@songsid/agend 2.1.2-beta.3 → 2.1.2-beta.30

package/dist/fleet-manager.js

@@ -4,7 +4,10 @@ import { createServer } from "node:http";
 import { join, dirname, basename } from "node:path";
 import { fileURLToPath } from "node:url";
 import { getAgendHome, ensureWorkspaceGit } from "./paths.js";
-import { sdNotify } from "./sd-notify.js";
+import { clearUpdateMarker, isUpdateInProgress } from "./update-marker.js";
+import { sdNotify, sdNotifyBlocking } from "./sd-notify.js";
+import { readFleetMemory } from "./process-memory.js";
+import { ReplyDeduper } from "./reply-dedup.js";
 import { isScalar, parseDocument } from "yaml";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -21,12 +24,12 @@ import { IpcClient } from "./channel/ipc-bridge.js";
 import { createAdapter } from "./channel/factory.js";
 import { createBackend } from "./backend/factory.js";
 import { isModelCompatible } from "./backend/types.js";
-import { createLogger } from "./logger.js";
+import { createLogger, rotateLogIfNeeded } from "./logger.js";
 import { processAttachments } from "./channel/attachment-handler.js";
 import { routeToolCall } from "./channel/tool-router.js";
 import { Scheduler } from "./scheduler/index.js";
 import { DEFAULT_SCHEDULER_CONFIG } from "./scheduler/index.js";
-import { TopicCommands, saveCommandForBackend, parseSaveFilename, parsePauseWakeCommand, SAVE_FILENAME_RE, SAVE_UNSUPPORTED_MSG } from "./topic-commands.js";
+import { TopicCommands, saveCommandForBackend, parseSaveFilename, parsePauseWakeCommand, SAVE_FILENAME_RE, SAVE_UNSUPPORTED_MSG, resolveInstanceContext, forgetInstanceContext } from "./topic-commands.js";
 import { DailySummary } from "./daily-summary.js";
 import { WebhookEmitter } from "./webhook-emitter.js";
 import { TmuxControlClient } from "./tmux-control.js";
@@ -38,6 +41,7 @@ import { StatuslineWatcher } from "./statusline-watcher.js";
 import { outboundHandlers } from "./outbound-handlers.js";
 import { handleWebRequest, broadcastSseEvent } from "./web-api.js";
 import { handleViewRequest, isViewPath } from "./view-api.js";
+import { handleUsageRequest, isUsagePath } from "./usage/usage-api.js";
 import { handleSettingsRequest } from "./settings-api.js";
 import { setLocale, detectLocale, t } from "./locale.js";
 import { handleAgentRequest } from "./agent-endpoint.js";
@@ -83,9 +87,74 @@ const CANCEL_BTN_MAX_RETRIES = 3;
  * buttons no clear trigger reached (e.g. a scheduled/HTTP turn that never called
  * reply). 5min (not the old 2s idle-watch) so Thinking isn't misread as idle. */
 const CANCEL_BTN_IDLE_CHECK_INTERVAL_MS = 5 * 60_000;
+/**
+ * How long after a reply an instance gets to resume working before its cancel
+ * button is retired. A short turn ends with a reply and never works again → the
+ * button disappears ~2 minutes after the answer. A multi-step run replies
+ * mid-flight and keeps going → the grace check sees "working" and leaves the
+ * button alone (the idle edge retires it when the run really ends).
+ */
+const REPLY_RETIRE_GRACE_MS = 2 * 60_000;
+/**
+ * The daemon only broadcasts execution state on TRANSITIONS, so a long
+ * single-state run sends nothing for hours. The idle backstop therefore pokes a
+ * query each tick; a live daemon answers within milliseconds and refreshes the
+ * cache. When nothing has refreshed it for this long despite those pokes, the
+ * reporting chain (daemon, IPC, or state monitor) is dead and a "working" state
+ * from 30 minutes ago proves nothing — the button may be retired.
+ */
+const STATE_REPORT_STALE_MS = 30 * 60_000;
+/**
+ * Unconditional ceiling on a cancel button's life. Deliberately far beyond any
+ * legitimate run (multi-hour tasks are normal on this fleet): everything below
+ * this is decided by real state; a button that somehow survives a full day is
+ * wreckage, stuck or not.
+ */
+const CANCEL_BTN_MAX_LIFETIME_MS = 24 * 60 * 60_000;
+/** A click on a button the fleet no longer tracks may fire at most this often. */
+const STALE_CANCEL_CLICK_COOLDOWN_MS = 10_000;
+/** Orphaned-button ledger, swept at startup. Lives in the fleet data dir. */
+const CANCEL_BTN_LEDGER_FILE = "cancel-buttons.json";
+/**
+ * How often the cancel button's text is refreshed with elapsed working time.
+ *
+ * One edit per working instance per interval — at 60s that is trivial for both
+ * platforms' rate limits, and it reads as a live counter rather than a stale
+ * snapshot. Nothing new is posted, so the channel is never spammed: there is
+ * exactly one progress message per turn, and it is the cancel button itself.
+ */
+const PROGRESS_UPDATE_INTERVAL_MS = 60_000;
+/** Elapsed time is only shown once work has clearly outlasted a quick answer. */
+/**
+ * Default delay before the button starts showing elapsed time. Configurable via
+ * `defaults.progress_min_elapsed` (seconds) in fleet.yaml. 30s is the balance
+ * point: most quick answers finish inside it (no churn for ordinary turns),
+ * while anything real shows signs of life well before the old two minutes.
+ */
+const PROGRESS_MIN_ELAPSED_MS = 30_000;
+/** How much of a tool summary the progress line will show before eliding. */
+const PROGRESS_ACTIVITY_MAX_CHARS = 48;
+/**
+ * Emoji AgEnD itself stamps on messages as the delivery-status ladder
+ * (⏳ queued, 👀 delivered, ✅ confirmed, ❌ failed). These are machine
+ * indicators, not opinions, so they never enter the reactions queue — from
+ * anyone. This exact-emoji filter is the ONLY bot filtering left: bot-to-bot
+ * reactions are otherwise delivered on purpose (agents signal each other), and
+ * 🫡 passes too — it reads as a deliberate acknowledgement, not plumbing.
+ */
+const DELIVERY_STATUS_EMOJIS = new Set(["👀", "⏳", "✅", "❌"]);
+/**
+ * How long a delivery waits out a disconnected instance IPC before giving up.
+ *
+ * Sized for a daemon restart (socket close → respawn → CLI ready), which is the
+ * event this exists for. Past it the delivery fails loudly as it always did.
+ */
+const IPC_RECONNECT_GRACE_MS = 30_000;
+const IPC_RECONNECT_POLL_MS = 250;
 const CLASSIC_BACKEND_SELECTION_TIMEOUT_MS = 60_000;
 const CLASSIC_BACKEND_CALLBACK_PREFIX = "classic-backend:";
 const MODEL_SELECT_CALLBACK_PREFIX = "model-select:";
+const EFFORT_SELECT_CALLBACK_PREFIX = "effort-select:";
 const CLI_ENV_TTL_MS = 24 * 60 * 60 * 1000; // /model reads cached CLI env within 24h
 export class FleetManager {
     dataDir;
@@ -93,7 +162,7 @@ export class FleetManager {
     static sighupHandlerInstalled = false;
     children = new Map();
     lifecycle;
-    /** @deprecated Use lifecycle.daemons — kept for backward compat */
+    /** Live view of lifecycle.daemons — used throughout; not deprecated. */
     get daemons() { return this.lifecycle.daemons; }
     fleetConfig = null;
     rawFleetConfig = {};
@@ -151,6 +220,12 @@ export class FleetManager {
     // reply, on cancel, or when a newer button supersedes it for the same
     // instance. Per-button tracking means a failed delete never strands a button.
     cancelButtons = new Map();
+    /** Duplicate-reply suppression across both the MCP and HTTP reply paths. */
+    replyDeduper = new ReplyDeduper();
+    /** instanceName → what it is doing right now, when the backend can tell us. */
+    instanceActivity = new Map();
+    /** instanceName → tail of deliveries waiting for its IPC to come back. */
+    ipcWaitTails = new Map();
     // Last user message delivered to each instance — used to react ✅ on completion.
     lastInboundMsg = new Map();
     topicArchiver;
@@ -158,11 +233,17 @@ export class FleetManager {
     classicChannels = null;
     pendingClassicStarts = new Map();
     /** In-flight /model selections, keyed by nonce (see handleModelSelection). */
+    /** In-flight /effort selections, same coordinator shape as pendingModelSelects. */
+    pendingEffortSelects = new Map();
     pendingModelSelects = new Map();
     // Model failover state
     failoverActive = new Map(); // instance → current failover model
     // IPC reconnect: tracks instances being intentionally stopped (skip reconnect)
+    /** instance → when a click with no live button entry last fired a cancel. */
+    staleCancelClickAt = new Map();
     ipcStoppingInstances = new Set();
+    /** Set the moment a graceful stop begins — see isPlannedRestart(). */
+    shuttingDown = false;
     /** Coalesce concurrent connection attempts for the same daemon socket. */
     ipcConnectInFlight = new Map();
     /** At most one reconnect/backoff loop may exist per instance. */
@@ -176,6 +257,10 @@ export class FleetManager {
     healthServer = null;
     healthPortRetried = false;
     updateCheckTimer = null;
+    eventLogPruneTimer = null;
+    logRotateTimer = null;
+    /** Days of event/activity history to keep. */
+    static EVENT_LOG_RETENTION_DAYS = 30;
     watchdogTimer = null;
     startedAt = 0;
     // Mirror topic: buffer cross-instance messages, flush every 3s
@@ -214,7 +299,13 @@ export class FleetManager {
         }
         this.reloadPending = false;
         this.reconcileInFlight = this.reconcileInstances()
-            .catch(err => this.logger.error({ err }, "SIGHUP config reload failed"))
+            .catch(err => {
+            // Almost always a YAML parse error. Log-only meant the user edited
+            // fleet.yaml, sent SIGHUP, and got no reaction and no explanation.
+            this.logger.error({ err }, "SIGHUP config reload failed");
+            const message = err instanceof Error ? err.message : String(err);
+            this.notifyFleetError(`⚠️ fleet.yaml reload FAILED — ${message}\nThe previous configuration is still running.`);
+        })
             .finally(() => {
             this.reconcileInFlight = null;
             if (this.reloadPending && this.startupComplete) {
@@ -222,16 +313,55 @@ export class FleetManager {
             }
         });
     }
+    /**
+     * Is the fleet going down (or coming back up) on purpose?
+     *
+     * Instances dying during a planned restart is the restart working, not an
+     * incident — but the code that notices a dead pane or a dead MCP server
+     * cannot tell the difference on its own. Two sources, because the noise
+     * starts before this process is even told to stop: `agend update` replaces
+     * the package on disk while this daemon is still running and still watching.
+     */
+    isPlannedRestart() {
+        return this.shuttingDown || isUpdateInProgress(this.dataDir);
+    }
     finishStartup() {
         this.startupComplete = true;
+        // We are the post-update fleet: the update is over by definition. Clearing
+        // it here (rather than in the update command, which exits before the new
+        // fleet is up) is what keeps the quiet window from outliving the restart.
+        clearUpdateMarker(this.dataDir);
         if (this.reloadPending)
             this.scheduleReconcile();
+        void this.sweepOrphanedCancelButtons();
     }
     // ── ArchiverContext bridge ────────────────────────────────────────────
     lastActivityMs(name) {
         return this.lastActivity.get(name) ?? 0;
     }
+    /**
+     * Is the instance between turns?
+     *
+     * Prefers the daemon's pane state machine (debounced, busy-pattern aware) over
+     * the control client's raw 2-second output-silence heuristic. The raw heuristic
+     * reads every >2s output lull as idle — and long silent tools (a build, a test
+     * run) or an LLM pause produce those constantly mid-turn. That misreading is
+     * what retired cancel buttons in the middle of long work (the 5-minute backstop
+     * fired during a lull) and froze their progress text (ticker skipped "idle"
+     * ticks). The silence heuristic remains only as the fallback for instances
+     * whose daemon has not reported a state yet.
+     */
     getInstanceIdle(name) {
+        // A daemon that is not running cannot be mid-turn. This is what a stale
+        // "working" cache after a hard daemon kill (SIGKILL/OOM — no IPC crash
+        // report ever arrives) must not override.
