@songsid/agend 2.1.2-beta.8 → 2.1.2

package/dist/fleet-manager.js

@@ -4,7 +4,10 @@ import { createServer } from "node:http";
 import { join, dirname, basename } from "node:path";
 import { fileURLToPath } from "node:url";
 import { getAgendHome, ensureWorkspaceGit } from "./paths.js";
-import { sdNotify } from "./sd-notify.js";
+import { clearUpdateMarker, isUpdateInProgress } from "./update-marker.js";
+import { sdNotify, sdNotifyBlocking } from "./sd-notify.js";
+import { readFleetMemory } from "./process-memory.js";
+import { ReplyDeduper } from "./reply-dedup.js";
 import { isScalar, parseDocument } from "yaml";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -21,12 +24,12 @@ import { IpcClient } from "./channel/ipc-bridge.js";
 import { createAdapter } from "./channel/factory.js";
 import { createBackend } from "./backend/factory.js";
 import { isModelCompatible } from "./backend/types.js";
-import { createLogger } from "./logger.js";
+import { createLogger, rotateLogIfNeeded } from "./logger.js";
 import { processAttachments } from "./channel/attachment-handler.js";
 import { routeToolCall } from "./channel/tool-router.js";
 import { Scheduler } from "./scheduler/index.js";
 import { DEFAULT_SCHEDULER_CONFIG } from "./scheduler/index.js";
-import { TopicCommands, saveCommandForBackend, parseSaveFilename, parsePauseWakeCommand, SAVE_FILENAME_RE, SAVE_UNSUPPORTED_MSG } from "./topic-commands.js";
+import { TopicCommands, saveCommandForBackend, parseSaveFilename, parsePauseWakeCommand, SAVE_FILENAME_RE, SAVE_UNSUPPORTED_MSG, resolveInstanceContext, forgetInstanceContext } from "./topic-commands.js";
 import { DailySummary } from "./daily-summary.js";
 import { WebhookEmitter } from "./webhook-emitter.js";
 import { TmuxControlClient } from "./tmux-control.js";
@@ -38,6 +41,7 @@ import { StatuslineWatcher } from "./statusline-watcher.js";
 import { outboundHandlers } from "./outbound-handlers.js";
 import { handleWebRequest, broadcastSseEvent } from "./web-api.js";
 import { handleViewRequest, isViewPath } from "./view-api.js";
+import { handleUsageRequest, isUsagePath } from "./usage/usage-api.js";
 import { handleSettingsRequest } from "./settings-api.js";
 import { setLocale, detectLocale, t } from "./locale.js";
 import { handleAgentRequest } from "./agent-endpoint.js";
@@ -45,6 +49,10 @@ import { ClassicChannelManager, getClassicBackendChoices, isSelectableClassicBac
 import { validateFleetConfig } from "./config-validator.js";
 import { readLastInboundAt } from "./daemon.js";
 import { clearPausedMarker } from "./pause-marker.js";
+import { releaseProcessFleetLock } from "./fleet-lock.js";
+import { GENERAL_PAUSE_ERROR, isGeneralInstance } from "./general-instance.js";
+import { loadOrCreateWebToken, WEB_TOKEN_INVALID_MESSAGE } from "./web-auth.js";
+import { RestartProgress } from "./restart-progress.js";
 import { getTmuxSession } from "./config.js";
 export function resolveReplyThreadId(argsThreadId, instanceConfig) {
     if (typeof argsThreadId === "string" && argsThreadId.length > 0) {
@@ -83,9 +91,80 @@ const CANCEL_BTN_MAX_RETRIES = 3;
  * buttons no clear trigger reached (e.g. a scheduled/HTTP turn that never called
  * reply). 5min (not the old 2s idle-watch) so Thinking isn't misread as idle. */
 const CANCEL_BTN_IDLE_CHECK_INTERVAL_MS = 5 * 60_000;
+/**
+ * A queued turn can produce a very short idle edge while the CLI hands off to
+ * the next message. Do not retire the cancel button until that edge remains
+ * idle for this long; a working/stuck report during the grace cancels it.
+ */
+const CANCEL_BTN_IDLE_RETIRE_GRACE_MS = 2_000;
+/**
+ * How long after a reply an instance gets to resume working before its cancel
+ * button is retired. A short turn ends with a reply and never works again → the
+ * button disappears ~2 minutes after the answer. A multi-step run replies
+ * mid-flight and keeps going → the grace check sees "working" and leaves the
+ * button alone (the idle edge retires it when the run really ends).
+ */
+const REPLY_RETIRE_GRACE_MS = 2 * 60_000;
+/**
+ * The daemon only broadcasts execution state on TRANSITIONS, so a long
+ * single-state run sends nothing for hours. The idle backstop therefore pokes a
+ * query each tick; a live daemon answers within milliseconds and refreshes the
+ * cache. When nothing has refreshed it for this long despite those pokes, the
+ * reporting chain (daemon, IPC, or state monitor) is dead and a "working" state
+ * from 30 minutes ago proves nothing — the button may be retired.
+ */
+const STATE_REPORT_STALE_MS = 30 * 60_000;
+/**
+ * Unconditional ceiling on a cancel button's life. Deliberately far beyond any
+ * legitimate run (multi-hour tasks are normal on this fleet): everything below
+ * this is decided by real state; a button that somehow survives a full day is
+ * wreckage, stuck or not.
+ */
+const CANCEL_BTN_MAX_LIFETIME_MS = 24 * 60 * 60_000;
+/** A click on a button the fleet no longer tracks may fire at most this often. */
+const STALE_CANCEL_CLICK_COOLDOWN_MS = 10_000;
+/** Orphaned-button ledger, swept at startup. Lives in the fleet data dir. */
+const CANCEL_BTN_LEDGER_FILE = "cancel-buttons.json";
+/**
+ * How often the cancel button's text is refreshed with elapsed working time.
+ *
+ * One edit per working instance per interval — at 60s that is trivial for both
+ * platforms' rate limits, and it reads as a live counter rather than a stale
+ * snapshot. Nothing new is posted, so the channel is never spammed: there is
+ * exactly one progress message per turn, and it is the cancel button itself.
+ */
+const PROGRESS_UPDATE_INTERVAL_MS = 60_000;
+/** Elapsed time is only shown once work has clearly outlasted a quick answer. */
+/**
+ * Default delay before the button starts showing elapsed time. Configurable via
+ * `defaults.progress_min_elapsed` (seconds) in fleet.yaml. 30s is the balance
+ * point: most quick answers finish inside it (no churn for ordinary turns),
+ * while anything real shows signs of life well before the old two minutes.
+ */
+const PROGRESS_MIN_ELAPSED_MS = 30_000;
+/** How much of a tool summary the progress line will show before eliding. */
+const PROGRESS_ACTIVITY_MAX_CHARS = 48;
+/**
+ * Emoji AgEnD itself stamps on messages as the delivery-status ladder
+ * (⏳ queued, 👀 delivered, ✅ confirmed, ❌ failed). These are machine
+ * indicators, not opinions, so they never enter the reactions queue — from
+ * anyone. This exact-emoji filter is the ONLY bot filtering left: bot-to-bot
+ * reactions are otherwise delivered on purpose (agents signal each other), and
+ * 🫡 passes too — it reads as a deliberate acknowledgement, not plumbing.
+ */
+const DELIVERY_STATUS_EMOJIS = new Set(["👀", "⏳", "✅", "❌"]);
+/**
+ * How long a delivery waits out a disconnected instance IPC before giving up.
+ *
+ * Sized for a daemon restart (socket close → respawn → CLI ready), which is the
+ * event this exists for. Past it the delivery fails loudly as it always did.
+ */
+const IPC_RECONNECT_GRACE_MS = 30_000;
+const IPC_RECONNECT_POLL_MS = 250;
 const CLASSIC_BACKEND_SELECTION_TIMEOUT_MS = 60_000;
 const CLASSIC_BACKEND_CALLBACK_PREFIX = "classic-backend:";
 const MODEL_SELECT_CALLBACK_PREFIX = "model-select:";
+const EFFORT_SELECT_CALLBACK_PREFIX = "effort-select:";
 const CLI_ENV_TTL_MS = 24 * 60 * 60 * 1000; // /model reads cached CLI env within 24h
 export class FleetManager {
     dataDir;
@@ -93,7 +172,7 @@ export class FleetManager {
     static sighupHandlerInstalled = false;
     children = new Map();
     lifecycle;
-    /** @deprecated Use lifecycle.daemons — kept for backward compat */
+    /** Live view of lifecycle.daemons — used throughout; not deprecated. */
     get daemons() { return this.lifecycle.daemons; }
     fleetConfig = null;
     rawFleetConfig = {};
@@ -108,8 +187,11 @@ export class FleetManager {
     // same guild both receive every message). Bounded FIFO of recent message keys.
     recentMessageIds = new Set();
     accessManager = null;
-    /** Primary world (first adapter) — used for fleet-level notifications */
-    get primaryWorld() { return this.worlds.values().next().value; }
+    /** Primary world (channels[0]), independent of concurrent adapter startup order. */
+    get primaryWorld() {
+        const adapterId = this.getPrimaryAdapterId();
+        return adapterId ? this.worlds.get(adapterId) : undefined;
+    }
     routing = new RoutingEngine();
     get routingTable() { return this.routing.map; }
     instanceIpcClients = new Map();
@@ -151,6 +233,16 @@ export class FleetManager {
     // reply, on cancel, or when a newer button supersedes it for the same
     // instance. Per-button tracking means a failed delete never strands a button.
     cancelButtons = new Map();
+    /** Pending idle-edge retirement, one timer per instance. */
+    cancelButtonIdleRetireTimers = new Map();
+    /** Duplicate-reply suppression across both the MCP and HTTP reply paths. */
+    replyDeduper = new ReplyDeduper();
+    /** instanceName → what it is doing right now, when the backend can tell us. */
+    instanceActivity = new Map();
+    /** instanceName → tail of deliveries waiting for its IPC to come back. */
+    ipcWaitTails = new Map();
+    /** instanceName → restart currently executing; concurrent callers join it. */
+    restartsInFlight = new Map();
     // Last user message delivered to each instance — used to react ✅ on completion.
     lastInboundMsg = new Map();
     topicArchiver;
@@ -158,11 +250,17 @@ export class FleetManager {
     classicChannels = null;
     pendingClassicStarts = new Map();
     /** In-flight /model selections, keyed by nonce (see handleModelSelection). */
+    /** In-flight /effort selections, same coordinator shape as pendingModelSelects. */
+    pendingEffortSelects = new Map();
     pendingModelSelects = new Map();
     // Model failover state
     failoverActive = new Map(); // instance → current failover model
     // IPC reconnect: tracks instances being intentionally stopped (skip reconnect)
+    /** instance → when a click with no live button entry last fired a cancel. */
+    staleCancelClickAt = new Map();
     ipcStoppingInstances = new Set();
+    /** Set the moment a graceful stop begins — see isPlannedRestart(). */
+    shuttingDown = false;
     /** Coalesce concurrent connection attempts for the same daemon socket. */
     ipcConnectInFlight = new Map();
     /** At most one reconnect/backoff loop may exist per instance. */
@@ -176,6 +274,10 @@ export class FleetManager {
     healthServer = null;
     healthPortRetried = false;
     updateCheckTimer = null;
+    eventLogPruneTimer = null;
+    logRotateTimer = null;
+    /** Days of event/activity history to keep. */
+    static EVENT_LOG_RETENTION_DAYS = 30;
     watchdogTimer = null;
     startedAt = 0;
     // Mirror topic: buffer cross-instance messages, flush every 3s
@@ -185,6 +287,7 @@ export class FleetManager {
     sseClients = new Set();
     webToken = null;
     viewToken = null;
+    healthServerListening = false;
     constructor(dataDir) {
         this.dataDir = dataDir;
         FleetManager.signalTarget = this;
@@ -214,7 +317,13 @@ export class FleetManager {
         }
         this.reloadPending = false;
         this.reconcileInFlight = this.reconcileInstances()
-            .catch(err => this.logger.error({ err }, "SIGHUP config reload failed"))
+            .catch(err => {
+            // Almost always a YAML parse error. Log-only meant the user edited
+            // fleet.yaml, sent SIGHUP, and got no reaction and no explanation.
+            this.logger.error({ err }, "SIGHUP config reload failed");
+            const message = err instanceof Error ? err.message : String(err);
+            this.notifyFleetError(`⚠️ fleet.yaml reload FAILED — ${message}\nThe previous configuration is still running.`);
+        })
             .finally(() => {
             this.reconcileInFlight = null;
             if (this.reloadPending && this.startupComplete) {
@@ -222,16 +331,55 @@ export class FleetManager {
             }
         });
     }
+    /**
+     * Is the fleet going down (or coming back up) on purpose?
+     *
+     * Instances dying during a planned restart is the restart working, not an
+     * incident — but the code that notices a dead pane or a dead MCP server
+     * cannot tell the difference on its own. Two sources, because the noise
+     * starts before this process is even told to stop: `agend update` replaces
+     * the package on disk while this daemon is still running and still watching.
+     */
+    isPlannedRestart() {
+        return this.shuttingDown || isUpdateInProgress(this.dataDir);
+    }
     finishStartup() {
         this.startupComplete = true;
+        // We are the post-update fleet: the update is over by definition. Clearing
+        // it here (rather than in the update command, which exits before the new
+        // fleet is up) is what keeps the quiet window from outliving the restart.
+        clearUpdateMarker(this.dataDir);
         if (this.reloadPending)
             this.scheduleReconcile();
+        void this.sweepOrphanedCancelButtons();
     }
     // ── ArchiverContext bridge ────────────────────────────────────────────
     lastActivityMs(name) {
         return this.lastActivity.get(name) ?? 0;
     }
+    /**
+     * Is the instance between turns?
+     *
+     * Prefers the daemon's pane state machine (debounced, busy-pattern aware) over
+     * the control client's raw 2-second output-silence heuristic. The raw heuristic
+     * reads every >2s output lull as idle — and long silent tools (a build, a test
+     * run) or an LLM pause produce those constantly mid-turn. That misreading is
+     * what retired cancel buttons in the middle of long work (the 5-minute backstop
+     * fired during a lull) and froze their progress text (ticker skipped "idle"
+     * ticks). The silence heuristic remains only as the fallback for instances
+     * whose daemon has not reported a state yet.
+     */
     getInstanceIdle(name) {
+        // A daemon that is not running cannot be mid-turn. This is what a stale
+        // "working" cache after a hard daemon kill (SIGKILL/OOM — no IPC crash
+        // report ever arrives) must not override.
+        if (this.getInstanceStatus(name) !== "running")
+            return true;
+        const state = this.getInstanceExecutionState(name);
+        if (state === "working" || state === "stuck")
+            return false;
+        if (state === "idle")
+            return true;
         try {
             const widFile = join(this.getInstanceDir(name), "window-id");
             if (!existsSync(widFile))
@@ -243,6 +391,18 @@ export class FleetManager {
             return true;
         }
     }
+    /**
+     * True when the instance claims working/stuck but nothing has refreshed that
+     * claim for STATE_REPORT_STALE_MS despite the backstop's per-tick queries.
+     * Measures the CACHE's age, not the button's — a healthy multi-hour run
+     * answers every query and never trips this.
+     */
+    stateReportDead(name) {
+        const cached = this.instanceStateCache.get(name);
+        if (!cached)
+            return false; // no claim to distrust — getInstanceIdle owns this case
+        return Date.now() - cached.receivedAt > STATE_REPORT_STALE_MS;
+    }
     // ── LifecycleContext bridge methods ──────────────────────────────────────
     webhookEmit(event, name, data) {
         this.webhookEmitter?.emit(event, name, data);
@@ -304,10 +464,20 @@ export class FleetManager {
         if (!this.classicChannels)
             return;
         const channels = this.classicChannels.getAll();
+        // Classic's persisted adapter is authoritative. Legacy adapter-less rows
+        // deterministically belong to channels[0], never to whichever bot happens
+        // to deliver the first message after startup/reconnect.
+        for (const ch of channels) {
+            const adapterId = ch.adapterId ?? this.getPrimaryAdapterId();
+            if (adapterId)
+                this.instanceWorldBinding.set(ch.instanceName, adapterId);
+        }
         // Always update adapter openChannels (including empty — clears stale entries on /stop)
         for (const [adapterId, w] of this.worlds) {
             if (typeof w.adapter?.setOpenChannels === "function") {
-                const owned = channels.filter(ch => ch.adapterId === adapterId).map(ch => ch.channelId);
+                const owned = channels
+                    .filter(ch => (ch.adapterId ?? this.getPrimaryAdapterId()) === adapterId)
+                    .map(ch => ch.channelId);
                 w.adapter.setOpenChannels(owned);
             }
         }
@@ -385,58 +555,113 @@ export class FleetManager {
     }
     /** Get the adapter bound to an instance, falling back to primary adapter */
     getAdapterForInstance(name) {
-        const worldId = this.instanceWorldBinding.get(name);
+        const worldId = this.getInstanceAdapterId(name);
         if (worldId)
             return this.worlds.get(worldId)?.adapter ?? this.adapter;
         return this.adapter;
     }
     /** Get the world for an instance */
     getWorldForInstance(name) {
-        const worldId = this.instanceWorldBinding.get(name);
-        return worldId ? this.worlds.get(worldId) : this.worlds.values().next().value;
+        const worldId = this.getInstanceAdapterId(name);
+        return worldId ? this.worlds.get(worldId) : undefined;
     }
     /** Get channel config for a specific adapter (by id), falling back to primary */
     getChannelConfig(adapterId) {
+        const channels = this.fleetConfig?.channels
+            ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
         if (adapterId) {
-            const world = this.worlds.get(adapterId);
-            if (world)
-                return world.channelConfig;
+            return channels.find(ch => (ch.id ?? ch.type) === adapterId)
+                ?? this.worlds.get(adapterId)?.channelConfig
+                ?? channels[0];
         }
-        return this.fleetConfig?.channel;
+        return channels[0];
     }
     /** Get the group_id for an instance's bound adapter */
     getGroupIdForInstance(name) {
-        const world = this.getWorldForInstance(name);
-        return world?.groupId ?? String(this.fleetConfig?.channel?.group_id ?? "");
+        const adapterId = this.getInstanceAdapterId(name);
+        const world = adapterId ? this.worlds.get(adapterId) : undefined;
+        return world?.groupId ?? String(this.getChannelConfig(adapterId)?.group_id ?? "");
+    }
+    /** Configured primary adapter id. Never infer this from Map insertion order. */
+    getPrimaryAdapterId() {
+        const primary = this.fleetConfig?.channels?.[0] ?? this.fleetConfig?.channel;
+        if (primary)
+            return primary.id ?? primary.type;
+        // Defensive compatibility for callers/tests that provide a live world but
+        // no channel config. Real multi-adapter fleets always have channels[].
