@songsid/agend 2.1.4-beta.9 → 2.1.4

package/dist/fleet-manager.js

@@ -1,15 +1,18 @@
 import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync } from "node:fs";
 import { randomBytes } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { freemem, totalmem } from "node:os";
 import { createServer } from "node:http";
 import { join, dirname, basename } from "node:path";
 import { fileURLToPath } from "node:url";
+import { isDeepStrictEqual } from "node:util";
 import { getAgendHome, ensureWorkspaceGit } from "./paths.js";
 import { beginUpdateProgress as persistUpdateProgress, clearUpdateMarker, isUpdateInProgress, readUpdateProgress, setUpdateProgressStage, } from "./update-marker.js";
 import { formatUpdateProgress } from "./update-progress.js";
 import { sdNotify, sdNotifyBlocking } from "./sd-notify.js";
 import { readFleetMemory } from "./process-memory.js";
 import { ReplyDeduper } from "./reply-dedup.js";
-import { isScalar, parseDocument } from "yaml";
+import { isMap, isScalar, parseDocument } from "yaml";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 /** Fallback access policy for a channel with no `access:` block — open (no gate). */
@@ -30,7 +33,7 @@ import { processAttachments } from "./channel/attachment-handler.js";
 import { routeToolCall } from "./channel/tool-router.js";
 import { Scheduler } from "./scheduler/index.js";
 import { DEFAULT_SCHEDULER_CONFIG } from "./scheduler/index.js";
-import { TopicCommands, saveCommandForBackend, parseSaveFilename, parsePauseWakeCommand, SAVE_FILENAME_RE, SAVE_UNSUPPORTED_MSG, CLEAR_UNSUPPORTED_MSG, resolveInstanceContext, forgetInstanceContext } from "./topic-commands.js";
+import { TopicCommands, saveCommandForBackend, parseSaveFilename, parsePauseWakeCommand, SAVE_FILENAME_RE, resolveInstanceContext, forgetInstanceContext } from "./topic-commands.js";
 import { DailySummary } from "./daily-summary.js";
 import { WebhookEmitter } from "./webhook-emitter.js";
 import { TmuxControlClient } from "./tmux-control.js";
@@ -42,9 +45,11 @@ import { StatuslineWatcher } from "./statusline-watcher.js";
 import { outboundHandlers } from "./outbound-handlers.js";
 import { handleWebRequest, broadcastSseEvent } from "./web-api.js";
 import { handleViewRequest, isViewPath } from "./view-api.js";
-import { handleUsageRequest, isUsagePath } from "./usage/usage-api.js";
+import { handleUsageRequest, isUsagePath, usageProviderIdForBackend } from "./usage/usage-api.js";
+import { LOGIN_FLOWS, LOGIN_BACKEND_ALIASES, checkAuthStatus } from "./login-flows.js";
+import { LoginSession } from "./login-manager.js";
 import { handleSettingsRequest } from "./settings-api.js";
-import { setLocale, detectLocale, t } from "./locale.js";
+import { setLocale, detectLocale, getLocale, t } from "./locale.js";
 import { handleAgentRequest } from "./agent-endpoint.js";
 import { ClassicChannelManager, getClassicBackendChoices, isSelectableClassicBackend, readClassicLastActivityAt } from "./classic-channel-manager.js";
 import { validateFleetConfig } from "./config-validator.js";
@@ -54,6 +59,11 @@ import { releaseProcessFleetLock } from "./fleet-lock.js";
 import { GENERAL_PAUSE_ERROR, isGeneralInstance } from "./general-instance.js";
 import { loadOrCreateWebToken, WEB_TOKEN_INVALID_MESSAGE } from "./web-auth.js";
 import { RestartProgress } from "./restart-progress.js";
+import { collectRedundantInstanceDefaultPaths } from "./fleet-yaml-slim.js";
+import { StormWindow } from "./storm-window.js";
+import { SpawnGate } from "./spawn-gate.js";
+import { BackendOutageTracker } from "./backend-outage.js";
+import { canUnlockAdvancedTips, DailyTipScheduler, selectTip, visibleTipLevels, } from "./tips.js";
 import { getTmuxSession } from "./config.js";
 export function resolveReplyThreadId(argsThreadId, instanceConfig) {
     if (typeof argsThreadId === "string" && argsThreadId.length > 0) {
@@ -106,6 +116,8 @@ const CANCEL_BTN_IDLE_RETIRE_GRACE_MS = 2_000;
  * button alone (the idle edge retires it when the run really ends).
  */
 const REPLY_RETIRE_GRACE_MS = 2 * 60_000;
+/** Bound for the daemon to capture the pane and answer a post-reply state query. */
+const REPLY_STATE_REFRESH_TIMEOUT_MS = 2_000;
 /**
  * The daemon only broadcasts execution state on TRANSITIONS, so a long
  * single-state run sends nothing for hours. The idle backstop therefore pokes a
@@ -162,6 +174,30 @@ const DELIVERY_STATUS_EMOJIS = new Set(["👀", "⏳", "✅", "❌"]);
  * emoji never changes the documented delivery-state protocol.
  */
 const IGNORED_REACTION_EMOJIS = new Set(["📷"]);
+const HOT_INSTANCE_CONFIG_KEYS = new Set([
+    "tool_progress",
+    "mcp_proxy_reply",
+    "auto_pause_after",
+    "warm_cap",
+    "display_name",
+    "description",
+    "tags",
+    "log_level",
+]);
+function splitHotColdConfig(config) {
+    const hot = {};
+    const cold = {};
+    for (const [key, value] of Object.entries(config)) {
+        (HOT_INSTANCE_CONFIG_KEYS.has(key) ? hot : cold)[key] = value;
+    }
+    return { hot, cold };
+}
+function hotConfigUpdate(config) {
+    const update = {};
+    for (const key of HOT_INSTANCE_CONFIG_KEYS)
+        update[key] = config[key] ?? null;
+    return update;
+}
 /**
  * How long a delivery waits out a disconnected instance IPC before giving up.
  *
@@ -178,9 +214,18 @@ const INTERACTIVE_ASSIST_CALLBACK_PREFIX = "interactive-assist:";
 const EXIT_RESTART_CALLBACK_PREFIX = "exit-restart:";
 const HANG_CALLBACK_PREFIX = "hang:";
 const CLEAR_CONFIRM_CALLBACK_PREFIX = "clear-confirm:";
+const TIP_DISMISS_CALLBACK_PREFIX = "tip-dismiss:";
+const TIP_UNLOCK_CALLBACK_PREFIX = "tip-unlock:";
+const LOGIN_CALLBACK_PREFIX = "login:";
+const INSTALL_CALLBACK_PREFIX = "install-select:";
+const CLASSIC_APPROVE_CALLBACK_PREFIX = "classic-approve:";
+const LOGIN_MENU_CALLBACK_PREFIX = "login-menu:";
+const LOGIN_CONFIRM_CALLBACK_PREFIX = "login-confirm:";
+const INSTALL_LOGIN_CALLBACK_PREFIX = "install-login:";
 const CLEAR_CONFIRM_TIMEOUT_MS = 15_000;
 /** Default lifetime for long-lived nonce prompts (clear overrides this to 15s). */
 const NONCE_BUTTON_TIMEOUT_MS = 15 * 60_000;
+const TIP_BUTTON_TIMEOUT_MS = 24 * 60 * 60_000;
 const CLI_ENV_TTL_MS = 24 * 60 * 60 * 1000; // /model reads cached CLI env within 24h
 export class FleetManager {
     dataDir;
@@ -188,6 +233,10 @@ export class FleetManager {
     static sighupHandlerInstalled = false;
     children = new Map();
     lifecycle;
+    stormWindow;
+    spawnGate;
+    /** Fleet-level backend reachability memory (fed by pty_error / startup panes). */
+    backendOutage = new BackendOutageTracker();
     /** Live view of lifecycle.daemons — used throughout; not deprecated. */
     get daemons() { return this.lifecycle.daemons; }
     fleetConfig = null;
@@ -227,6 +276,7 @@ export class FleetManager {
     costGuard = null;
     statuslineWatcher;
     dailySummary = null;
+    dailyTipScheduler = null;
     webhookEmitter = null;
     // Topic icon + auto-archive state
     topicIcons = {};
@@ -239,6 +289,13 @@ export class FleetManager {
     warmCapEvicting = new Set();
     /** Per-instance tail keeps cross-instance and scheduled deliveries FIFO. */
     idleGatedDeliveryTails = new Map();
+    /**
+     * Per-instance cancellation epoch for deliveries which have not reached the
+     * daemon yet. A cancel advances the epoch; queued work captures the old value
+     * and becomes a no-op, while messages arriving after the click capture the new
+     * value and remain deliverable.
+     */
+    deliveryEpochs = new Map();
     /** Non-user work must observe a fresh idle snapshot after the latest delivery. */
     lastDeliveryAt = new Map();
     /** State-cache updates wake event-driven idle waiters without busy polling. */
@@ -261,6 +318,28 @@ export class FleetManager {
     ipcWaitTails = new Map();
     /** instanceName → restart currently executing; concurrent callers join it. */
     restartsInFlight = new Map();
+    /**
+     * Delayed automatic retries for instances whose startup failed. Before this a
+     * failed start was logged once and the instance stayed `stopped` until an
+     * operator noticed (2026-09-03: 4 kiro instances, all victims of the same
+     * backend outage during a post-update herd). instanceName → pending retry.
+     */
+    startupRetries = new Map();
+    /** Bumped by every explicit stop (incl. the stop half of a restart); fences the outage hand-off. */
+    explicitStopGeneration = new Map();
+    /** instanceName → outage hand-off currently executing; a repeat joins it. */
+    handOffsInFlight = new Map();
+    /** instanceName → explicit stop currently executing; the outage hand-off waits for it. */
+    stopsInFlight = new Map();
+    /** Aggregation window for the "N instances failed to start" notice. */
+    startupRetryNotices = new Map();
+    /** Backoff between automatic startup retries; the last step repeats while the backend is down. */
+    static STARTUP_RETRY_BACKOFF_MS = [60_000, 5 * 60_000, 15 * 60_000];
+    /** Hard cap on automatic startup retries (3 backoff steps + up to 3 more during a backend outage). */
+    static STARTUP_RETRY_MAX_ATTEMPTS = 6;
+    /** Re-check interval when a retry is due but the tmux storm window still blocks spawns. */
+    static STARTUP_RETRY_STORM_DEFER_MS = 60_000;
+    static STARTUP_RETRY_NOTICE_AGGREGATE_MS = 1_000;
     // Last user message delivered to each instance — used to react ✅ on completion.
     lastInboundMsg = new Map();
     topicArchiver;
@@ -297,12 +376,14 @@ export class FleetManager {
     updateProgressTimer = null;
     updateProgressEditRunning = false;
     lastUpdateProgressText = null;
+    updateCompletionTipText = null;
     eventLogPruneTimer = null;
     logRotateTimer = null;
     /** Days of event/activity history to keep. */
     static EVENT_LOG_RETENTION_DAYS = 30;
     watchdogTimer = null;
     startedAt = 0;
+    stormOpenNotifyTimer = null;
     // Mirror topic: buffer cross-instance messages, flush every 3s
     mirrorBuffer = [];
     mirrorTimer = null;
@@ -318,11 +399,63 @@ export class FleetManager {
             process.on("SIGHUP", () => FleetManager.signalTarget?.handleSighup());
             FleetManager.sighupHandlerInstalled = true;
         }
+        this.stormWindow = new StormWindow();
+        this.spawnGate = new SpawnGate({
+            storm: this.stormWindow,
+            concurrency: () => this.spawnConcurrency(),
+            staggerMs: () => this.fleetConfig?.defaults?.startup?.stagger_delay_ms ?? 500,
+        });
+        this.bindStormWindowEvents();
         this.lifecycle = new InstanceLifecycle(this);
         this.topicCommands = new TopicCommands(this);
         this.topicArchiver = new TopicArchiver(this);
         this.statuslineWatcher = new StatuslineWatcher(this);
     }
+    spawnConcurrency() {
+        const explicit = this.fleetConfig?.defaults?.startup?.concurrency;
+        if (explicit != null)
+            return Math.max(1, Math.min(20, explicit));
+        const freeMemMB = Math.round(freemem() / (1024 * 1024));
+        return Math.max(2, Math.min(10, Math.floor(freeMemMB / 300)));
+    }
+    /** Wire the one fleet-wide storm into notification and recovery surfaces. */
+    bindStormWindowEvents() {
+        this.stormWindow.on("opened", (snapshot) => {
+            for (const [name, daemon] of this.daemons) {
+                if (!daemon.isPaused)
+                    this.stormWindow.addAffected(name);
+            }
+            this.logger.error({ ...snapshot }, "tmux server storm opened — holding respawns and delivery");
+            if (this.stormOpenNotifyTimer)
+                clearTimeout(this.stormOpenNotifyTimer);
+            this.stormOpenNotifyTimer = setTimeout(() => {
+                this.stormOpenNotifyTimer = null;
+                const current = this.stormWindow.snapshot();
+                this.notifyFleetError(t("storm.opened", current.affected.length, this.formatStormDelay(current.backoffMs)));
+            }, 1_000);
+            this.stormOpenNotifyTimer.unref?.();
+        });
+        this.stormWindow.on("extended", (snapshot) => {
+            this.logger.error({ ...snapshot }, "tmux server storm repeated — backoff extended");
+            this.notifyFleetError(t("storm.extended", snapshot.crashCount, this.formatStormDelay(snapshot.backoffMs)));
+        });
+        this.stormWindow.on("recovery_due", (snapshot) => {
+            this.logger.warn({ ...snapshot }, "tmux storm backoff elapsed — rolling recovery started");
+        });
+        this.stormWindow.on("closed", (snapshot, reason) => {
+            const unresolved = snapshot.affected.filter(name => !snapshot.recovered.includes(name));
+            this.logger.info({ ...snapshot, reason, unresolved }, "tmux server storm closed");
+            this.notifyFleetError(t(reason === "timeout" ? "storm.timed_out" : "storm.recovered", snapshot.recovered.length, snapshot.affected.length, unresolved.length > 0 ? unresolved.join(", ") : t("storm.none")));
+        });
+    }
+    formatStormDelay(ms) {
+        if (ms >= 60_000)
+            return `${Math.round(ms / 60_000)}m`;
+        return `${Math.round(ms / 1_000)}s`;
+    }
+    stormSuppressed(kind) {
+        return this.stormWindow.shouldSuppress(kind);
+    }
     handleSighup() {
         this.logger.info("Received SIGHUP, hot-reloading config...");
         if (!this.startupComplete) {
@@ -345,7 +478,7 @@ export class FleetManager {
             // fleet.yaml, sent SIGHUP, and got no reaction and no explanation.
             this.logger.error({ err }, "SIGHUP config reload failed");
             const message = err instanceof Error ? err.message : String(err);
-            this.notifyFleetError(`⚠️ fleet.yaml reload FAILED — ${message}\nThe previous configuration is still running.`);
+            this.notifyFleetError(t("fleet.reload_failed", message));
         })
             .finally(() => {
             this.reconcileInFlight = null;
@@ -434,7 +567,8 @@ export class FleetManager {
     getSysInfo() {
         const mem = process.memoryUsage();
         const toMB = (b) => Math.round(b / 1024 / 1024 * 10) / 10;
-        const instances = Object.keys(this.fleetConfig?.instances ?? {}).map(name => ({
+        // Fleet instances (fleet.yaml)
+        const fleetInstances = Object.keys(this.fleetConfig?.instances ?? {}).map(name => ({
             name,
             status: this.getInstanceStatus(name),
             state: this.getInstanceExecutionState(name),
@@ -442,12 +576,46 @@ export class FleetManager {
             costCents: this.costGuard?.getDailyCostCents(name) ?? 0,
             rateLimits: this.statuslineWatcher.getRateLimits(name) ?? null,
         }));
+        // Classic instances (classicBot.yaml) — dedupe against fleet
+        const fleetNames = new Set(fleetInstances.map(i => i.name));
+        const classicInstances = (this.classicChannels?.getAll() ?? [])
+            .filter(ch => !fleetNames.has(ch.instanceName))
+            .map(ch => ({
+            name: ch.instanceName,
+            status: this.getInstanceStatus(ch.instanceName),
+            state: this.getInstanceExecutionState(ch.instanceName),
+            ipc: this.instanceIpcClients.has(ch.instanceName),
+            costCents: this.costGuard?.getDailyCostCents(ch.instanceName) ?? 0,
+            rateLimits: this.statuslineWatcher.getRateLimits(ch.instanceName) ?? null,
+        }));
+        // Combined roster (matches /api/fleet and agend ls)
+        const allInstances = [...fleetInstances, ...classicInstances];
+        // Fleet summary counts (fleet + Classic combined)
+        const running_count = allInstances.filter(i => i.status === "running").length;
+        const paused_count = allInstances.filter(i => i.status === "paused").length;
+        // System memory (GB, 1 decimal)
+        const totalGB = totalmem() / (1024 ** 3);
+        const usedGB = (totalmem() - freemem()) / (1024 ** 3);
+        const system_mem_gb = {
+            used: Math.round(usedGB * 10) / 10,
+            total: Math.round(totalGB * 10) / 10,
+        };
+        // Fleet memory: O(1) cgroup read (includes entire service tree: fleet + CLIs + MCP servers)
+        // This avoids blocking the event loop with per-instance tree scans.