+        if (this.getInstanceStatus(name) !== "running")
+            return true;
+        const state = this.getInstanceExecutionState(name);
+        if (state === "working" || state === "stuck")
+            return false;
+        if (state === "idle")
+            return true;
         try {
             const widFile = join(this.getInstanceDir(name), "window-id");
             if (!existsSync(widFile))
@@ -243,6 +373,18 @@ export class FleetManager {
             return true;
         }
     }
+    /**
+     * True when the instance claims working/stuck but nothing has refreshed that
+     * claim for STATE_REPORT_STALE_MS despite the backstop's per-tick queries.
+     * Measures the CACHE's age, not the button's — a healthy multi-hour run
+     * answers every query and never trips this.
+     */
+    stateReportDead(name) {
+        const cached = this.instanceStateCache.get(name);
+        if (!cached)
+            return false; // no claim to distrust — getInstanceIdle owns this case
+        return Date.now() - cached.receivedAt > STATE_REPORT_STALE_MS;
+    }
     // ── LifecycleContext bridge methods ──────────────────────────────────────
     webhookEmit(event, name, data) {
         this.webhookEmitter?.emit(event, name, data);
@@ -471,14 +613,21 @@ export class FleetManager {
             unchangedForMs: numberOr(msg.unchangedForMs, previous?.unchangedForMs ?? 0),
             observedAt: numberOr(msg.observedAt, now),
             stateChangedAt: numberOr(msg.stateChangedAt, previous?.state === state ? previous.stateChangedAt : now),
+            // Fleet-manager receipt time, NOT the daemon's observation time: staleness
+            // asks "is anyone still reporting", which only the receiver can date.
+            receivedAt: now,
         });
         for (const check of this.instanceIdleWaiters.get(name) ?? [])
             check();
         // warm_cap: a fresh transition into idle may free this instance for eviction,
         // or (more usefully) reveal that the fleet is now over cap. Only fire on the
         // edge into idle, not on every idle heartbeat.
-        if (state === "idle" && previous?.state !== "idle")
+        if (state === "idle" && previous?.state !== "idle") {
             this.enforceWarmCap();
+            // The turn is genuinely over — retire the cancel/progress button now rather
+            // than waiting for the 5-minute idle backstop to notice.
+            this.retireInstanceButtons(name);
+        }
     }
     cacheInstanceProcessStatus(name, status) {
         if (status === "running") {
@@ -583,12 +732,70 @@ export class FleetManager {
         if (!idle) {
             this.logger.warn({ instanceName, timeoutMs }, "Idle gate timed out; forcing delivery");
         }
-        const ipc = this.instanceIpcClients.get(instanceName);
-        if (!ipc?.connected)
-            throw new Error(`Instance '${instanceName}' IPC is unavailable`);
-        ipc.send(payload);
+        await this.sendWhenConnected(instanceName, payload);
         this.lastDeliveryAt.set(instanceName, Date.now());
     }
+    /**
+     * Hand a payload to an instance's IPC, waiting out a *transient* disconnect.
+     *
+     * A daemon that is restarting — `/restart`, crash recovery, a model switch —
+     * drops its socket for a few seconds. Any message arriving in that window used
+     * to fail instantly: the caller logged a warning, put ❌ on the user's message,
+     * and the message was gone. The user had to notice the ❌ and retype it. That is
+     * the "instance 訊息不容易掉" goal failing on the most predictable event there is.
+     *
+     * The wait is bounded. If the instance is genuinely down, this still throws and
+     * the ❌ still appears — just for a real failure rather than a restart.
+     *
+     * Ordering is preserved by serialising behind any waiter already queued for this
+     * instance, *including* when the socket happens to be up: otherwise a message
+     * arriving after the reconnect could overtake one that has been waiting for it.
+     */
+    async sendWhenConnected(instanceName, payload) {
+        const queued = this.ipcWaitTails.get(instanceName);
+        if (!queued) {
+            const ipc = this.instanceIpcClients.get(instanceName);
+            if (ipc?.connected && ipc.send(payload))
+                return;
+        }
+        const attempt = (queued ?? Promise.resolve())
+            .catch(() => { })
+            .then(() => this.sendAfterIpcReturns(instanceName, payload));
+        // The chain stores a settled-either-way promise so one failed delivery cannot
+        // wedge every later one, and so `queued` above is safe to await unguarded.
+        const tail = attempt.catch(() => { });
+        this.ipcWaitTails.set(instanceName, tail);
+        try {
+            await attempt;
+        }
+        finally {
+            // Only the last waiter clears the chain; while a queue is still draining the
+            // map must keep pointing at it or ordering is lost.
+            if (this.ipcWaitTails.get(instanceName) === tail) {
+                this.ipcWaitTails.delete(instanceName);
+            }
+        }
+    }
+    /** Poll for the instance's IPC to come back, then send. Throws if it does not. */
+    async sendAfterIpcReturns(instanceName, payload) {
+        const deadline = Date.now() + IPC_RECONNECT_GRACE_MS;
+        let warned = false;
+        for (;;) {
+            // Re-read every round: a reconnect replaces the IpcClient object entirely,
+            // so a cached reference would stay dead forever.
+            const ipc = this.instanceIpcClients.get(instanceName);
+            if (ipc?.connected && ipc.send(payload))
+                return;
+            if (Date.now() >= deadline) {
+                throw new Error(`Instance '${instanceName}' IPC is unavailable`);
+            }
+            if (!warned) {
+                warned = true;
+                this.logger.info({ instanceName }, "Instance IPC is down — holding delivery until it reconnects");
+            }
+            await new Promise(resolve => setTimeout(resolve, IPC_RECONNECT_POLL_MS));
+        }
+    }
     /** Single delivery facade: wake paused CLIs and serialize non-user work behind idle. */
     async deliverToInstance(instanceName, payload, options = {}) {
         const meta = payload.meta && typeof payload.meta === "object"
@@ -604,10 +811,7 @@ export class FleetManager {
                 await this.lifecycle.wake(instanceName, 30_000);
                 this.enforceWarmCap(instanceName); // woke one → evict a different LRU idle if over cap
             }
-            const ipc = this.instanceIpcClients.get(instanceName);
-            if (!ipc?.connected)
-                throw new Error(`Instance '${instanceName}' IPC is unavailable`);
-            ipc.send(payload);
+            await this.sendWhenConnected(instanceName, payload);
             // A cross-instance item arriving before the daemon observes this turn as
             // working must not trust the stale idle snapshot from before the send.
             this.lastDeliveryAt.set(instanceName, Date.now());
@@ -655,7 +859,7 @@ export class FleetManager {
         await new Promise(resolve => setTimeout(resolve, 250));
         await this.startClassicInstance(instanceName, this.classicChannels.getBackendByInstance(instanceName, this.fleetConfig?.defaults?.backend), this.classicChannels.getPreTaskCommand(channel.channelId, channel.adapterId), this.classicChannels.getModel(channel.channelId, channel.adapterId, this.fleetConfig?.defaults?.model), this.classicChannels.getAutoPauseAfter(channel.channelId, channel.adapterId, this.fleetConfig?.defaults?.auto_pause_after));
     }
-    async startInstance(name, config, topicMode) {
+    async startInstance(name, config, topicMode, kind = "fleet-topic") {
         if (this.lifecycle.isPaused(name)) {
             this.logger.info({ name }, "Persisted paused instance — skipping startup");
             return;
@@ -671,7 +875,11 @@ export class FleetManager {
             this.ensureGeneralInstructions(config.working_directory, config.backend);
         }
         this.instanceProcessStatus.delete(name);
-        await this.lifecycle.start(name, config, topicMode);
+        await this.lifecycle.start(name, config, topicMode, {
+            kind,
+            backend: config.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code",
+            model: this.resolveInstanceModel(name).display,
+        });
         // Auto-connect IPC — daemon.start() ensures socket is ready before resolving
         await this.connectIpcToInstance(name);
     }
@@ -834,7 +1042,10 @@ export class FleetManager {
             const eqIdx = trimmed.indexOf("=");
             if (eqIdx < 0)
                 continue;
-            const key = trimmed.slice(0, eqIdx);
+            // Accept `export KEY=value` — the shell-style form people paste from their
+            // .bashrc. Without this the variable landed in process.env under the key
+            // "export KEY" and silently did nothing.
+            const key = trimmed.slice(0, eqIdx).replace(/^export\s+/, "").trim();
             const raw = trimmed.slice(eqIdx + 1);
             const value = raw.replace(/^["'](.*)["']$/, '$1');
             // .env file always wins over inherited shell env vars, so that
@@ -846,10 +1057,12 @@ export class FleetManager {
     async startAll(configPath) {
         FleetManager.signalTarget = this;
         this.startupComplete = false;
+        // Cleared here, not at the end of doStopAll: a stop has an async tail, and
+        // anything arriving during it is still part of the stop.
+        this.shuttingDown = false;
         this.configPath = configPath;
         this.loadEnvFile();
         // Rotate fleet.log if oversized (before any logging)
-        const { rotateLogIfNeeded } = await import("./logger.js");
         rotateLogIfNeeded(join(this.dataDir, "fleet.log"));
         const fleet = this.loadConfig(configPath);
         setLocale(detectLocale(fleet)); // user-facing text language (fleet.yaml defaults.locale / timezone)
@@ -893,7 +1106,7 @@ export class FleetManager {
         }
         const pidPath = join(this.dataDir, "fleet.pid");
         writeFileSync(pidPath, String(process.pid), "utf-8");
-        this.eventLog = new EventLog(join(this.dataDir, "events.db"));
+        this.eventLog = this.openEventLog();
         // Initialize classic channel manager. The primary adapter (channels[0])
         // migrates legacy single-bot entries and names without a suffix. Classic
         // routing does NOT go through the routing engine (single-key, can't hold two
@@ -982,6 +1195,10 @@ export class FleetManager {
             // Rotate fleet.log daily too (besides the startup size check above), so a
             // long-running fleet doesn't accumulate an unbounded log.
             rotateLogIfNeeded(join(this.dataDir, "fleet.log"));
+            // Instance output.log is pipe-pane (TUI ANSI). Daemon health ticks rotate a
+            // running instance's own log; this sweep is the safety net for every other
+            // kind. One implementation, so the two cannot cover different sets.
+            this.rotateAllInstanceLogs();
         }, () => {
             const instances = Object.keys(this.fleetConfig?.instances ?? {});
             const costMap = new Map();
@@ -1121,9 +1338,29 @@ export class FleetManager {
                 }
             }
         }
-        // Signal systemd: generals ready
-        sdNotify("READY=1");
+        // The systemd watchdog answers exactly one question: is this process still
+        // turning its event loop? Pinging from a timer proves that, and after the
+        // blocking child-process calls were made async it is a meaningful signal —
+        // a deadlocked or frozen fleet stops pinging and systemd restarts it.
+        //
+        // It deliberately does NOT gate on fleet health. "No adapter connected" or
+        // "an instance crashed" must not kill the process: the fleet would be restarted
+        // into the same broken state, and a user who has legitimately stopped every
+        // instance would get a restart loop. Those conditions surface through /health
+        // (which now returns 503) and through the General-topic notifications instead.
         this.watchdogTimer = setInterval(() => sdNotify("WATCHDOG=1"), 30_000);
+        // EventLog.prune() existed but was never called, so `events` and `activity`
+        // grew without bound for the life of the install. Prune once at startup and
+        // daily after that; the timer is unref'd so it never holds the loop open.
+        this.pruneEventLog();
+        this.eventLogPruneTimer = setInterval(() => this.pruneEventLog(), 24 * 60 * 60_000);
+        this.eventLogPruneTimer.unref?.();
+        // Same shape for pipe-pane logs, and for the same reason: the only sweep that
+        // covered them lived inside the daily-summary callback, so it did not run at
+        // all when summaries were off.
+        this.rotateAllInstanceLogs();
+        this.logRotateTimer = setInterval(() => this.rotateAllInstanceLogs(), 24 * 60 * 60_000);
+        this.logRotateTimer.unref?.();
         // Phase 2: Start remaining instances with staggered concurrency
         if (others.length > 0) {
             await this.startInstancesWithConcurrency(others, topicMode);
@@ -1259,6 +1496,15 @@ export class FleetManager {
         // rest of startup finishes. Replay one coalesced reload only after all
         // startup-owned lifecycle work and signal handlers are in place.
         this.finishStartup();
+        // Tell systemd we are ready only now. This used to fire right after the
+        // generals started — before adapters, classic instances, topic creation and the
+        // health server — so `systemctl start` returned success while the fleet was
+        // still deaf: no path existed for a user message to arrive.
