beta.17

package/dist/fleet-manager.js

@@ -4,7 +4,8 @@ import { createServer } from "node:http";
 import { join, dirname, basename } from "node:path";
 import { fileURLToPath } from "node:url";
 import { getAgendHome, ensureWorkspaceGit } from "./paths.js";
-import { sdNotify } from "./sd-notify.js";
+import { sdNotify, sdNotifyBlocking } from "./sd-notify.js";
+import { readFleetMemory } from "./process-memory.js";
 import { isScalar, parseDocument } from "yaml";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -21,12 +22,12 @@ import { IpcClient } from "./channel/ipc-bridge.js";
 import { createAdapter } from "./channel/factory.js";
 import { createBackend } from "./backend/factory.js";
 import { isModelCompatible } from "./backend/types.js";
-import { createLogger } from "./logger.js";
+import { createLogger, rotateLogIfNeeded } from "./logger.js";
 import { processAttachments } from "./channel/attachment-handler.js";
 import { routeToolCall } from "./channel/tool-router.js";
 import { Scheduler } from "./scheduler/index.js";
 import { DEFAULT_SCHEDULER_CONFIG } from "./scheduler/index.js";
-import { TopicCommands, saveCommandForBackend, parseSaveFilename, parsePauseWakeCommand, SAVE_FILENAME_RE, SAVE_UNSUPPORTED_MSG, resolveInstanceContext } from "./topic-commands.js";
+import { TopicCommands, saveCommandForBackend, parseSaveFilename, parsePauseWakeCommand, SAVE_FILENAME_RE, SAVE_UNSUPPORTED_MSG, resolveInstanceContext, forgetInstanceContext } from "./topic-commands.js";
 import { DailySummary } from "./daily-summary.js";
 import { WebhookEmitter } from "./webhook-emitter.js";
 import { TmuxControlClient } from "./tmux-control.js";
@@ -38,6 +39,7 @@ import { StatuslineWatcher } from "./statusline-watcher.js";
 import { outboundHandlers } from "./outbound-handlers.js";
 import { handleWebRequest, broadcastSseEvent } from "./web-api.js";
 import { handleViewRequest, isViewPath } from "./view-api.js";
+import { handleUsageRequest, isUsagePath } from "./usage/usage-api.js";
 import { handleSettingsRequest } from "./settings-api.js";
 import { setLocale, detectLocale, t } from "./locale.js";
 import { handleAgentRequest } from "./agent-endpoint.js";
@@ -83,6 +85,37 @@ const CANCEL_BTN_MAX_RETRIES = 3;
  * buttons no clear trigger reached (e.g. a scheduled/HTTP turn that never called
  * reply). 5min (not the old 2s idle-watch) so Thinking isn't misread as idle. */
 const CANCEL_BTN_IDLE_CHECK_INTERVAL_MS = 5 * 60_000;
+/**
+ * How often the cancel button's text is refreshed with elapsed working time.
+ *
+ * One edit per working instance per interval — at 60s that is trivial for both
+ * platforms' rate limits, and it reads as a live counter rather than a stale
+ * snapshot. Nothing new is posted, so the channel is never spammed: there is
+ * exactly one progress message per turn, and it is the cancel button itself.
+ */
+const PROGRESS_UPDATE_INTERVAL_MS = 60_000;
+/** Elapsed time is only shown once work has clearly outlasted a quick answer. */
+const PROGRESS_MIN_ELAPSED_MS = 2 * 60_000;
+/** How much of a tool summary the progress line will show before eliding. */
+const PROGRESS_ACTIVITY_MAX_CHARS = 48;
+/**
+ * Emoji AgEnD itself stamps on messages as machine signals: the delivery-status
+ * ladder (⏳ queued, 👀 delivered, ✅ confirmed, ❌ failed) and the 🫡 ack. They
+ * are indicators, not opinions, so they never belong in the reactions queue —
+ * regardless of who they arrive from, because the adapter-level bot filter can
+ * miss (Discord partial users may not carry the `bot` flag). The cost is that a
+ * human genuinely reacting ✅ is also dropped; with four bot-stamped meanings
+ * already attached to these glyphs, that reading is ambiguous anyway.
+ */
+const DELIVERY_STATUS_EMOJIS = new Set(["👀", "⏳", "✅", "❌", "🫡"]);
+/**
+ * How long a delivery waits out a disconnected instance IPC before giving up.
+ *
+ * Sized for a daemon restart (socket close → respawn → CLI ready), which is the
+ * event this exists for. Past it the delivery fails loudly as it always did.
+ */
+const IPC_RECONNECT_GRACE_MS = 30_000;
+const IPC_RECONNECT_POLL_MS = 250;
 const CLASSIC_BACKEND_SELECTION_TIMEOUT_MS = 60_000;
 const CLASSIC_BACKEND_CALLBACK_PREFIX = "classic-backend:";
 const MODEL_SELECT_CALLBACK_PREFIX = "model-select:";
@@ -93,7 +126,7 @@ export class FleetManager {
     static sighupHandlerInstalled = false;
     children = new Map();
     lifecycle;
-    /** @deprecated Use lifecycle.daemons — kept for backward compat */
+    /** Live view of lifecycle.daemons — used throughout; not deprecated. */
     get daemons() { return this.lifecycle.daemons; }
     fleetConfig = null;
     rawFleetConfig = {};
@@ -151,6 +184,10 @@ export class FleetManager {
     // reply, on cancel, or when a newer button supersedes it for the same
     // instance. Per-button tracking means a failed delete never strands a button.
     cancelButtons = new Map();
+    /** instanceName → what it is doing right now, when the backend can tell us. */
+    instanceActivity = new Map();
+    /** instanceName → tail of deliveries waiting for its IPC to come back. */
+    ipcWaitTails = new Map();
     // Last user message delivered to each instance — used to react ✅ on completion.
     lastInboundMsg = new Map();
     topicArchiver;
@@ -176,6 +213,10 @@ export class FleetManager {
     healthServer = null;
     healthPortRetried = false;
     updateCheckTimer = null;
+    eventLogPruneTimer = null;
+    logRotateTimer = null;
+    /** Days of event/activity history to keep. */
+    static EVENT_LOG_RETENTION_DAYS = 30;
     watchdogTimer = null;
     startedAt = 0;
     // Mirror topic: buffer cross-instance messages, flush every 3s
@@ -214,7 +255,13 @@ export class FleetManager {
         }
         this.reloadPending = false;
         this.reconcileInFlight = this.reconcileInstances()
-            .catch(err => this.logger.error({ err }, "SIGHUP config reload failed"))
+            .catch(err => {
+            // Almost always a YAML parse error. Log-only meant the user edited
+            // fleet.yaml, sent SIGHUP, and got no reaction and no explanation.