+        const fleetMem = readFleetMemory();
+        const fleet_mem_mb = fleetMem.cgroupAnonBytes != null
+            ? Math.round(fleetMem.cgroupAnonBytes / (1024 * 1024) * 10) / 10
+            : null;
         return {
             uptime_seconds: Math.floor((Date.now() - this.startedAt) / 1000),
             memory_mb: { rss: toMB(mem.rss), heapUsed: toMB(mem.heapUsed), heapTotal: toMB(mem.heapTotal) },
-            instances,
+            instances: fleetInstances, // SysInfo.instances is fleet-only; /api/fleet enriches with Classic
             fleet_cost_cents: this.costGuard?.getFleetTotalCents() ?? 0,
             fleet_cost_limit_cents: this.costGuard?.getLimitCents() ?? 0,
+            running_count,
+            paused_count,
+            fleet_mem_mb,
+            system_mem_gb,
         };
     }
     /** Load fleet.yaml and build routing table */
@@ -595,6 +763,57 @@ export class FleetManager {
         child.once("error", err => this.failUpdateProgress(err.message));
         child.unref();
     }
+    async handleTipsSlash(data, adapterId) {
+        if (!this.fleetConfig)
+            return;
+        const mode = typeof data.options?.mode === "string" ? data.options.mode : "";
+        if (mode === "advanced on") {
+            if (!this.isFleetAdmin(data.userId, adapterId)) {
+                await data.respond(t("permission.denied"));
+                return;
+            }
+            await data.respond(this.unlockAdvancedTips(data.userId)
+                ? t("tips.advanced.unlocked")
+                : t("tips.unavailable"));
+            return;
+        }
+        if (mode === "on" || mode === "off") {
+            if (!this.isFleetAdmin(data.userId, adapterId)) {
+                await data.respond(t("permission.denied"));
+                return;
+            }
+            this.fleetConfig.defaults.tips = mode === "on";
+            this.saveFleetConfig();
+            await data.respond(t(mode === "on" ? "tips.enabled" : "tips.disabled"));
+            return;
+        }
+        const adapter = this.adapters.get(adapterId) ?? this.adapter;
+        if (!adapter) {
+            await data.respond(t("tips.unavailable"));
+            return;
+        }
+        const targetName = this.resolveSlashTarget(data.channelId, adapterId)
+            ?? this.findGeneralInstance(adapterId)
+            ?? "general";
+        // Discord slash interactions are deferred ephemerally, but the Tip itself
+        // belongs in the channel where /tips was invoked. Post there directly,
+        // then delete the empty acknowledgement instead of leaving a slash corpse.
+        //
+        // The callback binding uses (chatId, threadId) that match what the adapter
+        // emits on callback_query. Discord emits (guildId, channelId); Telegram
+        // emits (supergroup chatId, topic threadId). For /tips invoked in an
+        // arbitrary channel, pass the canonical group id as chatId and the
+        // invocation channel as threadId, exactly as sendTipToGeneral() does.
+        const chatId = this.getGroupIdForInstance(targetName) || data.channelId;
+        const result = await this.promptTip(targetName, adapter, chatId, data.channelId);
+        if (result === "posted" && data.dismissResponse) {
+            await data.dismissResponse();
+            return;
+        }
+        await data.respond(t(result === "posted"
+            ? "tips.posted"
+            : result === "empty" ? "tips.empty" : "tips.unavailable"));
+    }
     /** Admin-only full conversation reset for fleet-topic and Classic instances. */
     async handleClearSlash(data, adapterId) {
         if (!this.isModelAdmin(data.userId, data.channelId, adapterId)) {
@@ -747,6 +966,39 @@ export class FleetManager {
             return null;
         return this.instanceStateCache.get(name)?.state ?? null;
     }
+    /**
+     * Subscription providers currently relevant to this fleet. Stopped/crashed
+     * rows do not keep a usage card alive, while persisted paused instances do.
+     * Classic channels use their effective backend merge chain, not the raw row.
+     */
+    getActiveUsageProviderIds() {
+        const providers = new Set();
+        for (const backend of this.getActiveBackendIds()) {
+            const provider = usageProviderIdForBackend(backend);
+            if (provider)
+                providers.add(provider);
+        }
+        return providers;
+    }
+    /** Effective backends with a running or persisted-paused fleet/Classic instance. */
+    getActiveBackendIds() {
+        const backends = new Set();
+        const add = (name, backend) => {
+            const status = this.getInstanceStatus(name);
+            if (status !== "running" && status !== "paused")
+                return;
+            if (backend)
+                backends.add(backend);
+        };
+        for (const [name, config] of Object.entries(this.fleetConfig?.instances ?? {})) {
+            // loadFleetConfig() has already merged the fleet default into each row.
+            add(name, config.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code");
+        }
+        for (const channel of this.classicChannels?.getAll() ?? []) {
+            add(channel.instanceName, this.classicChannels?.getBackendByInstance(channel.instanceName, this.fleetConfig?.defaults?.backend));
+        }
+        return backends;
+    }
     isClassicInstance(name) {
         return this.classicChannels?.getAll().some(channel => channel.instanceName === name) ?? false;
     }
@@ -859,7 +1111,7 @@ export class FleetManager {
                 .finally(() => this.warmCapEvicting.delete(victim));
         }
     }
-    waitForInstanceIdle(instanceName, timeoutMs, idleObservedAfter = 0) {
+    waitForInstanceIdle(instanceName, timeoutMs, idleObservedAfter = 0, cancelled) {
         const isReady = () => {
             const snapshot = this.instanceStateCache.get(instanceName);
             return snapshot?.state === "idle"
@@ -881,8 +1133,12 @@ export class FleetManager {
                     this.instanceIdleWaiters.delete(instanceName);
                 resolve(idle);
             };
-            const check = () => { if (isReady())
-                finish(true); };
+            const check = () => {
+                if (cancelled?.())
+                    finish(false);
+                else if (isReady())
+                    finish(true);
+            };
             const query = () => {
                 const ipc = this.instanceIpcClients.get(instanceName);
                 if (ipc?.connected) {
@@ -898,24 +1154,90 @@ export class FleetManager {
             query();
         });
     }
-    async deliverWithIdleGate(instanceName, payload, timeoutMs) {
+    /**
+     * Ask the daemon to capture the pane before answering, then wait for any state
+     * report produced after this request. The ordinary query is intentionally
+     * cache-only (idle gates call it frequently); this opt-in refresh is reserved
+     * for lifecycle decisions where a stale state would strand UI.
+     */
+    refreshInstanceExecutionState(instanceName, timeoutMs) {
+        const ipc = this.instanceIpcClients.get(instanceName);
+        if (!ipc?.connected)
+            return Promise.resolve(false);
+        const previous = this.instanceStateCache.get(instanceName);
+        return new Promise(resolve => {
+            let settled = false;
+            const finish = (refreshed) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timeout);
+                const waiters = this.instanceIdleWaiters.get(instanceName);
+                waiters?.delete(check);
+                if (waiters?.size === 0)
+                    this.instanceIdleWaiters.delete(instanceName);
+                resolve(refreshed);
+            };
+            const check = () => {
+                if (this.instanceStateCache.get(instanceName) !== previous)
+                    finish(true);
+            };
+            const waiters = this.instanceIdleWaiters.get(instanceName) ?? new Set();
+            waiters.add(check);
+            this.instanceIdleWaiters.set(instanceName, waiters);
+            const timeout = setTimeout(() => finish(false), timeoutMs);
+            timeout.unref?.();
+            const sent = ipc.send({
+                type: "query_instance_state",
+                requestId: `reply-grace-${Date.now()}`,
+                refresh: true,
+            });
+            if (!sent)
+                finish(false);
+        });
+    }
+    async deliverWithIdleGate(instanceName, payload, timeoutMs, deliveryEpoch) {
+        if (this.shuttingDown || !this.isDeliveryEpochCurrent(instanceName, deliveryEpoch))
+            return;
+        await this.holdDeliveryForStorm(instanceName, deliveryEpoch);
+        if (this.shuttingDown || !this.isDeliveryEpochCurrent(instanceName, deliveryEpoch))
+            return;
         let idleObservedAfter = this.lastDeliveryAt.get(instanceName) ?? 0;
         if (this.lifecycle.isPaused(instanceName)) {
             const wakeStartedAt = Date.now();
             await this.lifecycle.wake(instanceName, 30_000);
+            if (!this.isDeliveryEpochCurrent(instanceName, deliveryEpoch))
+                return;
             // Waking added one to the warm count — make room by evicting a different
             // LRU idle instance (never this one; it's about to work).
             this.enforceWarmCap(instanceName);
             // Never satisfy a post-wake gate from a stale pre-pause cache entry.
             idleObservedAfter = Math.max(idleObservedAfter, wakeStartedAt);
         }
-        const idle = await this.waitForInstanceIdle(instanceName, timeoutMs, idleObservedAfter);
+        const idle = await this.waitForInstanceIdle(instanceName, timeoutMs, idleObservedAfter, () => !this.isDeliveryEpochCurrent(instanceName, deliveryEpoch));
+        if (!this.isDeliveryEpochCurrent(instanceName, deliveryEpoch)) {
+            this.logger.info({ instanceName }, "Pending delivery dropped by user cancel");
+            return;
+        }
+        // A server crash can land while waitForInstanceIdle is pending. Re-check
+        // immediately before the old timeout path would force text into a boot UI.
+        await this.holdDeliveryForStorm(instanceName, deliveryEpoch);
+        if (this.shuttingDown || !this.isDeliveryEpochCurrent(instanceName, deliveryEpoch))
+            return;
         if (!idle) {
             this.logger.warn({ instanceName, timeoutMs }, "Idle gate timed out; forcing delivery");
         }
-        await this.sendWhenConnected(instanceName, payload);
+        await this.sendWhenConnected(instanceName, payload, deliveryEpoch);
+        if (!this.isDeliveryEpochCurrent(instanceName, deliveryEpoch))
+            return;
         this.lastDeliveryAt.set(instanceName, Date.now());
     }
+    async holdDeliveryForStorm(instanceName, deliveryEpoch) {
+        if (!this.stormWindow.isDeliveryHeld(instanceName))
+            return;
+        this.logger.warn({ instanceName, deliveryEpoch }, "Delivery held during tmux server recovery");
+        await this.stormWindow.waitForDeliveryAllowed(instanceName);
+    }
     /**
      * Hand a payload to an instance's IPC, waiting out a *transient* disconnect.
      *
@@ -932,7 +1254,9 @@ export class FleetManager {
      * instance, *including* when the socket happens to be up: otherwise a message
      * arriving after the reconnect could overtake one that has been waiting for it.
      */
-    async sendWhenConnected(instanceName, payload) {
+    async sendWhenConnected(instanceName, payload, deliveryEpoch = this.getDeliveryEpoch(instanceName)) {
+        if (!this.isDeliveryEpochCurrent(instanceName, deliveryEpoch))
+            return;
         const queued = this.ipcWaitTails.get(instanceName);
         if (!queued) {
             const ipc = this.instanceIpcClients.get(instanceName);
@@ -941,7 +1265,11 @@ export class FleetManager {
         }
         const attempt = (queued ?? Promise.resolve())
             .catch(() => { })
-            .then(() => this.sendAfterIpcReturns(instanceName, payload));
+            .then(() => {
+            if (!this.isDeliveryEpochCurrent(instanceName, deliveryEpoch))
+                return;
+            return this.sendAfterIpcReturns(instanceName, payload, deliveryEpoch);
+        });
         // The chain stores a settled-either-way promise so one failed delivery cannot
         // wedge every later one, and so `queued` above is safe to await unguarded.
         const tail = attempt.catch(() => { });
@@ -958,10 +1286,12 @@ export class FleetManager {
         }
     }
     /** Poll for the instance's IPC to come back, then send. Throws if it does not. */
-    async sendAfterIpcReturns(instanceName, payload) {
+    async sendAfterIpcReturns(instanceName, payload, deliveryEpoch = this.getDeliveryEpoch(instanceName)) {
         const deadline = Date.now() + IPC_RECONNECT_GRACE_MS;
         let warned = false;
         for (;;) {
+            if (!this.isDeliveryEpochCurrent(instanceName, deliveryEpoch))
+                return;
             // Re-read every round: a reconnect replaces the IpcClient object entirely,
             // so a cached reference would stay dead forever.
             const ipc = this.instanceIpcClients.get(instanceName);
@@ -977,8 +1307,14 @@ export class FleetManager {
             await new Promise(resolve => setTimeout(resolve, IPC_RECONNECT_POLL_MS));
         }
     }
+    /** Whether this target already has an ordinary non-user delivery in its FIFO. */
+    hasPendingIdleGatedDelivery(instanceName) {
+        return this.idleGatedDeliveryTails.has(instanceName);
+    }
     /** Single delivery facade: wake paused CLIs and serialize non-user work behind idle. */
     async deliverToInstance(instanceName, payload, options = {}) {
+        const deliveryEpoch = this.getDeliveryEpoch(instanceName);
+        const deliveryPayload = { ...payload, delivery_epoch: deliveryEpoch };
         const meta = payload.meta && typeof payload.meta === "object"
             ? payload.meta
             : undefined;
@@ -990,16 +1326,20 @@ export class FleetManager {
         if (!waitForIdle) {
             if (this.lifecycle.isPaused(instanceName)) {
                 await this.lifecycle.wake(instanceName, 30_000);
+                if (!this.isDeliveryEpochCurrent(instanceName, deliveryEpoch))
+                    return;
                 this.enforceWarmCap(instanceName); // woke one → evict a different LRU idle if over cap
             }
-            await this.sendWhenConnected(instanceName, payload);
+            await this.sendWhenConnected(instanceName, deliveryPayload, deliveryEpoch);
+            if (!this.isDeliveryEpochCurrent(instanceName, deliveryEpoch))
+                return;
             // A cross-instance item arriving before the daemon observes this turn as
             // working must not trust the stale idle snapshot from before the send.
             this.lastDeliveryAt.set(instanceName, Date.now());
             return;
         }
         const previous = this.idleGatedDeliveryTails.get(instanceName) ?? Promise.resolve();
-        const delivery = previous.catch(() => { }).then(() => this.deliverWithIdleGate(instanceName, payload, options.idleTimeoutMs ?? 60_000));
+        const delivery = previous.catch(() => { }).then(() => this.deliverWithIdleGate(instanceName, deliveryPayload, options.idleTimeoutMs ?? 60_000, deliveryEpoch));
         this.idleGatedDeliveryTails.set(instanceName, delivery);
         try {
             await delivery;
@@ -1033,6 +1373,7 @@ export class FleetManager {
             throw new Error("Classic channel manager not initialized");
         const wasRunning = this.daemons.has(instanceName);
         this.classicChannels.reloadFromDisk();
+        this.reportClassicUnrecoverableIds();
         this.reregisterClassicChannels();
         const channel = this.classicChannels.getAll().find(item => item.instanceName === instanceName);
         if (!channel)
@@ -1050,6 +1391,9 @@ export class FleetManager {
      * across a fleet restart.
      */
     resumePaused = false) {
+        // Any start supersedes a pending automatic retry (it would otherwise fire
+        // into a running instance — harmless, but noisy — or race this start).
+        this.cancelStartupRetry(name);
         if (resumePaused && this.lifecycle.isPaused(name)) {
             await this.lifecycle.wake(name, 30_000);
             // A successful wake clears the persisted pause marker and produces a
@@ -1080,12 +1424,6 @@ export class FleetManager {
         }
         const backend = config.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code";
         if (config.general_topic) {
-            // antigravity (agy) does not read MCP instructions — fleet context and
-            // routing instructions are not injected, so it cannot act as a dispatcher.
-            if (backend === "antigravity") {
-                this.logger.warn({ name }, "antigravity backend does not support MCP instructions — general dispatcher will not work correctly");
-                this.notifyInstanceTopic(name, "⚠️ antigravity backend is not supported for General instances (no MCP instructions injection). Switch to claude-code or kiro-cli.");
-            }
             this.ensureGeneralInstructions(config.working_directory, backend, name);
         }
         else if (kind === "fleet-topic") {
@@ -1151,86 +1489,243 @@ export class FleetManager {
         }
         if (runnableEntries.length === 0)
             return;
-        const raw = this.fleetConfig?.defaults?.startup;
-        const explicitConcurrency = raw?.concurrency;
-        const staggerMs = Math.max(0, Math.min(30_000, raw?.stagger_delay_ms ?? 500));
-        // Adaptive concurrency: if not explicitly set, estimate from available RAM.
-        // Each instance uses ~300MB (tmux + CLI process + model overhead).
-        const ESTIMATED_MB_PER_INSTANCE = 300;
-        const { freemem } = await import("node:os");
-        let concurrency;
-        if (explicitConcurrency != null) {
-            concurrency = Math.max(1, Math.min(20, explicitConcurrency));
+        if (this.fleetConfig?.defaults?.startup?.concurrency == null) {
+            this.logger.info({
+                concurrency: this.spawnConcurrency(),
+                freeMemMB: Math.round(freemem() / (1024 * 1024)),
+                totalInstances: runnableEntries.length,
+            }, "Adaptive startup concurrency");
+        }
+        await Promise.all(runnableEntries.map(([name, config]) => this.spawnGate.run({
+            instanceName: name,
+            workingDirectory: config.working_directory,
+            reason: "startup",
+        }, async () => {
+            if (await this.startInstanceUnattended(name, config, topicMode, "instance"))
+                onReady?.(name);
+        })));
+    }
+    /**
+     * Start from an UNATTENDED path (fleet startup, full restart, config
+     * reconcile): nobody is watching the result, so a failure is logged and
+     * handed to the delayed automatic retry instead of leaving the instance
+     * `stopped` forever. Explicit operator/API starts call startInstance directly
+     * and keep their synchronous error. Returns whether the instance is up.
+     */
+    async startInstanceUnattended(name, config, topicMode, what) {
+        try {
+            await this.startInstance(name, config, topicMode);
+            return this.daemons.has(name);
         }
-        else {
-            const freeMemMB = Math.round(freemem() / (1024 * 1024));
-            concurrency = Math.max(2, Math.min(10, Math.floor(freeMemMB / ESTIMATED_MB_PER_INSTANCE)));
-            this.logger.info({ concurrency, freeMemMB: freeMemMB, totalInstances: runnableEntries.length }, "Adaptive startup concurrency");
-        }
-        const byWorkDir = new Map();
-        for (const [name, config] of runnableEntries) {
-            const dir = config.working_directory;
-            if (!byWorkDir.has(dir))
-                byWorkDir.set(dir, []);
-            byWorkDir.get(dir).push([name, config]);
-        }
-        const groups = [...byWorkDir.values()];
-        let running = 0;
-        let idx = 0;
-        let lastStartAt = 0;
-        let pendingTimer = false;
-        await new Promise((resolve) => {
-            if (groups.length === 0) {
-                resolve();
+        catch (err) {
+            this.logger.error({ err, name }, `Failed to start ${what}`);
+            this.scheduleStartupRetry(name, 0);
+            return false;
+        }
+    }
+    // ── Delayed automatic startup retries ──────────────────────────────────
+    /**
+     * Schedule attempt `attempt` (0-based) of the automatic startup retry for an
+     * instance whose start just failed. Backoff 1 → 5 → 15 min; while the
+     * instance's backend is known to be unreachable the 15-min step repeats up to
+     * STARTUP_RETRY_MAX_ATTEMPTS, after which we give up with one notice. Each
+     * retry re-checks the world (still configured, not running, not paused, no
+     * tmux storm) and runs through the SpawnGate as "recovery" — so a herd of
+     * failed instances comes back at the gate's concurrency, never all at once.