+        return this.worlds.keys().next().value;
+    }
+    /** Warn when a coordinator's adapter identity is ambiguous to the operator. */
+    warnUnboundGeneralChannelIds(fleet) {
+        const channels = fleet.channels ?? (fleet.channel ? [fleet.channel] : []);
+        if (channels.length <= 1)
+            return;
+        const adapterIds = channels.map(ch => ch.id ?? ch.type);
+        for (const [name, config] of Object.entries(fleet.instances)) {
+            if (!config.general_topic || config.channel_id)
+                continue;
+            this.logger.warn({
+                instance: name,
+                defaultAdapter: adapterIds[0],
+                availableAdapters: adapterIds,
+            }, "General instance has no channel_id in a multi-channel fleet; defaulting to the first adapter. Set channel_id explicitly.");
+        }
+    }
+    /**
+     * Resolve the authoritative adapter identity for an instance.
+     * Fleet instances without channel_id and legacy Classic entries both belong
+     * to channels[0]. Runtime bindings remain available for external sessions.
+     */
+    getInstanceAdapterId(name) {
+        const cfg = this.fleetConfig?.instances[name];
+        if (cfg)
+            return cfg.channel_id ?? this.getPrimaryAdapterId();
+        if (this.classicChannels?.getChannelIdByInstance(name) !== undefined) {
+            return this.classicChannels.getAdapterIdByInstance(name) ?? this.getPrimaryAdapterId();
+        }
+        return this.instanceWorldBinding.get(name) ?? this.getPrimaryAdapterId();
     }
     /**
      * Bind an instance to a specific world (the bot that answers for it).
      * fromInbound=true (binding inferred from which adapter received a message)
-     * must not override a configured identity: skip when the instance is a general
-     * or has an explicit channel_id — otherwise a persona instance whose message
-     * was also seen by the main bot would get rebound to the wrong bot.
+     * must not override a configured identity. Fleet instances use channel_id or
+     * channels[0]; Classic instances use their persisted adapter (or channels[0]
+     * for a legacy entry). Only external sessions may bind from inbound traffic.
      */
     bindInstanceAdapter(name, adapterId, fromInbound = false) {
-        const cfg = this.fleetConfig?.instances[name];
         if (fromInbound) {
-            // Skip inbound-derived binding for any instance that doesn't have an
-            // explicit channel_id — those default to primary adapter deterministically.
-            // This prevents a non-deterministic race where whichever adapter delivers
-            // first after restart wins the binding.
-            if (cfg?.general_topic || cfg?.channel_id)
-                return;
-            if (cfg && !cfg.channel_id)
-                return; // fleet instance without explicit binding → use primary
-            // Classic instance: don't override an existing binding (authoritative from /start)
-            if (this.classicChannels?.getChannelIdByInstance(name) !== undefined && this.instanceWorldBinding.has(name))
+            const configuredId = this.getInstanceAdapterId(name);
+            if (this.fleetConfig?.instances[name]
+                || this.classicChannels?.getChannelIdByInstance(name) !== undefined) {
+                if (configuredId)
+                    this.instanceWorldBinding.set(name, configuredId);
                 return;
+            }
         }
         this.instanceWorldBinding.set(name, adapterId);
     }
     getInstanceStatus(name) {
         if (this.lifecycle.isPaused(name))
             return "paused";
+        const daemon = this.lifecycle.daemons.get(name);
         const processStatus = this.instanceProcessStatus.get(name);
+        // IPC can be disconnected during a respawn, so the event which announces
+        // the new live pane may be missed.  The in-process daemon is authoritative
+        // in that case; do not leave a stale `crashed` cache masking an instance
+        // that has already recovered and can answer messages.
+        const daemonStatus = daemon?.getProcessStatus?.();
+        if (daemonStatus === "running") {
+            if (processStatus)
+                this.instanceProcessStatus.delete(name);
+            // A recovered in-process daemon is also the authority for clearing a
+            // marker left by a crash-loop/reconnect race.  This keeps standalone
+            // `agend ls` from seeing the old marker after the next API outage.
+            try {
+                unlinkSync(join(this.getInstanceDir(name), "crash-state.json"));
+            }
+            catch { /* absent */ }
+            return "running";
+        }
         if (processStatus)
             return processStatus;
         const pidPath = join(this.getInstanceDir(name), "daemon.pid");
@@ -454,6 +679,10 @@ export class FleetManager {
     getInstanceExecutionState(name) {
         if (this.lifecycle.isPaused(name))
             return null;
+        // Process status wins over a stale pane snapshot. A dead remain-on-exit pane
+        // can still contain the old ready marker and must never surface as Idle.
+        if (this.instanceProcessStatus.has(name))
+            return null;
         return this.instanceStateCache.get(name)?.state ?? null;
     }
     isClassicInstance(name) {
@@ -471,22 +700,61 @@ export class FleetManager {
             unchangedForMs: numberOr(msg.unchangedForMs, previous?.unchangedForMs ?? 0),
             observedAt: numberOr(msg.observedAt, now),
             stateChangedAt: numberOr(msg.stateChangedAt, previous?.state === state ? previous.stateChangedAt : now),
+            // Fleet-manager receipt time, NOT the daemon's observation time: staleness
+            // asks "is anyone still reporting", which only the receiver can date.
+            receivedAt: now,
         });
         for (const check of this.instanceIdleWaiters.get(name) ?? [])
             check();
         // warm_cap: a fresh transition into idle may free this instance for eviction,
         // or (more usefully) reveal that the fleet is now over cap. Only fire on the
         // edge into idle, not on every idle heartbeat.
-        if (state === "idle" && previous?.state !== "idle")
+        if (state === "idle" && previous?.state !== "idle") {
             this.enforceWarmCap();
+            // A queued message may turn this edge back into working almost
+            // immediately. Give that handoff a short grace before retiring the button.
+            this.scheduleIdleButtonRetirement(name);
+        }
+        else if (state !== "idle") {
+            this.cancelIdleButtonRetirement(name);
+        }
+    }
+    cancelIdleButtonRetirement(name) {
+        const timer = this.cancelButtonIdleRetireTimers.get(name);
+        if (!timer)
+            return;
+        clearTimeout(timer);
+        this.cancelButtonIdleRetireTimers.delete(name);
+    }
+    scheduleIdleButtonRetirement(name) {
+        this.cancelIdleButtonRetirement(name);
+        const timer = setTimeout(() => {
+            // Ignore a superseded timer even if it was already queued to run.
+            if (this.cancelButtonIdleRetireTimers.get(name) !== timer)
+                return;
+            this.cancelButtonIdleRetireTimers.delete(name);
+            if (this.getInstanceExecutionState(name) === "idle") {
+                this.retireInstanceButtons(name);
+            }
+        }, CANCEL_BTN_IDLE_RETIRE_GRACE_MS);
+        timer.unref?.();
+        this.cancelButtonIdleRetireTimers.set(name, timer);
     }
     cacheInstanceProcessStatus(name, status) {
         if (status === "running") {
             this.instanceProcessStatus.delete(name);
+            // A prior crash-loop marker is one-shot.  Successful respawn is the
+            // authoritative recovery signal even when the marker outlived an IPC
+            // disconnect and was not consumed by a new Daemon constructor.
+            try {
+                unlinkSync(join(this.getInstanceDir(name), "crash-state.json"));
+            }
+            catch { /* absent */ }
             return;
         }
         if (status !== "crashed" && status !== "stopped")
             return;
+        this.cancelIdleButtonRetirement(name);
         this.instanceProcessStatus.set(name, status);
         // Never display the last ready prompt as current execution state after its
         // owning CLI process has exited.
@@ -517,7 +785,7 @@ export class FleetManager {
         const victims = selectLruEvictions(warm, cap, {
             exclude,
             isEvicting: name => this.warmCapEvicting.has(name),
-            isGeneral: name => this.fleetConfig?.instances[name]?.general_topic === true,
+            isGeneral: name => isGeneralInstance(this.fleetConfig, name),
             isIdle: name => this.getInstanceExecutionState(name) === "idle",
             lastInboundAt: name => readLastInboundAt(this.getInstanceDir(name)) ?? 0,
         });
@@ -583,12 +851,70 @@ export class FleetManager {
         if (!idle) {
             this.logger.warn({ instanceName, timeoutMs }, "Idle gate timed out; forcing delivery");
         }
-        const ipc = this.instanceIpcClients.get(instanceName);
-        if (!ipc?.connected)
-            throw new Error(`Instance '${instanceName}' IPC is unavailable`);
-        ipc.send(payload);
+        await this.sendWhenConnected(instanceName, payload);
         this.lastDeliveryAt.set(instanceName, Date.now());
     }
+    /**
+     * Hand a payload to an instance's IPC, waiting out a *transient* disconnect.
+     *
+     * A daemon that is restarting — `/restart`, crash recovery, a model switch —
+     * drops its socket for a few seconds. Any message arriving in that window used
+     * to fail instantly: the caller logged a warning, put ❌ on the user's message,
+     * and the message was gone. The user had to notice the ❌ and retype it. That is
+     * the "instance 訊息不容易掉" goal failing on the most predictable event there is.
+     *
+     * The wait is bounded. If the instance is genuinely down, this still throws and
+     * the ❌ still appears — just for a real failure rather than a restart.
+     *
+     * Ordering is preserved by serialising behind any waiter already queued for this
+     * instance, *including* when the socket happens to be up: otherwise a message
+     * arriving after the reconnect could overtake one that has been waiting for it.
+     */
+    async sendWhenConnected(instanceName, payload) {
+        const queued = this.ipcWaitTails.get(instanceName);
+        if (!queued) {
+            const ipc = this.instanceIpcClients.get(instanceName);
+            if (ipc?.connected && ipc.send(payload))
+                return;
+        }
+        const attempt = (queued ?? Promise.resolve())
+            .catch(() => { })
+            .then(() => this.sendAfterIpcReturns(instanceName, payload));
+        // The chain stores a settled-either-way promise so one failed delivery cannot
+        // wedge every later one, and so `queued` above is safe to await unguarded.
+        const tail = attempt.catch(() => { });
+        this.ipcWaitTails.set(instanceName, tail);
+        try {
+            await attempt;
+        }
+        finally {
+            // Only the last waiter clears the chain; while a queue is still draining the
+            // map must keep pointing at it or ordering is lost.
+            if (this.ipcWaitTails.get(instanceName) === tail) {
+                this.ipcWaitTails.delete(instanceName);
+            }
+        }
+    }
+    /** Poll for the instance's IPC to come back, then send. Throws if it does not. */
+    async sendAfterIpcReturns(instanceName, payload) {
+        const deadline = Date.now() + IPC_RECONNECT_GRACE_MS;
+        let warned = false;
+        for (;;) {
+            // Re-read every round: a reconnect replaces the IpcClient object entirely,
+            // so a cached reference would stay dead forever.
+            const ipc = this.instanceIpcClients.get(instanceName);
+            if (ipc?.connected && ipc.send(payload))
+                return;
+            if (Date.now() >= deadline) {
+                throw new Error(`Instance '${instanceName}' IPC is unavailable`);
+            }
+            if (!warned) {
+                warned = true;
+                this.logger.info({ instanceName }, "Instance IPC is down — holding delivery until it reconnects");
+            }
+            await new Promise(resolve => setTimeout(resolve, IPC_RECONNECT_POLL_MS));
+        }
+    }
     /** Single delivery facade: wake paused CLIs and serialize non-user work behind idle. */
     async deliverToInstance(instanceName, payload, options = {}) {
         const meta = payload.meta && typeof payload.meta === "object"
@@ -604,10 +930,7 @@ export class FleetManager {
                 await this.lifecycle.wake(instanceName, 30_000);
                 this.enforceWarmCap(instanceName); // woke one → evict a different LRU idle if over cap
             }
-            const ipc = this.instanceIpcClients.get(instanceName);
-            if (!ipc?.connected)
-                throw new Error(`Instance '${instanceName}' IPC is unavailable`);
-            ipc.send(payload);
+            await this.sendWhenConnected(instanceName, payload);
             // A cross-instance item arriving before the daemon observes this turn as
             // working must not trust the stale idle snapshot from before the send.
             this.lastDeliveryAt.set(instanceName, Date.now());
@@ -636,6 +959,9 @@ export class FleetManager {
             this.enforceWarmCap(name); // manual wake still respects the fleet warm cap
             return "awake";
         }
+        if (isGeneralInstance(this.fleetConfig, name)) {
+            throw new Error(GENERAL_PAUSE_ERROR);
+        }
         await this.lifecycle.pause(name);
         return this.lifecycle.isPaused(name) ? "paused" : "not_idle";
     }
@@ -655,11 +981,41 @@ export class FleetManager {
         await new Promise(resolve => setTimeout(resolve, 250));
         await this.startClassicInstance(instanceName, this.classicChannels.getBackendByInstance(instanceName, this.fleetConfig?.defaults?.backend), this.classicChannels.getPreTaskCommand(channel.channelId, channel.adapterId), this.classicChannels.getModel(channel.channelId, channel.adapterId, this.fleetConfig?.defaults?.model), this.classicChannels.getAutoPauseAfter(channel.channelId, channel.adapterId, this.fleetConfig?.defaults?.auto_pause_after));
     }
-    async startInstance(name, config, topicMode, kind = "fleet-topic") {
+    async startInstance(name, config, topicMode, kind = "fleet-topic", 
+    /**
+     * Explicit starts (CLI/API) may resume a paused or failed daemon.  Startup
+     * and reconcile calls leave this false so a persisted pause remains paused
+     * across a fleet restart.
+     */
+    resumePaused = false) {
+        if (resumePaused && this.lifecycle.isPaused(name)) {
+            await this.lifecycle.wake(name, 30_000);
+            // A successful wake clears the persisted pause marker and produces a
+            // fresh instance_state snapshot.  Drop any stale process error left by a
+            // pre-pause crash so /api/fleet and `agend ls` converge on running.
+            this.instanceProcessStatus.delete(name);
+            return;
+        }
         if (this.lifecycle.isPaused(name)) {
             this.logger.info({ name }, "Persisted paused instance — skipping startup");
             return;
         }
+        if (this.lifecycle.daemons.has(name)) {
+            // A crash-loop daemon remains in the lifecycle map so its health monitor
+            // can expose the failure.  The old start path treated that object as
+            // already running and merely deleted the process-status cache, leaving a
+            // dead pane (and crash marker) behind.  An explicit start is a recovery
+            // request: tear down the failed daemon and build a fresh one.
+            if (resumePaused) {
+                const status = this.getInstanceStatus(name);
+                if (status === "crashed" || status === "stopped") {
+                    await this.restartSingleInstance(name);
+                    return;
+                }
+            }
+            this.logger.info({ name }, "Instance already running, skipping");
+            return;
+        }
         if (config.general_topic) {
             // antigravity (agy) does not read MCP instructions — fleet context and
             // routing instructions are not injected, so it cannot act as a dispatcher.
@@ -670,12 +1026,19 @@ export class FleetManager {
             }
             this.ensureGeneralInstructions(config.working_directory, config.backend);
         }
-        this.instanceProcessStatus.delete(name);
         await this.lifecycle.start(name, config, topicMode, {
             kind,
             backend: config.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code",
             model: this.resolveInstanceModel(name).display,
         });
+        // Only clear a stale process status after a real start succeeded.  Clearing
+        // it before lifecycle.start() can turn a crash-loop daemon's dead pane into
+        // a falsely running instance when lifecycle.start() returns early.
+        this.instanceProcessStatus.delete(name);
+        try {
+            unlinkSync(join(this.getInstanceDir(name), "crash-state.json"));
+        }
+        catch { /* consumed or absent */ }
         // Auto-connect IPC — daemon.start() ensures socket is ready before resolving
         await this.connectIpcToInstance(name);
     }
@@ -699,7 +1062,18 @@ export class FleetManager {
      * to avoid config file races. Stagger delay is group-to-group, not instance-to-instance.
      * TODO: per-instance startup timeout (existing issue, not introduced here)
      */
-    async startInstancesWithConcurrency(entries, topicMode) {
+    async startInstancesWithConcurrency(entries, topicMode, onReady) {
+        // Persisted pauses are intentionally preserved across fleet restarts. Filter
+        // them before grouping/staggering: startInstance() retains its own guard as
+        // a final backstop, but putting a no-op entry in this queue still consumes a
+        // full stagger slot for every distinct working directory.