+        sdNotify("READY=1");
+        const health = this.getFleetHealth();
+        if (health.status !== "ok") {
+            this.logger.warn({ health }, "Fleet started with problems — see /health");
+        }
     }
     /**
      * Delete inbox files older than retentionDays (by mtime). Cleans the shared
@@ -1375,6 +1621,67 @@ export class FleetManager {
     getAdapterStates() {
         return this.adapterState;
     }
+    /**
+     * Real, checkable fleet health for `/health` and the operator.
+     *
+     * `status` is:
+     *  - `ok`       — at least one adapter connected and every configured instance
+     *                 that should be running is running
+     *  - `degraded` — reachable, but something the operator should look at (an
+     *                 adapter retrying, an instance crashed or stopped)
+     *  - `down`     — the fleet cannot do its job: no adapter is connected, so no
+     *                 message can arrive or be answered
+     *
+     * Deliberately does NOT gate the systemd watchdog — see the comment at the
+     * WATCHDOG timer for why.
+     */
+    getFleetHealth() {
+        const names = Object.keys(this.fleetConfig?.instances ?? {});
+        const counts = { configured: names.length, running: 0, crashed: 0, paused: 0, stopped: 0 };
+        for (const name of names) {
+            const state = this.getInstanceStatus(name);
+            if (state === "running")
+                counts.running++;
+            else if (state === "crashed")
+                counts.crashed++;
+            else if (state === "paused")
+                counts.paused++;
+            else
+                counts.stopped++;
+        }
+        const states = {};
+        let connected = 0;
+        for (const [id, state] of this.adapterState) {
+            states[id] = state.status;
+            if (state.status === "connected")
+                connected++;
+        }
+        const problems = [];
+        if (this.adapterState.size > 0 && connected === 0)
+            problems.push("no channel adapter is connected");
+        if (counts.crashed > 0)
+            problems.push(`${counts.crashed} instance(s) crashed`);
+        for (const [id, state] of this.adapterState) {
+            if (state.status !== "connected")
+                problems.push(`adapter ${id} is ${state.status}`);
+        }
+        if (!this.startupComplete)
+            problems.push("startup has not completed");
+        // "down" is reserved for "cannot receive or answer a message at all". A fleet
+        // with adapters configured but none connected is exactly that.
+        const status = this.adapterState.size > 0 && connected === 0
+            ? "down"
+            : problems.length > 0 ? "degraded" : "ok";
+        return {
+            status,
+            uptime: Math.floor((Date.now() - this.startedAt) / 1000),
+            instances: counts,
+            adapters: { total: this.adapterState.size, connected, states },
+            startupComplete: this.startupComplete,
+            memory: readFleetMemory(),
+            problems,
+        };
+    }
     /** Start the primary adapter (backward-compatible, sets this.adapter) */
     async startSingleAdapter(fleet, channelConfig) {
         const botToken = process.env[channelConfig.bot_token_env];
@@ -1401,11 +1708,16 @@ export class FleetManager {
         this.adapter.on("message", safeHandler(async (msg) => {
             await this.handleInboundMessage(msg);
         }, this.logger, "adapter.message"));
+        this.adapter.on("reaction", safeHandler(async (r) => {
+            await this.handleInboundReaction(r);
+        }, this.logger, "adapter.reaction"));
         this.adapter.on("callback_query", safeHandler(async (data) => {
             if (await this.handleClassicBackendSelection(data))
                 return;
             if (await this.handleModelSelection(data))
                 return;
+            if (await this.handleEffortSelection(data))
+                return;
             if (data.callbackData.startsWith("hang:")) {
                 const parts = data.callbackData.split(":");
                 const action = parts[1];
@@ -1426,12 +1738,7 @@ export class FleetManager {
                 return;
             }
             if (data.callbackData.startsWith("cancel:")) {
-                const instanceName = data.callbackData.slice("cancel:".length);
-                // Idempotent: a button click only acts while the button is live. A
-                // second click (entry already cleared) is a no-op — don't re-send the
-                // interrupt key. (The /cancel command path calls cancelInstance directly.)
-                if (this.hasCancelButton(instanceName))
-                    this.cancelInstance(instanceName);
+                this.handleCancelClick(data.callbackData.slice("cancel:".length), this.adapter, data);
                 return;
             }
         }, this.logger, "adapter.callback_query"));
@@ -1511,6 +1818,9 @@ export class FleetManager {
             else if (data.command === "model") {
                 await this.handleModelSlash(data, adapterId);
             }
+            else if (data.command === "effort") {
+                await this.handleEffortSlash(data, adapterId);
+            }
             else if (data.command === "cancel") {
                 const name = this.resolveSlashTarget(data.channelId, adapterId);
                 if (!name) {
@@ -1575,19 +1885,29 @@ export class FleetManager {
                     await data.respond(t("not_authorized"));
                     return;
                 }
+                await data.respond(await this.runBackendDoctor());
+            }
+            else if (data.command === "usage") {
+                // Same permission level as /ctx (none). The reply is still ephemeral —
+                // the adapter defers non-chat commands that way — so it never spams the
+                // channel either way.
                 try {
-                    const { execSync } = await import("node:child_process");
-                    const backend = this.fleetConfig?.defaults?.backend || "claude-code";
-                    const result = execSync(`agend backend doctor ${backend}`, { timeout: 30_000, encoding: "utf-8" });
-                    const clean = result.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
-                    await data.respond(clean || "No output");
+                    const { getUsageSnapshot } = await import("./usage/usage-api.js");
+                    const { renderUsageMarkdown } = await import("./usage/format-rich.js");
+                    // slash_command is Discord-only; editReply renders Markdown natively.
+                    await data.respond(renderUsageMarkdown(await getUsageSnapshot()));
                 }
                 catch (err) {
-                    const output = (err.stdout ?? err.message ?? "Doctor failed").replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
-                    await data.respond(output);
+                    await data.respond(`⚠️ Usage fetch failed: ${err.message}`);
                 }
             }
             else if (data.command === "status") {
+                // Admin-gated (like the topic path): the merged table shows every
+                // instance's cost and IPC health.
+                if (!this.isFleetAdmin(data.userId, adapterId)) {
+                    await data.respond(t("cmd.admin_required", "/status"));
+                    return;
+                }
                 const text = await this.topicCommands.getStatusText();
                 await data.respond(text);
             }
@@ -1696,11 +2016,16 @@ export class FleetManager {
         adapter.on("message", safeHandler(async (msg) => {
             await this.handleInboundMessage(msg);
         }, this.logger, `adapter[${adapterId}].message`));
+        adapter.on("reaction", safeHandler(async (r) => {
+            await this.handleInboundReaction(r);
+        }, this.logger, `adapter[${adapterId}].reaction`));
         adapter.on("callback_query", safeHandler(async (data) => {
             if (await this.handleClassicBackendSelection(data))
                 return;
             if (await this.handleModelSelection(data))
                 return;
+            if (await this.handleEffortSelection(data))
+                return;
             if (data.callbackData.startsWith("hang:")) {
                 const parts = data.callbackData.split(":");
                 const action = parts[1];
@@ -1720,10 +2045,7 @@ export class FleetManager {
                 return;
             }
             if (data.callbackData.startsWith("cancel:")) {
-                const instanceName = data.callbackData.slice("cancel:".length);
-                // Idempotent: only the first click (while the button is live) acts.
-                if (this.hasCancelButton(instanceName))
-                    this.cancelInstance(instanceName);
+                this.handleCancelClick(data.callbackData.slice("cancel:".length), adapter, data);
                 return;
             }
         }, this.logger, `adapter[${adapterId}].callback_query`));
@@ -1793,6 +2115,9 @@ export class FleetManager {
             else if (data.command === "model") {
                 await this.handleModelSlash(data, adapterId);
             }
+            else if (data.command === "effort") {
+                await this.handleEffortSlash(data, adapterId);
+            }
             else if (data.command === "cancel") {
                 const name = this.resolveSlashTarget(data.channelId, adapterId);
                 if (!name) {
@@ -1857,19 +2182,29 @@ export class FleetManager {
                     await data.respond(t("not_authorized"));
                     return;
                 }
+                await data.respond(await this.runBackendDoctor());
+            }
+            else if (data.command === "usage") {
+                // Same permission level as /ctx (none). The reply is still ephemeral —
+                // the adapter defers non-chat commands that way — so it never spams the
+                // channel either way.
                 try {
-                    const { execSync } = await import("node:child_process");
-                    const backend = this.fleetConfig?.defaults?.backend || "claude-code";
-                    const result = execSync(`agend backend doctor ${backend}`, { timeout: 30_000, encoding: "utf-8" });
-                    const clean = result.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
-                    await data.respond(clean || "No output");
+                    const { getUsageSnapshot } = await import("./usage/usage-api.js");
+                    const { renderUsageMarkdown } = await import("./usage/format-rich.js");
+                    // slash_command is Discord-only; editReply renders Markdown natively.
+                    await data.respond(renderUsageMarkdown(await getUsageSnapshot()));
                 }
                 catch (err) {
-                    const output = (err.stdout ?? err.message ?? "Doctor failed").replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
-                    await data.respond(output);
+                    await data.respond(`⚠️ Usage fetch failed: ${err.message}`);
                 }
             }
             else if (data.command === "status") {
+                // Admin-gated (like the topic path): the merged table shows every
+                // instance's cost and IPC health.
+                if (!this.isFleetAdmin(data.userId, adapterId)) {
+                    await data.respond(t("cmd.admin_required", "/status"));
+                    return;
+                }
                 const text = await this.topicCommands.getStatusText();
                 await data.respond(text);
             }
@@ -2025,6 +2360,9 @@ export class FleetManager {
                 else if (msg.type === "instance_process_state") {
                     this.cacheInstanceProcessStatus(name, msg.status);
                 }
+                else if (msg.type === "instance_activity") {
+                    this.cacheInstanceActivity(name, msg.activity);
+                }
                 else if (msg.type === "instance_state" || msg.type === "instance_state_response") {
                     this.cacheInstanceExecutionState(name, msg);
                     if (msg.type === "instance_state_response") {
@@ -2095,9 +2433,22 @@ export class FleetManager {
                 if (existsSync(windowIdPath)) {
                     const windowId = readFileSync(windowIdPath, "utf-8").trim();
                     if (windowId) {
+                        // Async with an explicit timeout: this was execSync with NO timeout at
+                        // all, so a wedged tmux server blocked the whole fleet event loop
+                        // indefinitely — while we were here to diagnose a lost connection.
+                        // A timeout is also the correct signal: an unresponsive tmux server
+                        // means we cannot verify the pane, which is treated as dead (the same
+                        // conclusion the old code reached only by throwing).
                         try {
-                            const { execSync } = await import("node:child_process");
-                            execSync(`tmux list-panes -t "${windowId}"`, { stdio: "ignore" });
+                            const { execFile } = await import("node:child_process");
+                            const { promisify } = await import("node:util");
+                            const { getTmuxSocketName } = await import("./paths.js");
+                            // Honour socket isolation: without -L this queried the user's default
+                            // tmux server instead of the fleet's, so under a custom AGEND_HOME the
+                            // check was meaningless (it reported every pane dead).
+                            const socket = getTmuxSocketName();
+                            const args = socket ? ["-L", socket, "list-panes", "-t", windowId] : ["list-panes", "-t", windowId];
+                            await promisify(execFile)("tmux", args, { timeout: 5_000 });
                         }
                         catch {
                             // Pane dead — respawn
@@ -2118,6 +2469,12 @@ export class FleetManager {
         if (this.adapterRestarting.has(id))
             return;
         this.adapterRestarting.add(id);
+        // Reflect reality in adapterState throughout. This loop used to leave the state
+        // untouched, so getAdapterStates() — and therefore /health and the dashboard —
+        // kept reporting "connected" for an adapter that had been down for hours. An
+        // adapter's true status was simply not knowable from inside the process.