+     */
+    scheduleStartupRetry(name, attempt) {
+        if (this.shuttingDown)
+            return;
+        if (this.startupRetries.has(name))
+            return;
+        const backoff = FleetManager.STARTUP_RETRY_BACKOFF_MS;
+        const outage = this.backendOutage.isActive(this.backendNameOf(name));
+        const exhausted = attempt >= backoff.length && !(outage && attempt < FleetManager.STARTUP_RETRY_MAX_ATTEMPTS);
+        if (attempt >= FleetManager.STARTUP_RETRY_MAX_ATTEMPTS || exhausted) {
+            this.logger.error({ name, attempts: attempt }, "Giving up automatic startup retries");
+            this.queueStartupRetryNotice("gave_up", name, 0);
+            return;
+        }
+        const delayMs = backoff[Math.min(attempt, backoff.length - 1)];
+        const timer = setTimeout(() => { void this.runStartupRetry(name, attempt); }, delayMs);
+        timer.unref?.();
+        this.startupRetries.set(name, { attempt, timer });
+        this.logger.warn({ name, attempt: attempt + 1, delayMs, backendOutage: outage }, "Startup failed — automatic retry scheduled");
+        if (attempt === 0)
+            this.queueStartupRetryNotice("scheduled", name, delayMs);
+    }
+    /** Drop a pending automatic retry (an operator start/stop/restart supersedes it). */
+    cancelStartupRetry(name) {
+        const pending = this.startupRetries.get(name);
+        if (!pending)
+            return;
+        clearTimeout(pending.timer);
+        this.startupRetries.delete(name);
+        this.logger.info({ name }, "Pending automatic startup retry cancelled");
+    }
+    /** Pending automatic retry, if any (status display / tests). */
+    pendingStartupRetry(name) {
+        const pending = this.startupRetries.get(name);
+        return pending ? { attempt: pending.attempt } : null;
+    }
+    /**
+     * A daemon's crash-respawn hit the backend outage (startup_backend_unreachable):
+     * stop THAT daemon and schedule the delayed retry. Serialized against the
+     * operator paths: an in-flight restart is awaited first (it replaces the
+     * daemon itself), the stop is identity-checked so a fresh daemon registered
+     * meanwhile is never deleted, and an explicit stop/restart that began during
+     * the hand-off (generation bump) owns the outcome — no retry is scheduled
+     * behind an operator's back.
+     */
+    async handOffToStartupRetry(name, daemon) {
+        const joined = this.handOffsInFlight.get(name);
+        if (joined)
+            return joined;
+        const run = (async () => {
+            // Let any operator restart/stop that is already executing finish first:
+            // a restart replaces the daemon itself, a stop removes it — either way
+            // the identity check below then sees "not ours any more" and we do
+            // nothing. Loop: one operation can be chained behind another.
+            for (;;) {
+                const inFlight = this.restartsInFlight.get(name) ?? this.stopsInFlight.get(name);
+                if (!inFlight)
+                    break;
+                await inFlight.catch(() => { });
+            }
+            const stopGen = this.explicitStopGeneration.get(name) ?? 0;
+            if (this.lifecycle.daemons.get(name) !== daemon)
+                return; // already replaced or stopped
+            await this.lifecycle.stopIfCurrent(name, daemon);
+            if (this.shuttingDown)
+                return;
+            if ((this.explicitStopGeneration.get(name) ?? 0) !== stopGen) {
+                this.logger.info({ name }, "Outage hand-off superseded by an explicit stop/restart — no automatic retry");
                 return;
             }
-            const startNext = () => {
-                if (pendingTimer)
-                    return;
-                while (running < concurrency && idx < groups.length) {
-                    // Re-check memory if adaptive (no explicit concurrency set)
-                    if (explicitConcurrency == null && running > 0) {
-                        const nowFreeMB = Math.round(freemem() / (1024 * 1024));
-                        if (nowFreeMB < ESTIMATED_MB_PER_INSTANCE) {
-                            this.logger.warn({ freeMemMB: nowFreeMB, remaining: groups.length - idx }, "Low memory — pausing instance startup");
-                            // Wait and retry in 5s
-                            pendingTimer = true;
-                            setTimeout(() => { pendingTimer = false; startNext(); }, 5000);
-                            return;
-                        }
-                    }
-                    const now = Date.now();
-                    const elapsed = now - lastStartAt;
-                    if (lastStartAt > 0 && elapsed < staggerMs) {
-                        pendingTimer = true;
-                        setTimeout(() => { pendingTimer = false; startNext(); }, staggerMs - elapsed);
-                        return;
-                    }
-                    const group = groups[idx++];
-                    running++;
-                    lastStartAt = Date.now();
-                    (async () => {
-                        for (const [name, config] of group) {
-                            try {
-                                await this.startInstance(name, config, topicMode);
-                                if (this.daemons.has(name))
-                                    onReady?.(name);
-                            }
-                            catch (err) {
-                                this.logger.error({ err, name }, "Failed to start instance");
-                            }
-                        }
-                    })().finally(() => {
-                        running--;
-                        if (idx >= groups.length && running === 0)
-                            resolve();
-                        else
-                            startNext();
-                    });
-                }
-            };
-            startNext();
-        });
+            if (this.lifecycle.daemons.has(name) || this.lifecycle.isPaused(name))
+                return;
+            this.scheduleStartupRetry(name, 0);
+        })().finally(() => this.handOffsInFlight.delete(name));
+        this.handOffsInFlight.set(name, run);
+        return run;
+    }
+    async runStartupRetry(name, attempt) {
+        this.startupRetries.delete(name);
+        if (this.shuttingDown)
+            return;
+        if (!this.isConfiguredInstance(name))
+            return; // removed from fleet.yaml / classic channel meanwhile
+        if (this.lifecycle.isPaused(name) || this.daemons.has(name))
+            return; // operator acted meanwhile
+        if (this.stormWindow.isSpawnBlocked()) {
+            // The tmux server is being restarted; joining that herd is what we are
+            // trying to avoid. Same attempt again after the storm's own recovery.
+            const timer = setTimeout(() => { void this.runStartupRetry(name, attempt); }, FleetManager.STARTUP_RETRY_STORM_DEFER_MS);
+            timer.unref?.();
+            this.startupRetries.set(name, { attempt, timer });
+            this.logger.info({ name, attempt: attempt + 1 }, "Startup retry deferred — tmux storm window is blocking spawns");
+            return;
+        }
+        const topicMode = this.fleetConfig?.channel?.mode === "topic"
+            || !!this.fleetConfig?.channels?.some(channel => channel.mode === "topic");
+        try {
+            await this.spawnGate.run({
+                instanceName: name,
+                workingDirectory: this.fleetConfig?.instances[name]?.working_directory || this.getInstanceDir(name),
+                reason: "recovery",
+            }, () => this.startConfiguredInstance(name, topicMode));
+            if (this.daemons.has(name)) {
+                this.logger.info({ name, attempt: attempt + 1 }, "Automatic startup retry succeeded");
+            }
+        }
+        catch (err) {
+            this.logger.error({ err, name, attempt: attempt + 1 }, "Automatic startup retry failed");
+            this.scheduleStartupRetry(name, attempt + 1);
+        }
+    }
+    /** Fleet-topic (fleet.yaml) or ClassicBot (classic channel) — both are retryable; anything else is gone. */
+    isConfiguredInstance(name) {
+        if (this.fleetConfig?.instances[name])
+            return true;
+        return !!this.classicChannels?.getAll().some(channel => channel.instanceName === name);
+    }
+    /**
+     * Kind-aware start for the automatic retry: fleet-topic instances come from
+     * fleet.yaml, ClassicBot instances exist only in the classic channel manager
+     * and must be rebuilt through startClassicInstance (a fleet.yaml lookup alone
+     * silently dropped them — the retry timer fired and nothing happened).
+     */
+    async startConfiguredInstance(name, topicMode) {
+        const config = this.fleetConfig?.instances[name];
+        if (config) {
+            await this.startInstance(name, config, topicMode);
+            return;
+        }
+        const channel = this.classicChannels?.getAll().find(item => item.instanceName === name);
+        if (!channel || !this.classicChannels)
+            throw new Error(`Instance '${name}' is no longer configured`);
+        await this.startClassicInstance(name, this.classicChannels.getBackendByInstance(name, this.fleetConfig?.defaults?.backend), this.classicChannels.getPreTaskCommand(channel.channelId, channel.adapterId), this.classicChannels.getModel(channel.channelId, channel.adapterId, this.fleetConfig?.defaults?.model), this.classicChannels.getAutoPauseAfter(channel.channelId, channel.adapterId, this.fleetConfig?.defaults?.auto_pause_after));
+    }
+    /**
+     * Unattended ClassicBot start (fleet startup batch, full-restart batch, the
+     * classicBot.yaml reconcile): same contract as startInstanceUnattended —
+     * failures are logged and handed to the delayed automatic retry, whose
+     * kind-aware startConfiguredInstance rebuilds the Classic instance. Returns
+     * whether the instance is up.
+     */
+    async startClassicInstanceUnattended(ch, what) {
+        try {
+            await this.startClassicInstance(ch.instanceName, this.classicChannels.getBackendByInstance(ch.instanceName, this.fleetConfig?.defaults?.backend), this.classicChannels.getPreTaskCommand(ch.channelId, ch.adapterId), this.classicChannels.getModel(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.model), this.classicChannels.getAutoPauseAfter(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.auto_pause_after));
+            return this.daemons.has(ch.instanceName);
+        }
+        catch (err) {
+            this.logger.warn({ err, instanceName: ch.instanceName }, `Failed to start ${what}`);
+            this.scheduleStartupRetry(ch.instanceName, 0);
+            return false;
+        }
+    }
+    backendNameOf(name) {
+        const fleetDefault = this.fleetConfig?.defaults?.backend;
+        const configured = this.fleetConfig?.instances[name]?.backend;
+        if (configured)
+            return configured;
+        // ClassicBot channels pick their own backend; the fleet default is only the fallback.
+        if (this.classicChannels?.getAll().some(channel => channel.instanceName === name)) {
+            return this.classicChannels.getBackendByInstance(name, fleetDefault);
+        }
+        return fleetDefault ?? "claude-code";
+    }
+    /**
+     * One fleet-level notice per burst, not one per instance: a post-update herd
+     * fails many instances within the same second. Two notices per incident at
+     * most — "N failed, retrying in X" and, if it comes to that, "gave up on N".
+     */
+    queueStartupRetryNotice(kind, name, delayMs) {
+        const pending = this.startupRetryNotices.get(kind);
+        if (pending) {
+            if (!pending.names.includes(name))
+                pending.names.push(name);
+            return;
+        }
+        const timer = setTimeout(() => {
+            const entry = this.startupRetryNotices.get(kind);
+            this.startupRetryNotices.delete(kind);
+            if (!entry)
+                return;
+            const list = entry.names.join(", ");
+            if (kind === "scheduled") {
+                let text = t("fleet.startup_retry_scheduled", entry.names.length, list, this.formatStormDelay(entry.delayMs));
+                const downBackends = [...new Set(entry.names.map(n => this.backendNameOf(n)))].filter(b => this.backendOutage.isActive(b));
+                if (downBackends.length)
+                    text += `\n${t("fleet.startup_retry_outage", downBackends.join(", "))}`;
+                this.notifyFleetError(text);
+            }
+            else {
+                this.notifyFleetError(t("fleet.startup_retry_gave_up", entry.names.length, list));
+            }
+        }, FleetManager.STARTUP_RETRY_NOTICE_AGGREGATE_MS);
+        timer.unref?.();
+        this.startupRetryNotices.set(kind, { names: [name], delayMs, timer });
     }
     runnableStartupCount(fleet, includeClassic) {
         const names = this.configuredStartupInstanceNames(fleet, includeClassic);
@@ -1265,6 +1760,8 @@ export class FleetManager {
         };
     }
     async stopInstance(name) {
+        this.explicitStopGeneration.set(name, (this.explicitStopGeneration.get(name) ?? 0) + 1);
+        this.cancelStartupRetry(name);
         this.failoverActive.delete(name);
         this.cancelIdleButtonRetirement(name);
         this.instanceStateCache.delete(name);
@@ -1276,12 +1773,20 @@ export class FleetManager {
         // interactive-prompt / clean-exit events whose handlers post fresh prompts
         // while the stop is still awaiting (the TOCTOU sol's review called out).
         this.clearNoncePromptsForInstance(name);
-        try {
-            return await this.lifecycle.stop(name);
-        }
-        finally {
-            this.clearNoncePromptsForInstance(name);
-        }
+        // Published so the outage hand-off can wait for an explicit stop that began
+        // BEFORE it (the generation fence alone only catches stops that begin after
+        // the hand-off snapshotted it).
+        const run = (async () => {
+            try {
+                await this.lifecycle.stop(name);
+            }
+            finally {
+                this.clearNoncePromptsForInstance(name);
+            }
+        })().finally(() => { if (this.stopsInFlight.get(name) === run)
+            this.stopsInFlight.delete(name); });
+        this.stopsInFlight.set(name, run);
+        return run;
     }
     /** Restart a single instance, reloading fleet.yaml first to pick up config changes. */
     async restartSingleInstance(name, opts) {
@@ -1294,7 +1799,12 @@ export class FleetManager {
             this.logger.info({ name }, "restartSingleInstance: joining the restart already in flight");
             return inFlight;
         }
-        const run = this.doRestartSingleInstance(name, opts)
+        const workingDirectory = this.fleetConfig?.instances[name]?.working_directory || this.getInstanceDir(name);
+        const run = this.spawnGate.run({
+            instanceName: name,
+            workingDirectory,
+            reason: "restart",
+        }, () => this.doRestartSingleInstance(name, opts))
             .finally(() => this.restartsInFlight.delete(name));
         this.restartsInFlight.set(name, run);
         return run;
@@ -1312,6 +1822,7 @@ export class FleetManager {
                 this.writeFreshStartMarker(name);
             const topicMode = this.fleetConfig?.channel?.mode === "topic";
             await this.startInstance(name, config, topicMode ?? false);
+            this.stormWindow.markRecovered(name);
             return;
         }
         // Classic instance fallback
@@ -1324,6 +1835,7 @@ export class FleetManager {
             if (opts?.freshStart)
                 this.writeFreshStartMarker(name);
             await this.startClassicInstance(name, this.classicChannels.getBackendByInstance(name, fleetBackend), this.classicChannels.getPreTaskCommand(channelId, adapterId), this.classicChannels.getModel(channelId, adapterId, this.fleetConfig?.defaults?.model), this.classicChannels.getAutoPauseAfter(channelId, adapterId, this.fleetConfig?.defaults?.auto_pause_after));
+            this.stormWindow.markRecovered(name);
             return;
         }
         throw new Error(`Instance not found: ${name}`);
@@ -1389,6 +1901,7 @@ export class FleetManager {
             messageId,
         });
         this.lastUpdateProgressText = null;
+        this.updateCompletionTipText = null;
         this.startUpdateProgressMonitor(adapter);
     }
     failUpdateProgress(message) {
@@ -1412,7 +1925,17 @@ export class FleetManager {
             const adapter = this.adapters.get(target.adapterId) ?? (initialAdapter?.id === target.adapterId ? initialAdapter : undefined);
             if (!adapter)
                 return;
-            const text = formatUpdateProgress(marker);
+            let text = formatUpdateProgress(marker);
+            // No-restart updates complete in the old fleet process, so they never
+            // reach RestartProgress.finish(). Append the same optional tip here.
+            if (marker.progress.stage === "complete" && this.tipsEnabled()) {
+                if (this.updateCompletionTipText === null) {
+                    const tip = this.pickAvailableTip();
+                    this.updateCompletionTipText = tip ? this.formatTip(tip) : "";
+                }
+                if (this.updateCompletionTipText)
+                    text += `\n\n${this.updateCompletionTipText}`;
+            }
             if (text === this.lastUpdateProgressText)
                 return;
             this.updateProgressEditRunning = true;
@@ -1453,6 +1976,7 @@ export class FleetManager {
         // Rotate fleet.log if oversized (before any logging)
         rotateLogIfNeeded(join(this.dataDir, "fleet.log"));
         const fleet = this.loadConfig(configPath);
+        this.slimFleetConfigAtStartup();
         setLocale(detectLocale(fleet)); // user-facing text language (fleet.yaml defaults.locale / timezone)
         const savedUpdateProgress = readUpdateProgress(this.dataDir);
         const pendingUpdateProgress = savedUpdateProgress
@@ -1469,6 +1993,10 @@ export class FleetManager {
         const { getTmuxSocketName: getSocket } = await import("./paths.js");
         TmuxManager.setSocketName(getSocket());
         await TmuxManager.ensureSession(getTmuxSession());
+        // Pre-flight (advisory, fire-and-forget): warm the per-backend auth cache
+        // before instances spawn, so a CLI that comes up on its sign-in screen gets
+        // an instant 🔑 verdict instead of decaying into crash/MCP-died noise.
+        this.lifecycle.primeAuthVerification(Object.values(fleet.instances).map(config => config.backend ?? fleet.defaults?.backend ?? "claude-code"));
         // Start tmux control mode client for idle detection
         if (!this.controlClient) {
             this.controlClient = new TmuxControlClient(getTmuxSession(), 2000, this.logger);
@@ -1512,6 +2040,11 @@ export class FleetManager {
         this.classicChannels = new ClassicChannelManager(this.dataDir, this.logger);
         const classicAdapters = fleet.channels?.length ? fleet.channels : (fleet.channel ? [fleet.channel] : []);
         this.classicChannels.configureAdapters(classicAdapters);
+        // The unrecoverable-id report is deliberately NOT sent here: no adapter
+        // exists yet at this point in startAll(), so notifyFleetError would find
+        // nothing to deliver through, drop the message silently, AND burn its
+        // 10-minute throttle key on the way out. It is sent once the shared adapter
+        // is up — see the adapterStartup continuation below.
         // Restore the persisted bot binding so replies/cancel go through the right
         // bot after a restart (before this, inbound would re-bind lazily).
         for (const ch of this.classicChannels.getAll()) {
@@ -1535,6 +2068,9 @@ export class FleetManager {
                 }
                 if (!this.classicChannels.checkReload())
                     return;
+                // A reload can introduce a bad id (hand edit) or clear one; the
+                // throttle keeps a repeated report from flooding the topic.