+        const runnableEntries = entries.filter(([name]) => !this.lifecycle.isPaused(name));
+        const pausedCount = entries.length - runnableEntries.length;
+        if (pausedCount > 0) {
+            this.logger.info({ pausedCount }, "Paused instances excluded from startup queue");
+        }
+        if (runnableEntries.length === 0)
+            return;
         const raw = this.fleetConfig?.defaults?.startup;
         const explicitConcurrency = raw?.concurrency;
         const staggerMs = Math.max(0, Math.min(30_000, raw?.stagger_delay_ms ?? 500));
@@ -714,10 +1088,10 @@ export class FleetManager {
         else {
             const freeMemMB = Math.round(freemem() / (1024 * 1024));
             concurrency = Math.max(2, Math.min(10, Math.floor(freeMemMB / ESTIMATED_MB_PER_INSTANCE)));
-            this.logger.info({ concurrency, freeMemMB: freeMemMB, totalInstances: entries.length }, "Adaptive startup concurrency");
+            this.logger.info({ concurrency, freeMemMB: freeMemMB, totalInstances: runnableEntries.length }, "Adaptive startup concurrency");
         }
         const byWorkDir = new Map();
-        for (const [name, config] of entries) {
+        for (const [name, config] of runnableEntries) {
             const dir = config.working_directory;
             if (!byWorkDir.has(dir))
                 byWorkDir.set(dir, []);
@@ -760,7 +1134,14 @@ export class FleetManager {
                     lastStartAt = Date.now();
                     (async () => {
                         for (const [name, config] of group) {
-                            await this.startInstance(name, config, topicMode).catch((err) => this.logger.error({ err, name }, "Failed to start instance"));
+                            try {
+                                await this.startInstance(name, config, topicMode);
+                                if (this.daemons.has(name))
+                                    onReady?.(name);
+                            }
+                            catch (err) {
+                                this.logger.error({ err, name }, "Failed to start instance");
+                            }
                         }
                     })().finally(() => {
                         running--;
@@ -774,8 +1155,41 @@ export class FleetManager {
             startNext();
         });
     }
+    runnableStartupCount(fleet, includeClassic) {
+        const names = this.configuredStartupInstanceNames(fleet, includeClassic);
+        let count = 0;
+        for (const name of names) {
+            if (!this.lifecycle.isPaused(name))
+                count++;
+        }
+        return count;
+    }
+    configuredStartupInstanceNames(fleet, includeClassic) {
+        const names = new Set(Object.keys(fleet.instances));
+        if (includeClassic) {
+            for (const channel of this.classicChannels?.getAll() ?? [])
+                names.add(channel.instanceName);
+        }
+        return [...names];
+    }
+    restartProgressTarget() {
+        const generalName = this.findGeneralInstance();
+        if (!generalName)
+            return null;
+        const adapter = this.getAdapterForInstance(generalName);
+        const chatId = this.getGroupIdForInstance(generalName);
+        if (!adapter || !chatId)
+            return null;
+        const topicId = this.fleetConfig?.instances[generalName]?.topic_id;
+        return {
+            adapter,
+            chatId,
+            threadId: topicId != null ? String(topicId) : undefined,
+        };
+    }
     async stopInstance(name) {
         this.failoverActive.delete(name);
+        this.cancelIdleButtonRetirement(name);
         this.instanceStateCache.delete(name);
         this.instanceProcessStatus.delete(name);
         this.lastDeliveryAt.delete(name);
@@ -783,6 +1197,21 @@ export class FleetManager {
     }
     /** Restart a single instance, reloading fleet.yaml first to pick up config changes. */
     async restartSingleInstance(name, opts) {
+        // One restart at a time per instance. Multiple sources can ask concurrently
+        // (MCP revival, /restart, pty_error, model failover); a second stop/start
+        // interleaved with the first tears down the window the first just created.
+        // Later callers join the in-flight restart instead — its opts win.
+        const inFlight = this.restartsInFlight.get(name);
+        if (inFlight) {
+            this.logger.info({ name }, "restartSingleInstance: joining the restart already in flight");
+            return inFlight;
+        }
+        const run = this.doRestartSingleInstance(name, opts)
+            .finally(() => this.restartsInFlight.delete(name));
+        this.restartsInFlight.set(name, run);
+        return run;
+    }
+    async doRestartSingleInstance(name, opts) {
         if (this.configPath) {
             this.loadConfig(this.configPath);
             this.routing.rebuild(this.fleetConfig);
@@ -838,7 +1267,10 @@ export class FleetManager {
             const eqIdx = trimmed.indexOf("=");
             if (eqIdx < 0)
                 continue;
-            const key = trimmed.slice(0, eqIdx);
+            // Accept `export KEY=value` — the shell-style form people paste from their
+            // .bashrc. Without this the variable landed in process.env under the key
+            // "export KEY" and silently did nothing.
+            const key = trimmed.slice(0, eqIdx).replace(/^export\s+/, "").trim();
             const raw = trimmed.slice(eqIdx + 1);
             const value = raw.replace(/^["'](.*)["']$/, '$1');
             // .env file always wins over inherited shell env vars, so that
@@ -846,17 +1278,36 @@ export class FleetManager {
             process.env[key] = value;
         }
     }
+    /** Initialize auth before any adapter can answer /dashboard. */
+    initializeWebAuthTokens() {
+        this.webToken = loadOrCreateWebToken(this.dataDir);
+        this.viewToken = randomBytes(24).toString("hex");
+        const viewTokenPath = join(this.dataDir, "view.token");
+        writeFileSync(viewTokenPath, this.viewToken, { encoding: "utf8", mode: 0o600 });
+        try {
+            chmodSync(viewTokenPath, 0o600);
+        }
+        catch { /* best effort */ }
+        this.healthServerListening = false;
+    }
+    getDashboardAccess() {
+        return { ready: this.healthServerListening, token: this.webToken };
+    }
     /** Start all instances from fleet config */
     async startAll(configPath) {
+        const startupStartedAt = Date.now();
         FleetManager.signalTarget = this;
         this.startupComplete = false;
+        // Cleared here, not at the end of doStopAll: a stop has an async tail, and
+        // anything arriving during it is still part of the stop.
+        this.shuttingDown = false;
         this.configPath = configPath;
         this.loadEnvFile();
         // Rotate fleet.log if oversized (before any logging)
-        const { rotateLogIfNeeded } = await import("./logger.js");
         rotateLogIfNeeded(join(this.dataDir, "fleet.log"));
         const fleet = this.loadConfig(configPath);
         setLocale(detectLocale(fleet)); // user-facing text language (fleet.yaml defaults.locale / timezone)
+        this.initializeWebAuthTokens();
         const topicMode = fleet.channel?.mode === "topic" || !!fleet.channels?.some(ch => ch.mode === "topic");
         // Set tmux socket isolation for custom AGEND_HOME
         const { getTmuxSocketName: getSocket } = await import("./paths.js");
@@ -897,7 +1348,7 @@ export class FleetManager {
         }
         const pidPath = join(this.dataDir, "fleet.pid");
         writeFileSync(pidPath, String(process.pid), "utf-8");
-        this.eventLog = new EventLog(join(this.dataDir, "events.db"));
+        this.eventLog = this.openEventLog();
         // Initialize classic channel manager. The primary adapter (channels[0])
         // migrates legacy single-bot entries and names without a suffix. Classic
         // routing does NOT go through the routing engine (single-key, can't hold two
@@ -986,6 +1437,10 @@ export class FleetManager {
             // Rotate fleet.log daily too (besides the startup size check above), so a
             // long-running fleet doesn't accumulate an unbounded log.
             rotateLogIfNeeded(join(this.dataDir, "fleet.log"));
+            // Instance output.log is pipe-pane (TUI ANSI). Daemon health ticks rotate a
+            // running instance's own log; this sweep is the safety net for every other
+            // kind. One implementation, so the two cannot cover different sets.
+            this.rotateAllInstanceLogs();
         }, () => {
             const instances = Object.keys(this.fleetConfig?.instances ?? {});
             const costMap = new Map();
@@ -1000,6 +1455,7 @@ export class FleetManager {
         this.rotateInboxes();
         // Auto-create/adopt a general dispatcher — ONLY for the primary adapter.
         const channelConfigs = fleet.channels ?? (fleet.channel ? [fleet.channel] : []);
+        this.warnUnboundGeneralChannelIds(fleet);
         const primaryAdapterId = channelConfigs[0] ? (channelConfigs[0].id ?? channelConfigs[0].type) : undefined;
         const generalInstances = Object.entries(fleet.instances).filter(([, inst]) => inst.general_topic === true);
         let generalsCreated = false;
@@ -1107,10 +1563,13 @@ export class FleetManager {
         const allEntries = Object.entries(fleet.instances);
         const generals = allEntries.filter(([_, cfg]) => cfg.general_topic);
         const others = allEntries.filter(([_, cfg]) => !cfg.general_topic);
+        const startupProgress = new RestartProgress(this.runnableStartupCount(fleet, topicMode), startupStartedAt, this.logger);
         if (generals.length > 0) {
             for (const [name, cfg] of generals) {
                 try {
                     await this.startInstance(name, cfg, topicMode);
+                    if (this.daemons.has(name))
+                        startupProgress.markReady();
                 }
                 catch (err) {
                     this.logger.error({ err, name }, "Failed to start general instance");
@@ -1125,39 +1584,63 @@ export class FleetManager {
                 }
             }
         }
-        // Signal systemd: generals ready
-        sdNotify("READY=1");
+        // The adapter must exist before General can receive the progress message.
+        // Start it after General is ready, in parallel with the remaining CLIs, so
+        // progress is visible without adding adapter startup time to the critical path.
+        let adapterStartup = null;
+        let progressStart = Promise.resolve(false);
+        if (topicMode && (fleet.channel || fleet.channels?.length)) {
+            // An adapter becoming reachable during startup can receive messages; make
+            // all existing topic ids routable before opening that inbound path.
+            this.routing.rebuild(fleet);
+            this.reregisterClassicChannels();
+            adapterStartup = (async () => {
+                try {
+                    await this.startSharedAdapter(fleet);
+                }
+                catch (err) {
+                    this.logger.error({ err }, "startSharedAdapter failed — fleet continues without some adapters");
+                }
+            })();
+            progressStart = adapterStartup.then(() => startupProgress.start(this.restartProgressTarget()));
+        }
+        // The systemd watchdog answers exactly one question: is this process still
+        // turning its event loop? Pinging from a timer proves that, and after the
+        // blocking child-process calls were made async it is a meaningful signal —
+        // a deadlocked or frozen fleet stops pinging and systemd restarts it.
+        //
+        // It deliberately does NOT gate on fleet health. "No adapter connected" or
+        // "an instance crashed" must not kill the process: the fleet would be restarted
+        // into the same broken state, and a user who has legitimately stopped every
+        // instance would get a restart loop. Those conditions surface through /health
+        // (which now returns 503) and through the General-topic notifications instead.
         this.watchdogTimer = setInterval(() => sdNotify("WATCHDOG=1"), 30_000);
+        // EventLog.prune() existed but was never called, so `events` and `activity`
+        // grew without bound for the life of the install. Prune once at startup and
+        // daily after that; the timer is unref'd so it never holds the loop open.
+        this.pruneEventLog();
+        this.eventLogPruneTimer = setInterval(() => this.pruneEventLog(), 24 * 60 * 60_000);
+        this.eventLogPruneTimer.unref?.();
+        // Same shape for pipe-pane logs, and for the same reason: the only sweep that
+        // covered them lived inside the daily-summary callback, so it did not run at
+        // all when summaries were off.
+        this.rotateAllInstanceLogs();
+        this.logRotateTimer = setInterval(() => this.rotateAllInstanceLogs(), 24 * 60 * 60_000);
+        this.logRotateTimer.unref?.();
         // Phase 2: Start remaining instances with staggered concurrency
         if (others.length > 0) {
-            await this.startInstancesWithConcurrency(others, topicMode);
+            await this.startInstancesWithConcurrency(others, topicMode, () => startupProgress.markReady());
         }
         if (topicMode && (fleet.channel || fleet.channels?.length)) {
-            try {
-                await this.startSharedAdapter(fleet);
-            }
-            catch (err) {
-                this.logger.error({ err }, "startSharedAdapter failed — fleet continues without some adapters");
-            }
-            // Bind instances to their adapter (which bot answers on their behalf).
-            // An explicit channel_id is authoritative — this is how a persona instance
-            // picks its bot when several share one guild. Generals without a channel_id
-            // fall back to a name-contains-adapterId heuristic.
-            const channelConfigsForBind = fleet.channels ?? (fleet.channel ? [fleet.channel] : []);
+            await adapterStartup;
+            // Bind every fleet instance deterministically. Explicit channel_id wins;
+            // otherwise channels[0] is authoritative. Do not infer identity from
+            // concurrent adapter startup or whichever bot receives a message first.
+            const primaryAdapterId = this.getPrimaryAdapterId();
             for (const [name, config] of Object.entries(fleet.instances)) {
-                if (config.channel_id) {
-                    this.bindInstanceAdapter(name, config.channel_id);
-                    continue;
-                }
-                if (!config.general_topic)
-                    continue;
-                for (const ch of channelConfigsForBind) {
-                    const id = ch.id ?? ch.type;
-                    if (name.includes(id)) {
-                        this.bindInstanceAdapter(name, id);
-                        break;
-                    }
-                }
+                const adapterId = config.channel_id ?? primaryAdapterId;
+                if (adapterId)
+                    this.bindInstanceAdapter(name, adapterId);
             }
             // Guard against a stale/invalid general topic_id. An old auto-general
             // could have written the TG-convention "1" for a Discord general; the DC
@@ -1167,7 +1650,7 @@ export class FleetManager {
             for (const [name, cfg] of Object.entries(this.fleetConfig.instances)) {
                 if (!cfg.general_topic || cfg.topic_id == null)
                     continue;
-                const adapterId = this.instanceWorldBinding.get(name) ?? cfg.channel_id;
+                const adapterId = this.getInstanceAdapterId(name);
                 if (this.getChannelConfig(adapterId)?.type === "discord" && !/^\d{17,}$/.test(String(cfg.topic_id))) {
                     this.logger.warn({ name, topic_id: cfg.topic_id }, "Discord general topic_id is not a valid channel — unbinding to avoid a crash loop");
                     delete cfg.topic_id;
@@ -1190,12 +1673,22 @@ export class FleetManager {
             // Start classic channel instances (parallel, concurrency 3)
             if (this.classicChannels) {
                 const fleetBackend = this.fleetConfig?.defaults?.backend;
-                const channels = this.classicChannels.getAll();
+                const channels = this.classicChannels.getAll()
+                    .filter(ch => !this.lifecycle.isPaused(ch.instanceName));
                 const concurrency = 3;
                 let idx = 0;
                 while (idx < channels.length) {
                     const batch = channels.slice(idx, idx + concurrency);
-                    await Promise.allSettled(batch.map(ch => this.startClassicInstance(ch.instanceName, this.classicChannels.getBackendByInstance(ch.instanceName, fleetBackend), this.classicChannels.getPreTaskCommand(ch.channelId, ch.adapterId), this.classicChannels.getModel(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.model), this.classicChannels.getAutoPauseAfter(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.auto_pause_after)).catch(err => this.logger.warn({ err, instanceName: ch.instanceName }, "Failed to start classic instance"))));
+                    await Promise.allSettled(batch.map(async (ch) => {
+                        try {
+                            await this.startClassicInstance(ch.instanceName, this.classicChannels.getBackendByInstance(ch.instanceName, fleetBackend), this.classicChannels.getPreTaskCommand(ch.channelId, ch.adapterId), this.classicChannels.getModel(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.model), this.classicChannels.getAutoPauseAfter(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.auto_pause_after));
+                            if (this.daemons.has(ch.instanceName))
+                                startupProgress.markReady();
+                        }
+                        catch (err) {
+                            this.logger.warn({ err, instanceName: ch.instanceName }, "Failed to start classic instance");
+                        }
+                    }));
                     idx += concurrency;
                 }
             }
@@ -1203,10 +1696,10 @@ export class FleetManager {
                 this.startStatuslineWatcher(name);
             }
             // Notify General topic that fleet is up
-            const classicCount = this.classicChannels?.getAll().length ?? 0;
-            const total = Object.keys(fleet.instances).length + classicCount;
-            const started = this.daemons.size;
-            const allNotRunning = Object.keys(fleet.instances).filter(n => !this.daemons.has(n));
+            const configuredNames = this.configuredStartupInstanceNames(fleet, topicMode);
+            const total = configuredNames.length;
+            const started = configuredNames.filter(name => this.daemons.has(name)).length;
+            const allNotRunning = configuredNames.filter(name => !this.daemons.has(name));
             const pausedNames = allNotRunning.filter(n => this.lifecycle.isPaused(n));
             const failedNames = allNotRunning.filter(n => !this.lifecycle.isPaused(n));
             const generalName = this.findGeneralInstance();
@@ -1214,7 +1707,15 @@ export class FleetManager {
             const { createRequire } = await import("node:module");
             const _require = createRequire(import.meta.url);
             const agendVersion = _require("../package.json").version ?? "unknown";
-            if (this.adapter && fleet.channel?.group_id) {
+            await progressStart;
+            const progressCompleted = await startupProgress.finish({
+                running: started,
+                total,
+                version: agendVersion,
+                pausedNames,
+                failedNames,
+            });
+            if (!progressCompleted && this.adapter && fleet.channel?.group_id) {
                 let text;
                 if (failedNames.length === 0 && pausedNames.length === 0) {
                     text = t("fleet.ready", started, total, agendVersion);
@@ -1263,6 +1764,15 @@ export class FleetManager {
         // rest of startup finishes. Replay one coalesced reload only after all
         // startup-owned lifecycle work and signal handlers are in place.
         this.finishStartup();
+        // Tell systemd we are ready only now. This used to fire right after the
+        // generals started — before adapters, classic instances, topic creation and the
+        // health server — so `systemctl start` returned success while the fleet was
+        // still deaf: no path existed for a user message to arrive.
+        sdNotify("READY=1");
+        const health = this.getFleetHealth();
+        if (health.status !== "ok") {
+            this.logger.warn({ health }, "Fleet started with problems — see /health");
+        }
     }
     /**
      * Delete inbox files older than retentionDays (by mtime). Cleans the shared
@@ -1379,6 +1889,67 @@ export class FleetManager {
     getAdapterStates() {
         return this.adapterState;
     }
+    /**
+     * Real, checkable fleet health for `/health` and the operator.
+     *
+     * `status` is:
+     *  - `ok`       — at least one adapter connected and every configured instance
+     *                 that should be running is running
+     *  - `degraded` — reachable, but something the operator should look at (an
+     *                 adapter retrying, an instance crashed or stopped)
+     *  - `down`     — the fleet cannot do its job: no adapter is connected, so no
+     *                 message can arrive or be answered
+     *
+     * Deliberately does NOT gate the systemd watchdog — see the comment at the
+     * WATCHDOG timer for why.
+     */
+    getFleetHealth() {
+        const names = Object.keys(this.fleetConfig?.instances ?? {});
+        const counts = { configured: names.length, running: 0, crashed: 0, paused: 0, stopped: 0 };
+        for (const name of names) {
+            const state = this.getInstanceStatus(name);
+            if (state === "running")
+                counts.running++;
+            else if (state === "crashed")
+                counts.crashed++;
+            else if (state === "paused")
+                counts.paused++;
+            else
+                counts.stopped++;
+        }
+        const states = {};
+        let connected = 0;
+        for (const [id, state] of this.adapterState) {
+            states[id] = state.status;
+            if (state.status === "connected")
+                connected++;
+        }
+        const problems = [];
+        if (this.adapterState.size > 0 && connected === 0)
+            problems.push("no channel adapter is connected");
+        if (counts.crashed > 0)
+            problems.push(`${counts.crashed} instance(s) crashed`);
+        for (const [id, state] of this.adapterState) {
+            if (state.status !== "connected")
+                problems.push(`adapter ${id} is ${state.status}`);
+        }
+        if (!this.startupComplete)
+            problems.push("startup has not completed");
+        // "down" is reserved for "cannot receive or answer a message at all". A fleet
+        // with adapters configured but none connected is exactly that.