+            this.logger.error({ err }, "SIGHUP config reload failed");
+            const message = err instanceof Error ? err.message : String(err);
+            this.notifyFleetError(`⚠️ fleet.yaml reload FAILED — ${message}\nThe previous configuration is still running.`);
+        })
             .finally(() => {
             this.reconcileInFlight = null;
             if (this.reloadPending && this.startupComplete) {
@@ -477,8 +524,12 @@ export class FleetManager {
         // warm_cap: a fresh transition into idle may free this instance for eviction,
         // or (more usefully) reveal that the fleet is now over cap. Only fire on the
         // edge into idle, not on every idle heartbeat.
-        if (state === "idle" && previous?.state !== "idle")
+        if (state === "idle" && previous?.state !== "idle") {
             this.enforceWarmCap();
+            // The turn is genuinely over — retire the cancel/progress button now rather
+            // than waiting for the 5-minute idle backstop to notice.
+            this.retireInstanceButtons(name);
+        }
     }
     cacheInstanceProcessStatus(name, status) {
         if (status === "running") {
@@ -583,12 +634,70 @@ export class FleetManager {
         if (!idle) {
             this.logger.warn({ instanceName, timeoutMs }, "Idle gate timed out; forcing delivery");
         }
-        const ipc = this.instanceIpcClients.get(instanceName);
-        if (!ipc?.connected)
-            throw new Error(`Instance '${instanceName}' IPC is unavailable`);
-        ipc.send(payload);
+        await this.sendWhenConnected(instanceName, payload);
         this.lastDeliveryAt.set(instanceName, Date.now());
     }
+    /**
+     * Hand a payload to an instance's IPC, waiting out a *transient* disconnect.
+     *
+     * A daemon that is restarting — `/restart`, crash recovery, a model switch —
+     * drops its socket for a few seconds. Any message arriving in that window used
+     * to fail instantly: the caller logged a warning, put ❌ on the user's message,
+     * and the message was gone. The user had to notice the ❌ and retype it. That is
+     * the "instance 訊息不容易掉" goal failing on the most predictable event there is.
+     *
+     * The wait is bounded. If the instance is genuinely down, this still throws and
+     * the ❌ still appears — just for a real failure rather than a restart.
+     *
+     * Ordering is preserved by serialising behind any waiter already queued for this
+     * instance, *including* when the socket happens to be up: otherwise a message
+     * arriving after the reconnect could overtake one that has been waiting for it.
+     */
+    async sendWhenConnected(instanceName, payload) {
+        const queued = this.ipcWaitTails.get(instanceName);
+        if (!queued) {
+            const ipc = this.instanceIpcClients.get(instanceName);
+            if (ipc?.connected && ipc.send(payload))
+                return;
+        }
+        const attempt = (queued ?? Promise.resolve())
+            .catch(() => { })
+            .then(() => this.sendAfterIpcReturns(instanceName, payload));
+        // The chain stores a settled-either-way promise so one failed delivery cannot
+        // wedge every later one, and so `queued` above is safe to await unguarded.
+        const tail = attempt.catch(() => { });
+        this.ipcWaitTails.set(instanceName, tail);
+        try {
+            await attempt;
+        }
+        finally {
+            // Only the last waiter clears the chain; while a queue is still draining the
+            // map must keep pointing at it or ordering is lost.
+            if (this.ipcWaitTails.get(instanceName) === tail) {
+                this.ipcWaitTails.delete(instanceName);
+            }
+        }
+    }
+    /** Poll for the instance's IPC to come back, then send. Throws if it does not. */
+    async sendAfterIpcReturns(instanceName, payload) {
+        const deadline = Date.now() + IPC_RECONNECT_GRACE_MS;
+        let warned = false;
+        for (;;) {
+            // Re-read every round: a reconnect replaces the IpcClient object entirely,
+            // so a cached reference would stay dead forever.
+            const ipc = this.instanceIpcClients.get(instanceName);
+            if (ipc?.connected && ipc.send(payload))
+                return;
+            if (Date.now() >= deadline) {
+                throw new Error(`Instance '${instanceName}' IPC is unavailable`);
+            }
+            if (!warned) {
+                warned = true;
+                this.logger.info({ instanceName }, "Instance IPC is down — holding delivery until it reconnects");
+            }
+            await new Promise(resolve => setTimeout(resolve, IPC_RECONNECT_POLL_MS));
+        }
+    }
     /** Single delivery facade: wake paused CLIs and serialize non-user work behind idle. */
     async deliverToInstance(instanceName, payload, options = {}) {
         const meta = payload.meta && typeof payload.meta === "object"
@@ -604,10 +713,7 @@ export class FleetManager {
                 await this.lifecycle.wake(instanceName, 30_000);
                 this.enforceWarmCap(instanceName); // woke one → evict a different LRU idle if over cap
             }
-            const ipc = this.instanceIpcClients.get(instanceName);
-            if (!ipc?.connected)
-                throw new Error(`Instance '${instanceName}' IPC is unavailable`);
-            ipc.send(payload);
+            await this.sendWhenConnected(instanceName, payload);
             // A cross-instance item arriving before the daemon observes this turn as
             // working must not trust the stale idle snapshot from before the send.
             this.lastDeliveryAt.set(instanceName, Date.now());
@@ -853,7 +959,6 @@ export class FleetManager {
         this.configPath = configPath;
         this.loadEnvFile();
         // Rotate fleet.log if oversized (before any logging)
-        const { rotateLogIfNeeded } = await import("./logger.js");
         rotateLogIfNeeded(join(this.dataDir, "fleet.log"));
         const fleet = this.loadConfig(configPath);
         setLocale(detectLocale(fleet)); // user-facing text language (fleet.yaml defaults.locale / timezone)
@@ -897,7 +1002,7 @@ export class FleetManager {
         }
         const pidPath = join(this.dataDir, "fleet.pid");
         writeFileSync(pidPath, String(process.pid), "utf-8");
-        this.eventLog = new EventLog(join(this.dataDir, "events.db"));
+        this.eventLog = this.openEventLog();
         // Initialize classic channel manager. The primary adapter (channels[0])
         // migrates legacy single-bot entries and names without a suffix. Classic
         // routing does NOT go through the routing engine (single-key, can't hold two
@@ -986,11 +1091,10 @@ export class FleetManager {
             // Rotate fleet.log daily too (besides the startup size check above), so a
             // long-running fleet doesn't accumulate an unbounded log.
             rotateLogIfNeeded(join(this.dataDir, "fleet.log"));
-            // Instance output.log is pipe-pane (TUI ANSI). Daemon health ticks also
-            // rotate it; this is the daily safety net for idle/stopped instances.
-            for (const name of Object.keys(this.fleetConfig?.instances ?? {})) {
-                rotateLogIfNeeded(join(this.dataDir, "instances", name, "output.log"));
-            }
+            // Instance output.log is pipe-pane (TUI ANSI). Daemon health ticks rotate a
+            // running instance's own log; this sweep is the safety net for every other
+            // kind. One implementation, so the two cannot cover different sets.
+            this.rotateAllInstanceLogs();
         }, () => {
             const instances = Object.keys(this.fleetConfig?.instances ?? {});
             const costMap = new Map();
@@ -1130,9 +1234,29 @@ export class FleetManager {
                 }
             }
         }
-        // Signal systemd: generals ready
-        sdNotify("READY=1");
+        // The systemd watchdog answers exactly one question: is this process still
+        // turning its event loop? Pinging from a timer proves that, and after the
+        // blocking child-process calls were made async it is a meaningful signal —
+        // a deadlocked or frozen fleet stops pinging and systemd restarts it.