+                this.reportClassicUnrecoverableIds();
                 this.reregisterClassicChannels();
                 for (const ch of this.classicChannels.getAll()) {
                     const newBackend = this.classicChannels.getBackendByInstance(ch.instanceName, fleetBackend);
@@ -1548,7 +2084,10 @@ export class FleetManager {
                         await this.stopInstance(ch.instanceName).catch(() => { });
                         // Small delay to let tmux window clean up
                         await new Promise(r => setTimeout(r, 2000));
-                        await this.startClassicInstance(ch.instanceName, newBackend, this.classicChannels.getPreTaskCommand(ch.channelId, ch.adapterId), newModel, newAutoPause).catch(err => this.logger.warn({ err, instanceName: ch.instanceName }, "Failed to restart classic instance"));
+                        // The manager already holds the new backend/model/auto-pause; the
+                        // unattended helper reads them from it and schedules the delayed
+                        // retry on failure like every other unattended start.
+                        await this.startClassicInstanceUnattended(ch, "classic instance after backend/model change");
                     }
                 }
             }
@@ -1699,6 +2238,13 @@ export class FleetManager {
             this.scheduler = new Scheduler(join(this.dataDir, "scheduler.db"), (schedule) => this.handleScheduleTrigger(schedule), schedulerConfig, (name) => this.fleetConfig?.instances?.[name] != null || !!this.classicChannels?.getAll().some(ch => ch.instanceName === name));
             this.scheduler.init();
             this.logger.info("Scheduler initialized");
+            // Tips share the daily-report clock but remain an independent internal
+            // job: disabling daily_summary must not disable tips (and vice versa).
+            // The callback checks defaults.tips at fire time, so /tips on|off is hot.
+            this.dailyTipScheduler = new DailyTipScheduler(summaryConfig, costGuardConfig.timezone, () => this.sendTipToGeneral().catch(err => {
+                this.logger.warn({ err }, "Failed to send daily tip");
+            }));
+            this.dailyTipScheduler.start();
             // Inject active decisions as env var for MCP instructions.
             // Snapshotted at startup — new decisions via post_decision are available
             // through list_decisions tool but not auto-injected until restart.
@@ -1728,6 +2274,9 @@ export class FleetManager {
                 }
                 catch (err) {
                     this.logger.error({ err, name }, "Failed to start general instance");
+                    // General is the most important instance to bring back: it also gets
+                    // the delayed automatic retry (the topic notice below still goes out).
+                    this.scheduleStartupRetry(name, 0);
                     const errorMsg = err instanceof Error ? err.message : String(err);
                     const topicId = cfg.topic_id ? String(cfg.topic_id) : undefined;
                     if (this.adapter && topicId) {
@@ -1756,6 +2305,10 @@ export class FleetManager {
                 catch (err) {
                     this.logger.error({ err }, "startSharedAdapter failed — fleet continues without some adapters");
                 }
+                // Now that there is somewhere to deliver: a classicBot.yaml that already
+                // holds an unmatchable id at boot is the COMMON case, and reporting it
+                // before the adapter existed meant the operator heard nothing at all.
+                this.reportClassicUnrecoverableIds();
             })();
             progressStart = adapterStartup.then(() => {
                 if (pendingUpdateProgress) {
@@ -1847,14 +2400,8 @@ export class FleetManager {
                 while (idx < channels.length) {
                     const batch = channels.slice(idx, idx + concurrency);
                     await Promise.allSettled(batch.map(async (ch) => {
-                        try {
-                            await this.startClassicInstance(ch.instanceName, this.classicChannels.getBackendByInstance(ch.instanceName, fleetBackend), this.classicChannels.getPreTaskCommand(ch.channelId, ch.adapterId), this.classicChannels.getModel(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.model), this.classicChannels.getAutoPauseAfter(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.auto_pause_after));
-                            if (this.daemons.has(ch.instanceName))
-                                startupProgress.markReady();
-                        }
-                        catch (err) {
-                            this.logger.warn({ err, instanceName: ch.instanceName }, "Failed to start classic instance");
-                        }
+                        if (await this.startClassicInstanceUnattended(ch, "classic instance"))
+                            startupProgress.markReady();
                     }));
                     idx += concurrency;
                 }
@@ -1881,6 +2428,12 @@ export class FleetManager {
                 version: agendVersion,
                 pausedNames,
                 failedNames,
+                tipText: pendingUpdateProgress && this.tipsEnabled()
+                    ? (() => {
+                        const tip = this.pickAvailableTip();
+                        return tip ? this.formatTip(tip) : undefined;
+                    })()
+                    : undefined,
             });
             if (!progressCompleted && this.adapter && fleet.channel?.group_id) {
                 let text;
@@ -2042,20 +2595,33 @@ export class FleetManager {
     notifyAdapterFailure(adapterId, error) {
         const generalId = this.findGeneralInstance();
         if (generalId) {
-            this.notifyInstanceTopic(generalId, `⚠️ Adapter "${adapterId}" failed to start: ${error}\nRetrying in background. Other adapters unaffected.`);
+            this.notifyInstanceTopic(generalId, t("adapter.start_failed", adapterId, error));
         }
     }
     /** Notify admin that a retried adapter reconnected. */
     notifyAdapterRecovery(adapterId, attempts) {
         const generalId = this.findGeneralInstance();
         if (generalId) {
-            this.notifyInstanceTopic(generalId, `✅ Adapter "${adapterId}" reconnected (after ${attempts} ${attempts === 1 ? "retry" : "retries"}).`);
+            this.notifyInstanceTopic(generalId, t("adapter.reconnected", adapterId, attempts));
         }
     }
     /** Get adapter states for /status visibility. */
     getAdapterStates() {
         return this.adapterState;
     }
+    bindAdapterHealth(adapter, adapterId) {
+        adapter.on("gateway_health", (snapshot) => {
+            const previous = this.adapterState.get(adapterId);
+            const status = snapshot.status === "connected" ? "connected"
+                : snapshot.status === "stopped" ? "failed"
+                    : "retrying";
+            this.adapterState.set(adapterId, {
+                status,
+                retryCount: previous?.retryCount ?? 0,
+                lastError: status === "connected" ? undefined : snapshot.lastReconnectReason ?? previous?.lastError,
+            });
+        });
+    }
     /**
      * Real, checkable fleet health for `/health` and the operator.
      *
@@ -2085,10 +2651,17 @@ export class FleetManager {
                 counts.stopped++;
         }
         const states = {};
+        const details = {};
         let connected = 0;
         for (const [id, state] of this.adapterState) {
-            states[id] = state.status;
-            if (state.status === "connected")
+            const snapshot = this.adapters.get(id)?.getHealthSnapshot?.();
+            if (snapshot)
+                details[id] = snapshot;
+            const effectiveStatus = snapshot?.status === "connected" ? "connected"
+                : snapshot && snapshot.status !== "stopped" ? "retrying"
+                    : state.status;
+            states[id] = effectiveStatus;
+            if (effectiveStatus === "connected")
                 connected++;
         }
         const problems = [];
@@ -2096,9 +2669,9 @@ export class FleetManager {
             problems.push("no channel adapter is connected");
         if (counts.crashed > 0)
             problems.push(`${counts.crashed} instance(s) crashed`);
-        for (const [id, state] of this.adapterState) {
-            if (state.status !== "connected")
-                problems.push(`adapter ${id} is ${state.status}`);
+        for (const [id, state] of Object.entries(states)) {
+            if (state !== "connected")
+                problems.push(`adapter ${id} is ${state}`);
         }
         if (!this.startupComplete)
             problems.push("startup has not completed");
@@ -2111,7 +2684,7 @@ export class FleetManager {
             status,
             uptime: Math.floor((Date.now() - this.startedAt) / 1000),
             instances: counts,
-            adapters: { total: this.adapterState.size, connected, states },
+            adapters: { total: this.adapterState.size, connected, states, details },
             startupComplete: this.startupComplete,
             memory: readFleetMemory(),
             problems,
@@ -2140,6 +2713,7 @@ export class FleetManager {
         const world = new AdapterWorld(adapterId, this.adapter, accessManager, channelConfig);
         this.worlds.set(adapterId, world);
         this.adapters.set(adapterId, this.adapter);
+        this.bindAdapterHealth(this.adapter, adapterId);
         this.adapter.on("message", safeHandler(async (msg) => {
             await this.handleInboundMessage(msg);
         }, this.logger, "adapter.message"));
@@ -2147,6 +2721,22 @@ export class FleetManager {
             await this.handleInboundReaction(r);
         }, this.logger, "adapter.reaction"));
         this.adapter.on("callback_query", safeHandler(async (data) => {
+            if (await this.handleTipDismiss(data, adapterId, this.adapter ?? undefined))
+                return;
+            if (await this.handleTipUnlock(data, adapterId, this.adapter ?? undefined))
+                return;
+            if (await this.handleLoginBackendSelect(data, adapterId, this.adapter ?? undefined))
+                return;
+            if (await this.handleInstallBackendSelect(data, adapterId, this.adapter ?? undefined))
+                return;
+            if (await this.handleClassicApproval(data, adapterId, this.adapter ?? undefined))
+                return;
+            if (await this.handleLoginMenuSelect(data, adapterId, this.adapter ?? undefined))
+                return;
+            if (await this.handleLoginConfirm(data, adapterId, this.adapter ?? undefined))
+                return;
+            if (await this.handleInstallLoginConfirm(data, adapterId, this.adapter ?? undefined))
+                return;
             if (await this.handleClearConfirmation(data, adapterId, this.adapter ?? undefined))
                 return;
             if (await this.handleExitRestartPrompt(data, adapterId, this.adapter ?? undefined))
@@ -2259,6 +2849,29 @@ export class FleetManager {
                 });
                 await data.respond(result);
             }
+            else if (data.command === "btw") {
+                const name = this.resolveSlashTarget(data.channelId, adapterId);
+                if (!name) {
+                    await data.respond(t("classic.no_agent"));
+                    return;
+                }
+                const btwText = String(data.options?.message ?? "").trim();
+                if (!btwText) {
+                    await data.respond(t("btw.usage"));
+                    return;
+                }
+                const result = this.topicCommands.sendBtw(name, btwText, {
+                    chatId: "", messageId: "", username: data.username ?? "user",
+                    userId: data.userId ?? "", threadId: undefined, adapterId, source: "discord",
+                });
+                await data.respond(result);
+            }
+            else if (data.command === "login") {
+                await this.handleLoginSlash(data, adapterId, this.adapter);
+            }
+            else if (data.command === "install-cli") {
+                await this.handleInstallCliSlash(data, adapterId, this.adapter);
+            }
             else if (data.command === "clear") {
                 await this.handleClearSlash(data, adapterId);
             }
@@ -2332,12 +2945,15 @@ export class FleetManager {
                     const { getUsageSnapshot } = await import("./usage/usage-api.js");
                     const { renderUsageMarkdown } = await import("./usage/format-rich.js");
                     // slash_command is Discord-only; editReply renders Markdown natively.
-                    await data.respond(renderUsageMarkdown(await getUsageSnapshot()));
+                    await data.respond(renderUsageMarkdown(await getUsageSnapshot(false, this.getActiveUsageProviderIds())));
                 }
                 catch (err) {
-                    await data.respond(`⚠️ Usage fetch failed: ${err.message}`);
+                    await data.respond(t("usage.failed", err.message));
                 }
             }
+            else if (data.command === "tips") {
+                await this.handleTipsSlash(data, adapterId);
+            }
             else if (data.command === "status") {
                 // Admin-gated (like the topic path): the merged table shows every
                 // instance's cost and IPC health.
@@ -2349,7 +2965,8 @@ export class FleetManager {
                 await data.respond(text);
             }
             else if (data.command === "sysinfo") {
-                await data.respond(this.topicCommands.getSysInfoText());
+                // Slash commands are Discord-only; use plain lines (no markdown table)
+                await data.respond(this.topicCommands.getSysInfoText({ platform: "discord" }));
             }
             else if (data.command === "dashboard") {
                 // Reply is ephemeral (adapter defers non-chat commands ephemerally), so
@@ -2403,6 +3020,29 @@ export class FleetManager {
                 });
                 await data.respond(result);
             }
+            else if (data.command === "btw") {
+                const name = this.resolveSlashTarget(data.channelId, adapterId);
+                if (!name) {
+                    await data.respond(t("classic.no_agent"));
+                    return;
+                }
+                const btwText = String(data.options?.message ?? "").trim();
+                if (!btwText) {
+                    await data.respond(t("btw.usage"));
+                    return;
+                }
+                const result = this.topicCommands.sendBtw(name, btwText, {
+                    chatId: "", messageId: "", username: data.username ?? "user",
+                    userId: data.userId ?? "", threadId: undefined, adapterId, source: "discord",
+                });
+                await data.respond(result);
+            }
+            else if (data.command === "login") {
+                await this.handleLoginSlash(data, adapterId, this.adapter);
+            }
+            else if (data.command === "install-cli") {
+                await this.handleInstallCliSlash(data, adapterId, this.adapter);
+            }
         }, this.logger, "adapter.slash_command"));
         await this.topicCommands.registerBotCommands().catch(e => this.logger.warn({ err: e }, "registerBotCommands failed (non-fatal)"));
         // Background-probe each backend's CLI env (version/models) → cli-env cache.
@@ -2429,13 +3069,14 @@ export class FleetManager {
         }, this.logger, "adapter.handler_error"));
         this.adapter.on("error", (err) => {
             this.logger.error({ err }, "Primary adapter fatal error");
-            this.restartAdapter(this.adapter, "primary").catch(() => { });
+            this.restartAdapter(this.adapter, adapterId).catch(() => { });
         });
-        this.adapter.on("new_group_detected", safeHandler((data) => {
+        this.adapter.on("new_group_detected", safeHandler(async (data) => {
             const adminMsg = t("alert.bot_added", data.groupTitle, data.groupId, data.source);
             const generalId = this.findGeneralInstance();
+            // No user to promote: the bot was just added, nobody has run /start yet.
             if (generalId)
-                this.notifyInstanceTopic(generalId, adminMsg);
+                await this.promptClassicApproval({ generalName: generalId, message: adminMsg, groupId: data.groupId, scope: data.source === "telegram" ? "group" : "guild" });
         }, this.logger, "adapter.new_group_detected"));
         // Start adapter AFTER all event listeners are registered (started event sets botUsername)
         await this.adapter.start();
@@ -2471,6 +3112,7 @@ export class FleetManager {
         const world = new AdapterWorld(adapterId, adapter, accessManager, channelConfig);
         this.worlds.set(adapterId, world);
         this.adapters.set(adapterId, adapter);
+        this.bindAdapterHealth(adapter, adapterId);
         // Wire up event handlers (same as primary, routes through shared handleInboundMessage)
         adapter.on("message", safeHandler(async (msg) => {
             await this.handleInboundMessage(msg);
@@ -2479,6 +3121,22 @@ export class FleetManager {
             await this.handleInboundReaction(r);
         }, this.logger, `adapter[${adapterId}].reaction`));
         adapter.on("callback_query", safeHandler(async (data) => {
+            if (await this.handleTipDismiss(data, adapterId, adapter))
+                return;
+            if (await this.handleTipUnlock(data, adapterId, adapter))
+                return;
+            if (await this.handleLoginBackendSelect(data, adapterId, adapter))
+                return;
+            if (await this.handleInstallBackendSelect(data, adapterId, adapter))
+                return;
+            if (await this.handleClassicApproval(data, adapterId, adapter))
+                return;
+            if (await this.handleLoginMenuSelect(data, adapterId, adapter))
+                return;
+            if (await this.handleLoginConfirm(data, adapterId, adapter))
+                return;
+            if (await this.handleInstallLoginConfirm(data, adapterId, adapter))
+                return;
             if (await this.handleClearConfirmation(data, adapterId, adapter))
                 return;
             if (await this.handleExitRestartPrompt(data, adapterId, adapter))
@@ -2634,12 +3292,15 @@ export class FleetManager {
                     const { getUsageSnapshot } = await import("./usage/usage-api.js");
                     const { renderUsageMarkdown } = await import("./usage/format-rich.js");
                     // slash_command is Discord-only; editReply renders Markdown natively.
-                    await data.respond(renderUsageMarkdown(await getUsageSnapshot()));
+                    await data.respond(renderUsageMarkdown(await getUsageSnapshot(false, this.getActiveUsageProviderIds())));
                 }
                 catch (err) {
-                    await data.respond(`⚠️ Usage fetch failed: ${err.message}`);
+                    await data.respond(t("usage.failed", err.message));
                 }
             }
+            else if (data.command === "tips") {
+                await this.handleTipsSlash(data, adapterId);
+            }
             else if (data.command === "status") {
                 // Admin-gated (like the topic path): the merged table shows every
                 // instance's cost and IPC health.
@@ -2651,7 +3312,8 @@ export class FleetManager {
                 await data.respond(text);
             }
             else if (data.command === "sysinfo") {
-                await data.respond(this.topicCommands.getSysInfoText());
+                // Slash commands are Discord-only; use plain lines (no markdown table)
+                await data.respond(this.topicCommands.getSysInfoText({ platform: "discord" }));
             }
             else if (data.command === "dashboard") {
                 // Reply is ephemeral (adapter defers non-chat commands ephemerally), so
@@ -2705,11 +3367,30 @@ export class FleetManager {
                 });
                 await data.respond(result);
             }
+            else if (data.command === "btw") {
+                const name = this.resolveSlashTarget(data.channelId, adapterId);
+                if (!name) {
+                    await data.respond(t("classic.no_agent"));
+                    return;
+                }
+                const btwText = String(data.options?.message ?? "").trim();
+                if (!btwText) {
+                    await data.respond(t("btw.usage"));
+                    return;
+                }
+                const result = this.topicCommands.sendBtw(name, btwText, {
+                    chatId: "", messageId: "", username: data.username ?? "user",
+                    userId: data.userId ?? "", threadId: undefined, adapterId, source: "discord",
+                });
+                await data.respond(result);
+            }
+            else if (data.command === "login") {
+                await this.handleLoginSlash(data, adapterId, adapter);
+            }
+            else if (data.command === "install-cli") {
+                await this.handleInstallCliSlash(data, adapterId, adapter);
+            }
         }, this.logger, `adapter[${adapterId}].slash_command`));
-        await adapter.start();
-        if (channelConfig.group_id) {
-            adapter.setChatId(String(channelConfig.group_id));
-        }
         adapter.on("started", safeHandler((username, userId) => {
             this.logger.info(`[${adapterId}] Bot @${username} polling started.`);
             const world = this.worlds.get(adapterId);
@@ -2719,16 +3400,21 @@ export class FleetManager {
                     world.botUserId = userId;
             }
         }, this.logger, `adapter[${adapterId}].started`));
-        adapter.on("new_group_detected", safeHandler((data) => {
+        adapter.on("new_group_detected", safeHandler(async (data) => {
             const adminMsg = t("alert.bot_added", data.groupTitle, data.groupId, data.source);
             const generalId = this.findGeneralInstance(adapterId);
             if (generalId)
-                this.notifyInstanceTopic(generalId, adminMsg);
+                await this.promptClassicApproval({ generalName: generalId, message: adminMsg, groupId: data.groupId, scope: data.source === "telegram" ? "group" : "guild" });
         }, this.logger, `adapter[${adapterId}].new_group_detected`));
         adapter.on("error", (err) => {
             this.logger.error({ err, adapterId }, "Additional adapter fatal error");
             this.restartAdapter(adapter, adapterId).catch(() => { });
         });
+        // Register lifecycle listeners before login; a fast ready/error must not be lost.