+        const status = this.adapterState.size > 0 && connected === 0
+            ? "down"
+            : problems.length > 0 ? "degraded" : "ok";
+        return {
+            status,
+            uptime: Math.floor((Date.now() - this.startedAt) / 1000),
+            instances: counts,
+            adapters: { total: this.adapterState.size, connected, states },
+            startupComplete: this.startupComplete,
+            memory: readFleetMemory(),
+            problems,
+        };
+    }
     /** Start the primary adapter (backward-compatible, sets this.adapter) */
     async startSingleAdapter(fleet, channelConfig) {
         const botToken = process.env[channelConfig.bot_token_env];
@@ -1405,11 +1976,16 @@ export class FleetManager {
         this.adapter.on("message", safeHandler(async (msg) => {
             await this.handleInboundMessage(msg);
         }, this.logger, "adapter.message"));
+        this.adapter.on("reaction", safeHandler(async (r) => {
+            await this.handleInboundReaction(r);
+        }, this.logger, "adapter.reaction"));
         this.adapter.on("callback_query", safeHandler(async (data) => {
             if (await this.handleClassicBackendSelection(data))
                 return;
             if (await this.handleModelSelection(data))
                 return;
+            if (await this.handleEffortSelection(data))
+                return;
             if (data.callbackData.startsWith("hang:")) {
                 const parts = data.callbackData.split(":");
                 const action = parts[1];
@@ -1430,12 +2006,7 @@ export class FleetManager {
                 return;
             }
             if (data.callbackData.startsWith("cancel:")) {
-                const instanceName = data.callbackData.slice("cancel:".length);
-                // Idempotent: a button click only acts while the button is live. A
-                // second click (entry already cleared) is a no-op — don't re-send the
-                // interrupt key. (The /cancel command path calls cancelInstance directly.)
-                if (this.hasCancelButton(instanceName))
-                    this.cancelInstance(instanceName);
+                this.handleCancelClick(data.callbackData.slice("cancel:".length), this.adapter, data);
                 return;
             }
         }, this.logger, "adapter.callback_query"));
@@ -1515,6 +2086,9 @@ export class FleetManager {
             else if (data.command === "model") {
                 await this.handleModelSlash(data, adapterId);
             }
+            else if (data.command === "effort") {
+                await this.handleEffortSlash(data, adapterId);
+            }
             else if (data.command === "cancel") {
                 const name = this.resolveSlashTarget(data.channelId, adapterId);
                 if (!name) {
@@ -1579,19 +2153,29 @@ export class FleetManager {
                     await data.respond(t("not_authorized"));
                     return;
                 }
+                await data.respond(await this.runBackendDoctor());
+            }
+            else if (data.command === "usage") {
+                // Same permission level as /ctx (none). The reply is still ephemeral —
+                // the adapter defers non-chat commands that way — so it never spams the
+                // channel either way.
                 try {
-                    const { execSync } = await import("node:child_process");
-                    const backend = this.fleetConfig?.defaults?.backend || "claude-code";
-                    const result = execSync(`agend backend doctor ${backend}`, { timeout: 30_000, encoding: "utf-8" });
-                    const clean = result.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
-                    await data.respond(clean || "No output");
+                    const { getUsageSnapshot } = await import("./usage/usage-api.js");
+                    const { renderUsageMarkdown } = await import("./usage/format-rich.js");
+                    // slash_command is Discord-only; editReply renders Markdown natively.
+                    await data.respond(renderUsageMarkdown(await getUsageSnapshot()));
                 }
                 catch (err) {
-                    const output = (err.stdout ?? err.message ?? "Doctor failed").replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
-                    await data.respond(output);
+                    await data.respond(`⚠️ Usage fetch failed: ${err.message}`);
                 }
             }
             else if (data.command === "status") {
+                // Admin-gated (like the topic path): the merged table shows every
+                // instance's cost and IPC health.
+                if (!this.isFleetAdmin(data.userId, adapterId)) {
+                    await data.respond(t("cmd.admin_required", "/status"));
+                    return;
+                }
                 const text = await this.topicCommands.getStatusText();
                 await data.respond(text);
             }
@@ -1637,7 +2221,9 @@ export class FleetManager {
         this.probeCliEnvs();
         this.adapter.on("started", safeHandler((username, userId) => {
             this.logger.info(`Bot @${username} polling started. Ensure no other service is polling this bot token.`);
-            const w = this.worlds.values().next().value;
+            // Concurrent startup can insert a secondary world first. Update the
+            // configured primary world, not Map insertion order.
+            const w = this.worlds.get(adapterId);
             if (w) {
                 w.botUsername = username;
                 if (userId)
@@ -1700,11 +2286,16 @@ export class FleetManager {
         adapter.on("message", safeHandler(async (msg) => {
             await this.handleInboundMessage(msg);
         }, this.logger, `adapter[${adapterId}].message`));
+        adapter.on("reaction", safeHandler(async (r) => {
+            await this.handleInboundReaction(r);
+        }, this.logger, `adapter[${adapterId}].reaction`));
         adapter.on("callback_query", safeHandler(async (data) => {
             if (await this.handleClassicBackendSelection(data))
                 return;
             if (await this.handleModelSelection(data))
                 return;
+            if (await this.handleEffortSelection(data))
+                return;
             if (data.callbackData.startsWith("hang:")) {
                 const parts = data.callbackData.split(":");
                 const action = parts[1];
@@ -1724,10 +2315,7 @@ export class FleetManager {
                 return;
             }
             if (data.callbackData.startsWith("cancel:")) {
-                const instanceName = data.callbackData.slice("cancel:".length);
-                // Idempotent: only the first click (while the button is live) acts.
-                if (this.hasCancelButton(instanceName))
-                    this.cancelInstance(instanceName);
+                this.handleCancelClick(data.callbackData.slice("cancel:".length), adapter, data);
                 return;
             }
         }, this.logger, `adapter[${adapterId}].callback_query`));
@@ -1797,6 +2385,9 @@ export class FleetManager {
             else if (data.command === "model") {
                 await this.handleModelSlash(data, adapterId);
             }
+            else if (data.command === "effort") {
+                await this.handleEffortSlash(data, adapterId);
+            }
             else if (data.command === "cancel") {
                 const name = this.resolveSlashTarget(data.channelId, adapterId);
                 if (!name) {
@@ -1861,19 +2452,29 @@ export class FleetManager {
                     await data.respond(t("not_authorized"));
                     return;
                 }
+                await data.respond(await this.runBackendDoctor());
+            }
+            else if (data.command === "usage") {
+                // Same permission level as /ctx (none). The reply is still ephemeral —
+                // the adapter defers non-chat commands that way — so it never spams the
+                // channel either way.
                 try {
-                    const { execSync } = await import("node:child_process");
-                    const backend = this.fleetConfig?.defaults?.backend || "claude-code";
-                    const result = execSync(`agend backend doctor ${backend}`, { timeout: 30_000, encoding: "utf-8" });
-                    const clean = result.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
-                    await data.respond(clean || "No output");
+                    const { getUsageSnapshot } = await import("./usage/usage-api.js");
+                    const { renderUsageMarkdown } = await import("./usage/format-rich.js");
+                    // slash_command is Discord-only; editReply renders Markdown natively.
+                    await data.respond(renderUsageMarkdown(await getUsageSnapshot()));
                 }
                 catch (err) {
-                    const output = (err.stdout ?? err.message ?? "Doctor failed").replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
-                    await data.respond(output);
+                    await data.respond(`⚠️ Usage fetch failed: ${err.message}`);
                 }
             }
             else if (data.command === "status") {
+                // Admin-gated (like the topic path): the merged table shows every
+                // instance's cost and IPC health.
+                if (!this.isFleetAdmin(data.userId, adapterId)) {
+                    await data.respond(t("cmd.admin_required", "/status"));
+                    return;
+                }
                 const text = await this.topicCommands.getStatusText();
                 await data.respond(text);
             }
@@ -2029,6 +2630,9 @@ export class FleetManager {
                 else if (msg.type === "instance_process_state") {
                     this.cacheInstanceProcessStatus(name, msg.status);
                 }
+                else if (msg.type === "instance_activity") {
+                    this.cacheInstanceActivity(name, msg.activity);
+                }
                 else if (msg.type === "instance_state" || msg.type === "instance_state_response") {
                     this.cacheInstanceExecutionState(name, msg);
                     if (msg.type === "instance_state_response") {
@@ -2099,9 +2703,22 @@ export class FleetManager {
                 if (existsSync(windowIdPath)) {
                     const windowId = readFileSync(windowIdPath, "utf-8").trim();
                     if (windowId) {
+                        // Async with an explicit timeout: this was execSync with NO timeout at
+                        // all, so a wedged tmux server blocked the whole fleet event loop
+                        // indefinitely — while we were here to diagnose a lost connection.
+                        // A timeout is also the correct signal: an unresponsive tmux server
+                        // means we cannot verify the pane, which is treated as dead (the same
+                        // conclusion the old code reached only by throwing).
                         try {
-                            const { execSync } = await import("node:child_process");
-                            execSync(`tmux list-panes -t "${windowId}"`, { stdio: "ignore" });
+                            const { execFile } = await import("node:child_process");
+                            const { promisify } = await import("node:util");
+                            const { getTmuxSocketName } = await import("./paths.js");
+                            // Honour socket isolation: without -L this queried the user's default
+                            // tmux server instead of the fleet's, so under a custom AGEND_HOME the
+                            // check was meaningless (it reported every pane dead).
+                            const socket = getTmuxSocketName();
+                            const args = socket ? ["-L", socket, "list-panes", "-t", windowId] : ["list-panes", "-t", windowId];
+                            await promisify(execFile)("tmux", args, { timeout: 5_000 });
                         }
                         catch {
                             // Pane dead — respawn
@@ -2122,6 +2739,12 @@ export class FleetManager {
         if (this.adapterRestarting.has(id))
             return;
         this.adapterRestarting.add(id);
+        // Reflect reality in adapterState throughout. This loop used to leave the state
+        // untouched, so getAdapterStates() — and therefore /health and the dashboard —
+        // kept reporting "connected" for an adapter that had been down for hours. An
+        // adapter's true status was simply not knowable from inside the process.
+        const previous = this.adapterState.get(id);
+        this.adapterState.set(id, { status: "retrying", retryCount: 0, lastError: previous?.lastError });
         try {
             for (let attempt = 1;; attempt++) {
                 if (this.ipcStoppingInstances.has("__fleet_stopping__"))
@@ -2134,9 +2757,16 @@ export class FleetManager {
                     await adapter.stop().catch(() => { });
                     await adapter.start();
                     this.logger.info({ id, attempt }, "Adapter restarted successfully");
+                    this.adapterState.set(id, { status: "connected", retryCount: 0 });
                     return;
                 }
-                catch { /* retry */ }
+                catch (err) {
+                    this.adapterState.set(id, {
+                        status: "retrying",
+                        retryCount: attempt,
+                        lastError: err?.message ?? String(err),
+                    });
+                }
                 if (attempt % 10 === 0) {
                     this.logger.warn({ id, attempt }, "Adapter restart still failing");
                 }
@@ -2172,6 +2802,49 @@ export class FleetManager {
         }
         return generals[0];
     }
+    /**
+     * A user reacted to one of the bot's messages (#408).
+     *
+     * A reaction is context, not a message (#432, reworking #413): it never triggers
+     * an agent turn and never wakes anything. It is queued in the event log and rides
+     * into the instance's NEXT real message as one compact leading line —
+     * `[Recent reactions: 👍×2 from hanhanv]` — after which it is marked consumed.
+     * No pending reactions → no line → zero context spent, which is the common case.
+     */
+    async handleInboundReaction(r) {
+        const instanceName = this.resolveSlashTarget(r.threadId ?? r.chatId, r.adapterId);
+        if (!instanceName) {
+            this.logger.debug({ emoji: r.emoji, chatId: r.chatId }, "Reaction in an unrouted channel — ignoring");
+            return;
+        }
+        if (DELIVERY_STATUS_EMOJIS.has(r.emoji)) {
+            this.logger.debug({ emoji: r.emoji, user: r.username }, "Ignoring delivery-status emoji as a reaction");
+            return;
+        }
+        this.eventLog?.logActivity("reaction", r.username, `${r.emoji} ${r.action}`, instanceName);
+        if (r.action === "add") {
+            this.eventLog?.addReaction(instanceName, r.messageId, r.username, r.emoji);
+        }
+        else {
+            // Withdrawn before anyone saw it → it never happened. See removeReaction.
+            this.eventLog?.removeReaction(instanceName, r.messageId, r.username, r.emoji);
+        }
+    }
+    /**
+     * The queued-reaction summary for an instance's next real message, or {} when
+     * nothing is pending (the common case must add zero context). The consume
+     * callback is separate from the fetch so reactions are only marked once the
+     * message actually went out — a failed delivery keeps them queued.
+     */
+    pendingReactionsMeta(instanceName) {
+        const pending = this.eventLog?.pendingReactions(instanceName);
+        if (!pending)
+            return { meta: {}, consume: () => { } };
+        return {
+            meta: { pending_reactions: pending.summary },
+            consume: () => this.eventLog?.markReactionsConsumed(instanceName, pending.maxId),
+        };
+    }
     async handleInboundMessage(msg) {
         const threadId = msg.threadId || undefined;
         this.logger.debug({ source: msg.source, chatId: msg.chatId, threadId, userId: msg.userId, isBotMessage: msg.isBotMessage, textLen: (msg.text ?? "").length, text: (msg.text ?? "").slice(0, 80) }, "handleInboundMessage entry");
@@ -2509,6 +3182,7 @@ export class FleetManager {
                 }
                 this.warnIfRateLimited(generalInstance, msg);
                 const { text, extraMeta } = await processAttachments(msg, inboundAdapter, this.logger, generalInstance);
+                const generalReactions = this.pendingReactionsMeta(generalInstance);
                 try {
                     await this.deliverToInstance(generalInstance, {
                         type: "fleet_inbound",
@@ -2521,12 +3195,18 @@ export class FleetManager {
                             user_id: msg.userId,
                             ts: msg.timestamp.toISOString(),
                             thread_id: "",
-                            adapter_id: msg.adapterId,
+                            // Fleet instances have an authoritative adapter binding. Multiple
+                            // bots in one guild can observe the same inbound message, so the
+                            // adapter whose event wins dedup is not necessarily the bot that
+                            // owns this instance.
+                            adapter_id: this.getInstanceAdapterId(generalInstance) ?? msg.adapterId,
                             source: msg.source,
                             ...(msg.replyToText ? { reply_to_text: msg.replyToText } : {}),
+                            ...generalReactions.meta,
                             ...extraMeta,
                         },
                     });
+                    generalReactions.consume();
                     this.lastInboundUser.set(generalInstance, msg.username);
                     this.logger.info(`${msg.username} → ${generalInstance}: ${(text ?? "").slice(0, 100)}`);
                     this.eventLog?.logActivity("message", msg.username, (text ?? "").slice(0, 200), generalInstance);
@@ -2602,6 +3282,7 @@ export class FleetManager {
         this.setTopicIcon(instanceName, "blue");
         this.warnIfRateLimited(instanceName, msg);
         const { text, extraMeta } = await processAttachments(msg, inboundAdapter, this.logger, instanceName);
+        const reactions = this.pendingReactionsMeta(instanceName);
         try {
             await this.deliverToInstance(instanceName, {
                 type: "fleet_inbound",
@@ -2614,12 +3295,18 @@ export class FleetManager {
                     user_id: msg.userId,
                     ts: msg.timestamp.toISOString(),
                     thread_id: msg.threadId ?? "",
-                    adapter_id: msg.adapterId,
+                    // Canonicalize the reply context to the configured world. Whichever
+                    // sibling bot wins inbound dedup must not decide which bot replies.
+                    adapter_id: this.getInstanceAdapterId(instanceName) ?? msg.adapterId,
                     source: msg.source,
                     ...(msg.replyToText ? { reply_to_text: msg.replyToText } : {}),
+                    ...reactions.meta,
                     ...extraMeta,
                 },
             });
+            // Only after the message actually went out. A failed delivery keeps the
+            // reactions queued for the retry / the next message.
+            reactions.consume();
         }
         catch (err) {
             this.logger.warn({ err: err.message, instanceName }, "Wake/delivery failed");
@@ -2694,8 +3381,21 @@ export class FleetManager {
             : (senderSessionName ? undefined : this.fleetConfig?.instances[instanceName]);
         let threadId = resolveReplyThreadId(args.thread_id, routingConfig)
             ?? this.classicChannels?.getChannelIdByInstance(senderInstanceName ?? instanceName);
-        // Select adapter: use instance binding, or resolve from chatId in args
-        const outAdapter = this.getAdapterForInstance(senderInstanceName ?? instanceName) ?? this.adapter;
+        // Select the adapter from the daemon's exact last-inbound context. Message
+        // ids are scoped to that bot/world; routing a secondary-world id through the
+        // primary adapter produces a 404. Instance binding remains the compatibility
+        // fallback for older daemons and calls without a live/persisted context.
+        const contextAdapterId = typeof msg.adapterId === "string" && msg.adapterId
+            ? msg.adapterId
+            : undefined;
+        const contextWorld = contextAdapterId ? this.worlds.get(contextAdapterId) : undefined;
+        if (contextAdapterId && !contextWorld) {
+            respond(null, `Adapter world unavailable: ${contextAdapterId}`);
+            return;
+        }
+        const outAdapter = contextWorld?.adapter
+            ?? this.getAdapterForInstance(senderInstanceName ?? instanceName)
+            ?? this.adapter;
         if (!outAdapter) {
             respond(null, "No adapter available");
             return;
@@ -2708,25 +3408,33 @@ export class FleetManager {
             delete args.thread_id;
             threadId = undefined;
         }
+        // Reply dedup: retries land here when the agent was told a send failed
+        // (daemon budget elapsed, shell tool killed) while the adapter send was
+        // still in flight and about to succeed. One real send, everyone gets its
+        // outcome; a genuinely failed send clears the entry so a retry passes.