+        const previous = this.adapterState.get(id);
+        this.adapterState.set(id, { status: "retrying", retryCount: 0, lastError: previous?.lastError });
         try {
             for (let attempt = 1;; attempt++) {
                 if (this.ipcStoppingInstances.has("__fleet_stopping__"))
@@ -2130,9 +2487,16 @@ export class FleetManager {
                     await adapter.stop().catch(() => { });
                     await adapter.start();
                     this.logger.info({ id, attempt }, "Adapter restarted successfully");
+                    this.adapterState.set(id, { status: "connected", retryCount: 0 });
                     return;
                 }
-                catch { /* retry */ }
+                catch (err) {
+                    this.adapterState.set(id, {
+                        status: "retrying",
+                        retryCount: attempt,
+                        lastError: err?.message ?? String(err),
+                    });
+                }
                 if (attempt % 10 === 0) {
                     this.logger.warn({ id, attempt }, "Adapter restart still failing");
                 }
@@ -2168,6 +2532,49 @@ export class FleetManager {
         }
         return generals[0];
     }
+    /**
+     * A user reacted to one of the bot's messages (#408).
+     *
+     * A reaction is context, not a message (#432, reworking #413): it never triggers
+     * an agent turn and never wakes anything. It is queued in the event log and rides
+     * into the instance's NEXT real message as one compact leading line —
+     * `[Recent reactions: 👍×2 from hanhanv]` — after which it is marked consumed.
+     * No pending reactions → no line → zero context spent, which is the common case.
+     */
+    async handleInboundReaction(r) {
+        const instanceName = this.resolveSlashTarget(r.threadId ?? r.chatId, r.adapterId);
+        if (!instanceName) {
+            this.logger.debug({ emoji: r.emoji, chatId: r.chatId }, "Reaction in an unrouted channel — ignoring");
+            return;
+        }
+        if (DELIVERY_STATUS_EMOJIS.has(r.emoji)) {
+            this.logger.debug({ emoji: r.emoji, user: r.username }, "Ignoring delivery-status emoji as a reaction");
+            return;
+        }
+        this.eventLog?.logActivity("reaction", r.username, `${r.emoji} ${r.action}`, instanceName);
+        if (r.action === "add") {
+            this.eventLog?.addReaction(instanceName, r.messageId, r.username, r.emoji);
+        }
+        else {
+            // Withdrawn before anyone saw it → it never happened. See removeReaction.
+            this.eventLog?.removeReaction(instanceName, r.messageId, r.username, r.emoji);
+        }
+    }
+    /**
+     * The queued-reaction summary for an instance's next real message, or {} when
+     * nothing is pending (the common case must add zero context). The consume
+     * callback is separate from the fetch so reactions are only marked once the
+     * message actually went out — a failed delivery keeps them queued.
+     */
+    pendingReactionsMeta(instanceName) {
+        const pending = this.eventLog?.pendingReactions(instanceName);
+        if (!pending)
+            return { meta: {}, consume: () => { } };
+        return {
+            meta: { pending_reactions: pending.summary },
+            consume: () => this.eventLog?.markReactionsConsumed(instanceName, pending.maxId),
+        };
+    }
     async handleInboundMessage(msg) {
         const threadId = msg.threadId || undefined;
         this.logger.debug({ source: msg.source, chatId: msg.chatId, threadId, userId: msg.userId, isBotMessage: msg.isBotMessage, textLen: (msg.text ?? "").length, text: (msg.text ?? "").slice(0, 80) }, "handleInboundMessage entry");
@@ -2505,6 +2912,7 @@ export class FleetManager {
                 }
                 this.warnIfRateLimited(generalInstance, msg);
                 const { text, extraMeta } = await processAttachments(msg, inboundAdapter, this.logger, generalInstance);
+                const generalReactions = this.pendingReactionsMeta(generalInstance);
                 try {
                     await this.deliverToInstance(generalInstance, {
                         type: "fleet_inbound",
@@ -2520,9 +2928,11 @@ export class FleetManager {
                             adapter_id: msg.adapterId,
                             source: msg.source,
                             ...(msg.replyToText ? { reply_to_text: msg.replyToText } : {}),
+                            ...generalReactions.meta,
                             ...extraMeta,
                         },
                     });
+                    generalReactions.consume();
                     this.lastInboundUser.set(generalInstance, msg.username);
                     this.logger.info(`${msg.username} → ${generalInstance}: ${(text ?? "").slice(0, 100)}`);
                     this.eventLog?.logActivity("message", msg.username, (text ?? "").slice(0, 200), generalInstance);
@@ -2598,6 +3008,7 @@ export class FleetManager {
         this.setTopicIcon(instanceName, "blue");
         this.warnIfRateLimited(instanceName, msg);
         const { text, extraMeta } = await processAttachments(msg, inboundAdapter, this.logger, instanceName);
+        const reactions = this.pendingReactionsMeta(instanceName);
         try {
             await this.deliverToInstance(instanceName, {
                 type: "fleet_inbound",
@@ -2613,9 +3024,13 @@ export class FleetManager {
                     adapter_id: msg.adapterId,
                     source: msg.source,
                     ...(msg.replyToText ? { reply_to_text: msg.replyToText } : {}),
+                    ...reactions.meta,
                     ...extraMeta,
                 },
             });
+            // Only after the message actually went out. A failed delivery keeps the
+            // reactions queued for the retry / the next message.
+            reactions.consume();
         }
         catch (err) {
             this.logger.warn({ err: err.message, instanceName }, "Wake/delivery failed");
@@ -2704,25 +3119,33 @@ export class FleetManager {
             delete args.thread_id;
             threadId = undefined;
         }
+        // Reply dedup: retries land here when the agent was told a send failed
+        // (daemon budget elapsed, shell tool killed) while the adapter send was
+        // still in flight and about to succeed. One real send, everyone gets its
+        // outcome; a genuinely failed send clears the entry so a retry passes.
+        if (tool === "reply") {
+            const ticket = this.replyDeduper.begin(instanceName, String(args.text ?? ""), Array.isArray(args.files) ? args.files : []);
+            if (ticket.duplicate) {
+                this.logger.info({ instanceName }, "Duplicate reply suppressed — replaying the original send's outcome");
+                ticket.subscribe(respond);
+                return;
+            }
+            const original = respond;
+            const respondAndRecord = (result, error) => {
+                ticket.complete(result, error);
+                original(result, error);
+            };
+            if (routeToolCall(outAdapter, tool, args, threadId, respondAndRecord)) {
+                this.afterReplyRouted(instanceName, args, senderSessionName);
+                return;
+            }
+            // routeToolCall knows "reply"; not handling it means the world changed.
+            ticket.complete(null, "reply not handled");
+            original(null, "reply not handled");
+            return;
+        }
         // Route standard channel tools (reply, react, edit_message, download_attachment)
         if (routeToolCall(outAdapter, tool, args, threadId, respond)) {
-            if (tool === "reply") {
-                // Agent answered — retire its pending cancel button and mark ✅ done.
-                this.clearCancelButton(instanceName);
-                this.reactDone(instanceName);
-                const replyTo = this.lastInboundUser.get(instanceName) ?? "user";
-                this.logger.info(`${instanceName} → ${replyTo}: ${(args.text ?? "").slice(0, 100)}`);
-                this.emitSseEvent("message", {
-                    instance: instanceName, sender: senderSessionName ?? instanceName,
-                    text: (args.text ?? "").slice(0, 2000),
-                    ts: new Date().toISOString(),
-                });
-                // Log bot reply to classic instance chat-log
-                const isClassic = this.classicChannels?.getChannelIdByInstance(instanceName) !== undefined;
-                if (isClassic) {
-                    ClassicChannelManager.logMessage(instanceName, "bot", args.text ?? "", new Date());
-                }
-            }
             return;
         }
         // Log tool calls for activity visualization
@@ -2737,6 +3160,35 @@ export class FleetManager {
             respond(null, `Unknown tool: ${tool}`);
         }
     }
+    /** Side effects of a routed reply: cancel-button lifecycle, logs, SSE, chat log. */
+    afterReplyRouted(instanceName, args, senderSessionName) {
+        // A reply is NOT proof the turn is over (#410) — but it is not proof of
+        // more work either. Split the difference: an instance that is clearly
+        // idle loses the button now; one that looks busy keeps it (re-posted
+        // below the reply so it stays last in the channel), with a 2-minute
+        // grace check — if it has NOT resumed working by then, the reply was the
+        // end of the turn and the button goes. A multi-step run that keeps
+        // working sails through the check and keeps its button.
+        if (this.getInstanceIdle(instanceName)) {
+            this.clearCancelButton(instanceName);
+        }
+        else {
+            void this.sendCancelButton(instanceName).then(() => this.armReplyGrace(instanceName));
+        }
+        this.reactDone(instanceName);
+        const replyTo = this.lastInboundUser.get(instanceName) ?? "user";
+        this.logger.info(`${instanceName} → ${replyTo}: ${(args.text ?? "").slice(0, 100)}`);
+        this.emitSseEvent("message", {
+            instance: instanceName, sender: senderSessionName ?? instanceName,
+            text: (args.text ?? "").slice(0, 2000),
+            ts: new Date().toISOString(),
+        });
+        // Log bot reply to classic instance chat-log
+        const isClassic = this.classicChannels?.getChannelIdByInstance(instanceName) !== undefined;
+        if (isClassic) {
+            ClassicChannelManager.logMessage(instanceName, "bot", args.text ?? "", new Date());
+        }
+    }
     /** Handle tool status update from a daemon instance */
     handleToolStatusFromInstance(instanceName, msg) {
         const statusAdapter = this.getAdapterForInstance(instanceName) ?? this.adapter;
@@ -3339,6 +3791,9 @@ export class FleetManager {
         }
     }
     async removeInstance(name) {
+        // Drop cached pane context — the map is keyed by instance name and nothing
+        // else evicted deleted entries, so it grew for the life of the process.
+        forgetInstanceContext(name);
         // Clean up schedules (scheduler is fleet-level, not lifecycle-level)
         const config = this.fleetConfig?.instances[name];
         if (this.scheduler && config?.topic_id) {
@@ -3444,6 +3899,171 @@ export class FleetManager {
         this.collabInstances.add(instanceName);
         return true;
     }
+    /**
+     * Open the event log, tolerating a corrupt file.
+     *
+     * `events.db` holds history only — event rows and the activity feed. Nothing the
+     * fleet needs to run depends on it, and every consumer already uses
+     * `this.eventLog?.`. An unguarded `new EventLog(...)` here meant a corrupt or
+     * unreadable history file (a truncated WAL after a hard kill, a full disk)
+     * threw during startAll and the WHOLE FLEET FAILED TO BOOT — trading every
+     * running agent for a file whose only job is reporting.
+     *
+     * So: try, move a bad file aside and retry once with a fresh one, and if even
+     * that fails carry on without an event log.
+     */
+    /**
+     * Run `agend backend doctor` for the fleet's default backend and return its
+     * cleaned output.
+     *
+     * Async on purpose: this was `execSync` with a 30s timeout, reachable by any
+     * allowlisted user through `/doctor`. While it ran, the entire fleet event loop
+     * was frozen — no IPC, no adapter, no message delivery, no health responses,
+     * and critically no WATCHDOG ping, so a slow doctor could push past
+     * WatchdogSec and have systemd SIGABRT the fleet.
+     */
+    async runBackendDoctor() {
+        const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
+        const backend = this.fleetConfig?.defaults?.backend || "claude-code";
+        try {
+            const { execFile } = await import("node:child_process");
+            const { promisify } = await import("node:util");
+            // execFile with an argv array — no shell, so the backend name cannot be
+            // interpreted as a command even if config is malformed.
+            const { stdout } = await promisify(execFile)("agend", ["backend", "doctor", backend], {
+                timeout: 30_000,
+                encoding: "utf-8",
+            });
+            return stripAnsi(stdout) || "No output";
+        }
+        catch (err) {
+            const e = err;
+            return stripAnsi(e.stdout ?? e.message ?? "Doctor failed");
+        }
+    }
+    /** Drop event/activity rows older than the retention window. Best-effort. */
+    /**
+     * Cap every instance's pipe-pane log, walking the instances **directory** rather
+     * than the config.
+     *
+     * A running instance rotates its own log on each health tick, so the ones that
+     * need this are the ones nothing else looks at:
+     *
+     *   - deleted instances, whose directory outlives the config entry. Nothing ever
+     *     touched these again. On the machine this was found on, one held 122 MB and
+     *     another 74 MB, out of 622 MB of pipe-pane logs in total.
+     *   - classic instances, which live in classicChannels, not fleetConfig.instances,
+     *     and so were never in the old config-driven loop at all.
+     *   - stopped instances, which have no health tick running.