+        //
+        // It deliberately does NOT gate on fleet health. "No adapter connected" or
+        // "an instance crashed" must not kill the process: the fleet would be restarted
+        // into the same broken state, and a user who has legitimately stopped every
+        // instance would get a restart loop. Those conditions surface through /health
+        // (which now returns 503) and through the General-topic notifications instead.
         this.watchdogTimer = setInterval(() => sdNotify("WATCHDOG=1"), 30_000);
+        // EventLog.prune() existed but was never called, so `events` and `activity`
+        // grew without bound for the life of the install. Prune once at startup and
+        // daily after that; the timer is unref'd so it never holds the loop open.
+        this.pruneEventLog();
+        this.eventLogPruneTimer = setInterval(() => this.pruneEventLog(), 24 * 60 * 60_000);
+        this.eventLogPruneTimer.unref?.();
+        // Same shape for pipe-pane logs, and for the same reason: the only sweep that
+        // covered them lived inside the daily-summary callback, so it did not run at
+        // all when summaries were off.
+        this.rotateAllInstanceLogs();
+        this.logRotateTimer = setInterval(() => this.rotateAllInstanceLogs(), 24 * 60 * 60_000);
+        this.logRotateTimer.unref?.();
         // Phase 2: Start remaining instances with staggered concurrency
         if (others.length > 0) {
             await this.startInstancesWithConcurrency(others, topicMode);
@@ -1268,6 +1392,15 @@ export class FleetManager {
         // rest of startup finishes. Replay one coalesced reload only after all
         // startup-owned lifecycle work and signal handlers are in place.
         this.finishStartup();
+        // Tell systemd we are ready only now. This used to fire right after the
+        // generals started — before adapters, classic instances, topic creation and the
+        // health server — so `systemctl start` returned success while the fleet was
+        // still deaf: no path existed for a user message to arrive.
+        sdNotify("READY=1");
+        const health = this.getFleetHealth();
+        if (health.status !== "ok") {
+            this.logger.warn({ health }, "Fleet started with problems — see /health");
+        }
     }
     /**
      * Delete inbox files older than retentionDays (by mtime). Cleans the shared
@@ -1384,6 +1517,67 @@ export class FleetManager {
     getAdapterStates() {
         return this.adapterState;
     }
+    /**
+     * Real, checkable fleet health for `/health` and the operator.
+     *
+     * `status` is:
+     *  - `ok`       — at least one adapter connected and every configured instance
+     *                 that should be running is running
+     *  - `degraded` — reachable, but something the operator should look at (an
+     *                 adapter retrying, an instance crashed or stopped)
+     *  - `down`     — the fleet cannot do its job: no adapter is connected, so no
+     *                 message can arrive or be answered
+     *
+     * Deliberately does NOT gate the systemd watchdog — see the comment at the
+     * WATCHDOG timer for why.
+     */
+    getFleetHealth() {
+        const names = Object.keys(this.fleetConfig?.instances ?? {});
+        const counts = { configured: names.length, running: 0, crashed: 0, paused: 0, stopped: 0 };
+        for (const name of names) {
+            const state = this.getInstanceStatus(name);
+            if (state === "running")
+                counts.running++;
+            else if (state === "crashed")
+                counts.crashed++;
+            else if (state === "paused")
+                counts.paused++;
+            else
+                counts.stopped++;
+        }
+        const states = {};
+        let connected = 0;
+        for (const [id, state] of this.adapterState) {
+            states[id] = state.status;
+            if (state.status === "connected")
+                connected++;
+        }
+        const problems = [];
+        if (this.adapterState.size > 0 && connected === 0)
+            problems.push("no channel adapter is connected");
+        if (counts.crashed > 0)
+            problems.push(`${counts.crashed} instance(s) crashed`);
+        for (const [id, state] of this.adapterState) {
+            if (state.status !== "connected")
+                problems.push(`adapter ${id} is ${state.status}`);
+        }
+        if (!this.startupComplete)
+            problems.push("startup has not completed");
+        // "down" is reserved for "cannot receive or answer a message at all". A fleet
+        // with adapters configured but none connected is exactly that.
+        const status = this.adapterState.size > 0 && connected === 0
+            ? "down"
+            : problems.length > 0 ? "degraded" : "ok";
+        return {
+            status,
+            uptime: Math.floor((Date.now() - this.startedAt) / 1000),
+            instances: counts,
+            adapters: { total: this.adapterState.size, connected, states },
+            startupComplete: this.startupComplete,
+            memory: readFleetMemory(),
+            problems,
+        };
+    }
     /** Start the primary adapter (backward-compatible, sets this.adapter) */
     async startSingleAdapter(fleet, channelConfig) {
         const botToken = process.env[channelConfig.bot_token_env];
@@ -1410,6 +1604,9 @@ export class FleetManager {
         this.adapter.on("message", safeHandler(async (msg) => {
             await this.handleInboundMessage(msg);
         }, this.logger, "adapter.message"));
+        this.adapter.on("reaction", safeHandler(async (r) => {
+            await this.handleInboundReaction(r);
+        }, this.logger, "adapter.reaction"));
         this.adapter.on("callback_query", safeHandler(async (data) => {
             if (await this.handleClassicBackendSelection(data))
                 return;
@@ -1584,19 +1781,29 @@ export class FleetManager {
                     await data.respond(t("not_authorized"));
                     return;
                 }
+                await data.respond(await this.runBackendDoctor());
+            }
+            else if (data.command === "usage") {
+                // Same permission level as /ctx (none). The reply is still ephemeral —
+                // the adapter defers non-chat commands that way — so it never spams the
+                // channel either way.
                 try {
-                    const { execSync } = await import("node:child_process");
-                    const backend = this.fleetConfig?.defaults?.backend || "claude-code";
-                    const result = execSync(`agend backend doctor ${backend}`, { timeout: 30_000, encoding: "utf-8" });
-                    const clean = result.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
-                    await data.respond(clean || "No output");
+                    const { getUsageSnapshot } = await import("./usage/usage-api.js");
+                    const { renderUsageMarkdown } = await import("./usage/format-rich.js");
+                    // slash_command is Discord-only; editReply renders Markdown natively.
+                    await data.respond(renderUsageMarkdown(await getUsageSnapshot()));
                 }
                 catch (err) {
-                    const output = (err.stdout ?? err.message ?? "Doctor failed").replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
-                    await data.respond(output);
+                    await data.respond(`⚠️ Usage fetch failed: ${err.message}`);
                 }
             }
             else if (data.command === "status") {
+                // Admin-gated (like the topic path): the merged table shows every
+                // instance's cost and IPC health.