+        if (tool === "reply") {
+            const ticket = this.replyDeduper.begin(instanceName, String(args.text ?? ""), Array.isArray(args.files) ? args.files : []);
+            if (ticket.duplicate) {
+                this.logger.info({ instanceName }, "Duplicate reply suppressed — replaying the original send's outcome");
+                ticket.subscribe(respond);
+                return;
+            }
+            const original = respond;
+            const respondAndRecord = (result, error) => {
+                ticket.complete(result, error);
+                original(result, error);
+            };
+            if (routeToolCall(outAdapter, tool, args, threadId, respondAndRecord)) {
+                this.afterReplyRouted(instanceName, args, senderSessionName);
+                return;
+            }
+            // routeToolCall knows "reply"; not handling it means the world changed.
+            ticket.complete(null, "reply not handled");
+            original(null, "reply not handled");
+            return;
+        }
         // Route standard channel tools (reply, react, edit_message, download_attachment)
         if (routeToolCall(outAdapter, tool, args, threadId, respond)) {
-            if (tool === "reply") {
-                // Agent answered — retire its pending cancel button and mark ✅ done.
-                this.clearCancelButton(instanceName);
-                this.reactDone(instanceName);
-                const replyTo = this.lastInboundUser.get(instanceName) ?? "user";
-                this.logger.info(`${instanceName} → ${replyTo}: ${(args.text ?? "").slice(0, 100)}`);
-                this.emitSseEvent("message", {
-                    instance: instanceName, sender: senderSessionName ?? instanceName,
-                    text: (args.text ?? "").slice(0, 2000),
-                    ts: new Date().toISOString(),
-                });
-                // Log bot reply to classic instance chat-log
-                const isClassic = this.classicChannels?.getChannelIdByInstance(instanceName) !== undefined;
-                if (isClassic) {
-                    ClassicChannelManager.logMessage(instanceName, "bot", args.text ?? "", new Date());
-                }
-            }
             return;
         }
         // Log tool calls for activity visualization
@@ -2741,6 +3449,35 @@ export class FleetManager {
             respond(null, `Unknown tool: ${tool}`);
         }
     }
+    /** Side effects of a routed reply: cancel-button lifecycle, logs, SSE, chat log. */
+    afterReplyRouted(instanceName, args, senderSessionName) {
+        // A reply is NOT proof the turn is over (#410) — but it is not proof of
+        // more work either. Split the difference: an instance that is clearly
+        // idle loses the button now; one that looks busy keeps it (re-posted
+        // below the reply so it stays last in the channel), with a 2-minute
+        // grace check — if it has NOT resumed working by then, the reply was the
+        // end of the turn and the button goes. A multi-step run that keeps
+        // working sails through the check and keeps its button.
+        if (this.getInstanceIdle(instanceName)) {
+            this.clearCancelButton(instanceName);
+        }
+        else {
+            void this.sendCancelButton(instanceName).then(() => this.armReplyGrace(instanceName));
+        }
+        this.reactDone(instanceName);
+        const replyTo = this.lastInboundUser.get(instanceName) ?? "user";
+        this.logger.info(`${instanceName} → ${replyTo}: ${(args.text ?? "").slice(0, 100)}`);
+        this.emitSseEvent("message", {
+            instance: instanceName, sender: senderSessionName ?? instanceName,
+            text: (args.text ?? "").slice(0, 2000),
+            ts: new Date().toISOString(),
+        });
+        // Log bot reply to classic instance chat-log
+        const isClassic = this.classicChannels?.getChannelIdByInstance(instanceName) !== undefined;
+        if (isClassic) {
+            ClassicChannelManager.logMessage(instanceName, "bot", args.text ?? "", new Date());
+        }
+    }
     /** Handle tool status update from a daemon instance */
     handleToolStatusFromInstance(instanceName, msg) {
         const statusAdapter = this.getAdapterForInstance(instanceName) ?? this.adapter;
@@ -3278,7 +4015,12 @@ export class FleetManager {
         // the before/after runtime diff cannot observe.
         for (const patch of explicitPatches) {
             if (patch.remove) {
-                this.rawFleetDocument.deleteIn(patch.path);
+                // YAML's deleteIn throws when an inherited nested key has no raw parent
+                // (or a legacy scalar occupies that parent). Removing an override which
+                // is already absent is an idempotent no-op, not a failed Settings save.
+                if (this.rawFleetDocument.hasIn(patch.path)) {
+                    this.rawFleetDocument.deleteIn(patch.path);
+                }
             }
             else {
                 const before = this.rawFleetDocument.getIn(patch.path);
@@ -3304,8 +4046,11 @@ export class FleetManager {
                 this.patchFleetDocument(document, [...path, i], before[i], after[i]);
             }
             // Remove from the end so YAML sequence indexes do not shift underneath us.
-            for (let i = before.length - 1; i >= after.length; i--)
-                document.deleteIn([...path, i]);
+            for (let i = before.length - 1; i >= after.length; i--) {
+                const itemPath = [...path, i];
+                if (document.hasIn(itemPath))
+                    document.deleteIn(itemPath);
+            }
             for (let i = shared; i < after.length; i++)
                 document.setIn([...path, i], after[i]);
             return;
@@ -3327,7 +4072,11 @@ export class FleetManager {
             return;
         }
         if (after === undefined) {
-            document.deleteIn(path);
+            // Effective config contains inherited objects that may not exist in the
+            // raw YAML at all. yaml.deleteIn() is not idempotent for a missing nested
+            // parent, so guard it explicitly.
+            if (document.hasIn(path))
+                document.deleteIn(path);
         }
         else if (path.length === 0) {
             document.contents = document.createNode(after);
@@ -3343,6 +4092,9 @@ export class FleetManager {
         }
     }
     async removeInstance(name) {
+        // Drop cached pane context — the map is keyed by instance name and nothing
+        // else evicted deleted entries, so it grew for the life of the process.
+        forgetInstanceContext(name);
         // Clean up schedules (scheduler is fleet-level, not lifecycle-level)
         const config = this.fleetConfig?.instances[name];
         if (this.scheduler && config?.topic_id) {
@@ -3448,47 +4200,212 @@ export class FleetManager {
         this.collabInstances.add(instanceName);
         return true;
     }
-    notifyInstanceTopic(instanceName, text, extraOpts) {
-        const adapter = this.getAdapterForInstance(instanceName) ?? this.adapter;
-        if (!adapter)
-            return;
-        const channelCfg = this.getChannelConfig(this.instanceWorldBinding.get(instanceName));
-        const groupId = channelCfg?.group_id;
-        // Fleet topic instance
-        const threadId = this.fleetConfig?.instances[instanceName]?.topic_id;
-        if (threadId != null && groupId) {
-            adapter.sendText(String(groupId), text, { threadId: String(threadId), ...extraOpts })
-                .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send instance topic notification"));
-            return;
-        }
-        // Classic instance: find its channelId from the classic manager
-        const classicChatId = this.classicChannels?.getChannelIdByInstance(instanceName);
-        if (classicChatId) {
-            adapter.sendText(classicChatId, text, extraOpts)
-                .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send classic notification"));
-            return;
+    /**
+     * Open the event log, tolerating a corrupt file.
+     *
+     * `events.db` holds history only — event rows and the activity feed. Nothing the
+     * fleet needs to run depends on it, and every consumer already uses
+     * `this.eventLog?.`. An unguarded `new EventLog(...)` here meant a corrupt or
+     * unreadable history file (a truncated WAL after a hard kill, a full disk)
+     * threw during startAll and the WHOLE FLEET FAILED TO BOOT — trading every
+     * running agent for a file whose only job is reporting.
+     *
+     * So: try, move a bad file aside and retry once with a fresh one, and if even
+     * that fails carry on without an event log.
+     */
+    /**
+     * Run `agend backend doctor` for the fleet's default backend and return its
+     * cleaned output.
+     *
+     * Async on purpose: this was `execSync` with a 30s timeout, reachable by any
+     * allowlisted user through `/doctor`. While it ran, the entire fleet event loop
+     * was frozen — no IPC, no adapter, no message delivery, no health responses,
+     * and critically no WATCHDOG ping, so a slow doctor could push past
+     * WatchdogSec and have systemd SIGABRT the fleet.
+     */
+    async runBackendDoctor() {
+        const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
+        const backend = this.fleetConfig?.defaults?.backend || "claude-code";
+        try {
+            const { execFile } = await import("node:child_process");
+            const { promisify } = await import("node:util");
+            // execFile with an argv array — no shell, so the backend name cannot be
+            // interpreted as a command even if config is malformed.
+            const { stdout } = await promisify(execFile)("agend", ["backend", "doctor", backend], {
+                timeout: 30_000,
+                encoding: "utf-8",
+            });
+            return stripAnsi(stdout) || "No output";
         }
-        // Fallback: send to group without threadId
-        if (groupId) {
-            adapter.sendText(String(groupId), text, extraOpts)
-                .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send notification (no topic)"));
+        catch (err) {
+            const e = err;
+            return stripAnsi(e.stdout ?? e.message ?? "Doctor failed");
         }
     }
-    // ── Cancel button ────────────────────────────────────────────────────
-    // Sent after delivering a user message to an instance; clicking it (or
-    // /cancel) sends Escape to the instance's pane to interrupt generation.
-    /** Send a "🛑 Cancel" button to the instance's topic/channel after delivery. */
+    /** Drop event/activity rows older than the retention window. Best-effort. */
     /**
-     * Handle the DC `/save` slash command for both classic AND fleet-topic targets.
-     * Picks the backend-appropriate command (kiro → /chat save, claude → /export);
-     * unsupported backends get a clear error. Routes via classic paste or fleet IPC.
+     * Cap every instance's pipe-pane log, walking the instances **directory** rather
+     * than the config.
+     *
+     * A running instance rotates its own log on each health tick, so the ones that
+     * need this are the ones nothing else looks at:
+     *
+     *   - deleted instances, whose directory outlives the config entry. Nothing ever
+     *     touched these again. On the machine this was found on, one held 122 MB and
+     *     another 74 MB, out of 622 MB of pipe-pane logs in total.
+     *   - classic instances, which live in classicChannels, not fleetConfig.instances,
+     *     and so were never in the old config-driven loop at all.
+     *   - stopped instances, which have no health tick running.
+     *
+     * pipe-pane writes raw TUI output, so a wedged splash screen can emit ANSI frames
+     * at animation rate. Unbounded growth here fills the disk, which takes the whole
+     * fleet down rather than one instance.
      */
-    async handleSlashSave(data, adapterId) {
-        if (!this.classicChannels?.isAdmin(data.userId)) {
-            await data.respond(t("admin.required"));
-            return;
+    rotateAllInstanceLogs() {
+        const root = join(this.dataDir, "instances");
+        let entries;
+        try {
+            entries = readdirSync(root, { withFileTypes: true });
         }
-        // Classic resolves per-bot (same-channel multi-bot); otherwise a fleet topic.
+        catch {
+            return; // no instances directory yet
+        }
+        for (const entry of entries) {
+            if (!entry.isDirectory())
+                continue;
+            // rotateLogIfNeeded is already best-effort and returns early on a missing
+            // file, so a directory without a pipe-pane log costs one stat.
+            rotateLogIfNeeded(join(root, entry.name, "output.log"));
+        }
+    }
+    pruneEventLog() {
+        try {
+            this.eventLog?.prune(FleetManager.EVENT_LOG_RETENTION_DAYS);
+        }
+        catch (err) {
+            this.logger.warn({ err }, "Event log prune failed");
+        }
+    }
+    openEventLog() {
+        const dbPath = join(this.dataDir, "events.db");
+        try {
+            return new EventLog(dbPath);
+        }
+        catch (err) {
+            this.logger.error({ err, dbPath }, "events.db unusable — moving it aside and starting a fresh one");
+            const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+            for (const suffix of ["", "-wal", "-shm"]) {
+                try {
+                    renameSync(`${dbPath}${suffix}`, `${dbPath}${suffix}.corrupt-${stamp}`);
+                }
+                catch { /* may not exist */ }
+            }
+            try {
+                return new EventLog(dbPath);
+            }
+            catch (retryErr) {
+                // History is worth losing; a fleet that won't start is not.
+                this.logger.error({ err: retryErr, dbPath }, "Could not open a fresh events.db — continuing without event logging");
+                return null;
+            }
+        }
+    }
+    /**
+     * Report a fleet-level fault (not attributable to one instance) to the General
+     * topic, so the operator learns about it without reading daemon.log.
+     *
+     * Throttled per distinct message: an unhandled rejection typically comes from a
+     * loop (a poller, a repeating timer), and one channel message per occurrence
+     * would bury the topic — which is worse than silence. First occurrence goes out
+     * immediately, repeats are suppressed for THROTTLE_MS and then re-sent with a
+     * count.
+     *
+     * The log line is written by the caller regardless: if every adapter is down,
+     * the only notification path is the one that is broken.
+     */
+    notifyFleetError(text) {
+        const now = Date.now();
+        const key = text.slice(0, 200);
+        const seen = this.fleetErrorNotices.get(key);
+        if (seen && now - seen.at < FleetManager.FLEET_ERROR_THROTTLE_MS) {
+            seen.suppressed++;
+            return;
+        }
+        const suppressed = seen?.suppressed ?? 0;
+        this.fleetErrorNotices.set(key, { at: now, suppressed: 0 });
+        // Bound the map: it is keyed by message text, and a message with a varying
+        // suffix (a path, an id) would otherwise grow it without limit.
+        if (this.fleetErrorNotices.size > 100) {
+            const oldest = this.fleetErrorNotices.keys().next().value;
+            if (oldest !== undefined)
+                this.fleetErrorNotices.delete(oldest);
+        }
+        const body = suppressed > 0
+            ? `${text}\n(plus ${suppressed} more in the last ${Math.round(FleetManager.FLEET_ERROR_THROTTLE_MS / 60_000)}m)`
+            : text;
+        // Resolved from config, NOT findGeneralInstance(): that requires a live daemon,
+        // and a fleet-level fault is exactly when the General may be down. The topic
+        // itself still exists, and notifyInstanceTopic only needs adapter + group +
+        // topic_id to post into it.
+        const general = Object.entries(this.fleetConfig?.instances ?? {})
+            .find(([, config]) => config.general_topic === true)?.[0];
+        if (general) {
+            this.notifyInstanceTopic(general, body);
+            return;
+        }
+        // No General instance — fall back to the primary channel's group.
+        const channelCfg = this.getChannelConfig();
+        const groupId = channelCfg?.group_id;
+        if (this.adapter && groupId) {
+            this.adapter.sendText(String(groupId), body)
+                .catch(err => this.logger.warn({ err }, "Failed to send fleet error notification"));
+            return;
+        }
+        this.logger.warn({ text: body }, "Fleet error had no notification target (no General instance, no adapter)");
+    }
+    static FLEET_ERROR_THROTTLE_MS = 10 * 60_000;
+    fleetErrorNotices = new Map();
+    notifyInstanceTopic(instanceName, text, extraOpts) {
+        const adapter = this.getAdapterForInstance(instanceName) ?? this.adapter;
+        if (!adapter)
+            return;
+        const channelCfg = this.getChannelConfig(this.getInstanceAdapterId(instanceName));
+        const groupId = channelCfg?.group_id;
+        // Fleet topic instance
+        const threadId = this.fleetConfig?.instances[instanceName]?.topic_id;
+        if (threadId != null && groupId) {
+            adapter.sendText(String(groupId), text, { threadId: String(threadId), ...extraOpts })
+                .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send instance topic notification"));
+            return;
+        }
+        // Classic instance: find its channelId from the classic manager
+        const classicChatId = this.classicChannels?.getChannelIdByInstance(instanceName);
+        if (classicChatId) {
+            adapter.sendText(classicChatId, text, extraOpts)
+                .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send classic notification"));
+            return;
+        }
+        // Fallback: send to group without threadId
+        if (groupId) {
+            adapter.sendText(String(groupId), text, extraOpts)
+                .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send notification (no topic)"));
+        }
+    }
+    // ── Cancel button ────────────────────────────────────────────────────
+    // Sent after delivering a user message to an instance; clicking it (or
+    // /cancel) sends Escape to the instance's pane to interrupt generation.
+    /** Send a "🛑 Cancel" button to the instance's topic/channel after delivery. */
+    /**
+     * Handle the DC `/save` slash command for both classic AND fleet-topic targets.
+     * Picks the backend-appropriate command (kiro → /chat save, claude → /export);
+     * unsupported backends get a clear error. Routes via classic paste or fleet IPC.
+     */
+    async handleSlashSave(data, adapterId) {
+        if (!this.classicChannels?.isAdmin(data.userId)) {
+            await data.respond(t("admin.required"));
+            return;
+        }
+        // Classic resolves per-bot (same-channel multi-bot); otherwise a fleet topic.
         const classicName = this.classicChannels.getInstanceByChannel(data.channelId, adapterId);
         const target = classicName
             ? { kind: "classic", name: classicName }
@@ -3521,6 +4438,40 @@ export class FleetManager {
         await data.respond(t("save.sent", cmd, target.name));
     }
     /** Whether the instance currently has at least one live cancel button. */
+    /**
+     * A click on a cancel button, whether or not the fleet still tracks it.
+     *
+     * The old rule was "act only while an entry is live", which made a click on a
+     * button the fleet had forgotten a silent no-op — no cancel, no message, not
+     * even a log line. That is indistinguishable from a broken button, and it is
+     * what the "按鈕點了沒反應" reports were: the entry is briefly absent while a
+     * button is being replaced, and a delete that fails leaves the message on
+     * screen with no entry at all.
+     *
+     * So: honour the click if the instance is actually running, and say so plainly
+     * if it is not. The stale-click path is rate-limited because the original
+     * concern was real — a second click must not fire a second interrupt key at an
+     * instance that has already started a new turn.
+     */
+    handleCancelClick(instanceName, adapter, data) {
+        if (this.hasCancelButton(instanceName)) {
+            this.cancelInstance(instanceName);
+            return;
+        }
+        const lastAt = this.staleCancelClickAt.get(instanceName) ?? 0;
+        if (Date.now() - lastAt < STALE_CANCEL_CLICK_COOLDOWN_MS)
+            return;
+        this.staleCancelClickAt.set(instanceName, Date.now());
+        // cancelInstance returns false when there is no daemon — i.e. nothing to
+        // cancel, which is the one case where the button really is dead.