+        await adapter.start();
+        if (channelConfig.group_id) {
+            adapter.setChatId(String(channelConfig.group_id));
+        }
         this.logger.info({ adapterId, type: channelConfig.type }, "Additional adapter started");
     }
     /** Connect IPC to a single instance with all handlers */
@@ -2825,6 +3511,39 @@ export class FleetManager {
                 else if (msg.type === "instance_progress") {
                     this.cacheInstanceProgress(name, msg.progress || null);
                 }
+                else if (msg.type === "cross_instance_delivery_failed") {
+                    const senderSession = String(msg.senderSession ?? "");
+                    const targetInstance = String(msg.targetInstance ?? name);
+                    const correlationId = String(msg.correlationId ?? "unknown");
+                    const error = String(msg.error ?? "unknown delivery failure");
+                    const senderInstance = this.instanceIpcClients.has(senderSession)
+                        ? senderSession
+                        : this.sessionRegistry.get(senderSession);
+                    this.logger.error({ senderSession, targetInstance, correlationId, error }, "Cross-instance pane delivery failed after queue acceptance");
+                    this.eventLog?.insert(targetInstance, "cross_instance_delivery_failed", {
+                        from: senderSession, correlation_id: correlationId, error,
+                    });
+                    if (senderInstance) {
+                        this.notifyInstanceTopic(senderInstance, t("cross_instance.delivery_failed_notice", targetInstance, error, correlationId));
+                        void this.deliverToInstance(senderInstance, {
+                            type: "fleet_inbound",
+                            targetSession: senderSession,
+                            content: t("cross_instance.delivery_failed_agent", targetInstance, error, correlationId),
+                            meta: {
+                                chat_id: "",
+                                message_id: `delivery-failed-${Date.now()}`,
+                                user: "AgEnD",
+                                user_id: "system:agend",
+                                ts: new Date().toISOString(),
+                                thread_id: "",
+                                request_kind: "update",
+                                correlation_id: correlationId,
+                            },
+                        }, { waitForIdle: true }).catch(deliveryError => {
+                            this.logger.error({ err: deliveryError, senderSession, correlationId }, "Could not deliver cross-instance failure status back to sender");
+                        });
+                    }
+                }
                 else if (msg.type === "instance_state" || msg.type === "instance_state_response") {
                     this.cacheInstanceExecutionState(name, msg);
                     if (msg.type === "instance_state_response") {
@@ -2938,6 +3657,26 @@ export class FleetManager {
         const previous = this.adapterState.get(id);
         this.adapterState.set(id, { status: "retrying", retryCount: 0, lastError: previous?.lastError });
         try {
+            if (adapter.reconnectGateway) {
+                try {
+                    // Discord requires a fresh Client after destroy(). Its adapter owns the
+                    // single-flight, generation fence and bounded IDENTIFY backoff, so all
+                    // watchdog/manual/error triggers must converge here instead of stop/start.
+                    await adapter.reconnectGateway(previous?.lastError ?? "fleet adapter restart");
+                    this.adapterState.set(id, { status: "connected", retryCount: 0 });
+                    this.logger.info({ id }, "Adapter gateway rebuilt successfully");
+                }
+                catch (err) {
+                    if (!this.ipcStoppingInstances.has("__fleet_stopping__")) {
+                        this.adapterState.set(id, {
+                            status: "failed",
+                            retryCount: previous?.retryCount ?? 0,
+                            lastError: err?.message ?? String(err),
+                        });
+                    }
+                }
+                return;
+            }
             for (let attempt = 1;; attempt++) {
                 if (this.ipcStoppingInstances.has("__fleet_stopping__"))
                     return;
@@ -3041,9 +3780,148 @@ export class FleetManager {
             consume: () => this.eventLog?.markReactionsConsumed(instanceName, pending.maxId),
         };
     }
+    /**
+     * Which adapter's access policy governs an inbound message.
+     *
+     * `authoritative` means the thread resolved to an owning instance, so that
+     * adapter's policy is the only one entitled to decide. A resolved owner whose
+     * policy cannot be read is NOT the same as having no owner: the owner's world
+     * may not exist yet (an adapter that fails its token check returns before its
+     * world and AccessManager are created) while sibling bots are already live and
+     * receiving copies. Falling back to a sibling's policy — or to the fleet-wide
+     * one — would let the owner's rules be decided by another adapter, so callers
+     * must refuse instead.
+     *
+     * Without an owner (classic channels, the no-thread Telegram path, unrouted
+     * threads, no adapter identity) the receiving adapter's policy applies, as
+     * before.
+     */
+    governingAccess(msg, threadId) {
+        if (threadId && !this.classicChannels?.hasChannel(threadId)) {
+            const target = this.routing.resolve(threadId);
+            if (target) {
+                const owner = this.getInstanceAdapterId(target.name);
+                if (owner)
+                    return { adapterId: owner, authoritative: true };
+            }
+        }
+        return { adapterId: msg.adapterId, authoritative: false };
+    }
+    /**
+     * Why this adapter should leave an inbound message to another adapter, or null
+     * to handle it.
+     *
+     * A fleet topic is served by exactly one instance, and that instance is
+     * answered by exactly one adapter. When several bots share a guild they each
+     * receive their own copy of every message, so the copy that is acted on must
+     * be chosen by ownership rather than by which inbound happened to fire first.
+     * Ownership is per-instance — the adapter the instance is bound to, falling
+     * back to channels[0] when it is not bound — so an instance answered by a
+     * non-default bot still receives its own traffic, and the access policy that
+     * applies is that instance's own adapter's.
+     *
+     * Callers must ask before claiming the shared dedup key: a copy that is going
+     * to be left alone must not consume the key, or the owner's copy would be
+     * discarded as a duplicate and the message lost.
+     *
+     * Exempt: classic channels (each bot owns its own agent there and handles its
+     * own copy, which is why their dedup key is adapter-scoped), the no-thread
+     * Telegram path (no thread to resolve an instance from), and messages with no
+     * adapter id (single-adapter fleets).
+     */
+    topicOwnerDropReason(msg, threadId) {
+        if (!threadId || !msg.adapterId)
+            return null;
+        if (this.classicChannels?.hasChannel(threadId))
+            return null;
+        const target = this.routing.resolve(threadId);
+        if (!target)
+            return null;
+        const ownerAdapterId = this.getInstanceAdapterId(target.name);
+        if (ownerAdapterId && msg.adapterId !== ownerAdapterId) {
+            return `not the adapter bound to ${target.name} (that is ${ownerAdapterId})`;
+        }
+        return null;
+    }
+    /**
+     * Why this adapter must ignore a bot/webhook message, or null to accept it.
+     * Pure: callers rely on being able to ask before claiming the dedup key.
+     */
+    botMessageDropReason(msg, threadId) {
+        if (!threadId) {
+            // TG classic: allow if the bot @mentions our bot or access mode is open
+            const world = this.worlds.get(msg.adapterId ?? "");
+            const botUser = world?.botUsername;
+            const isOpen = this.getChannelConfig(msg.adapterId)?.access?.mode === "open";
+            const mentionsUs = !!(botUser && msg.text?.toLowerCase().includes(`@${botUser.toLowerCase()}`));
+            return (!isOpen && !mentionsUs) ? "tg-classic: not open and does not mention us" : null;
+        }
+        if (this.classicChannels?.hasChannel(threadId)) {
+            // Classic channel (per-bot): bot messages only when THIS bot owns an
+            // agent here and collab is on for it.
+            if (!this.classicChannels.getInstanceByChannel(threadId, msg.adapterId)) {
+                return "classic: this bot owns no agent in the channel";
+            }
+            if (!this.classicChannels.isCollab(threadId, msg.adapterId))
+                return "classic: collab off";
+            return null;
+        }
+        const target = this.routing.resolve(threadId);
+        if (!target)
+            return "fleet topic: no instance routed for this thread";
+        // Fleet topic: allow if collab enabled OR access mode is open
+        const isOpen = this.getChannelConfig(msg.adapterId)?.access?.mode === "open";
+        if (!isOpen && !this.collabInstances.has(target.name)) {
+            return `fleet topic: adapter not open and collab off for ${target.name}`;
+        }
+        return null;
+    }
     async handleInboundMessage(msg) {
         const threadId = msg.threadId || undefined;
         this.logger.debug({ source: msg.source, chatId: msg.chatId, threadId, userId: msg.userId, isBotMessage: msg.isBotMessage, textLen: (msg.text ?? "").length, text: (msg.text ?? "").slice(0, 80) }, "handleInboundMessage entry");
+        // Ownership and per-adapter filtering both run before the dedup claim below.
+        // When several bots share a guild they all receive the same message; a copy
+        // this adapter is going to leave alone must not consume the shared dedup key,
+        // or the owning adapter's copy would be discarded as a duplicate and the
+        // message lost entirely. Claiming the key only on surviving copies also keeps
+        // delivery single when more than one adapter would otherwise accept it.
+        // Only bot messages are settled by ownership: a bot answering in a fleet
+        // topic would speak as the wrong identity, whereas a human message is just
+        // input for the instance and its reply is canonicalized to the owning
+        // adapter downstream — so a topic only a non-owner bot can see still works.
+        const drop = msg.isBotMessage
+            ? (this.topicOwnerDropReason(msg, threadId) ?? this.botMessageDropReason(msg, threadId))
+            : null;
+        if (drop) {
+            this.logger.debug({ adapterId: msg.adapterId, threadId: threadId ?? null, messageId: msg.messageId, reason: drop }, "Inbound message dropped before the dedup claim — key not consumed");
+            return;
+        }
+        // Access control — classic channels are open to all, others require an allowed
+        // user. This runs before the dedup claim, and is judged by the adapter that
+        // owns the topic rather than the one that happened to receive the message:
+        // otherwise a sibling bot could settle the message under its own policy —
+        // claiming the shared key and then refusing it, or admitting a user the
+        // owning adapter does not allow — purely by arriving first.
+        const governing = this.governingAccess(msg, threadId);
+        const ownerWorld = governing.adapterId ? this.worlds.get(governing.adapterId) : undefined;
+        if (governing.authoritative && !ownerWorld) {
+            this.logger.warn({ adapterId: msg.adapterId, owner: governing.adapterId, threadId, messageId: msg.messageId }, "Refusing inbound: the owning adapter is not running, so its access policy cannot be applied");
+            return;
+        }
+        const am = governing.authoritative
+            ? ownerWorld?.accessManager
+            : (ownerWorld?.accessManager ?? this.accessManager);
+        if (am && !am.isAllowed(msg.userId)) {
+            const adapterGroupId = String(this.getChannelConfig(msg.adapterId)?.group_id ?? "");
+            const isTelegramClassicCandidate = msg.source === "telegram" && msg.chatId !== adapterGroupId && !threadId;
+            if (!isTelegramClassicCandidate) {
+                // Classic channels are open to all; check per-bot ownership (or fleet topic).
+                const isClassic = !!(threadId && this.classicChannels?.hasChannel(threadId));
+                this.logger.info({ userId: msg.userId, threadId, isClassic, owner: governing.adapterId }, "Access DENIED for non-allowed user");
+                if (!isClassic)
+                    return;
+            }
+        }
         // Multi-adapter dedup: when several bots share a guild, each adapter fires
         // its own "message" event for the same underlying message. Process it once.
         // Routing (by topic/channel) and reply-adapter selection (by channel_id
@@ -3072,55 +3950,6 @@ export class FleetManager {
                     this.recentMessageIds.delete(oldest);
             }
         }
-        // Bot messages: only allow in collab channels or TG classic with @mention
-        if (msg.isBotMessage) {
-            if (!threadId) {
-                // TG classic: allow if bot @mentions our bot or access mode is open
-                const world = this.worlds.get(msg.adapterId ?? "");
-                const botUser = world?.botUsername;
-                const channelCfg = this.getChannelConfig(msg.adapterId);
-                const isOpen = channelCfg?.access?.mode === "open";
-                const mentionsUs = !!(botUser && msg.text?.toLowerCase().includes(`@${botUser.toLowerCase()}`));
-                this.logger.debug({ botUser, mentionsUs, isOpen, isBotMessage: true, threadId: null }, "Bot message filter (no threadId path)");
-                if (!isOpen && !mentionsUs)
-                    return;
-                // Fall through to TG classic handling below
-            }
-            else if (this.classicChannels?.hasChannel(threadId)) {
-                // Classic channel (per-bot): bot messages only when THIS bot owns an
-                // agent here and collab is on for it.
-                const classicName = this.classicChannels.getInstanceByChannel(threadId, msg.adapterId);
-                if (!classicName)
-                    return;
-                if (!this.classicChannels.isCollab(threadId, msg.adapterId))
-                    return;
-                // Fall through to channel handling
-            }
-            else {
-                const target = this.routing.resolve(threadId);
-                if (!target)
-                    return;
-                // Fleet topic: allow if collab enabled OR access mode is open
-                const channelCfg = this.getChannelConfig(msg.adapterId);
-                const isOpen = channelCfg?.access?.mode === "open";
-                if (!isOpen && !this.collabInstances.has(target.name))
-                    return;
-                // Fall through to channel handling
-            }
-        }
-        // Access control — classic channels are open to all, others require allowed user
-        const am = (msg.adapterId ? this.worlds.get(msg.adapterId)?.accessManager : undefined) ?? this.accessManager;
-        if (am && !am.isAllowed(msg.userId)) {
-            const adapterGroupId = String(this.getChannelConfig(msg.adapterId)?.group_id ?? "");
-            const isTelegramClassicCandidate = msg.source === "telegram" && msg.chatId !== adapterGroupId && !threadId;
-            if (!isTelegramClassicCandidate) {
-                // Classic channels are open to all; check per-bot ownership (or fleet topic).
-                const isClassic = !!(threadId && this.classicChannels?.hasChannel(threadId));
-                this.logger.info({ userId: msg.userId, threadId, isClassic }, "Access DENIED for non-allowed user");
-                if (!isClassic)
-                    return;
-            }
-        }
         if (threadId == null) {
             // ── Telegram Classic Mode ──
             // Messages from chats other than the primary forum group are classic mode candidates.
@@ -3175,7 +4004,13 @@ export class FleetManager {
                             const adminMsg = t("alert.new_group", groupTitle, chatId, msg.username, msg.userId, msg.source);
                             const generalId = this.findGeneralInstance(msg.adapterId);
                             if (generalId) {
-                                this.notifyInstanceTopic(generalId, adminMsg);
+                                await this.promptClassicApproval({
+                                    // Guarded by isGroupAllowed → this belongs in allowed_groups,
+                                    // NOT allowed_guilds; writing the latter would change the file
+                                    // without unblocking the group.
+                                    generalName: generalId, message: adminMsg, groupId: String(chatId),
+                                    scope: "group", userId: msg.userId,
+                                });
                             }
                             await msgAdapter?.sendText(chatId, t("classic.access_requested"));
                             return;
@@ -3290,6 +4125,24 @@ export class FleetManager {
                     await msgAdapter?.sendText(chatId, result);
                     return;
                 }
+                // /btw — Claude Code's native side-thread command. Like /steer it is
+                // not admin-gated, but it remains a distinct raw CLI command so Claude
+                // does not fold the question into the active task.