+                if (!this.isFleetAdmin(data.userId, adapterId)) {
+                    await data.respond(t("cmd.admin_required", "/status"));
+                    return;
+                }
                 const text = await this.topicCommands.getStatusText();
                 await data.respond(text);
             }
@@ -1705,6 +1912,9 @@ export class FleetManager {
         adapter.on("message", safeHandler(async (msg) => {
             await this.handleInboundMessage(msg);
         }, this.logger, `adapter[${adapterId}].message`));
+        adapter.on("reaction", safeHandler(async (r) => {
+            await this.handleInboundReaction(r);
+        }, this.logger, `adapter[${adapterId}].reaction`));
         adapter.on("callback_query", safeHandler(async (data) => {
             if (await this.handleClassicBackendSelection(data))
                 return;
@@ -1866,19 +2076,29 @@ export class FleetManager {
                     await data.respond(t("not_authorized"));
                     return;
                 }
+                await data.respond(await this.runBackendDoctor());
+            }
+            else if (data.command === "usage") {
+                // Same permission level as /ctx (none). The reply is still ephemeral —
+                // the adapter defers non-chat commands that way — so it never spams the
+                // channel either way.
                 try {
-                    const { execSync } = await import("node:child_process");
-                    const backend = this.fleetConfig?.defaults?.backend || "claude-code";
-                    const result = execSync(`agend backend doctor ${backend}`, { timeout: 30_000, encoding: "utf-8" });
-                    const clean = result.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
-                    await data.respond(clean || "No output");
+                    const { getUsageSnapshot } = await import("./usage/usage-api.js");
+                    const { renderUsageMarkdown } = await import("./usage/format-rich.js");
+                    // slash_command is Discord-only; editReply renders Markdown natively.
+                    await data.respond(renderUsageMarkdown(await getUsageSnapshot()));
                 }
                 catch (err) {
-                    const output = (err.stdout ?? err.message ?? "Doctor failed").replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
-                    await data.respond(output);
+                    await data.respond(`⚠️ Usage fetch failed: ${err.message}`);
                 }
             }
             else if (data.command === "status") {
+                // Admin-gated (like the topic path): the merged table shows every
+                // instance's cost and IPC health.
+                if (!this.isFleetAdmin(data.userId, adapterId)) {
+                    await data.respond(t("cmd.admin_required", "/status"));
+                    return;
+                }
                 const text = await this.topicCommands.getStatusText();
                 await data.respond(text);
             }
@@ -2034,6 +2254,9 @@ export class FleetManager {
                 else if (msg.type === "instance_process_state") {
                     this.cacheInstanceProcessStatus(name, msg.status);
                 }
+                else if (msg.type === "instance_activity") {
+                    this.cacheInstanceActivity(name, msg.activity);
+                }
                 else if (msg.type === "instance_state" || msg.type === "instance_state_response") {
                     this.cacheInstanceExecutionState(name, msg);
                     if (msg.type === "instance_state_response") {
@@ -2104,9 +2327,22 @@ export class FleetManager {
                 if (existsSync(windowIdPath)) {
                     const windowId = readFileSync(windowIdPath, "utf-8").trim();
                     if (windowId) {
+                        // Async with an explicit timeout: this was execSync with NO timeout at
+                        // all, so a wedged tmux server blocked the whole fleet event loop
+                        // indefinitely — while we were here to diagnose a lost connection.
+                        // A timeout is also the correct signal: an unresponsive tmux server
+                        // means we cannot verify the pane, which is treated as dead (the same
+                        // conclusion the old code reached only by throwing).
                         try {
-                            const { execSync } = await import("node:child_process");
-                            execSync(`tmux list-panes -t "${windowId}"`, { stdio: "ignore" });
+                            const { execFile } = await import("node:child_process");
+                            const { promisify } = await import("node:util");
+                            const { getTmuxSocketName } = await import("./paths.js");
+                            // Honour socket isolation: without -L this queried the user's default
+                            // tmux server instead of the fleet's, so under a custom AGEND_HOME the
+                            // check was meaningless (it reported every pane dead).
+                            const socket = getTmuxSocketName();
+                            const args = socket ? ["-L", socket, "list-panes", "-t", windowId] : ["list-panes", "-t", windowId];
+                            await promisify(execFile)("tmux", args, { timeout: 5_000 });
                         }
                         catch {
                             // Pane dead — respawn
@@ -2127,6 +2363,12 @@ export class FleetManager {
         if (this.adapterRestarting.has(id))
             return;
         this.adapterRestarting.add(id);
+        // Reflect reality in adapterState throughout. This loop used to leave the state
+        // untouched, so getAdapterStates() — and therefore /health and the dashboard —
+        // kept reporting "connected" for an adapter that had been down for hours. An
+        // adapter's true status was simply not knowable from inside the process.
+        const previous = this.adapterState.get(id);
+        this.adapterState.set(id, { status: "retrying", retryCount: 0, lastError: previous?.lastError });
         try {
             for (let attempt = 1;; attempt++) {
                 if (this.ipcStoppingInstances.has("__fleet_stopping__"))
@@ -2139,9 +2381,16 @@ export class FleetManager {
                     await adapter.stop().catch(() => { });
                     await adapter.start();
                     this.logger.info({ id, attempt }, "Adapter restarted successfully");
+                    this.adapterState.set(id, { status: "connected", retryCount: 0 });
                     return;
                 }
-                catch { /* retry */ }
+                catch (err) {
+                    this.adapterState.set(id, {
+                        status: "retrying",
+                        retryCount: attempt,
+                        lastError: err?.message ?? String(err),
+                    });
+                }
                 if (attempt % 10 === 0) {
                     this.logger.warn({ id, attempt }, "Adapter restart still failing");
                 }
@@ -2177,6 +2426,49 @@ export class FleetManager {
         }
         return generals[0];
     }
+    /**
+     * A user reacted to one of the bot's messages (#408).
+     *
+     * A reaction is context, not a message (#432, reworking #413): it never triggers
+     * an agent turn and never wakes anything. It is queued in the event log and rides
+     * into the instance's NEXT real message as one compact leading line —
+     * `[Recent reactions: 👍×2 from hanhanv]` — after which it is marked consumed.
+     * No pending reactions → no line → zero context spent, which is the common case.
+     */
+    async handleInboundReaction(r) {
+        const instanceName = this.resolveSlashTarget(r.threadId ?? r.chatId, r.adapterId);
+        if (!instanceName) {
+            this.logger.debug({ emoji: r.emoji, chatId: r.chatId }, "Reaction in an unrouted channel — ignoring");
+            return;
+        }
+        if (DELIVERY_STATUS_EMOJIS.has(r.emoji)) {
+            this.logger.debug({ emoji: r.emoji, user: r.username }, "Ignoring delivery-status emoji as a reaction");
+            return;
+        }
+        this.eventLog?.logActivity("reaction", r.username, `${r.emoji} ${r.action}`, instanceName);
+        if (r.action === "add") {
+            this.eventLog?.addReaction(instanceName, r.messageId, r.username, r.emoji);
+        }
+        else {
+            // Withdrawn before anyone saw it → it never happened. See removeReaction.