+        if (this.cancelInstance(instanceName)) {
+            this.logger.info({ instanceName }, "Cancel click honoured with no live button entry");
+            return;
+        }
+        this.logger.info({ instanceName }, "Cancel click on an expired button — instance not running");
+        adapter?.editMessage(data.chatId, data.messageId, t("cancel.button_stale", instanceName), data.threadId)
+            .catch(() => { });
+    }
     hasCancelButton(instanceName) {
         for (const e of this.cancelButtons.values()) {
             if (e.instanceName === instanceName)
@@ -3529,15 +4480,22 @@ export class FleetManager {
         return false;
     }
     async sendCancelButton(instanceName, correlationId) {
-        // At most one button shown per instance: retire any existing ones first
-        // (delete + bounded retry). Each is tracked separately, so a failed delete
-        // here doesn't strand it — it keeps retrying on its own timer.
-        this.retireInstanceButtons(instanceName);
+        // Post first, retire after (see the tail of this method). Retiring up front
+        // meant that from the delete until the new message came back — a chat API
+        // round trip, and every reply goes through here — the instance had NO live
+        // entry, while the old button was still on screen. A click in that window
+        // hit `hasCancelButton() === false` and was silently dropped: the reported
+        // "按鈕失效". If notifyAlert then failed, the button was simply gone.
         const adapter = this.getAdapterForInstance(instanceName) ?? this.adapter;
         if (!adapter)
             return;
-        const adapterId = this.instanceWorldBinding.get(instanceName);
-        const groupId = this.getChannelConfig(adapterId)?.group_id;
+        // Resolve the group through the world fallback (first world when unbound),
+        // NOT through getChannelConfig(binding)?.group_id: on a fleet configured with
+        // `channels:` worlds the primary `channel:` block is empty, so an instance
+        // with no world binding yet (fresh restart, cross-instance delegation)
+        // resolved group_id to undefined and the button silently never appeared.
+        const adapterId = this.getInstanceAdapterId(instanceName);
+        const groupId = this.getGroupIdForInstance(instanceName) || undefined;
         const topicId = this.fleetConfig?.instances[instanceName]?.topic_id;
         let chatId;
         let threadId;
@@ -3553,8 +4511,12 @@ export class FleetManager {
             if (!chatId && groupId)
                 chatId = String(groupId);
         }
-        if (!chatId)
+        if (!chatId) {
+            // A button that cannot be addressed must say so — this exact silence is how
+            // "the cancel button sometimes never appears" stayed unreported-in-logs.
+            this.logger.warn({ instanceName, topicId, groupId }, "Cannot address cancel button (no chat id resolved)");
             return;
+        }
         try {
             const sent = await adapter.notifyAlert(chatId, {
                 type: "cancel",
@@ -3562,13 +4524,6 @@ export class FleetManager {
                 message: "👀 處理中…",
                 choices: [{ id: `cancel:${instanceName}`, label: t("cancel.button") }],
             }, threadId ? { threadId } : undefined);
-            // A concurrent sendCancelButton for the same instance may have posted its
-            // own button while we awaited notifyAlert. Retire any other buttons for
-            // this instance (not the one we just posted) so only the newest shows.
-            for (const other of this.cancelButtons.values()) {
-                if (other.instanceName === instanceName)
-                    this.retireButton(other);
-            }
             const entry = {
                 instanceName,
                 adapterId,
@@ -3577,7 +4532,16 @@ export class FleetManager {
                 threadId: sent.threadId ?? threadId,
                 correlationId,
                 retryCount: 0,
+                // Elapsed time is measured from when this button was posted — i.e. from
+                // when the work was handed over — not from the pane's working transition,
+                // which resets if the CLI blips idle mid-turn.
+                startedAt: Date.now(),
+                // Matches the text notifyAlert just posted, so the first 60s tick does
+                // not re-edit identical text — which put a "(edited)" mark on Discord
+                // with nothing visibly changed.
+                lastProgressText: "👀 處理中…",
             };
+            this.startProgressTicker(entry);
             // Idle-check backstop: every 5min, if the instance is idle, retire the
             // button. Covers turns that end without hitting a clear trigger (reply /
             // cancel / correlation). Cleared in discardButton when the entry is removed.
@@ -3586,18 +4550,167 @@ export class FleetManager {
                     clearInterval(entry.idleCheckTimer);
                     return;
                 }
-                if (this.getInstanceIdle(instanceName)) {
-                    this.logger.info({ instanceName, messageId: entry.messageId }, "Cancel button idle backstop retiring");
+                const reason = this.getInstanceIdle(instanceName) ? "idle"
+                    : this.stateReportDead(instanceName) ? "state reports stopped"
+                        : Date.now() - (entry.startedAt ?? 0) > CANCEL_BTN_MAX_LIFETIME_MS ? "24h ceiling"
+                            : null;
+                if (reason) {
+                    this.logger.info({ instanceName, messageId: entry.messageId, reason }, "Cancel button backstop retiring");
                     this.retireButton(entry);
+                    return;
                 }
+                // Still looks busy. The daemon only broadcasts on transitions, so ask for
+                // a fresh snapshot — a live daemon's answer refreshes receivedAt and keeps
+                // the staleness check honest; a dead one's silence is the evidence.
+                this.instanceIpcClients.get(instanceName)?.send({
+                    type: "query_instance_state", requestId: `cancel-btn-${Date.now()}`,
+                });
             }, CANCEL_BTN_IDLE_CHECK_INTERVAL_MS);
             this.cancelButtons.set(sent.messageId, entry);
+            // Only now: at most one button per instance, but never zero. Covers both
+            // the previous turn's button and any button a concurrent
+            // sendCancelButton posted while we were awaiting notifyAlert.
+            for (const other of [...this.cancelButtons.values()]) {
+                if (other.instanceName === instanceName && other.messageId !== sent.messageId) {
+                    this.retireButton(other);
+                }
+            }
+            this.persistCancelButtons();
             this.logger.info({ instanceName, messageId: sent.messageId }, "Cancel button sent");
         }
         catch (e) {
             this.logger.warn({ err: e.message, instanceName }, "Failed to send cancel button");
         }
     }
+    /**
+     * The cancel button's text for a given elapsed time.
+     *
+     * Below the threshold it keeps the original wording, so a normal quick answer
+     * looks exactly as it did before. Past it, the button doubles as the live
+     * progress indicator (#409) — the channel showed nothing at all during long work,
+     * and once the agent had replied once there was no sign it was still going.
+     */
+    static progressText(elapsedMs, activity, minElapsedMs = PROGRESS_MIN_ELAPSED_MS) {
+        if (elapsedMs < minElapsedMs)
+            return "👀 處理中…";
+        const totalSeconds = Math.floor(elapsedMs / 1000);
+        const minutes = Math.floor(totalSeconds / 60);
+        const seconds = totalSeconds % 60;
+        const elapsed = minutes >= 60
+            ? `${Math.floor(minutes / 60)}h ${minutes % 60}m`
+            : `${minutes}m ${String(seconds).padStart(2, "0")}s`;
+        const detail = FleetManager.sanitizeActivity(activity);
+        return detail
+            ? `⏳ 處理中… (已進行 ${elapsed} · ${detail})`
+            : `⏳ 處理中… (已進行 ${elapsed})`;
+    }
+    /**
+     * Make a tool summary safe to paste into a channel message.
+     *
+     * The text is agent-controlled (it is built from tool inputs — file paths,
+     * shell commands), so it gets flattened to one line, capped, and stripped of
+     * the two Discord mass-mention triggers. Neither channel renders it with a
+     * parse mode, so no markup escaping is needed beyond that.
+     */
+    static sanitizeActivity(activity) {
+        if (!activity)
+            return null;
+        const flat = activity.replace(/\s+/g, " ").replace(/@(everyone|here)/g, "@​$1").trim();
+        if (!flat)
+            return null;
+        return flat.length > PROGRESS_ACTIVITY_MAX_CHARS
+            ? `${flat.slice(0, PROGRESS_ACTIVITY_MAX_CHARS - 1)}…`
+            : flat;
+    }
+    /**
+     * Remember what an instance is currently doing, for the progress line.
+     *
+     * Best-effort by design: only backends that expose a live activity feed report
+     * anything, and the progress line simply omits the detail for the rest. It is
+     * never used to decide anything — purely what the user is shown.
+     */
+    cacheInstanceActivity(name, activity) {
+        if (activity)
+            this.instanceActivity.set(name, activity);
+        else
+            this.instanceActivity.delete(name);
+    }
+    /**
+     * Refresh the button's text in place while the instance keeps working.
+     *
+     * Uses `editAlert`, NOT `editMessage`: on Telegram the latter omits reply_markup,
+     * and the Bot API treats that as "clear the keyboard" — so editing with it would
+     * delete the very cancel button this is trying to keep alive.
+     */
+    /** Configured threshold before elapsed time appears, in ms. */
+    progressMinElapsedMs() {
+        const seconds = this.fleetConfig?.defaults
+            ?.progress_min_elapsed;
+        if (typeof seconds === "number" && Number.isFinite(seconds) && seconds >= 0) {
+            return seconds * 1000;
+        }
+        return PROGRESS_MIN_ELAPSED_MS;
+    }
+    startProgressTicker(entry) {
+        const tick = () => {
+            if (!this.cancelButtons.has(entry.messageId)) {
+                clearInterval(entry.progressTimer);
+                return;
+            }
+            const text = FleetManager.progressText(Date.now() - (entry.startedAt ?? Date.now()), this.instanceActivity.get(entry.instanceName), this.progressMinElapsedMs());
+            if (text === entry.lastProgressText)
+                return; // nothing changed — skip the API call
+            const adapter = this.getAdapterForInstance(entry.instanceName) ?? this.adapter;
+            if (!adapter?.editAlert)
+                return;
+            entry.lastProgressText = text;
+            adapter.editAlert(entry.chatId, entry.messageId, {
+                type: "cancel",
+                instanceName: entry.instanceName,
+                message: text,
+                choices: [{ id: `cancel:${entry.instanceName}`, label: t("cancel.button") }],
+            }, entry.threadId ? { threadId: entry.threadId } : undefined)
+                .catch(err => {
+                // A failed progress edit must never escalate: the button still works and
+                // the next tick retries. Common causes are a deleted message or a
+                // rate limit.
+                this.logger.debug({ err, instanceName: entry.instanceName }, "Progress edit failed");
+            });
+        };
+        entry.progressTimer = setInterval(tick, PROGRESS_UPDATE_INTERVAL_MS);
+        entry.progressTimer.unref?.();
+        // One extra tick right when the threshold passes, so a 30s threshold shows
+        // time at ~30s instead of waiting for the first 60s interval. Costs at most
+        // one additional edit per turn that lives past the threshold.
+        const firstAt = this.progressMinElapsedMs() - (Date.now() - (entry.startedAt ?? Date.now()));
+        if (firstAt > 0 && firstAt < PROGRESS_UPDATE_INTERVAL_MS) {
+            const firstTick = setTimeout(tick, firstAt);
+            firstTick.unref?.();
+        }
+    }
+    /**
+     * After a reply: give the instance REPLY_RETIRE_GRACE_MS to resume working; if
+     * it has not, retire its button. Re-arming replaces the previous timer, so a
+     * burst of replies ends with exactly one pending check.
+     */
+    armReplyGrace(instanceName) {
+        for (const entry of this.cancelButtons.values()) {
+            if (entry.instanceName !== instanceName)
+                continue;
+            if (entry.replyGraceTimer)
+                clearTimeout(entry.replyGraceTimer);
+            entry.replyGraceTimer = setTimeout(() => {
+                entry.replyGraceTimer = undefined;
+                if (!this.cancelButtons.has(entry.messageId))
+                    return;
+                if (!this.getInstanceIdle(instanceName))
+                    return; // resumed — a long run keeps its button
+                this.logger.info({ instanceName, messageId: entry.messageId }, "Cancel button retired — no work resumed after reply");
+                this.retireButton(entry);
+            }, REPLY_RETIRE_GRACE_MS);
+            entry.replyGraceTimer.unref?.();
+        }
+    }
     /** Retire (delete) every cancel button belonging to an instance. */
     retireInstanceButtons(instanceName) {
         // Snapshot first — retireButton may delete entries from the map on success.
@@ -3629,7 +4742,70 @@ export class FleetManager {
             clearTimeout(entry.retryTimer);
         if (entry.idleCheckTimer)
             clearInterval(entry.idleCheckTimer);
+        if (entry.progressTimer)
+            clearInterval(entry.progressTimer);
+        if (entry.replyGraceTimer)
+            clearTimeout(entry.replyGraceTimer);
         this.cancelButtons.delete(entry.messageId);
+        this.persistCancelButtons();
+    }
+    /**
+     * Mirror the live buttons to disk. The map is memory-only, so before this a
+     * fleet restart orphaned every button on screen: frozen "處理中…" text and a
+     * click that did nothing, forever. The ledger is tiny (a handful of rows) and
+     * written on every add/remove — no debounce needed at that rate.
+     */
+    persistCancelButtons() {
+        try {
+            const rows = [...this.cancelButtons.values()].map(e => ({
+                instanceName: e.instanceName,
+                adapterId: e.adapterId,
+                chatId: e.chatId,
+                messageId: e.messageId,
+                threadId: e.threadId,
+            }));
+            writeFileSync(join(this.dataDir, CANCEL_BTN_LEDGER_FILE), JSON.stringify(rows));
+        }
+        catch (err) {
+            this.logger.debug({ err }, "Cancel button ledger write failed");
+        }
+    }
+    /**
+     * Delete the previous process's buttons. Runs once adapters are up: nothing
+     * from a previous fleet process can still be mid-turn from this process's
+     * point of view, so every ledger row is an orphan by definition.
+     */
+    async sweepOrphanedCancelButtons() {
+        const ledgerPath = join(this.dataDir, CANCEL_BTN_LEDGER_FILE);
+        let rows;
+        try {
+            if (!existsSync(ledgerPath))
+                return;
+            rows = JSON.parse(readFileSync(ledgerPath, "utf-8"));
+        }
+        catch {
+            try {
+                unlinkSync(ledgerPath);
+            }
+            catch { /* corrupt ledger — drop it */ }
+            return;
+        }
+        for (const row of rows) {
+            const adapter = (row.adapterId ? this.worlds.get(row.adapterId)?.adapter : undefined)
+                ?? this.getAdapterForInstance?.(row.instanceName) ?? this.adapter;
+            if (!adapter?.deleteMessage)
+                continue;
+            try {
+                await adapter.deleteMessage(row.chatId, row.messageId, row.threadId);
+                this.logger.info({ instanceName: row.instanceName, messageId: row.messageId }, "Swept orphaned cancel button from previous run");
+            }
+            catch (err) {
+                // Best effort: the message may already be gone, or too old to delete.
+                this.logger.debug({ err, messageId: row.messageId }, "Orphaned cancel button sweep failed");
+            }
+        }
+        // The current process owns the ledger from here on.
+        this.persistCancelButtons();
     }
     /** Re-attempt a failed button delete up to CANCEL_BTN_MAX_RETRIES times. */
     scheduleButtonRetry(entry, err) {
@@ -3743,7 +4919,7 @@ export class FleetManager {
         const adapter = this.getAdapterForInstance(instanceName) ?? this.adapter;
         if (!adapter)
             return;
-        const channelCfg = this.getChannelConfig(this.instanceWorldBinding.get(instanceName));
+        const channelCfg = this.getChannelConfig(this.getInstanceAdapterId(instanceName));
         const groupId = channelCfg?.group_id;
         if (!groupId)
             return;
@@ -4294,6 +5470,12 @@ When users create specialized instances, suggest these configurations:
                 meta.image_path = saves[saves.length - 1][1].split(",")[0].trim();
             }
         }
+        // Classic channels queue reactions like everyone else (#432 stored them, but
+        // this path never attached them — reactions in a ClassicBot channel went into
+        // the DB and were never seen again). Same contract as the topic paths:
+        // consumed only after the delivery succeeded.