+                if (text === "/btw" || text.startsWith("/btw ") || text.startsWith("/btw@")) {
+                    const btwName = this.classicChannels.getInstanceByChannel(chatId, msg.adapterId);
+                    if (!btwName) {
+                        await msgAdapter?.sendText(chatId, t("classic.no_agent_start"));
+                        return;
+                    }
+                    const btwContent = text.replace(/^\/btw(@\S+)?/, "").trim();
+                    if (!btwContent) {
+                        await msgAdapter?.sendText(chatId, t("btw.usage"));
+                        return;
+                    }
+                    const result = this.topicCommands.sendBtw(btwName, btwContent, msg);
+                    await msgAdapter?.sendText(chatId, result);
+                    return;
+                }
                 // Handle /clear command (admin only) — unlike /compact this starts a
                 // fresh conversation and intentionally discards the current history.
                 if (text === "/clear" || text.startsWith("/clear@")) {
@@ -3317,7 +4170,7 @@ export class FleetManager {
                         return;
                     }
                     const ok = this.cancelInstance(cancelName);
-                    await msgAdapter?.sendText(chatId, ok ? `🛑 已送出取消給 ${cancelName}。` : `❌ ${cancelName} 未在執行。`);
+                    await msgAdapter?.sendText(chatId, ok ? t("cancel.sent", cancelName) : t("cancel.not_running", cancelName));
                     return;
                 }
                 // Handle /ctx command
@@ -3354,7 +4207,7 @@ export class FleetManager {
                     const backend = this.classicChannels.getBackendByInstance(saveName, this.fleetConfig?.defaults?.backend);
                     const cmd = saveCommandForBackend(backend, filename);
                     if (!cmd) {
-                        await msgAdapter?.sendText(chatId, SAVE_UNSUPPORTED_MSG);
+                        await msgAdapter?.sendText(chatId, t("save.unsupported"));
                         return;
                     }
                     this.pasteRawToClassicInstance(saveName, cmd);
@@ -3572,10 +4425,10 @@ export class FleetManager {
             return;
         let warning = "";
         if (rl.five_hour_pct >= 95) {
-            warning = `⚠️ ${instanceName} at ${Math.round(rl.five_hour_pct)}% of 5h rate limit. Responses may be slower.`;
+            warning = t("rate_limit.five_hour", instanceName, Math.round(rl.five_hour_pct));
         }
         else if (rl.seven_day_pct >= 95) {
-            warning = `⚠️ ${instanceName} at ${Math.round(rl.seven_day_pct)}% weekly usage. Responses may be slower or fail.`;
+            warning = t("rate_limit.weekly", instanceName, Math.round(rl.seven_day_pct));
         }
         if (!warning)
             return;
@@ -3590,8 +4443,6 @@ export class FleetManager {
     }
     /** Handle outbound tool calls from a daemon instance */
     async handleOutboundFromInstance(instanceName, msg) {
-        if (this.worlds.size === 0)
-            return;
         this.touchActivity(instanceName);
         this.setTopicIcon(instanceName, "green");
         const tool = msg.tool;
@@ -3601,13 +4452,21 @@ export class FleetManager {
         const senderSessionName = msg.senderSessionName;
         const respond = (result, error) => {
             const ipc = this.instanceIpcClients.get(instanceName);
+            let sent = false;
             if (fleetRequestId) {
-                ipc?.send({ type: "fleet_outbound_response", fleetRequestId, result, error });
+                sent = ipc?.send({ type: "fleet_outbound_response", fleetRequestId, result, error }) ?? false;
             }
             else {
-                ipc?.send({ type: "fleet_outbound_response", requestId, result, error });
+                sent = ipc?.send({ type: "fleet_outbound_response", requestId, result, error }) ?? false;
+            }
+            if (!sent) {
+                this.logger.warn({ instanceName, tool, requestId, fleetRequestId, error }, "Fleet outbound result could not be returned — instance IPC is disconnected");
             }
         };
+        if (this.worlds.size === 0) {
+            respond(null, "Channel adapters are not ready — retry shortly");
+            return;
+        }
         // Resolve threadId: use sender's topic_id if sender is a known fleet instance,
         // fall back to general topic if sender is unknown, or IPC owner if no sender.
         const senderInstanceName = senderSessionName && this.fleetConfig?.instances[senderSessionName]
@@ -3652,17 +4511,30 @@ export class FleetManager {
         if (tool === "reply") {
             const ticket = this.replyDeduper.begin(instanceName, String(args.text ?? ""), Array.isArray(args.files) ? args.files : []);
             if (ticket.duplicate) {
-                this.logger.info({ instanceName }, "Duplicate reply suppressed — replaying the original send's outcome");
+                this.logger.info({ instanceName }, "Concurrent duplicate reply joined — awaiting the original send's outcome");
                 ticket.subscribe(respond);
                 return;
             }
             const original = respond;
             const respondAndRecord = (result, error) => {
                 ticket.complete(result, error);
+                // Return the platform outcome first. Bookkeeping below must never turn
+                // a confirmed Discord/Telegram POST into a tool error if a secondary
+                // log/button side effect happens to throw.
                 original(result, error);
+                // The adapter resolves only after the platform POST returns. Keep
+                // outward-facing logs/cancel state on the same confirmation boundary:
+                // a routed-but-failed reply is not a delivered reply.
+                if (!error && result != null) {
+                    try {
+                        this.afterReplyRouted(instanceName, args, senderSessionName);
+                    }
+                    catch (err) {
+                        this.logger.warn({ err, instanceName }, "Reply delivered but post-delivery bookkeeping failed");
+                    }
+                }
             };
             if (routeToolCall(outAdapter, tool, args, threadId, respondAndRecord)) {
-                this.afterReplyRouted(instanceName, args, senderSessionName);
                 return;
             }
             // routeToolCall knows "reply"; not handling it means the world changed.
@@ -3699,7 +4571,7 @@ export class FleetManager {
             this.clearCancelButton(instanceName);
         }
         else {
-            void this.sendCancelButton(instanceName).then(() => this.armReplyGrace(instanceName));
+            void this.sendCancelButton(instanceName, undefined, true).then(() => this.armReplyGrace(instanceName));
         }
         this.reactDone(instanceName);
         const replyTo = this.lastInboundUser.get(instanceName) ?? "user";
@@ -3736,7 +4608,11 @@ export class FleetManager {
         if (silent) {
             const ipc = this.instanceIpcClients.get(target);
             if (ipc) {
-                ipc.send({ type: "raw_paste", content: message });
+                ipc.send({
+                    type: "raw_paste",
+                    content: message,
+                    delivery_epoch: this.getDeliveryEpoch(target),
+                });
                 this.scheduler.recordRun(id, "delivered");
                 this.logger.info({ target, scheduleId: id, label }, "Silent schedule injected via raw_paste");
             }
@@ -3751,10 +4627,19 @@ export class FleetManager {
         const retryInterval = schedulerDefaults?.retry_interval_ms ?? 30_000;
         const deliver = async () => {
             try {
+                // A schedule has no live inbound adapter context. Seed the daemon with
+                // the target instance's configured world so replies use its persona
+                // after a fresh start instead of falling back to channels[0].
+                const adapterId = this.getInstanceAdapterId(target);
                 await this.deliverToInstance(target, {
                     type: "fleet_schedule_trigger",
                     payload: { schedule_id: id, message: `[Scheduled] ${message}`, label },
-                    meta: { chat_id: reply_chat_id, thread_id: reply_thread_id, user: "scheduler" },
+                    meta: {
+                        chat_id: reply_chat_id,
+                        thread_id: reply_thread_id,
+                        user: "scheduler",
+                        ...(adapterId ? { adapter_id: adapterId } : {}),
+                    },
                 }, { waitForIdle: true });
                 // A scheduled trigger also puts the instance to work — show a cancel button.
                 void this.sendCancelButton(target);
@@ -3902,7 +4787,29 @@ export class FleetManager {
     }
     /** Resolve display name for an instance, fallback to instance name. */
     resolveDisplayName(instanceName) {
-        return this.fleetConfig?.instances[instanceName]?.display_name ?? instanceName;
+        return this.fleetConfig?.instances[instanceName]?.display_name
+            ?? this.classicChannels?.getAll().find(ch => ch.instanceName === instanceName)?.displayName
+            ?? instanceName;
+    }
+    /** Persist identity to the instance's actual config store. Classic instances
+     * are registry rows in classicBot.yaml, not fleet.yaml instance entries. */
+    setInstanceDisplayName(instanceName, displayName) {
+        const fleetInstance = this.fleetConfig?.instances[instanceName];
+        if (fleetInstance) {
+            fleetInstance.display_name = displayName;
+            this.saveFleetConfig();
+            return true;
+        }
+        return this.classicChannels?.setDisplayNameByInstance(instanceName, displayName) ?? false;
+    }
+    setInstanceDescription(instanceName, description) {
+        const fleetInstance = this.fleetConfig?.instances[instanceName];
+        if (fleetInstance) {
+            fleetInstance.description = description;
+            this.saveFleetConfig();
+            return true;
+        }
+        return this.classicChannels?.setDescriptionByInstance(instanceName, description) ?? false;
     }
     handleSetDisplayName(instanceName, msg) {
         const fleetRequestId = msg.fleetRequestId;
@@ -3915,8 +4822,10 @@ export class FleetManager {
             ipc.send({ type: "fleet_display_name_response", fleetRequestId, error: "Name must be 1-30 characters" });
             return;
         }
-        this.fleetConfig.instances[instanceName].display_name = displayName;
-        this.saveFleetConfig();
+        if (!this.setInstanceDisplayName(instanceName, displayName)) {
+            ipc.send({ type: "fleet_display_name_response", fleetRequestId, error: `Instance '${instanceName}' not found` });
+            return;
+        }
         this.logger.info({ instanceName, displayName }, "Display name set");
         ipc.send({ type: "fleet_display_name_response", fleetRequestId, result: { display_name: displayName } });
     }
@@ -3931,8 +4840,10 @@ export class FleetManager {
             ipc.send({ type: "fleet_description_response", fleetRequestId, error: "Description cannot be empty" });
             return;
         }
-        this.fleetConfig.instances[instanceName].description = description;
-        this.saveFleetConfig();
+        if (!this.setInstanceDescription(instanceName, description)) {
+            ipc.send({ type: "fleet_description_response", fleetRequestId, error: `Instance '${instanceName}' not found` });
+            return;
+        }
         this.logger.info({ instanceName, description: description.slice(0, 80) }, "Description set");
         ipc.send({ type: "fleet_description_response", fleetRequestId, result: { description } });
     }
@@ -4061,8 +4972,8 @@ export class FleetManager {
             return { error: "Fleet config not available" };
         if (!name || name.length > 30)
             return { error: "Name must be 1-30 characters" };
-        this.fleetConfig.instances[instance].display_name = name;
-        this.saveFleetConfig();
+        if (!this.setInstanceDisplayName(instance, name))
+            return { error: `Instance '${instance}' not found` };
         return { display_name: name };
     }
     async handleSetDescriptionHttp(instance, description) {
@@ -4070,8 +4981,8 @@ export class FleetManager {
             return { error: "Fleet config not available" };
         if (!description)
             return { error: "Description cannot be empty" };
-        this.fleetConfig.instances[instance].description = description;
-        this.saveFleetConfig();
+        if (!this.setInstanceDescription(instance, description))
+            return { error: `Instance '${instance}' not found` };
         return { description };
     }
     summarizeToolCall(tool, args) {
@@ -4203,7 +5114,8 @@ export class FleetManager {
     }
     /**
      * Patch only values changed in the effective config into the original YAML
-     * document. Unknown keys, explicit overrides and comments remain untouched.
+     * document. Unknown keys and comments remain untouched; redundant
+     * non-identity instance leaves are canonicalized to inheritance afterward.
      */
     saveFleetConfig(explicitPatches = []) {
         if (!this.fleetConfig || !this.configPath)
@@ -4219,9 +5131,9 @@ export class FleetManager {
         }
         this.rawFleetConfig = loadRawFleetConfig(this.configPath);
         this.patchFleetDocument(this.rawFleetDocument, [], this.savedFleetConfigSnapshot, this.fleetConfig);
-        // Settings edits are expressed against the raw config. Persist them even
-        // when the chosen override equals the inherited effective value, a case
-        // the before/after runtime diff cannot observe.
+        // Settings edits are expressed against the raw config, so apply them before
+        // canonicalization. A non-identity value equal to its inherited default is
+        // intentionally stored as inheritance rather than an explicit duplicate.
         for (const patch of explicitPatches) {
             if (patch.remove) {
                 // YAML's deleteIn throws when an inherited nested key has no raw parent
@@ -4236,7 +5148,24 @@ export class FleetManager {
                 this.patchFleetDocument(this.rawFleetDocument, patch.path, before, patch.value);
             }
         }
+        const rawAfterPatches = this.rawFleetDocument.toJS();
+        const redundantPaths = collectRedundantInstanceDefaultPaths(rawAfterPatches);
+        for (const path of redundantPaths) {
+            if (this.rawFleetDocument.hasIn(path))
+                this.rawFleetDocument.deleteIn(path);
+            // Avoid leaving empty operational maps such as `terminal: {}` while
+            // preserving the instance mapping itself and all surrounding comments.
+            for (let depth = path.length - 1; depth > 2; depth--) {
+                const parentPath = path.slice(0, depth);
+                const parent = this.rawFleetDocument.getIn(parentPath, true);
+                if (!isMap(parent) || parent.items.length > 0)
+                    break;
+                this.rawFleetDocument.deleteIn(parentPath);
+            }
+        }
         const output = String(this.rawFleetDocument);
+        if (redundantPaths.length > 0)
+            this.writeFleetConfigBackup(source);
         const tempPath = `${this.configPath}.tmp-${process.pid}`;
         writeFileSync(tempPath, output, "utf-8");
         if (existsSync(this.configPath))
@@ -4244,7 +5173,36 @@ export class FleetManager {
         renameSync(tempPath, this.configPath);
         this.rawFleetConfig = loadRawFleetConfig(this.configPath);
         this.savedFleetConfigSnapshot = structuredClone(this.fleetConfig);
-        this.logger.info({ path: this.configPath }, "Saved fleet config (lossless patch)");
+        this.logger.info({ path: this.configPath, strippedDefaults: redundantPaths.length }, "Saved fleet config (lossless patch)");
+    }
+    /** One-time upgrade migration; invalid YAML is never rewritten. */
+    slimFleetConfigAtStartup() {
+        const redundantPaths = collectRedundantInstanceDefaultPaths(this.rawFleetConfig);
+        if (redundantPaths.length === 0)
+            return;
+        const validation = validateFleetConfig(this.rawFleetConfig);
+        if (!validation.valid) {
+            this.logger.warn({ errors: validation.errors, redundantDefaults: redundantPaths.length }, "Skipping fleet.yaml default slimming because the raw config is invalid");
+            return;
+        }
+        try {
+            this.saveFleetConfig();
+            this.logger.info({ strippedDefaults: redundantPaths.length, backup: `${this.configPath}.bak` }, "Slimmed redundant instance defaults in fleet.yaml");
+        }
+        catch (err) {
+            // A migration must not turn a previously bootable fleet into an outage.
+            this.logger.warn({ err }, "Could not slim fleet.yaml; continuing with the original config");
+        }
+    }
+    writeFleetConfigBackup(source) {
+        if (!this.configPath)
+            return;
+        const backupPath = `${this.configPath}.bak`;
+        const tempPath = `${backupPath}.tmp-${process.pid}`;
+        writeFileSync(tempPath, source, "utf-8");
+        if (existsSync(this.configPath))
+            chmodSync(tempPath, statSync(this.configPath).mode);
+        renameSync(tempPath, backupPath);
     }
     patchFleetDocument(document, path, before, after) {
         if (Object.is(before, after))
@@ -4296,7 +5254,12 @@ export class FleetManager {
                 currentNode.value = after;
             }
             else {
-                document.setIn(path, after);
+                // Use a YAML collection node for newly-added objects. Passing the raw
+                // object creates a scalar wrapper: it serializes, but nested hasIn /
+                // deleteIn cannot traverse it (notably when slimming create_instance).
+                document.setIn(path, after !== null && typeof after === "object"
+                    ? document.createNode(after)
+                    : after);
             }
         }
     }
@@ -4387,7 +5350,7 @@ export class FleetManager {
                 from: primaryModel, to: fallbackModel, five_hour_pct: fiveHourPct,
             });
             this.webhookEmitter?.emit("model_failover", name, { from: primaryModel, to: fallbackModel, five_hour_pct: fiveHourPct });
-            this.notifyInstanceTopic(name, `⚡ Rate limit ${fiveHourPct}% — next rotation will use ${fallbackModel} (was ${primaryModel})`);
+            this.notifyInstanceTopic(name, t("failover.triggered", fiveHourPct, fallbackModel, primaryModel));
         }
         else if (fiveHourPct < FleetManager.FAILOVER_RECOVER_PCT && currentFailover) {
             // Recover: switch back to primary
@@ -4398,7 +5361,7 @@ export class FleetManager {
                 restored: primaryModel, five_hour_pct: fiveHourPct,
             });
             this.webhookEmitter?.emit("model_recovered", name, { restored: primaryModel, five_hour_pct: fiveHourPct });
-            this.notifyInstanceTopic(name, `✅ Rate limit recovered (${fiveHourPct}%) — next rotation will use ${primaryModel}`);
+            this.notifyInstanceTopic(name, t("failover.recovered", fiveHourPct, primaryModel));
         }
     }
     toggleFleetCollab(instanceName) {
@@ -4452,9 +5415,9 @@ export class FleetManager {
             if (output)
                 return output;
             if (e.code === "ENOENT") {
-                return "Backend doctor unavailable — agend CLI not found in PATH";
+                return t("doctor.cli_missing");
             }
-            return stripAnsi(e.message ?? "").trim() || "Doctor failed";
+            return stripAnsi(e.message ?? "").trim() || t("doctor.failed");
         }
     }
     /** Drop event/activity rows older than the retention window. Best-effort. */
@@ -4538,6 +5501,31 @@ export class FleetManager {
      * The log line is written by the caller regardless: if every adapter is down,
      * the only notification path is the one that is broken.
      */
+    /**
+     * Surface ids that can never match into the operator's General topic.
+     *
+     * The load-time log is still silence for anyone not reading daemon.log, and a
+     * chat that never gets in with nothing said anywhere is exactly the failure
+     * this line of work exists to remove. notifyFleetError throttles by message
+     * text for 10 minutes and resolves its target from config, so the 30s reload
+     * poll cannot flood the topic and a down General does not swallow it.
+     */
+    reportClassicUnrecoverableIds() {
+        const bad = this.classicChannels?.getUnrecoverableIds?.() ?? [];
+        if (bad.length === 0)
+            return;
+        // notifyFleetError claims its throttle key BEFORE attempting delivery, so
+        // calling it with no adapter would silence this message for ten minutes
+        // without anyone having seen it. Log and leave the key unspent; a later
+        // call, once an adapter exists, still gets through.
+        if (!this.adapter && this.adapters.size === 0) {
+            this.logger.error({ ids: bad }, "classicBot.yaml holds ids that can never match — deferring the operator notice until an adapter is up");
+            return;
+        }
+        const list = bad.map(e => `${e.field}: ${e.value}`).join(", ");
+        this.logger.error({ ids: bad }, "classicBot.yaml holds ids that can never match");
+        this.notifyFleetError(t("classic.unrecoverable_ids", list));
+    }
     notifyFleetError(text) {
         const now = Date.now();
         const key = text.slice(0, 200);
@@ -4547,16 +5535,8 @@ export class FleetManager {
             return;
         }
         const suppressed = seen?.suppressed ?? 0;
-        this.fleetErrorNotices.set(key, { at: now, suppressed: 0 });
-        // Bound the map: it is keyed by message text, and a message with a varying
-        // suffix (a path, an id) would otherwise grow it without limit.
-        if (this.fleetErrorNotices.size > 100) {
-            const oldest = this.fleetErrorNotices.keys().next().value;
-            if (oldest !== undefined)
-                this.fleetErrorNotices.delete(oldest);
-        }
         const body = suppressed > 0
-            ? `${text}\n(plus ${suppressed} more in the last ${Math.round(FleetManager.FLEET_ERROR_THROTTLE_MS / 60_000)}m)`
+            ? `${text}\n${t("fleet.error_suppressed", suppressed, Math.round(FleetManager.FLEET_ERROR_THROTTLE_MS / 60_000))}`
             : text;
         // Resolved from config, NOT findGeneralInstance(): that requires a live daemon,
         // and a fleet-level fault is exactly when the General may be down. The topic
@@ -4564,26 +5544,60 @@ export class FleetManager {
         // topic_id to post into it.
         const general = Object.entries(this.fleetConfig?.instances ?? {})
             .find(([, config]) => config.general_topic === true)?.[0];
+        // "dispatched", not "delivered": see notifyInstanceTopic. A platform that
+        // rejects the message afterwards still consumes the throttle window, which
+        // is the pre-existing semantic and not something this change alters.