+     *
+     * pipe-pane writes raw TUI output, so a wedged splash screen can emit ANSI frames
+     * at animation rate. Unbounded growth here fills the disk, which takes the whole
+     * fleet down rather than one instance.
+     */
+    rotateAllInstanceLogs() {
+        const root = join(this.dataDir, "instances");
+        let entries;
+        try {
+            entries = readdirSync(root, { withFileTypes: true });
+        }
+        catch {
+            return; // no instances directory yet
+        }
+        for (const entry of entries) {
+            if (!entry.isDirectory())
+                continue;
+            // rotateLogIfNeeded is already best-effort and returns early on a missing
+            // file, so a directory without a pipe-pane log costs one stat.
+            rotateLogIfNeeded(join(root, entry.name, "output.log"));
+        }
+    }
+    pruneEventLog() {
+        try {
+            this.eventLog?.prune(FleetManager.EVENT_LOG_RETENTION_DAYS);
+        }
+        catch (err) {
+            this.logger.warn({ err }, "Event log prune failed");
+        }
+    }
+    openEventLog() {
+        const dbPath = join(this.dataDir, "events.db");
+        try {
+            return new EventLog(dbPath);
+        }
+        catch (err) {
+            this.logger.error({ err, dbPath }, "events.db unusable — moving it aside and starting a fresh one");
+            const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+            for (const suffix of ["", "-wal", "-shm"]) {
+                try {
+                    renameSync(`${dbPath}${suffix}`, `${dbPath}${suffix}.corrupt-${stamp}`);
+                }
+                catch { /* may not exist */ }
+            }
+            try {
+                return new EventLog(dbPath);
+            }
+            catch (retryErr) {
+                // History is worth losing; a fleet that won't start is not.
+                this.logger.error({ err: retryErr, dbPath }, "Could not open a fresh events.db — continuing without event logging");
+                return null;
+            }
+        }
+    }
+    /**
+     * Report a fleet-level fault (not attributable to one instance) to the General
+     * topic, so the operator learns about it without reading daemon.log.
+     *
+     * Throttled per distinct message: an unhandled rejection typically comes from a
+     * loop (a poller, a repeating timer), and one channel message per occurrence
+     * would bury the topic — which is worse than silence. First occurrence goes out
+     * immediately, repeats are suppressed for THROTTLE_MS and then re-sent with a
+     * count.
+     *
+     * The log line is written by the caller regardless: if every adapter is down,
+     * the only notification path is the one that is broken.
+     */
+    notifyFleetError(text) {
+        const now = Date.now();
+        const key = text.slice(0, 200);
+        const seen = this.fleetErrorNotices.get(key);
+        if (seen && now - seen.at < FleetManager.FLEET_ERROR_THROTTLE_MS) {
+            seen.suppressed++;
+            return;
+        }
+        const suppressed = seen?.suppressed ?? 0;
+        this.fleetErrorNotices.set(key, { at: now, suppressed: 0 });
+        // Bound the map: it is keyed by message text, and a message with a varying
+        // suffix (a path, an id) would otherwise grow it without limit.
+        if (this.fleetErrorNotices.size > 100) {
+            const oldest = this.fleetErrorNotices.keys().next().value;
+            if (oldest !== undefined)
+                this.fleetErrorNotices.delete(oldest);
+        }
+        const body = suppressed > 0
+            ? `${text}\n(plus ${suppressed} more in the last ${Math.round(FleetManager.FLEET_ERROR_THROTTLE_MS / 60_000)}m)`
+            : text;
+        // Resolved from config, NOT findGeneralInstance(): that requires a live daemon,
+        // and a fleet-level fault is exactly when the General may be down. The topic
+        // itself still exists, and notifyInstanceTopic only needs adapter + group +
+        // topic_id to post into it.
+        const general = Object.entries(this.fleetConfig?.instances ?? {})
+            .find(([, config]) => config.general_topic === true)?.[0];
+        if (general) {
+            this.notifyInstanceTopic(general, body);
+            return;
+        }
+        // No General instance — fall back to the primary channel's group.
+        const channelCfg = this.getChannelConfig();
+        const groupId = channelCfg?.group_id;
+        if (this.adapter && groupId) {
+            this.adapter.sendText(String(groupId), body)
+                .catch(err => this.logger.warn({ err }, "Failed to send fleet error notification"));
+            return;
+        }
+        this.logger.warn({ text: body }, "Fleet error had no notification target (no General instance, no adapter)");
+    }
+    static FLEET_ERROR_THROTTLE_MS = 10 * 60_000;
+    fleetErrorNotices = new Map();
     notifyInstanceTopic(instanceName, text, extraOpts) {
         const adapter = this.getAdapterForInstance(instanceName) ?? this.adapter;
         if (!adapter)
@@ -3517,6 +4137,40 @@ export class FleetManager {
         await data.respond(t("save.sent", cmd, target.name));
     }
     /** Whether the instance currently has at least one live cancel button. */
+    /**
+     * A click on a cancel button, whether or not the fleet still tracks it.
+     *
+     * The old rule was "act only while an entry is live", which made a click on a
+     * button the fleet had forgotten a silent no-op — no cancel, no message, not
+     * even a log line. That is indistinguishable from a broken button, and it is
+     * what the "按鈕點了沒反應" reports were: the entry is briefly absent while a
+     * button is being replaced, and a delete that fails leaves the message on
+     * screen with no entry at all.
+     *
+     * So: honour the click if the instance is actually running, and say so plainly
+     * if it is not. The stale-click path is rate-limited because the original
+     * concern was real — a second click must not fire a second interrupt key at an
+     * instance that has already started a new turn.
+     */
+    handleCancelClick(instanceName, adapter, data) {
+        if (this.hasCancelButton(instanceName)) {
+            this.cancelInstance(instanceName);
+            return;
+        }
+        const lastAt = this.staleCancelClickAt.get(instanceName) ?? 0;
+        if (Date.now() - lastAt < STALE_CANCEL_CLICK_COOLDOWN_MS)
+            return;
+        this.staleCancelClickAt.set(instanceName, Date.now());
+        // cancelInstance returns false when there is no daemon — i.e. nothing to
+        // cancel, which is the one case where the button really is dead.
+        if (this.cancelInstance(instanceName)) {
+            this.logger.info({ instanceName }, "Cancel click honoured with no live button entry");
+            return;
+        }
+        this.logger.info({ instanceName }, "Cancel click on an expired button — instance not running");
+        adapter?.editMessage(data.chatId, data.messageId, t("cancel.button_stale", instanceName), data.threadId)
+            .catch(() => { });
+    }
     hasCancelButton(instanceName) {
         for (const e of this.cancelButtons.values()) {
             if (e.instanceName === instanceName)
@@ -3525,15 +4179,22 @@ export class FleetManager {
         return false;
     }
     async sendCancelButton(instanceName, correlationId) {
-        // At most one button shown per instance: retire any existing ones first
-        // (delete + bounded retry). Each is tracked separately, so a failed delete
-        // here doesn't strand it — it keeps retrying on its own timer.
-        this.retireInstanceButtons(instanceName);
+        // Post first, retire after (see the tail of this method). Retiring up front
+        // meant that from the delete until the new message came back — a chat API
+        // round trip, and every reply goes through here — the instance had NO live
+        // entry, while the old button was still on screen. A click in that window
+        // hit `hasCancelButton() === false` and was silently dropped: the reported
+        // "按鈕失效". If notifyAlert then failed, the button was simply gone.
         const adapter = this.getAdapterForInstance(instanceName) ?? this.adapter;
         if (!adapter)
             return;
+        // Resolve the group through the world fallback (first world when unbound),
+        // NOT through getChannelConfig(binding)?.group_id: on a fleet configured with
+        // `channels:` worlds the primary `channel:` block is empty, so an instance
+        // with no world binding yet (fresh restart, cross-instance delegation)
+        // resolved group_id to undefined and the button silently never appeared.
         const adapterId = this.instanceWorldBinding.get(instanceName);
-        const groupId = this.getChannelConfig(adapterId)?.group_id;
+        const groupId = this.getGroupIdForInstance(instanceName) || undefined;
         const topicId = this.fleetConfig?.instances[instanceName]?.topic_id;
         let chatId;
         let threadId;
@@ -3549,8 +4210,12 @@ export class FleetManager {
             if (!chatId && groupId)
                 chatId = String(groupId);
         }
-        if (!chatId)
+        if (!chatId) {
+            // A button that cannot be addressed must say so — this exact silence is how
+            // "the cancel button sometimes never appears" stayed unreported-in-logs.
+            this.logger.warn({ instanceName, topicId, groupId }, "Cannot address cancel button (no chat id resolved)");
             return;
+        }
         try {
             const sent = await adapter.notifyAlert(chatId, {
                 type: "cancel",
@@ -3558,13 +4223,6 @@ export class FleetManager {
                 message: "👀 處理中…",
                 choices: [{ id: `cancel:${instanceName}`, label: t("cancel.button") }],
             }, threadId ? { threadId } : undefined);
-            // A concurrent sendCancelButton for the same instance may have posted its
-            // own button while we awaited notifyAlert. Retire any other buttons for
-            // this instance (not the one we just posted) so only the newest shows.
-            for (const other of this.cancelButtons.values()) {
-                if (other.instanceName === instanceName)
-                    this.retireButton(other);
-            }
             const entry = {
                 instanceName,
                 adapterId,
@@ -3573,7 +4231,16 @@ export class FleetManager {
                 threadId: sent.threadId ?? threadId,
                 correlationId,
                 retryCount: 0,
+                // Elapsed time is measured from when this button was posted — i.e. from
+                // when the work was handed over — not from the pane's working transition,
+                // which resets if the CLI blips idle mid-turn.
+                startedAt: Date.now(),
+                // Matches the text notifyAlert just posted, so the first 60s tick does
+                // not re-edit identical text — which put a "(edited)" mark on Discord
+                // with nothing visibly changed.
+                lastProgressText: "👀 處理中…",
             };
+            this.startProgressTicker(entry);
             // Idle-check backstop: every 5min, if the instance is idle, retire the
             // button. Covers turns that end without hitting a clear trigger (reply /
             // cancel / correlation). Cleared in discardButton when the entry is removed.
@@ -3582,18 +4249,167 @@ export class FleetManager {
                     clearInterval(entry.idleCheckTimer);
                     return;
                 }
-                if (this.getInstanceIdle(instanceName)) {
-                    this.logger.info({ instanceName, messageId: entry.messageId }, "Cancel button idle backstop retiring");
+                const reason = this.getInstanceIdle(instanceName) ? "idle"
+                    : this.stateReportDead(instanceName) ? "state reports stopped"
+                        : Date.now() - (entry.startedAt ?? 0) > CANCEL_BTN_MAX_LIFETIME_MS ? "24h ceiling"
+                            : null;
+                if (reason) {
+                    this.logger.info({ instanceName, messageId: entry.messageId, reason }, "Cancel button backstop retiring");
                     this.retireButton(entry);
+                    return;
                 }
+                // Still looks busy. The daemon only broadcasts on transitions, so ask for
+                // a fresh snapshot — a live daemon's answer refreshes receivedAt and keeps
+                // the staleness check honest; a dead one's silence is the evidence.
+                this.instanceIpcClients.get(instanceName)?.send({
+                    type: "query_instance_state", requestId: `cancel-btn-${Date.now()}`,
+                });
             }, CANCEL_BTN_IDLE_CHECK_INTERVAL_MS);
             this.cancelButtons.set(sent.messageId, entry);
+            // Only now: at most one button per instance, but never zero. Covers both
+            // the previous turn's button and any button a concurrent
+            // sendCancelButton posted while we were awaiting notifyAlert.
+            for (const other of [...this.cancelButtons.values()]) {
+                if (other.instanceName === instanceName && other.messageId !== sent.messageId) {
+                    this.retireButton(other);
+                }
+            }
+            this.persistCancelButtons();
             this.logger.info({ instanceName, messageId: sent.messageId }, "Cancel button sent");
         }
         catch (e) {
             this.logger.warn({ err: e.message, instanceName }, "Failed to send cancel button");
         }
     }
+    /**
+     * The cancel button's text for a given elapsed time.
+     *
+     * Below the threshold it keeps the original wording, so a normal quick answer
+     * looks exactly as it did before. Past it, the button doubles as the live
+     * progress indicator (#409) — the channel showed nothing at all during long work,
+     * and once the agent had replied once there was no sign it was still going.