+        const reactions = this.pendingReactionsMeta(instanceName);
+        Object.assign(meta, reactions.meta);
         try {
             await this.deliverToInstance(instanceName, {
                 type: "fleet_inbound",
@@ -4301,6 +5483,7 @@ When users create specialized instances, suggest these configurations:
                 targetSession: instanceName,
                 meta,
             });
+            reactions.consume();
         }
         catch (err) {
             this.logger.warn({ err: err.message, instanceName }, "Classic wake/delivery failed");
@@ -4439,6 +5622,170 @@ When users create specialized instances, suggest these configurations:
         return env?.models ?? [];
     }
     /** `/model` slash handler (admin only). No arg → DC menu; `/model <name>` → apply directly. */
+    /** Label an effort choice, marking the one currently configured. */
+    effortChoiceLabel(level, current) {
+        return level === current ? `✓ ${level}` : level;
+    }
+    effortMenuHeader(instanceName) {
+        const { effort, source } = this.resolveInstanceEffort(instanceName);
+        if (!effort)
+            return "Current effort: (CLI default)";
+        return source === "fleet-default"
+            ? `Current effort: ${effort} (fleet default)`
+            : `Current effort: ${effort}`;
+    }
+    /** `/effort` — DC Select Menu, or apply directly when a level is given. */
+    async handleEffortSlash(data, adapterId) {
+        if (!this.isModelAdmin(data.userId, data.channelId, adapterId)) {
+            await data.respond(t("permission.denied"));
+            return;
+        }
+        const name = this.resolveSlashTarget(data.channelId, adapterId);
+        if (!name) {
+            await data.respond(t("classic.no_agent"));
+            return;
+        }
+        const requested = (typeof data.options?.level === "string" ? data.options.level.trim() : "")
+            || (data.text?.trim() ?? "");
+        if (requested) {
+            await data.respond(await this.applyEffort(name, requested));
+            return;
+        }
+        const levels = this.effortLevelsFor(name);
+        if (levels.length === 0) {
+            await data.respond(`❌ ${this.backendNameForInstance(name)} has no reasoning-effort setting.`);
+            return;
+        }
+        if (!data.respondChoices) {
+            await data.respond(`Usage: /effort <${levels.join("|")}>`);
+            return;
+        }
+        const current = this.resolveInstanceEffort(name).effort;
+        const nonce = randomBytes(6).toString("hex");
+        const choices = levels.map(l => ({
+            id: `${EFFORT_SELECT_CALLBACK_PREFIX}${nonce}:${l}`,
+            label: this.effortChoiceLabel(l, current),
+        }));
+        const timer = setTimeout(() => this.pendingEffortSelects.delete(nonce), CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
+        timer.unref?.();
+        this.pendingEffortSelects.set(nonce, { instanceName: name, userId: data.userId, channelId: data.channelId, timer, respond: data.respond });
+        try {
+            await data.respondChoices(`${this.effortMenuHeader(name)}\nSelect a new effort level:`, choices);
+        }
+        catch (err) {
+            this.pendingEffortSelects.delete(nonce);
+            clearTimeout(timer);
+            this.logger.warn({ err, instanceName: name }, "effort menu failed");
+            await data.respond(`Usage: /effort <${levels.join("|")}>`);
+        }
+    }
+    /** TG inline-keyboard effort menu. Returns null on success, else a fallback string. */
+    async promptEffortMenu(instanceName, userId, channelId, adapter, chatId, threadId) {
+        const levels = this.effortLevelsFor(instanceName);
+        if (levels.length === 0) {
+            return `❌ ${this.backendNameForInstance(instanceName)} has no reasoning-effort setting.`;
+        }
+        const current = this.resolveInstanceEffort(instanceName).effort;
+        const nonce = randomBytes(6).toString("hex");
+        const choices = levels.map(l => ({
+            id: `${EFFORT_SELECT_CALLBACK_PREFIX}${nonce}:${l}`,
+            label: this.effortChoiceLabel(l, current),
+        }));
+        const respond = async (text) => {
+            await adapter.sendText(chatId, text, { threadId });
+            return undefined;
+        };
+        const timer = setTimeout(() => {
+            const p = this.pendingEffortSelects.get(nonce);
+            if (p) {
+                this.pendingEffortSelects.delete(nonce);
+                p.respond("⏰ Effort selection expired.").catch(() => { });
+            }
+        }, CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
+        timer.unref?.();
+        this.pendingEffortSelects.set(nonce, { instanceName, userId, channelId, timer, respond, adapter, adapterChatId: chatId, adapterThreadId: threadId });
+        try {
+            const menuMessageId = await adapter.promptUser(chatId, `${this.effortMenuHeader(instanceName)}\nSelect a new effort level:`, choices, { threadId });
+            const pending = this.pendingEffortSelects.get(nonce);
+            if (pending)
+                pending.menuMessageId = menuMessageId;
+            return null;
+        }
+        catch (err) {
+            this.pendingEffortSelects.delete(nonce);
+            clearTimeout(timer);
+            this.logger.warn({ err, instanceName }, "TG effort menu failed");
+            return `Usage: /effort <${levels.join("|")}>`;
+        }
+    }
+    /** Consume an `/effort` selection callback. Mirrors handleModelSelection. */
+    async handleEffortSelection(data) {
+        if (!data.callbackData.startsWith(EFFORT_SELECT_CALLBACK_PREFIX))
+            return false;
+        const match = data.callbackData.match(/^effort-select:([0-9a-f]+):(.+)$/);
+        if (!match)
+            return true;
+        const pending = this.pendingEffortSelects.get(match[1]);
+        if (!pending)
+            return true;
+        if (data.userId && data.userId !== pending.userId)
+            return true;
+        const cbChannel = data.threadId ?? data.chatId;
+        if (cbChannel !== pending.channelId && data.chatId !== pending.channelId)
+            return true;
+        this.pendingEffortSelects.delete(match[1]);
+        clearTimeout(pending.timer);
+        const level = match[2];
+        const progressText = `⏳ Setting ${pending.instanceName} effort to \`${level}\`…`;
+        let progressMsgId;
+        if (pending.adapter && pending.adapterChatId) {
+            const menuMessageId = pending.menuMessageId ?? data.messageId;
+            if (menuMessageId && pending.adapter.editMessageRemoveButtons) {
+                try {
+                    await pending.adapter.editMessageRemoveButtons(pending.adapterChatId, menuMessageId, progressText, pending.adapterThreadId);
+                    progressMsgId = menuMessageId;
+                }
+                catch { /* fall back to a new message */ }
+            }
+            if (!progressMsgId) {
+                try {
+                    const sent = await pending.adapter.sendText(pending.adapterChatId, progressText, { threadId: pending.adapterThreadId });
+                    progressMsgId = sent.messageId;
+                }
+                catch { /* non-fatal */ }
+            }
+        }
+        else {
+            await pending.respond(progressText).catch(() => { });
+        }
+        // Background-applied and guarded for the same reason as the model path: a
+        // restart backend respawns the instance here, and an unguarded rejection
+        // from a menu click must not take the fleet down.
+        void (async () => {
+            let result;
+            try {
+                result = await this.applyEffort(pending.instanceName, level);
+            }
+            catch (err) {
+                this.logger.error({ err, instance: pending.instanceName, level }, "Effort switch failed");
+                result = `Effort switch to \`${level}\` failed: ${err instanceof Error ? err.message : String(err)}`;
+            }
+            if (pending.adapter && pending.adapterChatId) {
+                if (progressMsgId) {
+                    pending.adapter.editMessage(pending.adapterChatId, progressMsgId, result, pending.adapterThreadId).catch(() => {
+                        pending.adapter.sendText(pending.adapterChatId, result, { threadId: pending.adapterThreadId }).catch(() => { });
+                    });
+                }
+                else {
+                    pending.adapter.sendText(pending.adapterChatId, result, { threadId: pending.adapterThreadId }).catch(() => { });
+                }
+            }
+            else {
+                await pending.respond(result).catch(() => { });
+            }
+        })();
+        return true;
+    }
     async handleModelSlash(data, adapterId) {
         if (!this.isModelAdmin(data.userId, data.channelId, adapterId)) {
             await data.respond(t("permission.denied"));
@@ -4575,9 +5922,19 @@ When users create specialized instances, suggest these configurations:
             // DC path: respond immediately with progress text
             await pending.respond(progressText).catch(() => { });
         }
-        // Apply model in background — don't await here (keeps callback handler fast)
+        // Apply model in background — don't await here (keeps callback handler fast).
+        // Guarded: applyModel() restarts the instance, and an unguarded rejection here
+        // meant a user picking from the /model menu could take the whole fleet down.
+        // On failure the user gets told, rather than the click silently doing nothing.
         void (async () => {
-            const result = await this.applyModel(pending.instanceName, model);
+            let result;
+            try {
+                result = await this.applyModel(pending.instanceName, model);
+            }
+            catch (err) {
+                this.logger.error({ err, instance: pending.instanceName, model }, "Model switch failed");
+                result = `Model switch to \`${model}\` failed: ${err instanceof Error ? err.message : String(err)}`;
+            }
             if (pending.adapter && pending.adapterChatId) {
                 if (progressMsgId) {
                     pending.adapter.editMessage(pending.adapterChatId, progressMsgId, result, pending.adapterThreadId).catch(() => {
@@ -4595,6 +5952,110 @@ When users create specialized instances, suggest these configurations:
         return true;
     }
     /** Apply a model to an instance: runtime paste (claude-code) or persist + restart (others). */
+    /** AgEnD's canonical effort ladder, low → max. Backends expose a subset. */
+    static EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
+    /** How this instance's backend applies an effort change. */
+    effortStrategyFor(instanceName) {
+        try {
+            const backend = createBackend(this.backendNameForInstance(instanceName), this.getInstanceDir(instanceName));
+            const strategy = backend.getEffortStrategy?.() ?? "unsupported";
+            // A backend claiming support but listing no levels is unusable either way.
+            return strategy !== "unsupported" && (backend.getEffortLevels?.() ?? []).length > 0
+                ? strategy
+                : "unsupported";
+        }
+        catch {
+            return "unsupported";
+        }
+    }
+    /** Effort levels this instance's backend actually accepts (empty = unsupported). */
+    effortLevelsFor(instanceName) {
+        try {
+            const backend = createBackend(this.backendNameForInstance(instanceName), this.getInstanceDir(instanceName));
+            if ((backend.getEffortStrategy?.() ?? "unsupported") === "unsupported")
+                return [];
+            return backend.getEffortLevels?.() ?? [];
+        }
+        catch {
+            return [];
+        }
+    }
+    /** Configured effort for an instance: per-instance, else fleet default, else none. */
+    resolveInstanceEffort(instanceName) {
+        const own = this.fleetConfig?.instances[instanceName]?.effort;
+        if (own)
+            return { effort: own, source: "instance" };
+        const fallback = this.fleetConfig?.defaults?.effort;
+        if (fallback)
+            return { effort: fallback, source: "fleet-default" };
+        return { effort: null, source: "unset" };
+    }
+    /**
+     * Clamp a canonical level to the nearest one this backend supports.
+     *
+     * Clamping DOWN the ladder, never up: asking for `max` on a CLI that stops at
+     * `high` should get high, not silently fall to low. The caller reports the
+     * clamp — a user who asks for max and quietly receives high has been told the
+     * request succeeded when it did not.
+     */
+    static clampEffort(level, supported) {
+        if (supported.includes(level))
+            return level;
+        const ladder = FleetManager.EFFORT_LEVELS;
+        const wanted = ladder.indexOf(level);
+        if (wanted < 0)
+            return null;
+        for (let i = wanted - 1; i >= 0; i--) {
+            if (supported.includes(ladder[i]))
+                return ladder[i];
+        }
+        return supported[0] ?? null;
+    }
+    /**
+     * Apply a reasoning-effort level, mirroring applyModel's shape.
+     *
+     * runtime backends take `/effort <level>` in the pane and keep working;
+     * restart backends only read it at launch, so it is persisted and the
+     * instance respawns.
+     */
+    async applyEffort(instanceName, requested) {
+        const level = requested.trim().toLowerCase();
+        const backendName = this.backendNameForInstance(instanceName);
+        let strategy = "unsupported";
+        let supported = [];
+        try {
+            const backend = createBackend(backendName, this.getInstanceDir(instanceName));
+            strategy = backend.getEffortStrategy?.() ?? "unsupported";
+            supported = backend.getEffortLevels?.() ?? [];
+        }
+        catch { /* treated as unsupported below */ }
+        if (strategy === "unsupported" || supported.length === 0) {
+            return `❌ ${backendName} has no reasoning-effort setting.`;
+        }
+        if (!FleetManager.EFFORT_LEVELS.includes(level)) {
+            return `❌ Unknown effort level \`${level}\`. Use: ${FleetManager.EFFORT_LEVELS.join(", ")}.`;
+        }
+        const applied = FleetManager.clampEffort(level, supported);
+        if (!applied)
+            return `❌ ${backendName} accepts none of the canonical effort levels.`;
+        const warn = applied === level
+            ? ""
+            : `⚠️ Clamped to \`${applied}\` (\`${level}\` not supported by ${backendName}).\n`;
+        // Persist either way: a runtime switch must survive the next respawn too,
+        // or the instance silently reverts on restart.
+        if (this.fleetConfig?.instances[instanceName]) {
+            this.fleetConfig.instances[instanceName].effort = applied;
+            this.saveFleetConfig();
+        }
+        if (strategy === "runtime") {
+            if (!this.instanceIpcClients.get(instanceName))
+                return `${warn}❌ ${instanceName} is not running.`;
+            this.pasteRawToClassicInstance(instanceName, `/effort ${applied}`);
+            return `${warn}✅ Set ${instanceName} effort to \`${applied}\` (runtime).`;
+        }
+        await this.restartSingleInstance(instanceName);
+        return `${warn}✅ Set ${instanceName} effort to \`${applied}\` and restarted.`;
+    }
     async applyModel(instanceName, model) {
         const backendName = this.backendNameForInstance(instanceName);
         let strategy = "restart";
@@ -4607,7 +6068,7 @@ When users create specialized instances, suggest these configurations:
             if (!this.instanceIpcClients.get(instanceName))
                 return `${warn}❌ ${instanceName} is not running.`;
             this.pasteRawToClassicInstance(instanceName, `/model ${model}`);
-            return `${warn}✅ Switched ${instanceName} to \`${model}\` (runtime).`;
+            return `${warn}✅ Switched ${instanceName} to \`${model}\` (runtime).${this.effortSuffix(instanceName)}`;
         }
         // restart: persist the model so the respawned CLI launches with it.
         let persisted = false;
@@ -4622,7 +6083,24 @@ When users create specialized instances, suggest these configurations:
         if (!persisted)
             return `${warn}❌ Could not set model for ${instanceName}.`;
         await this.restartSingleInstance(instanceName);
-        return `${warn}✅ Set ${instanceName} to \`${model}\` and restarted.`;
+        return `${warn}✅ Set ${instanceName} to \`${model}\` and restarted.${this.effortSuffix(instanceName)}`;
+    }
+    /**
+     * The trailing "Current effort: …" line for a /model reply.
+     *
+     * Model and effort interact (a cheaper model at max effort is a different
+     * trade than a bigger one at low), so showing the effort in force right after
+     * a switch saves the round trip of asking. Empty when the backend has none.
+     */
+    effortSuffix(instanceName) {
+        if (this.effortLevelsFor(instanceName).length === 0)
+            return "";
+        const { effort, source } = this.resolveInstanceEffort(instanceName);
+        if (!effort)
+            return "\nCurrent effort: (CLI default)";
+        return source === "fleet-default"
+            ? `\nCurrent effort: ${effort} (fleet default)`
+            : `\nCurrent effort: ${effort}`;
     }
     /** Read recent chat log for agent context */
     getRecentChatLog(instanceName, maxLines = 10) {
@@ -4857,11 +6335,28 @@ When users create specialized instances, suggest these configurations:
         this.logger.info({ channelId, adapterId, instanceName: ch.instanceName }, "Classic channel stopped");
         return t("classic.stopped");
     }
-    async stopAll() {
+    /**
+     * Idempotent while in flight: SIGINT and SIGTERM share one handler and the
+     * uncaughtException path calls this too, so overlapping runs were possible —
+     * each snapshotting the daemon map and calling stop() on the same daemons
+     * concurrently. Deliberately NOT `async`, so callers receive the same promise
+     * object rather than a fresh wrapper around it. The latch clears when the run
+     * settles, so a later genuine stop (after a restart) still does the work.
+     */
+    stopAll() {
+        this.stopAllInFlight ??= this.doStopAll().finally(() => { this.stopAllInFlight = null; });
+        return this.stopAllInFlight;
+    }
+    stopAllInFlight = null;
+    async doStopAll() {
         this.startupComplete = false;
         this.reloadPending = false;
+        // Before anything is stopped: everything that dies from here on dies
+        // because we asked it to. Set synchronously — doStopAll runs to its first
+        // await in the same tick as the signal handler, so no event can slip in.
+        this.shuttingDown = true;
         this.ipcStoppingInstances.add("__fleet_stopping__");
-        sdNotify("STOPPING=1");
+        sdNotifyBlocking("STOPPING=1");
         if (this.watchdogTimer) {
             clearInterval(this.watchdogTimer);
             this.watchdogTimer = null;
@@ -4881,6 +6376,29 @@ When users create specialized instances, suggest these configurations:
             clearInterval(this.updateCheckTimer);
             this.updateCheckTimer = null;
         }
+        if (this.eventLogPruneTimer) {
+            clearInterval(this.eventLogPruneTimer);
+            this.eventLogPruneTimer = null;
+        }
+        if (this.logRotateTimer) {
+            clearInterval(this.logRotateTimer);
+            this.logRotateTimer = null;
+        }
+        // Cancel-button timers were never cleared here. The idle-check interval is not
+        // unref'd, so it held the event loop open past shutdown and kept retrying
+        // deletes against an adapter that was already gone.
+        for (const entry of [...this.cancelButtons.values()]) {
+            if (entry.retryTimer)
+                clearTimeout(entry.retryTimer);
+            if (entry.idleCheckTimer)
+                clearInterval(entry.idleCheckTimer);
+            if (entry.progressTimer)
+                clearInterval(entry.progressTimer);
+        }
+        this.cancelButtons.clear();
+        for (const timer of this.cancelButtonIdleRetireTimers.values())
+            clearTimeout(timer);
+        this.cancelButtonIdleRetireTimers.clear();
         if (this.topicCleanupTimer) {
             clearInterval(this.topicCleanupTimer);
             this.topicCleanupTimer = null;
@@ -4937,6 +6455,7 @@ When users create specialized instances, suggest these configurations:
         this.controlClient?.stop();
         this.controlClient = null;
         if (this.healthServer) {
+            this.healthServerListening = false;
             this.healthServer.close();
             this.healthServer = null;
         }
@@ -4948,6 +6467,9 @@ When users create specialized instances, suggest these configurations:
         catch (e) {
             this.logger.debug({ err: e }, "Failed to remove fleet PID file");
         }
+        // The lock contains a nonce, so an older/shutting-down process can never
+        // remove a lock acquired by a newer fleet owner.
+        releaseProcessFleetLock();
     }
     /**
      * Prune stale external sessions by re-querying each daemon for live sessions.
@@ -5099,6 +6621,15 @@ When users create specialized instances, suggest these configurations:
                 removedRatio,
                 validationErrors: validation.errors,
             }, "Refusing unsafe fleet config reload; running configuration was kept");
+            // Tell the operator. A silently ignored config edit is the most confusing
+            // possible outcome: they change fleet.yaml, send SIGHUP, and nothing happens
+            // with no explanation anywhere they are looking.
+            const why = !validation.valid
+                ? `validation failed:\n${validation.errors.map(e => `• ${e.path}: ${e.message}`).join("\n")}`
+                : unsafeEmpty
+                    ? `it removed every instance (${oldCount} → 0)`
+                    : `it removed more than half the instances (${oldCount} → ${newCount})`;
+            this.notifyFleetError(`⚠️ fleet.yaml reload REJECTED — ${why}\nThe previous configuration is still running.`);
             return;
         }
         this.routing.rebuild(this.fleetConfig);
@@ -5182,6 +6713,10 @@ When users create specialized instances, suggest these configurations:
             clearTimeout(timeoutHandle);
         }
         this.logger.info("All instances idle — restarting...");
+        const restartStartedAt = Date.now();
+        // Capture the live adapter/topic before General's daemon is stopped. The
+        // channel adapter remains connected throughout an in-process restart.