+        let dispatched = false;
         if (general) {
-            this.notifyInstanceTopic(general, body);
-            return;
+            dispatched = this.notifyInstanceTopic(general, body);
         }
-        // No General instance — fall back to the primary channel's group.
-        const channelCfg = this.getChannelConfig();
-        const groupId = channelCfg?.group_id;
-        if (this.adapter && groupId) {
-            this.adapter.sendText(String(groupId), body)
-                .catch(err => this.logger.warn({ err }, "Failed to send fleet error notification"));
+        else {
+            // No General instance — fall back to the primary channel's group.
+            const groupId = this.getChannelConfig()?.group_id;
+            if (this.adapter && groupId) {
+                this.adapter.sendText(String(groupId), body)
+                    .catch(err => this.logger.warn({ err }, "Failed to send fleet error notification"));
+                dispatched = true;
+            }
+        }
+        if (!dispatched) {
+            // Do NOT record the throttle key. It used to be claimed before delivery
+            // was attempted, so a message nobody could receive — every fleet error
+            // raised before adapters exist, which is when startup faults happen —
+            // also suppressed the next ten minutes of identical ones. Leaving the key
+            // unspent lets the next caller, once an adapter is up, actually get
+            // through. The counter is not reset either: nothing was shown.
+            this.logger.warn({ text: body }, "Fleet error could not be delivered (no adapter or no target yet) — not consuming the throttle window");
             return;
         }
-        this.logger.warn({ text: body }, "Fleet error had no notification target (no General instance, no adapter)");
+        this.fleetErrorNotices.set(key, { at: now, suppressed: 0 });
+        // Bound the map: it is keyed by message text, and a message with a varying
+        // suffix (a path, an id) would otherwise grow it without limit.
+        if (this.fleetErrorNotices.size > 100) {
+            const oldest = this.fleetErrorNotices.keys().next().value;
+            if (oldest !== undefined)
+                this.fleetErrorNotices.delete(oldest);
+        }
     }
     static FLEET_ERROR_THROTTLE_MS = 10 * 60_000;
     fleetErrorNotices = new Map();
+    /**
+     * Post into an instance's topic. Returns whether a send was DISPATCHED — a
+     * target was resolved and sendText was called — so a caller that must not
+     * lose the message (notifyFleetError, which spends a throttle key) can tell
+     * that from silence. Existing callers ignore the result and are unaffected.
+     *
+     * Not a delivery guarantee: sendText is fire-and-forget, and a platform-side
+     * rejection surfaces only as a warn in its .catch. True delivery confirmation
+     * would have to make this async and change every caller.
+     */
     notifyInstanceTopic(instanceName, text, extraOpts) {
         const adapter = this.getAdapterForInstance(instanceName) ?? this.adapter;
-        if (!adapter)
-            return;
+        if (!adapter) {
+            // Early startup: adapters are created well after the fleet object exists.
+            this.logger.warn({ instanceName }, "No adapter yet — instance topic notification not sent");
+            return false;
+        }
         const channelCfg = this.getChannelConfig(this.getInstanceAdapterId(instanceName));
         const groupId = channelCfg?.group_id;
         // Fleet topic instance
@@ -4591,26 +5605,30 @@ export class FleetManager {
         if (threadId != null && groupId) {
             adapter.sendText(String(groupId), text, { threadId: String(threadId), ...extraOpts })
                 .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send instance topic notification"));
-            return;
+            return true;
         }
         // Classic instance: find its channelId from the classic manager
         const classicChatId = this.classicChannels?.getChannelIdByInstance(instanceName);
         if (classicChatId) {
             adapter.sendText(classicChatId, text, extraOpts)
                 .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send classic notification"));
-            return;
+            return true;
         }
         // Fallback: send to group without threadId
         if (groupId) {
             adapter.sendText(String(groupId), text, extraOpts)
                 .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send notification (no topic)"));
+            return true;
         }
+        this.logger.warn({ instanceName }, "No group id — instance topic notification not sent");
+        return false;
     }
     // ── Nonce-armed button prompts (hang / assist / exit / clear) ──
     //
     // One shared lifecycle for every "notification with decision buttons":
     // post with a 128-bit nonce, arm a bounded expiry, bind the click to the
-    // exact adapter+chat+thread+message that created it, require fleet admin,
+    // exact adapter+chat+thread+message that created it, require fleet admin for
+    // actions that mutate runtime state (Tips are the harmless exception),
     // consume exactly once. The features differ only in what they post
     // and what a consumed click does.
     /**
@@ -4621,8 +5639,14 @@ export class FleetManager {
      */
     async postNonceButtonPrompt(opts) {
         // 16 bytes = the 128-bit capability the design claims. Telegram's 64-byte
-        // callback_data cap still holds: longest id is "interactive-assist:" (19)
-        // + 32 hex + ":confirm" (8) = 59 bytes.
+        // callback_data cap still holds, with two prefixes tied at the longest:
+        // "interactive-assist:" (19) + 32 hex + ":confirm" (8) = 59, and
+        // "install-select:" (15) + 32 hex + ":" + the longest backend name
+        // ("claude-code"/"antigravity", 11) = 59. The longest overall is
+        // "classic-approve:" (16) + 32 hex + ":allow-admin" (12) = 60, leaving 4
+        // bytes. A longer prefix or action would be silently rejected by Telegram —
+        // both sets are pinned by callback_data assertions in
+        // install-backend-menu.test.ts and classic-approve-buttons.test.ts.
         const nonce = randomBytes(16).toString("hex");
         const entry = {
             prefix: opts.prefix,
@@ -4652,6 +5676,17 @@ export class FleetManager {
                 message: opts.message,
                 choices: opts.choices.map(c => ({ id: `${opts.prefix}${nonce}:${c.action}`, label: c.label })),
             }, opts.threadId ? { threadId: opts.threadId } : undefined);
+            // Bind the nonce to the provider's canonical delivery address, not the
+            // logical routing input. Telegram, for example, represents General as
+            // AgEnD topic "1" on input but omits message_thread_id on the wire and in
+            // callback queries. Exact callback matching below remains fail-closed.
+            entry.chatId = sent.chatId;
+            // Preserve compatibility with adapters that predate SentMessage.threadId
+            // and omit the optional property altogether. An explicit undefined is a
+            // canonical flat/root delivery context (notably Telegram General).
+            if (Object.prototype.hasOwnProperty.call(sent, "threadId")) {
+                entry.threadId = sent.threadId;
+            }
             entry.messageId = sent.messageId;
             return nonce;
         }
@@ -4664,19 +5699,18 @@ export class FleetManager {
         }
     }
     /**
-     * Claim a nonce-armed callback exactly once.
+     * Validate a nonce-armed callback and claim it exactly once.
      *
      * Returns:
      *  - null       — the callback is not for this prefix; try the next handler
      *  - "consumed" — for this prefix but stale/denied/malformed; stop dispatch
-     *  - the entry+action — the click is authorized and now claimed (removed
-     *    from the map before any await, so double clicks cannot act twice)
+     *  - the entry+action — the click is authorized and claimed before any await
      *
      * A stale click (expired nonce, or a pre-upgrade button whose payload no
      * longer parses) collapses the clicked message so the dead button stops
      * inviting clicks — the same courtesy the cancel button extends.
      */
-    consumeNonceCallback(prefix, actionRe, data, callbackAdapterId, receivingAdapter) {
+    consumeNonceCallback(prefix, actionRe, data, callbackAdapterId, receivingAdapter, staleHandling) {
         if (!data.callbackData.startsWith(prefix))
             return null;
         const match = data.callbackData.match(actionRe);
@@ -4688,27 +5722,52 @@ export class FleetManager {
             pending = undefined;
         if (!match || !pending) {
             const adapter = receivingAdapter ?? this.adapter;
-            adapter?.editMessageRemoveButtons?.(data.chatId, data.messageId, t("buttons.stale"), data.threadId).catch(() => { });
+            if (staleHandling?.keepText && adapter?.removeMessageButtons) {
+                adapter.removeMessageButtons(data.chatId, data.messageId, data.threadId)
+                    .catch(() => { });
+            }
+            else {
+                adapter?.editMessageRemoveButtons?.(data.chatId, data.messageId, t("buttons.stale"), data.threadId).catch(() => { });
+            }
+            if (staleHandling?.notice) {
+                adapter?.sendText(data.chatId, staleHandling.notice, { threadId: data.threadId })
+                    .catch(() => { });
+            }
             return "consumed";
         }
         // Bind the capability to the exact message/world that created it. Telegram
-        // keyboards are visible to everyone, so the click also requires fleet admin.
+        // keyboards are visible to everyone, so mutating actions require fleet admin;
+        // a Tip acknowledgement only records that the shared content was read.
         const isAuthorized = data.userId
-            ? pending.authChannelId
-                ? this.isModelAdmin(data.userId, pending.authChannelId, callbackAdapterId)
-                : this.isFleetAdmin(data.userId, callbackAdapterId)
+            ? pending.allowAnyUser
+                ? true
+                : pending.authChannelId
+                    ? this.isModelAdmin(data.userId, pending.authChannelId, callbackAdapterId)
+                    : this.isFleetAdmin(data.userId, callbackAdapterId)
             : false;
-        if (pending.adapterId !== callbackAdapterId
-            || data.chatId !== pending.chatId
-            || (pending.threadId != null && data.threadId !== pending.threadId)
-            || (pending.messageId != null && data.messageId !== pending.messageId)
-            || !isAuthorized) {
+        const mismatchedFields = [];
+        if (pending.adapterId !== callbackAdapterId)
+            mismatchedFields.push("adapterId");
+        if (data.chatId !== pending.chatId)
+            mismatchedFields.push("chatId");
+        if (pending.threadId != null && data.threadId !== pending.threadId)
+            mismatchedFields.push("threadId");
+        if (pending.messageId != null && data.messageId !== pending.messageId)
+            mismatchedFields.push("messageId");
+        if (!isAuthorized)
+            mismatchedFields.push("authorization");
+        if (mismatchedFields.length > 0) {
             // Deliberately does NOT consume the nonce: the real admin can still click.
-            this.logger.warn({ instanceName: pending.instanceName, prefix, userId: data.userId }, "Rejected unauthorized or mismatched button callback");
+            this.logger.warn({
+                instanceName: pending.instanceName,
+                prefix,
+                userId: data.userId,
+                mismatchedFields: mismatchedFields.join(","),
+            }, "Rejected unauthorized or mismatched button callback");
             return "consumed";
         }
-        // Claim before any await: double clicks and duplicate callback delivery can
-        // never act twice.
+        // Claim before any await: double clicks and duplicate callback delivery
+        // can never act twice for state-changing actions.
         this.pendingNonceButtons.delete(match[1]);
         if (pending.timer)
             clearTimeout(pending.timer);
@@ -4729,10 +5788,223 @@ export class FleetManager {
             this.logger.warn({ err, instanceName: pending.instanceName }, "Failed to retire prompt buttons");
         }
     }
+    tipsEnabled() {
+        return this.fleetConfig?.defaults.tips !== false;
+    }
+    readTipState() {
+        if (!this.scheduler)
+            return null;
+        try {
+            return {
+                dismissed: this.scheduler.db.listDismissedTipIds(),
+                advancedUnlocked: this.scheduler.db.isAdvancedTipsUnlocked(),
+            };
+        }
+        catch (err) {
+            // Tips are additive. A damaged/locked scheduler DB must never block fleet
+            // startup, update completion, or a General command.
+            this.logger.warn({ err }, "Failed to read tip state");
+            return null;
+        }
+    }
+    pickAvailableTip() {
+        const state = this.readTipState();
+        return state
+            ? selectTip(state.dismissed, Math.random, state.advancedUnlocked, this.getActiveBackendIds())
+            : null;
+    }
+    tipText(tip) {
+        return getLocale() === "zh-TW" ? tip.text_zh : tip.text_en;
+    }
+    formatTip(tip) {
+        return `💡 ${t("tips.label")}: ${this.tipText(tip)}`;
+    }
+    /** Persistently enable advanced tips through the admin-only slash command. */
+    unlockAdvancedTips(userId) {
+        if (!this.scheduler)
+            return false;
+        try {
+            this.scheduler.db.unlockAdvancedTips(userId);
+            this.eventLog?.insert(this.findGeneralInstance() ?? "general", "tips_advanced_unlocked", {
+                userId,
+                source: "command",
+            });
+            return true;
+        }
+        catch (err) {
+            this.logger.warn({ err, userId }, "Failed to unlock advanced tips from command");
+            return false;
+        }
+    }
+    /** Post one fresh nonce-armed tip in a known General channel. */
+    async promptTip(generalName, adapter, chatId, threadId) {
+        const state = this.readTipState();
+        if (!state)
+            return "unavailable";
+        if (!state.advancedUnlocked
+            && visibleTipLevels(true).has("advanced")
+            && canUnlockAdvancedTips(state.dismissed)) {
+            return await this.promptAdvancedTipUnlock(generalName, adapter, chatId, threadId)
+                ? "posted"
+                : "unavailable";
+        }
+        const tip = selectTip(state.dismissed, Math.random, state.advancedUnlocked, this.getActiveBackendIds());
+        if (!tip)
+            return this.scheduler ? "empty" : "unavailable";
+        const nonce = await this.postNonceButtonPrompt({
+            prefix: TIP_DISMISS_CALLBACK_PREFIX,
+            alertType: "tip",
+            instanceName: generalName,
+            adapter,
+            adapterId: adapter.id,
+            chatId,
+            threadId,
+            message: this.formatTip(tip),
+            choices: [
+                { action: "dismiss", label: t("tips.dismiss") },
+                { action: "confused", label: t("tips.confused") },
+            ],
+            // Expiry removes only the stale button; the useful tip remains readable.
+            expiredText: this.formatTip(tip),
+            extra: { allowAnyUser: true, tipId: tip.id },
+            timeoutMs: TIP_BUTTON_TIMEOUT_MS,
+        });
+        return nonce ? "posted" : "unavailable";
+    }
+    async promptAdvancedTipUnlock(generalName, adapter, chatId, threadId) {
+        const nonce = await this.postNonceButtonPrompt({
+            prefix: TIP_UNLOCK_CALLBACK_PREFIX,
+            alertType: "tip",
+            instanceName: generalName,
+            adapter,
+            adapterId: adapter.id,
+            chatId,
+            threadId,
+            message: t("tips.advanced.unlock_prompt"),
+            choices: [{ action: "unlock", label: t("tips.advanced.unlock") }],
+            expiredText: t("tips.advanced.expired"),
+            extra: { allowAnyUser: true },
+            timeoutMs: TIP_BUTTON_TIMEOUT_MS,
+        });
+        return nonce !== null;
+    }
+    async sendTipToGeneral() {
+        if (!this.tipsEnabled())
+            return;
+        const generalName = this.findGeneralInstance();
+        if (!generalName)
+            return;
+        const adapter = this.getAdapterForInstance(generalName);
+        const chatId = this.getGroupIdForInstance(generalName);
+        const topicId = this.fleetConfig?.instances[generalName]?.topic_id;
+        if (!adapter || !chatId)
+            return;
+        const result = await this.promptTip(generalName, adapter, chatId, topicId != null ? String(topicId) : undefined);
+        if (result === "unavailable") {
+            this.logger.warn({ generalName }, "Daily tip could not be posted");
+        }
+    }
+    async handleTipDismiss(data, callbackAdapterId, receivingAdapter) {
+        const claimed = this.consumeNonceCallback(TIP_DISMISS_CALLBACK_PREFIX, /^tip-dismiss:([0-9a-f]+):(dismiss|confused)$/, data, callbackAdapterId, receivingAdapter, 
+        // A restart orphans the expiry timer, so tip buttons can outlive their
+        // nonce by days. Keep the tip text readable and always tell the clicker
+        // what to do next (the keyboard edit itself can be refused: Telegram
+        // rejects edits on messages older than 48h).
+        { keepText: true, notice: t("tips.expired_use_tips") });
+        if (claimed === null)
+            return false;
+        if (claimed === "consumed")
+            return true;
+        const { entry: pending } = claimed;
+        if (claimed.action === "confused") {
+            if (!pending.tipId || !data.userId || !this.scheduler) {
+                this.logger.error({ tipId: pending.tipId, userId: data.userId }, "Tip feedback has incomplete persistence context");
+                await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, pending.expiredText);
+                await pending.adapter.sendText(pending.chatId, t("tips.unavailable"), { threadId: pending.threadId });
+                return true;
+            }
+            try {
+                this.scheduler.db.recordTipFeedback(data.userId, pending.tipId, "confused");
+            }
+            catch (err) {
+                this.logger.warn({ err, tipId: pending.tipId, userId: data.userId }, "Failed to persist tip feedback");
+                await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, pending.expiredText);
+                await pending.adapter.sendText(pending.chatId, t("tips.unavailable"), { threadId: pending.threadId }).catch(() => { });
+                return true;
+            }
+            this.logger.info({
+                tipId: pending.tipId,
+                userId: data.userId,
+                feedbackType: "confused",
+            }, "Tip feedback recorded");
+            this.eventLog?.insert(pending.instanceName, "tip_feedback", {
+                tipId: pending.tipId,
+                userId: data.userId,
+                feedbackType: "confused",
+            });
+            await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, 
+            // Confusion is feedback, not a dismissal. Keep the Tip readable while
+            // retiring this one-shot prompt; it remains eligible for future draws.