+            this.eventLog?.removeReaction(instanceName, r.messageId, r.username, r.emoji);
+        }
+    }
+    /**
+     * The queued-reaction summary for an instance's next real message, or {} when
+     * nothing is pending (the common case must add zero context). The consume
+     * callback is separate from the fetch so reactions are only marked once the
+     * message actually went out — a failed delivery keeps them queued.
+     */
+    pendingReactionsMeta(instanceName) {
+        const pending = this.eventLog?.pendingReactions(instanceName);
+        if (!pending)
+            return { meta: {}, consume: () => { } };
+        return {
+            meta: { pending_reactions: pending.summary },
+            consume: () => this.eventLog?.markReactionsConsumed(instanceName, pending.maxId),
+        };
+    }
     async handleInboundMessage(msg) {
         const threadId = msg.threadId || undefined;
         this.logger.debug({ source: msg.source, chatId: msg.chatId, threadId, userId: msg.userId, isBotMessage: msg.isBotMessage, textLen: (msg.text ?? "").length, text: (msg.text ?? "").slice(0, 80) }, "handleInboundMessage entry");
@@ -2514,6 +2806,7 @@ export class FleetManager {
                 }
                 this.warnIfRateLimited(generalInstance, msg);
                 const { text, extraMeta } = await processAttachments(msg, inboundAdapter, this.logger, generalInstance);
+                const generalReactions = this.pendingReactionsMeta(generalInstance);
                 try {
                     await this.deliverToInstance(generalInstance, {
                         type: "fleet_inbound",
@@ -2529,9 +2822,11 @@ export class FleetManager {
                             adapter_id: msg.adapterId,
                             source: msg.source,
                             ...(msg.replyToText ? { reply_to_text: msg.replyToText } : {}),
+                            ...generalReactions.meta,
                             ...extraMeta,
                         },
                     });
+                    generalReactions.consume();
                     this.lastInboundUser.set(generalInstance, msg.username);
                     this.logger.info(`${msg.username} → ${generalInstance}: ${(text ?? "").slice(0, 100)}`);
                     this.eventLog?.logActivity("message", msg.username, (text ?? "").slice(0, 200), generalInstance);
@@ -2607,6 +2902,7 @@ export class FleetManager {
         this.setTopicIcon(instanceName, "blue");
         this.warnIfRateLimited(instanceName, msg);
         const { text, extraMeta } = await processAttachments(msg, inboundAdapter, this.logger, instanceName);
+        const reactions = this.pendingReactionsMeta(instanceName);
         try {
             await this.deliverToInstance(instanceName, {
                 type: "fleet_inbound",
@@ -2622,9 +2918,13 @@ export class FleetManager {
                     adapter_id: msg.adapterId,
                     source: msg.source,
                     ...(msg.replyToText ? { reply_to_text: msg.replyToText } : {}),
+                    ...reactions.meta,
                     ...extraMeta,
                 },
             });
+            // Only after the message actually went out. A failed delivery keeps the
+            // reactions queued for the retry / the next message.
+            reactions.consume();
         }
         catch (err) {
             this.logger.warn({ err: err.message, instanceName }, "Wake/delivery failed");
@@ -2716,8 +3016,18 @@ export class FleetManager {
         // Route standard channel tools (reply, react, edit_message, download_attachment)
         if (routeToolCall(outAdapter, tool, args, threadId, respond)) {
             if (tool === "reply") {
-                // Agent answered — retire its pending cancel button and mark ✅ done.
-                this.clearCancelButton(instanceName);
+                // A reply is NOT proof the turn is over: on multi-step work an agent
+                // replies ("starting…") and keeps going for many minutes. Retiring the
+                // button here left the channel looking idle with no way to cancel and no
+                // sign anything was happening (#410). Idle state owns retirement now; if the
+                // instance is still working, move the button below the new reply so it stays
+                // the last thing in the channel.
+                if (this.getInstanceIdle(instanceName)) {
+                    this.clearCancelButton(instanceName);
+                }
+                else {
+                    void this.sendCancelButton(instanceName);
+                }
                 this.reactDone(instanceName);
                 const replyTo = this.lastInboundUser.get(instanceName) ?? "user";
                 this.logger.info(`${instanceName} → ${replyTo}: ${(args.text ?? "").slice(0, 100)}`);
@@ -3348,6 +3658,9 @@ export class FleetManager {
         }
     }
     async removeInstance(name) {
+        // Drop cached pane context — the map is keyed by instance name and nothing
+        // else evicted deleted entries, so it grew for the life of the process.
+        forgetInstanceContext(name);
         // Clean up schedules (scheduler is fleet-level, not lifecycle-level)
         const config = this.fleetConfig?.instances[name];
         if (this.scheduler && config?.topic_id) {
@@ -3453,6 +3766,171 @@ export class FleetManager {
         this.collabInstances.add(instanceName);
         return true;
     }
+    /**
+     * Open the event log, tolerating a corrupt file.
+     *
+     * `events.db` holds history only — event rows and the activity feed. Nothing the
+     * fleet needs to run depends on it, and every consumer already uses
+     * `this.eventLog?.`. An unguarded `new EventLog(...)` here meant a corrupt or
+     * unreadable history file (a truncated WAL after a hard kill, a full disk)
+     * threw during startAll and the WHOLE FLEET FAILED TO BOOT — trading every
+     * running agent for a file whose only job is reporting.
+     *
+     * So: try, move a bad file aside and retry once with a fresh one, and if even
+     * that fails carry on without an event log.
+     */
+    /**
+     * Run `agend backend doctor` for the fleet's default backend and return its
+     * cleaned output.
+     *
+     * Async on purpose: this was `execSync` with a 30s timeout, reachable by any
+     * allowlisted user through `/doctor`. While it ran, the entire fleet event loop
+     * was frozen — no IPC, no adapter, no message delivery, no health responses,
+     * and critically no WATCHDOG ping, so a slow doctor could push past
+     * WatchdogSec and have systemd SIGABRT the fleet.
+     */
+    async runBackendDoctor() {
+        const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
+        const backend = this.fleetConfig?.defaults?.backend || "claude-code";
+        try {
+            const { execFile } = await import("node:child_process");
+            const { promisify } = await import("node:util");
+            // execFile with an argv array — no shell, so the backend name cannot be
+            // interpreted as a command even if config is malformed.
+            const { stdout } = await promisify(execFile)("agend", ["backend", "doctor", backend], {
+                timeout: 30_000,
+                encoding: "utf-8",
+            });
+            return stripAnsi(stdout) || "No output";
+        }
+        catch (err) {
+            const e = err;
+            return stripAnsi(e.stdout ?? e.message ?? "Doctor failed");
+        }
+    }
+    /** Drop event/activity rows older than the retention window. Best-effort. */
+    /**
+     * Cap every instance's pipe-pane log, walking the instances **directory** rather
+     * than the config.
+     *
+     * A running instance rotates its own log on each health tick, so the ones that
+     * need this are the ones nothing else looks at:
+     *
+     *   - deleted instances, whose directory outlives the config entry. Nothing ever
+     *     touched these again. On the machine this was found on, one held 122 MB and
+     *     another 74 MB, out of 622 MB of pipe-pane logs in total.