+     */
+    static progressText(elapsedMs, activity, minElapsedMs = PROGRESS_MIN_ELAPSED_MS) {
+        if (elapsedMs < minElapsedMs)
+            return "👀 處理中…";
+        const totalSeconds = Math.floor(elapsedMs / 1000);
+        const minutes = Math.floor(totalSeconds / 60);
+        const seconds = totalSeconds % 60;
+        const elapsed = minutes >= 60
+            ? `${Math.floor(minutes / 60)}h ${minutes % 60}m`
+            : `${minutes}m ${String(seconds).padStart(2, "0")}s`;
+        const detail = FleetManager.sanitizeActivity(activity);
+        return detail
+            ? `⏳ 處理中… (已進行 ${elapsed} · ${detail})`
+            : `⏳ 處理中… (已進行 ${elapsed})`;
+    }
+    /**
+     * Make a tool summary safe to paste into a channel message.
+     *
+     * The text is agent-controlled (it is built from tool inputs — file paths,
+     * shell commands), so it gets flattened to one line, capped, and stripped of
+     * the two Discord mass-mention triggers. Neither channel renders it with a
+     * parse mode, so no markup escaping is needed beyond that.
+     */
+    static sanitizeActivity(activity) {
+        if (!activity)
+            return null;
+        const flat = activity.replace(/\s+/g, " ").replace(/@(everyone|here)/g, "@​$1").trim();
+        if (!flat)
+            return null;
+        return flat.length > PROGRESS_ACTIVITY_MAX_CHARS
+            ? `${flat.slice(0, PROGRESS_ACTIVITY_MAX_CHARS - 1)}…`
+            : flat;
+    }
+    /**
+     * Remember what an instance is currently doing, for the progress line.
+     *
+     * Best-effort by design: only backends that expose a live activity feed report
+     * anything, and the progress line simply omits the detail for the rest. It is
+     * never used to decide anything — purely what the user is shown.
+     */
+    cacheInstanceActivity(name, activity) {
+        if (activity)
+            this.instanceActivity.set(name, activity);
+        else
+            this.instanceActivity.delete(name);
+    }
+    /**
+     * Refresh the button's text in place while the instance keeps working.
+     *
+     * Uses `editAlert`, NOT `editMessage`: on Telegram the latter omits reply_markup,
+     * and the Bot API treats that as "clear the keyboard" — so editing with it would
+     * delete the very cancel button this is trying to keep alive.
+     */
+    /** Configured threshold before elapsed time appears, in ms. */
+    progressMinElapsedMs() {
+        const seconds = this.fleetConfig?.defaults
+            ?.progress_min_elapsed;
+        if (typeof seconds === "number" && Number.isFinite(seconds) && seconds >= 0) {
+            return seconds * 1000;
+        }
+        return PROGRESS_MIN_ELAPSED_MS;
+    }
+    startProgressTicker(entry) {
+        const tick = () => {
+            if (!this.cancelButtons.has(entry.messageId)) {
+                clearInterval(entry.progressTimer);
+                return;
+            }
+            const text = FleetManager.progressText(Date.now() - (entry.startedAt ?? Date.now()), this.instanceActivity.get(entry.instanceName), this.progressMinElapsedMs());
+            if (text === entry.lastProgressText)
+                return; // nothing changed — skip the API call
+            const adapter = this.getAdapterForInstance(entry.instanceName) ?? this.adapter;
+            if (!adapter?.editAlert)
+                return;
+            entry.lastProgressText = text;
+            adapter.editAlert(entry.chatId, entry.messageId, {
+                type: "cancel",
+                instanceName: entry.instanceName,
+                message: text,
+                choices: [{ id: `cancel:${entry.instanceName}`, label: t("cancel.button") }],
+            }, entry.threadId ? { threadId: entry.threadId } : undefined)
+                .catch(err => {
+                // A failed progress edit must never escalate: the button still works and
+                // the next tick retries. Common causes are a deleted message or a
+                // rate limit.
+                this.logger.debug({ err, instanceName: entry.instanceName }, "Progress edit failed");
+            });
+        };
+        entry.progressTimer = setInterval(tick, PROGRESS_UPDATE_INTERVAL_MS);
+        entry.progressTimer.unref?.();
+        // One extra tick right when the threshold passes, so a 30s threshold shows
+        // time at ~30s instead of waiting for the first 60s interval. Costs at most
+        // one additional edit per turn that lives past the threshold.
+        const firstAt = this.progressMinElapsedMs() - (Date.now() - (entry.startedAt ?? Date.now()));
+        if (firstAt > 0 && firstAt < PROGRESS_UPDATE_INTERVAL_MS) {
+            const firstTick = setTimeout(tick, firstAt);
+            firstTick.unref?.();
+        }
+    }
+    /**
+     * After a reply: give the instance REPLY_RETIRE_GRACE_MS to resume working; if
+     * it has not, retire its button. Re-arming replaces the previous timer, so a
+     * burst of replies ends with exactly one pending check.
+     */
+    armReplyGrace(instanceName) {
+        for (const entry of this.cancelButtons.values()) {
+            if (entry.instanceName !== instanceName)
+                continue;
+            if (entry.replyGraceTimer)
+                clearTimeout(entry.replyGraceTimer);
+            entry.replyGraceTimer = setTimeout(() => {
+                entry.replyGraceTimer = undefined;
+                if (!this.cancelButtons.has(entry.messageId))
+                    return;
+                if (!this.getInstanceIdle(instanceName))
+                    return; // resumed — a long run keeps its button
+                this.logger.info({ instanceName, messageId: entry.messageId }, "Cancel button retired — no work resumed after reply");
+                this.retireButton(entry);
+            }, REPLY_RETIRE_GRACE_MS);
+            entry.replyGraceTimer.unref?.();
+        }
+    }
     /** Retire (delete) every cancel button belonging to an instance. */
     retireInstanceButtons(instanceName) {
         // Snapshot first — retireButton may delete entries from the map on success.
@@ -3625,7 +4441,70 @@ export class FleetManager {
             clearTimeout(entry.retryTimer);
         if (entry.idleCheckTimer)
             clearInterval(entry.idleCheckTimer);
+        if (entry.progressTimer)
+            clearInterval(entry.progressTimer);
+        if (entry.replyGraceTimer)
+            clearTimeout(entry.replyGraceTimer);
         this.cancelButtons.delete(entry.messageId);
+        this.persistCancelButtons();
+    }
+    /**
+     * Mirror the live buttons to disk. The map is memory-only, so before this a
+     * fleet restart orphaned every button on screen: frozen "處理中…" text and a
+     * click that did nothing, forever. The ledger is tiny (a handful of rows) and
+     * written on every add/remove — no debounce needed at that rate.
+     */
+    persistCancelButtons() {
+        try {
+            const rows = [...this.cancelButtons.values()].map(e => ({
+                instanceName: e.instanceName,
+                adapterId: e.adapterId,
+                chatId: e.chatId,
+                messageId: e.messageId,
+                threadId: e.threadId,
+            }));
+            writeFileSync(join(this.dataDir, CANCEL_BTN_LEDGER_FILE), JSON.stringify(rows));
+        }
+        catch (err) {
+            this.logger.debug({ err }, "Cancel button ledger write failed");
+        }
+    }
+    /**
+     * Delete the previous process's buttons. Runs once adapters are up: nothing
+     * from a previous fleet process can still be mid-turn from this process's
+     * point of view, so every ledger row is an orphan by definition.
+     */
+    async sweepOrphanedCancelButtons() {
+        const ledgerPath = join(this.dataDir, CANCEL_BTN_LEDGER_FILE);
+        let rows;
+        try {
+            if (!existsSync(ledgerPath))
+                return;
+            rows = JSON.parse(readFileSync(ledgerPath, "utf-8"));
+        }
+        catch {
+            try {
+                unlinkSync(ledgerPath);
+            }
+            catch { /* corrupt ledger — drop it */ }
+            return;
+        }
+        for (const row of rows) {
+            const adapter = (row.adapterId ? this.worlds.get(row.adapterId)?.adapter : undefined)
+                ?? this.getAdapterForInstance?.(row.instanceName) ?? this.adapter;
+            if (!adapter?.deleteMessage)
+                continue;
+            try {
+                await adapter.deleteMessage(row.chatId, row.messageId, row.threadId);
+                this.logger.info({ instanceName: row.instanceName, messageId: row.messageId }, "Swept orphaned cancel button from previous run");
+            }
+            catch (err) {
+                // Best effort: the message may already be gone, or too old to delete.
+                this.logger.debug({ err, messageId: row.messageId }, "Orphaned cancel button sweep failed");
+            }
+        }
+        // The current process owns the ledger from here on.
+        this.persistCancelButtons();
     }
     /** Re-attempt a failed button delete up to CANCEL_BTN_MAX_RETRIES times. */
     scheduleButtonRetry(entry, err) {
@@ -4290,6 +5169,12 @@ When users create specialized instances, suggest these configurations:
                 meta.image_path = saves[saves.length - 1][1].split(",")[0].trim();
             }
         }
+        // Classic channels queue reactions like everyone else (#432 stored them, but
+        // this path never attached them — reactions in a ClassicBot channel went into
+        // the DB and were never seen again). Same contract as the topic paths:
+        // consumed only after the delivery succeeded.