+        const progressTarget = this.restartProgressTarget();
         this.clearStatuslineWatchers();
         for (const [, ipc] of this.instanceIpcClients) {
             await ipc.close();
@@ -5206,15 +6741,25 @@ When users create specialized instances, suggest these configurations:
         const fleet = this.loadConfig(this.configPath);
         this.fleetConfig = fleet;
         const topicMode = fleet.channel?.mode === "topic" || !!fleet.channels?.some(ch => ch.mode === "topic");
+        const restartProgress = new RestartProgress(this.runnableStartupCount(fleet, topicMode), restartStartedAt, this.logger);
         // Phase 1: generals first
         const restartEntries = Object.entries(fleet.instances);
         const restartGenerals = restartEntries.filter(([_, cfg]) => cfg.general_topic);
         const restartOthers = restartEntries.filter(([_, cfg]) => !cfg.general_topic);
         for (const [name, cfg] of restartGenerals) {
-            await this.startInstance(name, cfg, topicMode).catch(err => this.logger.error({ err, name }, "Failed to start general instance"));
+            try {
+                await this.startInstance(name, cfg, topicMode);
+                if (this.daemons.has(name))
+                    restartProgress.markReady();
+            }
+            catch (err) {
+                this.logger.error({ err, name }, "Failed to start general instance");
+            }
         }
+        // General is ready again; now its topic can own the live progress message.
+        await restartProgress.start(progressTarget);
         if (restartOthers.length > 0) {
-            await this.startInstancesWithConcurrency(restartOthers, topicMode);
+            await this.startInstancesWithConcurrency(restartOthers, topicMode, () => restartProgress.markReady());
         }
         if (topicMode) {
             this.routing.rebuild(this.fleetConfig);
@@ -5223,12 +6768,22 @@ When users create specialized instances, suggest these configurations:
             // Restart classic channel instances (killed during orphan cleanup)
             if (this.classicChannels) {
                 const fleetBackend = this.fleetConfig?.defaults?.backend;
-                const channels = this.classicChannels.getAll();
+                const channels = this.classicChannels.getAll()
+                    .filter(ch => !this.lifecycle.isPaused(ch.instanceName));
                 const concurrency = 3;
                 let idx = 0;
                 while (idx < channels.length) {
                     const batch = channels.slice(idx, idx + concurrency);
-                    await Promise.allSettled(batch.map(ch => this.startClassicInstance(ch.instanceName, this.classicChannels.getBackendByInstance(ch.instanceName, fleetBackend), this.classicChannels.getPreTaskCommand(ch.channelId, ch.adapterId), this.classicChannels.getModel(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.model), this.classicChannels.getAutoPauseAfter(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.auto_pause_after)).catch(err => this.logger.warn({ err, instanceName: ch.instanceName }, "Failed to start classic instance"))));
+                    await Promise.allSettled(batch.map(async (ch) => {
+                        try {
+                            await this.startClassicInstance(ch.instanceName, this.classicChannels.getBackendByInstance(ch.instanceName, fleetBackend), this.classicChannels.getPreTaskCommand(ch.channelId, ch.adapterId), this.classicChannels.getModel(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.model), this.classicChannels.getAutoPauseAfter(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.auto_pause_after));
+                            if (this.daemons.has(ch.instanceName))
+                                restartProgress.markReady();
+                        }
+                        catch (err) {
+                            this.logger.warn({ err, instanceName: ch.instanceName }, "Failed to start classic instance");
+                        }
+                    }));
                     idx += concurrency;
                 }
             }
@@ -5237,15 +6792,23 @@ When users create specialized instances, suggest these configurations:
             }
         }
         this.logger.info("Graceful restart complete");
+        const configuredNames = this.configuredStartupInstanceNames(fleet, topicMode);
+        const total = configuredNames.length;
+        const started = configuredNames.filter(name => this.daemons.has(name)).length;
+        const allNotRunning2 = configuredNames.filter(name => !this.daemons.has(name));
+        const pausedNames2 = allNotRunning2.filter(n => this.lifecycle.isPaused(n));
+        const failedNames = allNotRunning2.filter(n => !this.lifecycle.isPaused(n));
+        const { createRequire } = await import("node:module");
+        const _require2 = createRequire(import.meta.url);
+        const agendVersion2 = _require2("../package.json").version ?? "unknown";
+        const progressCompleted = await restartProgress.finish({
+            running: started,
+            total,
+            version: agendVersion2,
+            pausedNames: pausedNames2,
+            failedNames,
+        });
         if (groupId && this.adapter) {
-            const total = Object.keys(fleet.instances).length;
-            const started = this.daemons.size;
-            const allNotRunning2 = Object.keys(fleet.instances).filter(n => !this.daemons.has(n));
-            const pausedNames2 = allNotRunning2.filter(n => this.lifecycle.isPaused(n));
-            const failedNames = allNotRunning2.filter(n => !this.lifecycle.isPaused(n));
-            const { createRequire } = await import("node:module");
-            const _require2 = createRequire(import.meta.url);
-            const agendVersion2 = _require2("../package.json").version ?? "unknown";
             let restartText;
             if (failedNames.length === 0 && pausedNames2.length === 0) {
                 restartText = t("fleet.ready", started, total, agendVersion2);
@@ -5257,8 +6820,10 @@ When users create specialized instances, suggest these configurations:
                 restartText = t("fleet.ready_with_failed", started, total, agendVersion2, failedNames.join(", "))
                     + (pausedNames2.length > 0 ? `\n⏸ Paused: ${pausedNames2.join(", ")}` : "");
             }
-            await this.adapter.sendText(String(groupId), restartText, notifyOpts)
-                .catch(e => this.logger.warn({ err: e }, "Failed to post restart completion notification"));
+            if (!progressCompleted) {
+                await this.adapter.sendText(String(groupId), restartText, notifyOpts)
+                    .catch(e => this.logger.warn({ err: e }, "Failed to post restart completion notification"));
+            }
             // Notify each instance's channel — staggered to avoid rate limit storm
             const instances = Object.entries(this.fleetConfig?.instances ?? {});
             this.logger.info({ count: instances.length }, "Sending restart notification to instances (staggered)");
@@ -5298,10 +6863,20 @@ When users create specialized instances, suggest these configurations:
     // ── Update check ────────────────────────────────────────────────────
     async checkForUpdates() {
         try {
-            const { execSync } = await import("node:child_process");
+            // Both npm lookups are async: as execSync they froze the fleet event loop for
+            // up to 15s each, and on a beta build BOTH ran — 30s with no WATCHDOG ping,
+            // past WatchdogSec's half-interval and enough for systemd to SIGABRT the fleet
+            // for a background version check.
+            const { execFile } = await import("node:child_process");
+            const { promisify } = await import("node:util");
+            const execFileP = promisify(execFile);
+            const npmVersion = async (spec) => {
+                const { stdout } = await execFileP("npm", ["view", spec, "version"], { timeout: 15_000 });
+                return stdout.toString().trim();
+            };
             const pkgPath = join(dirname(fileURLToPath(import.meta.url)), "..", "package.json");
             const currentVersion = JSON.parse(readFileSync(pkgPath, "utf-8")).version ?? "0.0.0";
-            const latest = execSync("npm view @songsid/agend version", { stdio: "pipe", timeout: 15_000 }).toString().trim();
+            const latest = await npmVersion("@songsid/agend");
             let target = latest;
             if (currentVersion.includes("-beta")) {
                 // Beta users track the @beta channel (never fall back to @latest, which is
@@ -5309,7 +6884,7 @@ When users create specialized instances, suggest these configurations:
                 // of beta/latest is the newest.
                 let beta = "";
                 try {
-                    beta = execSync("npm view @songsid/agend@beta version", { stdio: "pipe", timeout: 15_000 }).toString().trim();
+                    beta = await npmVersion("@songsid/agend@beta");
                 }
                 catch { /* no beta tag */ }
                 target = beta || latest;
@@ -5383,28 +6958,22 @@ When users create specialized instances, suggest these configurations:
     // ── Health HTTP endpoint ─────────────────────────────────────────────
     startHealthServer(port) {
         this.startedAt = Date.now();
-        // Generate web token before server starts so auth is enforced from the first request.
-        this.webToken = randomBytes(24).toString("hex");
-        const tokenPath = join(this.dataDir, "web.token");
-        writeFileSync(tokenPath, this.webToken, { mode: 0o600 });
-        // Defensive: if file existed previously with looser perms, tighten it.
-        try {
-            chmodSync(tokenPath, 0o600);
-        }
-        catch {
-            // best-effort
-        }
-        // Separate read-only token for the /view page: grants terminal-view + profile
-        // read, but never write (POSTs still require the full web token).
-        this.viewToken = randomBytes(24).toString("hex");
-        const viewTokenPath = join(this.dataDir, "view.token");
-        writeFileSync(viewTokenPath, this.viewToken, { mode: 0o600 });
-        try {
-            chmodSync(viewTokenPath, 0o600);
-        }
-        catch { /* best-effort */ }
+        this.healthServerListening = false;
+        this.healthPortRetried = false;
+        // Defensive for direct/unit callers; normal startup initializes these before adapters.
+        if (!this.webToken || !this.viewToken)
+            this.initializeWebAuthTokens();
         this.healthServer = createServer((req, res) => {
             res.setHeader("Content-Type", "application/json");
+            const requestPath = new URL(req.url ?? "/", `http://localhost:${port}`).pathname;
+            // Browsers request this automatically and AgEnD does not ship an icon.
+            // It is neither user data nor an API route, so do not turn the harmless
+            // probe into a noisy web-token 401 in the browser console.
+            if (req.method === "GET" && requestPath === "/favicon.ico") {
+                res.writeHead(204);
+                res.end();
+                return;
+            }
             // Public health probe — no auth required.
             if (req.method === "GET" && req.url === "/health") {
                 // fallthrough to existing handler below
@@ -5416,6 +6985,10 @@ When users create specialized instances, suggest these configurations:
                 // /view routes accept the read-only view.token (or web.token) and do
                 // their own per-method auth in view-api.ts — skip the web-token gate.
             }
+            else if (isUsagePath(new URL(req.url ?? "/", `http://localhost:${port}`).pathname)) {
+                // /api/ai-usage is read-only GET data for the /view Usage panel — open
+                // like the other /view data routes (usage-api.ts rejects non-GET).
+            }
             else {
                 // All other endpoints require a valid token (query ?token= or X-Agend-Token header).
                 // /ui/* will also re-check in web-api.ts, which is harmless.
@@ -5425,39 +6998,39 @@ When users create specialized instances, suggest these configurations:
                     ?? (typeof headerToken === "string" ? headerToken : null);
                 if (!this.webToken || providedToken !== this.webToken) {
                     res.writeHead(401);
-                    res.end(JSON.stringify({ error: "Unauthorized" }));
+                    res.end(JSON.stringify({ error: WEB_TOKEN_INVALID_MESSAGE }));
                     return;
                 }
             }
             if (req.method === "GET" && req.url === "/health") {
-                const instanceCount = this.fleetConfig?.instances
-                    ? Object.keys(this.fleetConfig.instances).length
-                    : 0;
-                res.writeHead(200);
-                res.end(JSON.stringify({
-                    status: "ok",
-                    instances: instanceCount,
-                    uptime: Math.floor((Date.now() - this.startedAt) / 1000),
-                }));
+                const health = this.getFleetHealth();
+                // 503 when the fleet cannot do its job, so an external monitor sees it.
+                // This used to always answer 200 "ok" with a count of CONFIGURED instances,
+                // so every agent could be dead and every adapter down and it still looked
+                // green.
+                res.writeHead(health.status === "ok" ? 200 : 503);
+                res.end(JSON.stringify(health));
                 return;
             }
             if (req.method === "GET" && req.url === "/status") {
                 const instances = Object.keys(this.fleetConfig?.instances ?? {}).map(name => {
                     const statusFile = join(this.getInstanceDir(name), "statusline.json");
-                    let context_pct = 0;
                     let cost = 0;
                     try {
                         const data = JSON.parse(readFileSync(statusFile, "utf-8"));
-                        context_pct = data.context_window?.used_percentage ?? 0;
                         cost = data.cost?.total_cost_usd ?? 0;
                     }
                     catch (err) {
                         this.logger.debug({ err, name }, "statusline.json read failed (/status)");
                     }
+                    const backend = this.fleetConfig?.instances[name]?.backend
+                        ?? this.fleetConfig?.defaults?.backend
+                        ?? "claude-code";
+                    const { context } = resolveInstanceContext(this.dataDir, name, backend);
                     return {
                         name,
                         status: this.getInstanceStatus(name),
-                        context_pct,
+                        context_pct: context ?? 0,
                         cost,
                     };
                 });
@@ -5563,7 +7136,7 @@ When users create specialized instances, suggest these configurations:
                 (async () => {
                     try {
                         const topicMode = this.fleetConfig?.channel?.mode === "topic";
-                        await this.startInstance(name, config, topicMode ?? false);
+                        await this.startInstance(name, config, topicMode ?? false, "fleet-topic", true);
                         this.emitSseEvent("status", this.getUiStatus());
                         res.writeHead(200);
                         res.end(JSON.stringify({ ok: true }));
@@ -5572,7 +7145,10 @@ When users create specialized instances, suggest these configurations:
                         res.writeHead(500);
                         res.end(JSON.stringify({ error: `Start failed: ${err.message}` }));
                     }
-                })();
+                    // The inner catch can itself throw (writeHead after a successful
+                    // writeHead is ERR_HTTP_HEADERS_SENT), and that rejection escapes the
+                    // IIFE. Same for the two handlers below.
+                })().catch(err => this.logger.error({ err, name }, "HTTP start handler failed"));
                 return;
             }
             // Instance restart (immediate, no idle wait)
@@ -5593,7 +7169,7 @@ When users create specialized instances, suggest these configurations:
                         res.writeHead(status);
                         res.end(JSON.stringify({ error: `Restart failed: ${err.message}` }));
                     }
-                })();
+                })().catch(err => this.logger.error({ err, name }, "HTTP restart handler failed"));
                 return;
             }
             if (req.method === "POST" && req.url?.startsWith("/stop/")) {
@@ -5616,7 +7192,7 @@ When users create specialized instances, suggest these configurations:
                         res.writeHead(500);
                         res.end(JSON.stringify({ error: `Stop failed: ${err.message}` }));
                     }
-                })();
+                })().catch(err => this.logger.error({ err, name }, "HTTP stop handler failed"));
                 return;
             }
             // ── Agent CLI endpoint ─────
@@ -5628,6 +7204,8 @@ When users create specialized instances, suggest these configurations:
             const url = new URL(req.url ?? "/", `http://localhost:${port}`);
             if (handleViewRequest(req, res, url, this))
                 return;
+            if (handleUsageRequest(req, res, url, this))
+                return;
             if (handleSettingsRequest(req, res, url, this))
                 return;
             if (handleWebRequest(req, res, url, this))
@@ -5635,10 +7213,20 @@ When users create specialized instances, suggest these configurations:
             res.writeHead(404);
             res.end(JSON.stringify({ error: "not found" }));
         });
+        const markListening = (afterTakeover = false) => {
+            this.healthServerListening = true;
+            this.logger.info({ port }, afterTakeover
+                ? "Health endpoint listening (after takeover)"
+                : "Health endpoint listening");
+            this.logger.info({ url: `http://localhost:${port}/ui?token=${this.webToken}` }, "Web UI available");
+            this.logger.info({ url: `http://localhost:${port}/view?token=${this.viewToken}` }, "Web View available");
+        };
         this.healthServer.on("error", (err) => {
+            this.healthServerListening = false;
             if (err.code === "EADDRINUSE") {
                 if (this.healthPortRetried) {
-                    this.logger.debug({ port }, "Health port still in use after takeover — skipping health endpoint");
+                    this.logger.error({ err, port }, "Health port still in use after takeover — dashboard disabled");
+                    this.notifyFleetError(`⚠️ Dashboard unavailable — health port ${port} is already in use. Stop the conflicting process or configure a different health_port.`);
                     return;
                 }
                 this.healthPortRetried = true;
@@ -5659,35 +7247,45 @@ When users create specialized instances, suggest these configurations:
                 setTimeout(() => {
                     if (!this.healthServer)
                         return;
-                    this.healthServer.listen(port, "127.0.0.1", () => {
-                        this.logger.info({ port }, "Health endpoint listening (after takeover)");
-                    });
+                    this.healthServer.listen(port, "127.0.0.1", () => markListening(true));
                 }, 1500);
                 return;
             }
             this.logger.error({ err, port }, "Health server error");
+            this.notifyFleetError(`⚠️ Dashboard unavailable — health server failed: ${err.message}`);
         });
-        this.healthServer.listen(port, "127.0.0.1", () => {
-            this.logger.info({ port }, "Health endpoint listening");
-        });
-        this.logger.info({ url: `http://localhost:${port}/ui?token=${this.webToken}` }, "Web UI available");
-        this.logger.info({ url: `http://localhost:${port}/view?token=${this.viewToken}` }, "Web View available");
+        this.healthServer.listen(port, "127.0.0.1", () => markListening());
     }
     getUiStatus() {
-        const instances = Object.keys(this.fleetConfig?.instances ?? {}).map(name => {
+        const fleetNames = Object.keys(this.fleetConfig?.instances ?? {});
+        // Classic rooms live only in classicBot.yaml — /api/profiles merges them into
+        // the View roster, but previously getUiStatus skipped them so context_pct was
+        // always 0 (live map miss → l?.context_pct ?? 0).
+        const classicOnly = (this.classicChannels?.getAll() ?? [])
+            .map(ch => ch.instanceName)
+            .filter(name => !fleetNames.includes(name));
+        const names = [...fleetNames, ...classicOnly];
+        const instances = names.map(name => {
             const statusFile = join(this.getInstanceDir(name), "statusline.json");
-            let context_pct = 0;
             let cost = 0;
             let model = "";
             try {
                 const data = JSON.parse(readFileSync(statusFile, "utf-8"));
-                context_pct = data.context_window?.used_percentage ?? 0;
                 cost = data.cost?.total_cost_usd ?? 0;
                 model = data.model?.display_name ?? "";
             }
             catch (err) {
                 this.logger.debug({ err, name }, "statusline.json read failed (getUiStatus)");
             }
+            // Align with /ctx: statusline for claude-code, pane scrape for kiro/grok/codex.
+            const classic = classicOnly.includes(name);
+            const backend = classic
+                ? this.classicChannels.getBackendByInstance(name, this.fleetConfig?.defaults?.backend)
+                : (this.fleetConfig?.instances[name]?.backend
+                    ?? this.fleetConfig?.defaults?.backend
+                    ?? "claude-code");
+            const { context } = resolveInstanceContext(this.dataDir, name, backend);
+            const context_pct = context ?? 0;
             return { name, status: this.getInstanceStatus(name), context_pct, cost, model };
         });
         return {