+     *   - classic instances, which live in classicChannels, not fleetConfig.instances,
+     *     and so were never in the old config-driven loop at all.
+     *   - stopped instances, which have no health tick running.
+     *
+     * pipe-pane writes raw TUI output, so a wedged splash screen can emit ANSI frames
+     * at animation rate. Unbounded growth here fills the disk, which takes the whole
+     * fleet down rather than one instance.
+     */
+    rotateAllInstanceLogs() {
+        const root = join(this.dataDir, "instances");
+        let entries;
+        try {
+            entries = readdirSync(root, { withFileTypes: true });
+        }
+        catch {
+            return; // no instances directory yet
+        }
+        for (const entry of entries) {
+            if (!entry.isDirectory())
+                continue;
+            // rotateLogIfNeeded is already best-effort and returns early on a missing
+            // file, so a directory without a pipe-pane log costs one stat.
+            rotateLogIfNeeded(join(root, entry.name, "output.log"));
+        }
+    }
+    pruneEventLog() {
+        try {
+            this.eventLog?.prune(FleetManager.EVENT_LOG_RETENTION_DAYS);
+        }
+        catch (err) {
+            this.logger.warn({ err }, "Event log prune failed");
+        }
+    }
+    openEventLog() {
+        const dbPath = join(this.dataDir, "events.db");
+        try {
+            return new EventLog(dbPath);
+        }
+        catch (err) {
+            this.logger.error({ err, dbPath }, "events.db unusable — moving it aside and starting a fresh one");
+            const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+            for (const suffix of ["", "-wal", "-shm"]) {
+                try {
+                    renameSync(`${dbPath}${suffix}`, `${dbPath}${suffix}.corrupt-${stamp}`);
+                }
+                catch { /* may not exist */ }
+            }
+            try {
+                return new EventLog(dbPath);
+            }
+            catch (retryErr) {
+                // History is worth losing; a fleet that won't start is not.
+                this.logger.error({ err: retryErr, dbPath }, "Could not open a fresh events.db — continuing without event logging");
+                return null;
+            }
+        }
+    }
+    /**
+     * Report a fleet-level fault (not attributable to one instance) to the General
+     * topic, so the operator learns about it without reading daemon.log.
+     *
+     * Throttled per distinct message: an unhandled rejection typically comes from a
+     * loop (a poller, a repeating timer), and one channel message per occurrence
+     * would bury the topic — which is worse than silence. First occurrence goes out
+     * immediately, repeats are suppressed for THROTTLE_MS and then re-sent with a
+     * count.
+     *
+     * The log line is written by the caller regardless: if every adapter is down,
+     * the only notification path is the one that is broken.
+     */
+    notifyFleetError(text) {
+        const now = Date.now();
+        const key = text.slice(0, 200);
+        const seen = this.fleetErrorNotices.get(key);
+        if (seen && now - seen.at < FleetManager.FLEET_ERROR_THROTTLE_MS) {
+            seen.suppressed++;
+            return;
+        }
+        const suppressed = seen?.suppressed ?? 0;
+        this.fleetErrorNotices.set(key, { at: now, suppressed: 0 });
+        // Bound the map: it is keyed by message text, and a message with a varying
+        // suffix (a path, an id) would otherwise grow it without limit.
+        if (this.fleetErrorNotices.size > 100) {
+            const oldest = this.fleetErrorNotices.keys().next().value;
+            if (oldest !== undefined)
+                this.fleetErrorNotices.delete(oldest);
+        }
+        const body = suppressed > 0
+            ? `${text}\n(plus ${suppressed} more in the last ${Math.round(FleetManager.FLEET_ERROR_THROTTLE_MS / 60_000)}m)`
+            : text;
+        // Resolved from config, NOT findGeneralInstance(): that requires a live daemon,
+        // and a fleet-level fault is exactly when the General may be down. The topic
+        // itself still exists, and notifyInstanceTopic only needs adapter + group +
+        // topic_id to post into it.
+        const general = Object.entries(this.fleetConfig?.instances ?? {})
+            .find(([, config]) => config.general_topic === true)?.[0];
+        if (general) {
+            this.notifyInstanceTopic(general, body);
+            return;
+        }
+        // No General instance — fall back to the primary channel's group.
+        const channelCfg = this.getChannelConfig();
+        const groupId = channelCfg?.group_id;
+        if (this.adapter && groupId) {
+            this.adapter.sendText(String(groupId), body)
+                .catch(err => this.logger.warn({ err }, "Failed to send fleet error notification"));
+            return;
+        }
+        this.logger.warn({ text: body }, "Fleet error had no notification target (no General instance, no adapter)");
+    }
+    static FLEET_ERROR_THROTTLE_MS = 10 * 60_000;
+    fleetErrorNotices = new Map();
     notifyInstanceTopic(instanceName, text, extraOpts) {
         const adapter = this.getAdapterForInstance(instanceName) ?? this.adapter;
         if (!adapter)
@@ -3582,7 +4060,12 @@ export class FleetManager {
                 threadId: sent.threadId ?? threadId,
                 correlationId,
                 retryCount: 0,
+                // Elapsed time is measured from when this button was posted — i.e. from
+                // when the work was handed over — not from the pane's working transition,
+                // which resets if the CLI blips idle mid-turn.
+                startedAt: Date.now(),
             };
+            this.startProgressTicker(entry);
             // Idle-check backstop: every 5min, if the instance is idle, retire the
             // button. Covers turns that end without hitting a clear trigger (reply /
             // cancel / correlation). Cleared in discardButton when the entry is removed.
@@ -3603,6 +4086,97 @@ export class FleetManager {
             this.logger.warn({ err: e.message, instanceName }, "Failed to send cancel button");
         }
     }
+    /**
+     * The cancel button's text for a given elapsed time.
+     *
+     * Below the threshold it keeps the original wording, so a normal quick answer
+     * looks exactly as it did before. Past it, the button doubles as the live
+     * progress indicator (#409) — the channel showed nothing at all during long work,
+     * and once the agent had replied once there was no sign it was still going.
+     */
+    static progressText(elapsedMs, activity) {
+        if (elapsedMs < PROGRESS_MIN_ELAPSED_MS)
+            return "👀 處理中…";
+        const totalSeconds = Math.floor(elapsedMs / 1000);
+        const minutes = Math.floor(totalSeconds / 60);
+        const seconds = totalSeconds % 60;
+        const elapsed = minutes >= 60
+            ? `${Math.floor(minutes / 60)}h ${minutes % 60}m`
+            : `${minutes}m ${String(seconds).padStart(2, "0")}s`;
+        const detail = FleetManager.sanitizeActivity(activity);
+        return detail
+            ? `⏳ 處理中… (已進行 ${elapsed} · ${detail})`
+            : `⏳ 處理中… (已進行 ${elapsed})`;
+    }
+    /**
+     * Make a tool summary safe to paste into a channel message.