+        const reactions = this.pendingReactionsMeta(instanceName);
+        Object.assign(meta, reactions.meta);
         try {
             await this.deliverToInstance(instanceName, {
                 type: "fleet_inbound",
@@ -4297,6 +5182,7 @@ When users create specialized instances, suggest these configurations:
                 targetSession: instanceName,
                 meta,
             });
+            reactions.consume();
         }
         catch (err) {
             this.logger.warn({ err: err.message, instanceName }, "Classic wake/delivery failed");
@@ -4435,6 +5321,170 @@ When users create specialized instances, suggest these configurations:
         return env?.models ?? [];
     }
     /** `/model` slash handler (admin only). No arg → DC menu; `/model <name>` → apply directly. */
+    /** Label an effort choice, marking the one currently configured. */
+    effortChoiceLabel(level, current) {
+        return level === current ? `✓ ${level}` : level;
+    }
+    effortMenuHeader(instanceName) {
+        const { effort, source } = this.resolveInstanceEffort(instanceName);
+        if (!effort)
+            return "Current effort: (CLI default)";
+        return source === "fleet-default"
+            ? `Current effort: ${effort} (fleet default)`
+            : `Current effort: ${effort}`;
+    }
+    /** `/effort` — DC Select Menu, or apply directly when a level is given. */
+    async handleEffortSlash(data, adapterId) {
+        if (!this.isModelAdmin(data.userId, data.channelId, adapterId)) {
+            await data.respond(t("permission.denied"));
+            return;
+        }
+        const name = this.resolveSlashTarget(data.channelId, adapterId);
+        if (!name) {
+            await data.respond(t("classic.no_agent"));
+            return;
+        }
+        const requested = (typeof data.options?.level === "string" ? data.options.level.trim() : "")
+            || (data.text?.trim() ?? "");
+        if (requested) {
+            await data.respond(await this.applyEffort(name, requested));
+            return;
+        }
+        const levels = this.effortLevelsFor(name);
+        if (levels.length === 0) {
+            await data.respond(`❌ ${this.backendNameForInstance(name)} has no reasoning-effort setting.`);
+            return;
+        }
+        if (!data.respondChoices) {
+            await data.respond(`Usage: /effort <${levels.join("|")}>`);
+            return;
+        }
+        const current = this.resolveInstanceEffort(name).effort;
+        const nonce = randomBytes(6).toString("hex");
+        const choices = levels.map(l => ({
+            id: `${EFFORT_SELECT_CALLBACK_PREFIX}${nonce}:${l}`,
+            label: this.effortChoiceLabel(l, current),
+        }));
+        const timer = setTimeout(() => this.pendingEffortSelects.delete(nonce), CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
+        timer.unref?.();
+        this.pendingEffortSelects.set(nonce, { instanceName: name, userId: data.userId, channelId: data.channelId, timer, respond: data.respond });
+        try {
+            await data.respondChoices(`${this.effortMenuHeader(name)}\nSelect a new effort level:`, choices);
+        }
+        catch (err) {
+            this.pendingEffortSelects.delete(nonce);
+            clearTimeout(timer);
+            this.logger.warn({ err, instanceName: name }, "effort menu failed");
+            await data.respond(`Usage: /effort <${levels.join("|")}>`);
+        }
+    }
+    /** TG inline-keyboard effort menu. Returns null on success, else a fallback string. */
+    async promptEffortMenu(instanceName, userId, channelId, adapter, chatId, threadId) {
+        const levels = this.effortLevelsFor(instanceName);
+        if (levels.length === 0) {
+            return `❌ ${this.backendNameForInstance(instanceName)} has no reasoning-effort setting.`;
+        }
+        const current = this.resolveInstanceEffort(instanceName).effort;
+        const nonce = randomBytes(6).toString("hex");
+        const choices = levels.map(l => ({
+            id: `${EFFORT_SELECT_CALLBACK_PREFIX}${nonce}:${l}`,
+            label: this.effortChoiceLabel(l, current),
+        }));
+        const respond = async (text) => {
+            await adapter.sendText(chatId, text, { threadId });
+            return undefined;
+        };
+        const timer = setTimeout(() => {
+            const p = this.pendingEffortSelects.get(nonce);
+            if (p) {
+                this.pendingEffortSelects.delete(nonce);
+                p.respond("⏰ Effort selection expired.").catch(() => { });
+            }
+        }, CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
+        timer.unref?.();
+        this.pendingEffortSelects.set(nonce, { instanceName, userId, channelId, timer, respond, adapter, adapterChatId: chatId, adapterThreadId: threadId });
+        try {
+            const menuMessageId = await adapter.promptUser(chatId, `${this.effortMenuHeader(instanceName)}\nSelect a new effort level:`, choices, { threadId });
+            const pending = this.pendingEffortSelects.get(nonce);
+            if (pending)
+                pending.menuMessageId = menuMessageId;
+            return null;
+        }
+        catch (err) {
+            this.pendingEffortSelects.delete(nonce);
+            clearTimeout(timer);
+            this.logger.warn({ err, instanceName }, "TG effort menu failed");
+            return `Usage: /effort <${levels.join("|")}>`;
+        }
+    }
+    /** Consume an `/effort` selection callback. Mirrors handleModelSelection. */
+    async handleEffortSelection(data) {
+        if (!data.callbackData.startsWith(EFFORT_SELECT_CALLBACK_PREFIX))
+            return false;
+        const match = data.callbackData.match(/^effort-select:([0-9a-f]+):(.+)$/);
+        if (!match)
+            return true;
+        const pending = this.pendingEffortSelects.get(match[1]);
+        if (!pending)
+            return true;
+        if (data.userId && data.userId !== pending.userId)
+            return true;
+        const cbChannel = data.threadId ?? data.chatId;
+        if (cbChannel !== pending.channelId && data.chatId !== pending.channelId)
+            return true;
+        this.pendingEffortSelects.delete(match[1]);
+        clearTimeout(pending.timer);
+        const level = match[2];
+        const progressText = `⏳ Setting ${pending.instanceName} effort to \`${level}\`…`;
+        let progressMsgId;
+        if (pending.adapter && pending.adapterChatId) {
+            const menuMessageId = pending.menuMessageId ?? data.messageId;
+            if (menuMessageId && pending.adapter.editMessageRemoveButtons) {
+                try {
+                    await pending.adapter.editMessageRemoveButtons(pending.adapterChatId, menuMessageId, progressText, pending.adapterThreadId);
+                    progressMsgId = menuMessageId;
+                }
+                catch { /* fall back to a new message */ }
+            }
+            if (!progressMsgId) {
+                try {
+                    const sent = await pending.adapter.sendText(pending.adapterChatId, progressText, { threadId: pending.adapterThreadId });
+                    progressMsgId = sent.messageId;
+                }
+                catch { /* non-fatal */ }
+            }
+        }
+        else {
+            await pending.respond(progressText).catch(() => { });
+        }
+        // Background-applied and guarded for the same reason as the model path: a
+        // restart backend respawns the instance here, and an unguarded rejection
+        // from a menu click must not take the fleet down.
+        void (async () => {
+            let result;
+            try {
+                result = await this.applyEffort(pending.instanceName, level);
+            }
+            catch (err) {
+                this.logger.error({ err, instance: pending.instanceName, level }, "Effort switch failed");
+                result = `Effort switch to \`${level}\` failed: ${err instanceof Error ? err.message : String(err)}`;
+            }
+            if (pending.adapter && pending.adapterChatId) {
+                if (progressMsgId) {
+                    pending.adapter.editMessage(pending.adapterChatId, progressMsgId, result, pending.adapterThreadId).catch(() => {
+                        pending.adapter.sendText(pending.adapterChatId, result, { threadId: pending.adapterThreadId }).catch(() => { });
+                    });
+                }
+                else {
+                    pending.adapter.sendText(pending.adapterChatId, result, { threadId: pending.adapterThreadId }).catch(() => { });
+                }
+            }
+            else {
+                await pending.respond(result).catch(() => { });
+            }
+        })();
+        return true;
+    }
     async handleModelSlash(data, adapterId) {
         if (!this.isModelAdmin(data.userId, data.channelId, adapterId)) {
             await data.respond(t("permission.denied"));
@@ -4571,9 +5621,19 @@ When users create specialized instances, suggest these configurations:
             // DC path: respond immediately with progress text
             await pending.respond(progressText).catch(() => { });
         }
-        // Apply model in background — don't await here (keeps callback handler fast)
+        // Apply model in background — don't await here (keeps callback handler fast).
+        // Guarded: applyModel() restarts the instance, and an unguarded rejection here
+        // meant a user picking from the /model menu could take the whole fleet down.
+        // On failure the user gets told, rather than the click silently doing nothing.
         void (async () => {
-            const result = await this.applyModel(pending.instanceName, model);
+            let result;
+            try {
+                result = await this.applyModel(pending.instanceName, model);
+            }
+            catch (err) {
+                this.logger.error({ err, instance: pending.instanceName, model }, "Model switch failed");
+                result = `Model switch to \`${model}\` failed: ${err instanceof Error ? err.message : String(err)}`;
+            }
             if (pending.adapter && pending.adapterChatId) {
                 if (progressMsgId) {
                     pending.adapter.editMessage(pending.adapterChatId, progressMsgId, result, pending.adapterThreadId).catch(() => {
@@ -4591,6 +5651,110 @@ When users create specialized instances, suggest these configurations:
         return true;
     }
     /** Apply a model to an instance: runtime paste (claude-code) or persist + restart (others). */
+    /** AgEnD's canonical effort ladder, low → max. Backends expose a subset. */
+    static EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
+    /** How this instance's backend applies an effort change. */
+    effortStrategyFor(instanceName) {
+        try {
+            const backend = createBackend(this.backendNameForInstance(instanceName), this.getInstanceDir(instanceName));
+            const strategy = backend.getEffortStrategy?.() ?? "unsupported";
+            // A backend claiming support but listing no levels is unusable either way.
+            return strategy !== "unsupported" && (backend.getEffortLevels?.() ?? []).length > 0
+                ? strategy
+                : "unsupported";
+        }
+        catch {
+            return "unsupported";
+        }
+    }
+    /** Effort levels this instance's backend actually accepts (empty = unsupported). */
+    effortLevelsFor(instanceName) {
+        try {
+            const backend = createBackend(this.backendNameForInstance(instanceName), this.getInstanceDir(instanceName));
+            if ((backend.getEffortStrategy?.() ?? "unsupported") === "unsupported")
+                return [];
+            return backend.getEffortLevels?.() ?? [];
+        }
+        catch {
+            return [];
+        }
+    }
+    /** Configured effort for an instance: per-instance, else fleet default, else none. */
+    resolveInstanceEffort(instanceName) {
+        const own = this.fleetConfig?.instances[instanceName]?.effort;
+        if (own)
+            return { effort: own, source: "instance" };
+        const fallback = this.fleetConfig?.defaults?.effort;
+        if (fallback)
+            return { effort: fallback, source: "fleet-default" };
+        return { effort: null, source: "unset" };
+    }
+    /**
+     * Clamp a canonical level to the nearest one this backend supports.
+     *
+     * Clamping DOWN the ladder, never up: asking for `max` on a CLI that stops at
+     * `high` should get high, not silently fall to low. The caller reports the
+     * clamp — a user who asks for max and quietly receives high has been told the
+     * request succeeded when it did not.
+     */
+    static clampEffort(level, supported) {
+        if (supported.includes(level))
+            return level;
+        const ladder = FleetManager.EFFORT_LEVELS;
+        const wanted = ladder.indexOf(level);
+        if (wanted < 0)
+            return null;
+        for (let i = wanted - 1; i >= 0; i--) {
+            if (supported.includes(ladder[i]))
+                return ladder[i];
+        }
+        return supported[0] ?? null;
+    }
+    /**
+     * Apply a reasoning-effort level, mirroring applyModel's shape.
+     *
+     * runtime backends take `/effort <level>` in the pane and keep working;
+     * restart backends only read it at launch, so it is persisted and the
+     * instance respawns.
+     */
+    async applyEffort(instanceName, requested) {
+        const level = requested.trim().toLowerCase();
+        const backendName = this.backendNameForInstance(instanceName);
+        let strategy = "unsupported";
+        let supported = [];
+        try {
+            const backend = createBackend(backendName, this.getInstanceDir(instanceName));
+            strategy = backend.getEffortStrategy?.() ?? "unsupported";
+            supported = backend.getEffortLevels?.() ?? [];
+        }
+        catch { /* treated as unsupported below */ }
+        if (strategy === "unsupported" || supported.length === 0) {
+            return `❌ ${backendName} has no reasoning-effort setting.`;
+        }
+        if (!FleetManager.EFFORT_LEVELS.includes(level)) {
+            return `❌ Unknown effort level \`${level}\`. Use: ${FleetManager.EFFORT_LEVELS.join(", ")}.`;
+        }
+        const applied = FleetManager.clampEffort(level, supported);
+        if (!applied)
+            return `❌ ${backendName} accepts none of the canonical effort levels.`;
+        const warn = applied === level
+            ? ""
+            : `⚠️ Clamped to \`${applied}\` (\`${level}\` not supported by ${backendName}).\n`;
+        // Persist either way: a runtime switch must survive the next respawn too,
+        // or the instance silently reverts on restart.
+        if (this.fleetConfig?.instances[instanceName]) {
+            this.fleetConfig.instances[instanceName].effort = applied;
+            this.saveFleetConfig();
+        }
+        if (strategy === "runtime") {
+            if (!this.instanceIpcClients.get(instanceName))
+                return `${warn}❌ ${instanceName} is not running.`;
+            this.pasteRawToClassicInstance(instanceName, `/effort ${applied}`);
+            return `${warn}✅ Set ${instanceName} effort to \`${applied}\` (runtime).`;
+        }
+        await this.restartSingleInstance(instanceName);
+        return `${warn}✅ Set ${instanceName} effort to \`${applied}\` and restarted.`;
+    }
     async applyModel(instanceName, model) {
         const backendName = this.backendNameForInstance(instanceName);
         let strategy = "restart";
@@ -4603,7 +5767,7 @@ When users create specialized instances, suggest these configurations:
             if (!this.instanceIpcClients.get(instanceName))
                 return `${warn}❌ ${instanceName} is not running.`;
             this.pasteRawToClassicInstance(instanceName, `/model ${model}`);
-            return `${warn}✅ Switched ${instanceName} to \`${model}\` (runtime).`;
+            return `${warn}✅ Switched ${instanceName} to \`${model}\` (runtime).${this.effortSuffix(instanceName)}`;
         }
         // restart: persist the model so the respawned CLI launches with it.
         let persisted = false;
@@ -4618,7 +5782,24 @@ When users create specialized instances, suggest these configurations:
         if (!persisted)
             return `${warn}❌ Could not set model for ${instanceName}.`;
         await this.restartSingleInstance(instanceName);
-        return `${warn}✅ Set ${instanceName} to \`${model}\` and restarted.`;
+        return `${warn}✅ Set ${instanceName} to \`${model}\` and restarted.${this.effortSuffix(instanceName)}`;
+    }
+    /**
+     * The trailing "Current effort: …" line for a /model reply.
+     *
+     * Model and effort interact (a cheaper model at max effort is a different
+     * trade than a bigger one at low), so showing the effort in force right after
+     * a switch saves the round trip of asking. Empty when the backend has none.