+     *
+     * The text is agent-controlled (it is built from tool inputs — file paths,
+     * shell commands), so it gets flattened to one line, capped, and stripped of
+     * the two Discord mass-mention triggers. Neither channel renders it with a
+     * parse mode, so no markup escaping is needed beyond that.
+     */
+    static sanitizeActivity(activity) {
+        if (!activity)
+            return null;
+        const flat = activity.replace(/\s+/g, " ").replace(/@(everyone|here)/g, "@​$1").trim();
+        if (!flat)
+            return null;
+        return flat.length > PROGRESS_ACTIVITY_MAX_CHARS
+            ? `${flat.slice(0, PROGRESS_ACTIVITY_MAX_CHARS - 1)}…`
+            : flat;
+    }
+    /**
+     * Remember what an instance is currently doing, for the progress line.
+     *
+     * Best-effort by design: only backends that expose a live activity feed report
+     * anything, and the progress line simply omits the detail for the rest. It is
+     * never used to decide anything — purely what the user is shown.
+     */
+    cacheInstanceActivity(name, activity) {
+        if (activity)
+            this.instanceActivity.set(name, activity);
+        else
+            this.instanceActivity.delete(name);
+    }
+    /**
+     * Refresh the button's text in place while the instance keeps working.
+     *
+     * Uses `editAlert`, NOT `editMessage`: on Telegram the latter omits reply_markup,
+     * and the Bot API treats that as "clear the keyboard" — so editing with it would
+     * delete the very cancel button this is trying to keep alive.
+     */
+    startProgressTicker(entry) {
+        entry.progressTimer = setInterval(() => {
+            if (!this.cancelButtons.has(entry.messageId)) {
+                clearInterval(entry.progressTimer);
+                return;
+            }
+            // Idle means the turn ended; the idle-edge handler retires the button.
+            if (this.getInstanceIdle(entry.instanceName))
+                return;
+            const text = FleetManager.progressText(Date.now() - (entry.startedAt ?? Date.now()), this.instanceActivity.get(entry.instanceName));
+            if (text === entry.lastProgressText)
+                return; // nothing changed — skip the API call
+            const adapter = this.getAdapterForInstance(entry.instanceName) ?? this.adapter;
+            if (!adapter?.editAlert)
+                return;
+            entry.lastProgressText = text;
+            adapter.editAlert(entry.chatId, entry.messageId, {
+                type: "cancel",
+                instanceName: entry.instanceName,
+                message: text,
+                choices: [{ id: `cancel:${entry.instanceName}`, label: t("cancel.button") }],
+            }, entry.threadId ? { threadId: entry.threadId } : undefined)
+                .catch(err => {
+                // A failed progress edit must never escalate: the button still works and
+                // the next tick retries. Common causes are a deleted message or a
+                // rate limit.
+                this.logger.debug({ err, instanceName: entry.instanceName }, "Progress edit failed");
+            });
+        }, PROGRESS_UPDATE_INTERVAL_MS);
+        entry.progressTimer.unref?.();
+    }
     /** Retire (delete) every cancel button belonging to an instance. */
     retireInstanceButtons(instanceName) {
         // Snapshot first — retireButton may delete entries from the map on success.
@@ -3634,6 +4208,8 @@ export class FleetManager {
             clearTimeout(entry.retryTimer);
         if (entry.idleCheckTimer)
             clearInterval(entry.idleCheckTimer);
+        if (entry.progressTimer)
+            clearInterval(entry.progressTimer);
         this.cancelButtons.delete(entry.messageId);
     }
     /** Re-attempt a failed button delete up to CANCEL_BTN_MAX_RETRIES times. */
@@ -4299,6 +4875,12 @@ When users create specialized instances, suggest these configurations:
                 meta.image_path = saves[saves.length - 1][1].split(",")[0].trim();
             }
         }
+        // Classic channels queue reactions like everyone else (#432 stored them, but
+        // this path never attached them — reactions in a ClassicBot channel went into
+        // the DB and were never seen again). Same contract as the topic paths:
+        // consumed only after the delivery succeeded.
+        const reactions = this.pendingReactionsMeta(instanceName);
+        Object.assign(meta, reactions.meta);
         try {
             await this.deliverToInstance(instanceName, {
                 type: "fleet_inbound",
@@ -4306,6 +4888,7 @@ When users create specialized instances, suggest these configurations:
                 targetSession: instanceName,
                 meta,
             });
+            reactions.consume();
         }
         catch (err) {
             this.logger.warn({ err: err.message, instanceName }, "Classic wake/delivery failed");
@@ -4580,9 +5163,19 @@ When users create specialized instances, suggest these configurations:
             // DC path: respond immediately with progress text
             await pending.respond(progressText).catch(() => { });
         }
-        // Apply model in background — don't await here (keeps callback handler fast)
+        // Apply model in background — don't await here (keeps callback handler fast).
+        // Guarded: applyModel() restarts the instance, and an unguarded rejection here
+        // meant a user picking from the /model menu could take the whole fleet down.
+        // On failure the user gets told, rather than the click silently doing nothing.
         void (async () => {
-            const result = await this.applyModel(pending.instanceName, model);
+            let result;
+            try {
+                result = await this.applyModel(pending.instanceName, model);
+            }
+            catch (err) {
+                this.logger.error({ err, instance: pending.instanceName, model }, "Model switch failed");
+                result = `Model switch to \`${model}\` failed: ${err instanceof Error ? err.message : String(err)}`;
+            }
             if (pending.adapter && pending.adapterChatId) {
                 if (progressMsgId) {
                     pending.adapter.editMessage(pending.adapterChatId, progressMsgId, result, pending.adapterThreadId).catch(() => {
@@ -4862,11 +5455,24 @@ When users create specialized instances, suggest these configurations:
         this.logger.info({ channelId, adapterId, instanceName: ch.instanceName }, "Classic channel stopped");
         return t("classic.stopped");
     }
-    async stopAll() {
+    /**
+     * Idempotent while in flight: SIGINT and SIGTERM share one handler and the
+     * uncaughtException path calls this too, so overlapping runs were possible —
+     * each snapshotting the daemon map and calling stop() on the same daemons
+     * concurrently. Deliberately NOT `async`, so callers receive the same promise
+     * object rather than a fresh wrapper around it. The latch clears when the run
+     * settles, so a later genuine stop (after a restart) still does the work.
+     */
+    stopAll() {
+        this.stopAllInFlight ??= this.doStopAll().finally(() => { this.stopAllInFlight = null; });
+        return this.stopAllInFlight;
+    }
+    stopAllInFlight = null;
+    async doStopAll() {
         this.startupComplete = false;
         this.reloadPending = false;
         this.ipcStoppingInstances.add("__fleet_stopping__");
-        sdNotify("STOPPING=1");
+        sdNotifyBlocking("STOPPING=1");
         if (this.watchdogTimer) {
             clearInterval(this.watchdogTimer);
             this.watchdogTimer = null;
@@ -4886,6 +5492,26 @@ When users create specialized instances, suggest these configurations:
             clearInterval(this.updateCheckTimer);
             this.updateCheckTimer = null;
         }
+        if (this.eventLogPruneTimer) {
+            clearInterval(this.eventLogPruneTimer);
+            this.eventLogPruneTimer = null;
+        }
+        if (this.logRotateTimer) {
+            clearInterval(this.logRotateTimer);
+            this.logRotateTimer = null;
+        }
+        // Cancel-button timers were never cleared here. The idle-check interval is not
+        // unref'd, so it held the event loop open past shutdown and kept retrying
+        // deletes against an adapter that was already gone.