+     */
+    effortSuffix(instanceName) {
+        if (this.effortLevelsFor(instanceName).length === 0)
+            return "";
+        const { effort, source } = this.resolveInstanceEffort(instanceName);
+        if (!effort)
+            return "\nCurrent effort: (CLI default)";
+        return source === "fleet-default"
+            ? `\nCurrent effort: ${effort} (fleet default)`
+            : `\nCurrent effort: ${effort}`;
     }
     /** Read recent chat log for agent context */
     getRecentChatLog(instanceName, maxLines = 10) {
@@ -4811,7 +5992,7 @@ When users create specialized instances, suggest these configurations:
             ...(preTaskCommand ? { pre_task_command: preTaskCommand } : {}),
         };
         const topicMode = this.fleetConfig?.channel?.mode === "topic";
-        await this.startInstance(instanceName, config, topicMode);
+        await this.startInstance(instanceName, config, topicMode, "classic");
     }
     /** Handle /start slash command — register classic channel */
     async handleClassicStart(channelId, channelName, userId, guildId, adapterId, backend) {
@@ -4853,11 +6034,28 @@ When users create specialized instances, suggest these configurations:
         this.logger.info({ channelId, adapterId, instanceName: ch.instanceName }, "Classic channel stopped");
         return t("classic.stopped");
     }
-    async stopAll() {
+    /**
+     * Idempotent while in flight: SIGINT and SIGTERM share one handler and the
+     * uncaughtException path calls this too, so overlapping runs were possible —
+     * each snapshotting the daemon map and calling stop() on the same daemons
+     * concurrently. Deliberately NOT `async`, so callers receive the same promise
+     * object rather than a fresh wrapper around it. The latch clears when the run
+     * settles, so a later genuine stop (after a restart) still does the work.
+     */
+    stopAll() {
+        this.stopAllInFlight ??= this.doStopAll().finally(() => { this.stopAllInFlight = null; });
+        return this.stopAllInFlight;
+    }
+    stopAllInFlight = null;
+    async doStopAll() {
         this.startupComplete = false;
         this.reloadPending = false;
+        // Before anything is stopped: everything that dies from here on dies
+        // because we asked it to. Set synchronously — doStopAll runs to its first
+        // await in the same tick as the signal handler, so no event can slip in.
+        this.shuttingDown = true;
         this.ipcStoppingInstances.add("__fleet_stopping__");
-        sdNotify("STOPPING=1");
+        sdNotifyBlocking("STOPPING=1");
         if (this.watchdogTimer) {
             clearInterval(this.watchdogTimer);
             this.watchdogTimer = null;
@@ -4877,6 +6075,26 @@ When users create specialized instances, suggest these configurations:
             clearInterval(this.updateCheckTimer);
             this.updateCheckTimer = null;
         }
+        if (this.eventLogPruneTimer) {
+            clearInterval(this.eventLogPruneTimer);
+            this.eventLogPruneTimer = null;
+        }
+        if (this.logRotateTimer) {
+            clearInterval(this.logRotateTimer);
+            this.logRotateTimer = null;
+        }
+        // Cancel-button timers were never cleared here. The idle-check interval is not
+        // unref'd, so it held the event loop open past shutdown and kept retrying
+        // deletes against an adapter that was already gone.
+        for (const entry of [...this.cancelButtons.values()]) {
+            if (entry.retryTimer)
+                clearTimeout(entry.retryTimer);
+            if (entry.idleCheckTimer)
+                clearInterval(entry.idleCheckTimer);
+            if (entry.progressTimer)
+                clearInterval(entry.progressTimer);
+        }
+        this.cancelButtons.clear();
         if (this.topicCleanupTimer) {
             clearInterval(this.topicCleanupTimer);
             this.topicCleanupTimer = null;
@@ -5095,6 +6313,15 @@ When users create specialized instances, suggest these configurations:
                 removedRatio,
                 validationErrors: validation.errors,
             }, "Refusing unsafe fleet config reload; running configuration was kept");
+            // Tell the operator. A silently ignored config edit is the most confusing
+            // possible outcome: they change fleet.yaml, send SIGHUP, and nothing happens
+            // with no explanation anywhere they are looking.
+            const why = !validation.valid
+                ? `validation failed:\n${validation.errors.map(e => `• ${e.path}: ${e.message}`).join("\n")}`
+                : unsafeEmpty
+                    ? `it removed every instance (${oldCount} → 0)`
+                    : `it removed more than half the instances (${oldCount} → ${newCount})`;
+            this.notifyFleetError(`⚠️ fleet.yaml reload REJECTED — ${why}\nThe previous configuration is still running.`);
             return;
         }
         this.routing.rebuild(this.fleetConfig);
@@ -5294,10 +6521,20 @@ When users create specialized instances, suggest these configurations:
     // ── Update check ────────────────────────────────────────────────────
     async checkForUpdates() {
         try {
-            const { execSync } = await import("node:child_process");
+            // Both npm lookups are async: as execSync they froze the fleet event loop for
+            // up to 15s each, and on a beta build BOTH ran — 30s with no WATCHDOG ping,
+            // past WatchdogSec's half-interval and enough for systemd to SIGABRT the fleet
+            // for a background version check.
+            const { execFile } = await import("node:child_process");
+            const { promisify } = await import("node:util");
+            const execFileP = promisify(execFile);
+            const npmVersion = async (spec) => {
+                const { stdout } = await execFileP("npm", ["view", spec, "version"], { timeout: 15_000 });
+                return stdout.toString().trim();
+            };
             const pkgPath = join(dirname(fileURLToPath(import.meta.url)), "..", "package.json");
             const currentVersion = JSON.parse(readFileSync(pkgPath, "utf-8")).version ?? "0.0.0";
-            const latest = execSync("npm view @songsid/agend version", { stdio: "pipe", timeout: 15_000 }).toString().trim();
+            const latest = await npmVersion("@songsid/agend");
             let target = latest;
             if (currentVersion.includes("-beta")) {
                 // Beta users track the @beta channel (never fall back to @latest, which is
@@ -5305,7 +6542,7 @@ When users create specialized instances, suggest these configurations:
                 // of beta/latest is the newest.
                 let beta = "";
                 try {
-                    beta = execSync("npm view @songsid/agend@beta version", { stdio: "pipe", timeout: 15_000 }).toString().trim();
+                    beta = await npmVersion("@songsid/agend@beta");
                 }
                 catch { /* no beta tag */ }
                 target = beta || latest;
@@ -5412,6 +6649,10 @@ When users create specialized instances, suggest these configurations:
                 // /view routes accept the read-only view.token (or web.token) and do
                 // their own per-method auth in view-api.ts — skip the web-token gate.
             }
+            else if (isUsagePath(new URL(req.url ?? "/", `http://localhost:${port}`).pathname)) {
+                // /api/ai-usage is read-only GET data for the /view Usage panel — open
+                // like the other /view data routes (usage-api.ts rejects non-GET).
+            }
             else {
                 // All other endpoints require a valid token (query ?token= or X-Agend-Token header).
                 // /ui/* will also re-check in web-api.ts, which is harmless.
@@ -5426,34 +6667,34 @@ When users create specialized instances, suggest these configurations:
                 }
             }
             if (req.method === "GET" && req.url === "/health") {
-                const instanceCount = this.fleetConfig?.instances
-                    ? Object.keys(this.fleetConfig.instances).length
-                    : 0;
-                res.writeHead(200);
-                res.end(JSON.stringify({
-                    status: "ok",
-                    instances: instanceCount,
-                    uptime: Math.floor((Date.now() - this.startedAt) / 1000),
-                }));
+                const health = this.getFleetHealth();
+                // 503 when the fleet cannot do its job, so an external monitor sees it.
+                // This used to always answer 200 "ok" with a count of CONFIGURED instances,
+                // so every agent could be dead and every adapter down and it still looked
+                // green.
+                res.writeHead(health.status === "ok" ? 200 : 503);
+                res.end(JSON.stringify(health));
                 return;
             }
             if (req.method === "GET" && req.url === "/status") {
                 const instances = Object.keys(this.fleetConfig?.instances ?? {}).map(name => {
                     const statusFile = join(this.getInstanceDir(name), "statusline.json");
-                    let context_pct = 0;
                     let cost = 0;
                     try {
                         const data = JSON.parse(readFileSync(statusFile, "utf-8"));
-                        context_pct = data.context_window?.used_percentage ?? 0;
                         cost = data.cost?.total_cost_usd ?? 0;
                     }
                     catch (err) {
                         this.logger.debug({ err, name }, "statusline.json read failed (/status)");
                     }
+                    const backend = this.fleetConfig?.instances[name]?.backend
+                        ?? this.fleetConfig?.defaults?.backend
+                        ?? "claude-code";
+                    const { context } = resolveInstanceContext(this.dataDir, name, backend);
                     return {
                         name,
                         status: this.getInstanceStatus(name),
-                        context_pct,
+                        context_pct: context ?? 0,
                         cost,
                     };
                 });
@@ -5568,7 +6809,10 @@ When users create specialized instances, suggest these configurations:
                         res.writeHead(500);
                         res.end(JSON.stringify({ error: `Start failed: ${err.message}` }));
                     }
-                })();
+                    // The inner catch can itself throw (writeHead after a successful
+                    // writeHead is ERR_HTTP_HEADERS_SENT), and that rejection escapes the
+                    // IIFE. Same for the two handlers below.
+                })().catch(err => this.logger.error({ err, name }, "HTTP start handler failed"));
                 return;
             }
             // Instance restart (immediate, no idle wait)
@@ -5589,7 +6833,7 @@ When users create specialized instances, suggest these configurations:
                         res.writeHead(status);
                         res.end(JSON.stringify({ error: `Restart failed: ${err.message}` }));
                     }
-                })();
+                })().catch(err => this.logger.error({ err, name }, "HTTP restart handler failed"));
                 return;
             }
             if (req.method === "POST" && req.url?.startsWith("/stop/")) {
@@ -5612,7 +6856,7 @@ When users create specialized instances, suggest these configurations:
                         res.writeHead(500);
                         res.end(JSON.stringify({ error: `Stop failed: ${err.message}` }));
                     }
-                })();
+                })().catch(err => this.logger.error({ err, name }, "HTTP stop handler failed"));
                 return;
             }
             // ── Agent CLI endpoint ─────
@@ -5624,6 +6868,8 @@ When users create specialized instances, suggest these configurations:
             const url = new URL(req.url ?? "/", `http://localhost:${port}`);
             if (handleViewRequest(req, res, url, this))
                 return;
+            if (handleUsageRequest(req, res, url, this))
+                return;
             if (handleSettingsRequest(req, res, url, this))
                 return;
             if (handleWebRequest(req, res, url, this))
@@ -5670,20 +6916,35 @@ When users create specialized instances, suggest these configurations:
         this.logger.info({ url: `http://localhost:${port}/view?token=${this.viewToken}` }, "Web View available");
     }
     getUiStatus() {
-        const instances = Object.keys(this.fleetConfig?.instances ?? {}).map(name => {
+        const fleetNames = Object.keys(this.fleetConfig?.instances ?? {});
+        // Classic rooms live only in classicBot.yaml — /api/profiles merges them into
+        // the View roster, but previously getUiStatus skipped them so context_pct was
+        // always 0 (live map miss → l?.context_pct ?? 0).
+        const classicOnly = (this.classicChannels?.getAll() ?? [])
+            .map(ch => ch.instanceName)
+            .filter(name => !fleetNames.includes(name));
+        const names = [...fleetNames, ...classicOnly];
+        const instances = names.map(name => {
             const statusFile = join(this.getInstanceDir(name), "statusline.json");
-            let context_pct = 0;
             let cost = 0;
             let model = "";
             try {
                 const data = JSON.parse(readFileSync(statusFile, "utf-8"));
-                context_pct = data.context_window?.used_percentage ?? 0;
                 cost = data.cost?.total_cost_usd ?? 0;
                 model = data.model?.display_name ?? "";
             }
             catch (err) {
                 this.logger.debug({ err, name }, "statusline.json read failed (getUiStatus)");
             }
+            // Align with /ctx: statusline for claude-code, pane scrape for kiro/grok/codex.
+            const classic = classicOnly.includes(name);
+            const backend = classic
+                ? this.classicChannels.getBackendByInstance(name, this.fleetConfig?.defaults?.backend)
+                : (this.fleetConfig?.instances[name]?.backend
+                    ?? this.fleetConfig?.defaults?.backend
+                    ?? "claude-code");
+            const { context } = resolveInstanceContext(this.dataDir, name, backend);
+            const context_pct = context ?? 0;
             return { name, status: this.getInstanceStatus(name), context_pct, cost, model };
         });
         return {