+        for (const entry of [...this.cancelButtons.values()]) {
+            if (entry.retryTimer)
+                clearTimeout(entry.retryTimer);
+            if (entry.idleCheckTimer)
+                clearInterval(entry.idleCheckTimer);
+            if (entry.progressTimer)
+                clearInterval(entry.progressTimer);
+        }
+        this.cancelButtons.clear();
         if (this.topicCleanupTimer) {
             clearInterval(this.topicCleanupTimer);
             this.topicCleanupTimer = null;
@@ -5104,6 +5730,15 @@ When users create specialized instances, suggest these configurations:
                 removedRatio,
                 validationErrors: validation.errors,
             }, "Refusing unsafe fleet config reload; running configuration was kept");
+            // Tell the operator. A silently ignored config edit is the most confusing
+            // possible outcome: they change fleet.yaml, send SIGHUP, and nothing happens
+            // with no explanation anywhere they are looking.
+            const why = !validation.valid
+                ? `validation failed:\n${validation.errors.map(e => `• ${e.path}: ${e.message}`).join("\n")}`
+                : unsafeEmpty
+                    ? `it removed every instance (${oldCount} → 0)`
+                    : `it removed more than half the instances (${oldCount} → ${newCount})`;
+            this.notifyFleetError(`⚠️ fleet.yaml reload REJECTED — ${why}\nThe previous configuration is still running.`);
             return;
         }
         this.routing.rebuild(this.fleetConfig);
@@ -5303,10 +5938,20 @@ When users create specialized instances, suggest these configurations:
     // ── Update check ────────────────────────────────────────────────────
     async checkForUpdates() {
         try {
-            const { execSync } = await import("node:child_process");
+            // Both npm lookups are async: as execSync they froze the fleet event loop for
+            // up to 15s each, and on a beta build BOTH ran — 30s with no WATCHDOG ping,
+            // past WatchdogSec's half-interval and enough for systemd to SIGABRT the fleet
+            // for a background version check.
+            const { execFile } = await import("node:child_process");
+            const { promisify } = await import("node:util");
+            const execFileP = promisify(execFile);
+            const npmVersion = async (spec) => {
+                const { stdout } = await execFileP("npm", ["view", spec, "version"], { timeout: 15_000 });
+                return stdout.toString().trim();
+            };
             const pkgPath = join(dirname(fileURLToPath(import.meta.url)), "..", "package.json");
             const currentVersion = JSON.parse(readFileSync(pkgPath, "utf-8")).version ?? "0.0.0";
-            const latest = execSync("npm view @songsid/agend version", { stdio: "pipe", timeout: 15_000 }).toString().trim();
+            const latest = await npmVersion("@songsid/agend");
             let target = latest;
             if (currentVersion.includes("-beta")) {
                 // Beta users track the @beta channel (never fall back to @latest, which is
@@ -5314,7 +5959,7 @@ When users create specialized instances, suggest these configurations:
                 // of beta/latest is the newest.
                 let beta = "";
                 try {
-                    beta = execSync("npm view @songsid/agend@beta version", { stdio: "pipe", timeout: 15_000 }).toString().trim();
+                    beta = await npmVersion("@songsid/agend@beta");
                 }
                 catch { /* no beta tag */ }
                 target = beta || latest;
@@ -5421,6 +6066,10 @@ When users create specialized instances, suggest these configurations:
                 // /view routes accept the read-only view.token (or web.token) and do
                 // their own per-method auth in view-api.ts — skip the web-token gate.
             }
+            else if (isUsagePath(new URL(req.url ?? "/", `http://localhost:${port}`).pathname)) {
+                // /api/ai-usage is read-only GET data for the /view Usage panel — open
+                // like the other /view data routes (usage-api.ts rejects non-GET).
+            }
             else {
                 // All other endpoints require a valid token (query ?token= or X-Agend-Token header).
                 // /ui/* will also re-check in web-api.ts, which is harmless.
@@ -5435,15 +6084,13 @@ When users create specialized instances, suggest these configurations:
                 }
             }
             if (req.method === "GET" && req.url === "/health") {
-                const instanceCount = this.fleetConfig?.instances
-                    ? Object.keys(this.fleetConfig.instances).length
-                    : 0;
-                res.writeHead(200);
-                res.end(JSON.stringify({
-                    status: "ok",
-                    instances: instanceCount,
-                    uptime: Math.floor((Date.now() - this.startedAt) / 1000),
-                }));
+                const health = this.getFleetHealth();
+                // 503 when the fleet cannot do its job, so an external monitor sees it.
+                // This used to always answer 200 "ok" with a count of CONFIGURED instances,
+                // so every agent could be dead and every adapter down and it still looked
+                // green.
+                res.writeHead(health.status === "ok" ? 200 : 503);
+                res.end(JSON.stringify(health));
                 return;
             }
             if (req.method === "GET" && req.url === "/status") {
@@ -5579,7 +6226,10 @@ When users create specialized instances, suggest these configurations:
                         res.writeHead(500);
                         res.end(JSON.stringify({ error: `Start failed: ${err.message}` }));
                     }
-                })();
+                    // The inner catch can itself throw (writeHead after a successful
+                    // writeHead is ERR_HTTP_HEADERS_SENT), and that rejection escapes the
+                    // IIFE. Same for the two handlers below.
+                })().catch(err => this.logger.error({ err, name }, "HTTP start handler failed"));
                 return;
             }
             // Instance restart (immediate, no idle wait)
@@ -5600,7 +6250,7 @@ When users create specialized instances, suggest these configurations:
                         res.writeHead(status);
                         res.end(JSON.stringify({ error: `Restart failed: ${err.message}` }));
                     }
-                })();
+                })().catch(err => this.logger.error({ err, name }, "HTTP restart handler failed"));
                 return;
             }
             if (req.method === "POST" && req.url?.startsWith("/stop/")) {
@@ -5623,7 +6273,7 @@ When users create specialized instances, suggest these configurations:
                         res.writeHead(500);
                         res.end(JSON.stringify({ error: `Stop failed: ${err.message}` }));
                     }
-                })();
+                })().catch(err => this.logger.error({ err, name }, "HTTP stop handler failed"));
                 return;
             }
             // ── Agent CLI endpoint ─────
@@ -5635,6 +6285,8 @@ When users create specialized instances, suggest these configurations:
             const url = new URL(req.url ?? "/", `http://localhost:${port}`);
             if (handleViewRequest(req, res, url, this))
                 return;
+            if (handleUsageRequest(req, res, url, this))
+                return;
             if (handleSettingsRequest(req, res, url, this))
                 return;
             if (handleWebRequest(req, res, url, this))