+            pending.expiredText);
+            await pending.adapter.sendText(pending.chatId, t("tips.feedback_recorded"), { threadId: pending.threadId }).catch(err => this.logger.warn({ err, tipId: pending.tipId }, "Failed to acknowledge tip feedback"));
+            return true;
+        }
+        if (!pending.tipId || !data.userId || !this.scheduler) {
+            this.logger.error({ tipId: pending.tipId, userId: data.userId }, "Tip dismissal has incomplete persistence context");
+            await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("tips.unavailable"));
+            return true;
+        }
+        try {
+            this.scheduler.db.dismissTip(data.userId, pending.tipId);
+        }
+        catch (err) {
+            this.logger.warn({ err, tipId: pending.tipId, userId: data.userId }, "Failed to persist tip dismissal");
+            await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("tips.unavailable"));
+            return true;
+        }
+        this.eventLog?.insert(pending.instanceName, "tip_dismissed", {
+            tipId: pending.tipId,
+            userId: data.userId,
+        });
+        await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, 
+        // Dismissal changes future selection only. Keep the useful tip text in
+        // chat history and remove just the now-consumed button. Append a short
+        // confirmation so the user sees feedback (unlike the pre-#605 version
+        // that replaced the entire message with just the confirmation line).
+        `${pending.expiredText}\n\n${t("tips.dismissed")}`);
+        const state = this.readTipState();
+        if (state && !state.advancedUnlocked && canUnlockAdvancedTips(state.dismissed)) {
+            await this.promptAdvancedTipUnlock(pending.instanceName, pending.adapter, pending.chatId, pending.threadId);
+        }
+        return true;
+    }
+    async handleTipUnlock(data, callbackAdapterId, receivingAdapter) {
+        const claimed = this.consumeNonceCallback(TIP_UNLOCK_CALLBACK_PREFIX, /^tip-unlock:([0-9a-f]+):(unlock)$/, data, callbackAdapterId, receivingAdapter, { keepText: true, notice: t("tips.expired_use_tips") });
+        if (claimed === null)
+            return false;
+        if (claimed === "consumed")
+            return true;
+        const { entry: pending } = claimed;
+        if (!data.userId || !this.scheduler) {
+            await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("tips.unavailable"));
+            return true;
+        }
+        try {
+            this.scheduler.db.unlockAdvancedTips(data.userId);
+        }
+        catch (err) {
+            this.logger.warn({ err, userId: data.userId }, "Failed to unlock advanced tips");
+            await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("tips.unavailable"));
+            return true;
+        }
+        this.eventLog?.insert(pending.instanceName, "tips_advanced_unlocked", { userId: data.userId });
+        await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("tips.advanced.unlocked"));
+        return true;
+    }
     /** Post the destructive `/clear` confirmation in the invoking channel. */
     async promptClearConfirmation(instanceName, channelId, adapter, chatId, threadId) {
         if (!this.topicCommands.supportsClear(instanceName))
-            return CLEAR_UNSUPPORTED_MSG;
+            return t("clear.unsupported");
         const adapterId = adapter.id;
         if (!adapterId)
             return t("clear.prompt_unavailable");
@@ -5006,7 +6278,7 @@ export class FleetManager {
         const force = target.kind === "classic" && !!data.options?.force;
         const cmd = saveCommandForBackend(backend, filename, force);
         if (!cmd) {
-            await data.respond(SAVE_UNSUPPORTED_MSG);
+            await data.respond(t("save.unsupported"));
             return;
         }
         if (target.kind === "classic") {
@@ -5059,7 +6331,7 @@ export class FleetManager {
         }
         return false;
     }
-    async sendCancelButton(instanceName, correlationId) {
+    async sendCancelButton(instanceName, correlationId, preserveProgress = false) {
         // Post first, retire after (see the tail of this method). Retiring up front
         // meant that from the delete until the new message came back — a chat API
         // round trip, and every reply goes through here — the instance had NO live
@@ -5120,6 +6392,10 @@ export class FleetManager {
                 // not re-edit identical text — which put a "(edited)" mark on Discord
                 // with nothing visibly changed.
                 lastProgressText: "👀 處理中…",
+                // A reply can re-post the same in-flight bubble below the reply. Carry
+                // its current list into that replacement; fresh inbound work must start
+                // empty even if the daemon's reset broadcast is still in flight.
+                toolProgress: preserveProgress ? this.instanceProgress.get(instanceName) : undefined,
             };
             this.startProgressTicker(entry);
             // Idle-check backstop: every 5min, if the instance is idle, retire the
@@ -5173,16 +6449,28 @@ export class FleetManager {
     static progressText(elapsedMs, activity, minElapsedMs = PROGRESS_MIN_ELAPSED_MS) {
         if (elapsedMs < minElapsedMs)
             return "👀 處理中…";
+        const elapsed = FleetManager.formatProgressElapsed(elapsedMs);
+        const detail = FleetManager.sanitizeActivity(activity);
+        return detail
+            ? `⏳ 處理中… (已進行 ${elapsed} · ${detail})`
+            : `⏳ 處理中… (已進行 ${elapsed})`;
+    }
+    /** Render elapsed time consistently in live and retained progress bubbles. */
+    static formatProgressElapsed(elapsedMs) {
         const totalSeconds = Math.floor(elapsedMs / 1000);
         const minutes = Math.floor(totalSeconds / 60);
         const seconds = totalSeconds % 60;
-        const elapsed = minutes >= 60
+        return minutes >= 60
             ? `${Math.floor(minutes / 60)}h ${minutes % 60}m`
             : `${minutes}m ${String(seconds).padStart(2, "0")}s`;
-        const detail = FleetManager.sanitizeActivity(activity);
-        return detail
-            ? `⏳ 處理中… (已進行 ${elapsed} · ${detail})`
-            : `⏳ 處理中… (已進行 ${elapsed})`;
+    }
+    /** Final read-only form of a bubble that contains semantic tool history.
+     * Neutral wording is intentional: the same retirement primitive is used for
+     * normal completion, a mid-turn bubble replacement, and user cancellation,
+     * so claiming every retained checkpoint is "completed" would be false. */
+    composeRetiredBubbleText(entry) {
+        const elapsed = FleetManager.formatProgressElapsed(Date.now() - (entry.startedAt ?? Date.now()));
+        return `🧾 工具歷程 (記錄至 ${elapsed})\n${entry.toolProgress}`;
     }
     /**
      * Make a tool summary safe to paste into a channel message.
@@ -5227,12 +6515,20 @@ export class FleetManager {
         else
             this.instanceProgress.delete(name);
         for (const entry of this.cancelButtons.values()) {
-            if (entry.instanceName === name)
-                this.scheduleProgressEdit(entry);
+            if (entry.instanceName !== name)
+                continue;
+            // Empty means the daemon completed/reset the turn. Clear the live cache
+            // for the next turn, but retain this bubble's last non-empty list so its
+            // retirement can preserve the history instead of deleting the message.
+            if (progress)
+                entry.toolProgress = progress;
+            this.scheduleProgressEdit(entry);
         }
     }
     /** At most one progress-driven edit per bubble per TOOL_PROGRESS_EDIT_MIN_MS. */
     scheduleProgressEdit(entry) {
+        if (entry.retiring)
+            return;
         const since = Date.now() - (entry.lastProgressEditAt ?? 0);
         if (since >= TOOL_PROGRESS_EDIT_MIN_MS) {
             this.refreshBubble(entry);
@@ -5253,7 +6549,7 @@ export class FleetManager {
      * wiped by the next elapsed tick (#528 trap 2).
      */
     composeBubbleText(entry) {
-        return FleetManager.bubbleText(Date.now() - (entry.startedAt ?? Date.now()), this.instanceActivity.get(entry.instanceName), this.progressMinElapsedMs(), this.instanceProgress.get(entry.instanceName));
+        return FleetManager.bubbleText(Date.now() - (entry.startedAt ?? Date.now()), this.instanceActivity.get(entry.instanceName), this.progressMinElapsedMs(), entry.toolProgress);
     }
     /** Pure composition of header + tool list, exposed for tests. */
     static bubbleText(elapsedMs, activity, minElapsedMs, progress) {
@@ -5264,7 +6560,7 @@ export class FleetManager {
     }
     /** Recompose and edit the bubble in place; skips when nothing changed. */
     refreshBubble(entry) {
-        if (!this.cancelButtons.has(entry.messageId)) {
+        if (entry.retiring || !this.cancelButtons.has(entry.messageId)) {
             clearInterval(entry.progressTimer);
             return;
         }
@@ -5320,8 +6616,11 @@ export class FleetManager {
     }
     /**
      * After a reply: give the instance REPLY_RETIRE_GRACE_MS to resume working; if
-     * it has not, retire its button. Re-arming replaces the previous timer, so a
-     * burst of replies ends with exactly one pending check.
+     * it has not, retire its button. The daemon is asked for a fresh pane capture
+     * before deciding. Reading only the transition cache stranded the first
+     * post-restart bubble when its startup "working" report never got a matching
+     * idle edge. Re-arming replaces the previous timer, so a burst of replies ends
+     * with exactly one pending check.
      */
     armReplyGrace(instanceName) {
         for (const entry of this.cancelButtons.values()) {
@@ -5333,14 +6632,26 @@ export class FleetManager {
                 entry.replyGraceTimer = undefined;
                 if (!this.cancelButtons.has(entry.messageId))
                     return;
-                if (!this.getInstanceIdle(instanceName))
-                    return; // resumed — a long run keeps its button
-                this.logger.info({ instanceName, messageId: entry.messageId }, "Cancel button retired — no work resumed after reply");
-                this.retireButton(entry);
+                void this.finishReplyGrace(instanceName, entry);
             }, REPLY_RETIRE_GRACE_MS);
             entry.replyGraceTimer.unref?.();
         }
     }
+    async finishReplyGrace(instanceName, entry) {
+        const refreshed = await this.refreshInstanceExecutionState(instanceName, REPLY_STATE_REFRESH_TIMEOUT_MS);
+        if (!this.cancelButtons.has(entry.messageId) || entry.retiring)
+            return;
+        if (!refreshed) {
+            // Fail safe: without an authoritative answer, retain a potentially live
+            // Cancel button. The 5-minute/30-minute/24-hour safety nets still apply.
+            this.logger.debug({ instanceName, messageId: entry.messageId }, "Cancel reply-grace state refresh timed out");
+            return;
+        }
+        if (!this.getInstanceIdle(instanceName))
+            return; // genuine long run keeps its button
+        this.logger.info({ instanceName, messageId: entry.messageId }, "Cancel button retired — no work resumed after reply");
+        this.retireButton(entry);
+    }
     /** Retire (delete) every cancel button belonging to an instance. */
     retireInstanceButtons(instanceName) {
         // Snapshot first — retireButton may delete entries from the map on success.
@@ -5362,7 +6673,7 @@ export class FleetManager {
         this.deleteButtonMessage(entry)
             .then(() => {
             this.discardButton(entry);
-            this.logger.info({ instanceName: entry.instanceName, messageId: entry.messageId }, "Cancel button removed");
+            this.logger.info({ instanceName: entry.instanceName, messageId: entry.messageId, historyPreserved: Boolean(entry.toolProgress) }, "Cancel button retired");
         })
             .catch((err) => this.scheduleButtonRetry(entry, err));
     }
@@ -5453,12 +6764,21 @@ export class FleetManager {
         // Continue the same retire cycle (bypass the retiring-guard in retireButton).
         entry.retryTimer = setTimeout(() => this.attemptButtonDelete(entry), CANCEL_BTN_RETRY_INTERVAL_MS);
     }
-    /** Delete one button's message via its own adapter. Resolves on success,
+    /** Retire one cancel bubble via its own adapter. A bubble that accumulated
+     * tool progress is kept as a read-only history message; a plain bubble keeps
+     * the legacy delete/edit-to-checkmark behavior. Resolves on success and
      * rejects on failure so the caller can retry. */
     deleteButtonMessage(e) {
         const adapter = (e.adapterId ? this.worlds.get(e.adapterId)?.adapter : undefined) ?? this.adapter;
         if (!adapter)
             return Promise.reject(new Error("no adapter for cancel button"));
+        if (e.toolProgress && adapter.editMessageRemoveButtons) {
+            return adapter.editMessageRemoveButtons(e.chatId, e.messageId, this.composeRetiredBubbleText(e), e.threadId);
+        }
+        // All production adapters currently implement editMessageRemoveButtons.
+        // A third-party adapter without it degrades to the legacy delete behavior:
+        // removing a live Cancel control is safer than retaining an actionable,
+        // untracked button forever.
         if (adapter.deleteMessage)
             return adapter.deleteMessage(e.chatId, e.messageId, e.threadId);
         if (adapter.editMessageRemoveButtons)
@@ -5510,11 +6830,604 @@ export class FleetManager {
         const daemon = this.daemons.get(instanceName);
         if (!daemon)
             return false;
+        const deliveryEpoch = this.cancelPendingDeliveries(instanceName);
+        daemon.clearPendingDeliveries?.(deliveryEpoch);
         daemon.sendEscape().catch(e => this.logger.warn({ err: e, instanceName }, "sendEscape failed"));
         this.lastInboundMsg.delete(instanceName);
         this.clearCancelButton(instanceName);
         return true;
     }
+    getDeliveryEpoch(instanceName) {
+        return this.deliveryEpochs.get(instanceName) ?? 0;
+    }
+    isDeliveryEpochCurrent(instanceName, deliveryEpoch) {
+        return deliveryEpoch === this.getDeliveryEpoch(instanceName);
+    }
+    /** Invalidate work queued before a user cancel and wake idle-gate waiters. */
+    cancelPendingDeliveries(instanceName) {
+        const next = this.getDeliveryEpoch(instanceName) + 1;
+        this.deliveryEpochs.set(instanceName, next);
+        for (const check of this.instanceIdleWaiters.get(instanceName) ?? [])
+            check();
+        return next;
+    }
+    // ── Remote CLI login (`/login`) ──────────────────────────────────────────
+    //
+    // One session at a time, in a dedicated tmux window — never an instance
+    // pane. Credentials are per-backend (codex homes symlink auth.json to the
+    // shared ~/.codex; the other CLIs use one real home), so a single sign-in
+    // repairs every instance of that backend, and instance delivery, pane-state
+    // detection, tool progress, and mcp_proxy_reply never observe login output.
+    activeLogin = null;
+    /** Post the backend chooser for a bare `/login`. Caller enforces admin. */
+    async promptLoginBackends(chat) {
+        const configured = new Set();
+        for (const [, config] of Object.entries(this.fleetConfig?.instances ?? {})) {
+            configured.add(config.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code");
+        }
+        const choices = Object.keys(LOGIN_FLOWS)
+            .filter(backend => configured.size === 0 || configured.has(backend))
+            .map(backend => ({ action: backend, label: backend }));
+        if (choices.length === 0) {
+            await chat.adapter.sendText(chat.chatId, t("login.unsupported", [...configured].join(", ")), { threadId: chat.threadId });
+            return;
+        }
+        await this.postNonceButtonPrompt({
+            prefix: LOGIN_CALLBACK_PREFIX,
+            alertType: "login",
+            instanceName: "login",
+            adapter: chat.adapter,
+            adapterId: chat.adapterId,
+            chatId: chat.chatId,
+            threadId: chat.threadId,
+            message: t("login.choose_backend"),
+            choices,
+            expiredText: t("buttons.stale"),
+        });
+    }
+    /**
+     * Ask the General topic to approve a ClassicBot access request.
+     *
+     * Two affirmative buttons rather than one, when the trigger identified a
+     * user. Allowing a group to talk and granting that person ClassicBot admin
+     * (start/stop/model on classic channels — NOT fleet admin, which reads
+     * fleet.yaml `channel.access.allowed_users`) have different blast radii, and
+     * bundling them would force anyone who wants only the cheap one to accept the
+     * expensive one or go edit YAML by hand.
+     *
+     * Built on postNonceButtonPrompt, so it inherits the canonical-address
+     * binding (#682) that makes these buttons answer in a Telegram General topic.
+     */
+    async promptClassicApproval(opts) {
+        const adapter = this.getAdapterForInstance(opts.generalName);
+        // An instance with no world binding yet (fresh restart, or a fleet whose
+        // primary `channel:` block carries the config) still has a usable adapter —
+        // fall back to that adapter's own id rather than dropping the buttons. The
+        // id only has to match what the callback arrives with, which is this same
+        // adapter.
+        const adapterId = this.getInstanceAdapterId(opts.generalName) ?? adapter?.id;
+        const chatId = this.getGroupIdForInstance(opts.generalName);
+        const topicId = this.fleetConfig?.instances[opts.generalName]?.topic_id;
+        if (!adapter || !adapterId || !chatId) {
+            // Never lose the notification because the buttons could not be addressed.
+            this.notifyInstanceTopic(opts.generalName, opts.message);
+            return;
+        }
+        const choices = [{ action: "allow", label: t("classic.approve_group") }];
+        if (opts.userId)
+            choices.push({ action: "allow-admin", label: t("classic.approve_group_admin") });
+        choices.push({ action: "ignore", label: t("classic.approve_ignore") });
+        await this.postNonceButtonPrompt({
+            prefix: CLASSIC_APPROVE_CALLBACK_PREFIX,
+            alertType: "classic_approve",
+            instanceName: opts.generalName,
+            adapter,
+            adapterId,
+            chatId,
+            threadId: topicId != null ? String(topicId) : undefined,
+            message: opts.message,
+            choices,
+            expiredText: t("buttons.stale"),
+            extra: { classicGroupId: opts.groupId, classicUserId: opts.userId, classicScope: opts.scope },
+        });
+    }
+    /**
+     * Apply an approved ClassicBot access request.
+     *
+     * Writes through ClassicChannelManager's typed mutators rather than handing
+     * General a YAML edit: the id is stored via String() so a Discord snowflake
+     * cannot land as a YAML integer and lose precision, the existing save() path
+     * is reused, in-memory state is correct immediately (no waiting on the 30s
+     * reload poll), and a click cannot silently do nothing because General
+     * happened to be paused. General is still told the outcome.
+     */
+    async applyClassicApproval(entry, groupId, adminUserId) {
+        const classic = this.classicChannels;
+        if (!classic) {
+            this.notifyInstanceTopic(entry.instanceName, t("classic.approve_failed", groupId));
+            return;
+        }
+        const scope = entry.classicScope ?? "guild";
+        const access = scope === "group" ? classic.allowGroup(groupId) : classic.allowGuild(groupId);
+        const admin = adminUserId ? classic.addAdminUser(adminUserId) : null;
+        const lines = [t(access === "added" ? "classic.approve_done_group"
+                : access === "already" ? "classic.approve_done_group_already"
+                    : "classic.approve_done_group_open", groupId)];
+        if (admin) {
+            lines.push(t(admin === "added" ? "classic.approve_done_admin" : "classic.approve_done_admin_already", adminUserId ?? ""));
+        }
+        this.notifyInstanceTopic(entry.instanceName, lines.join("\n"));
+    }
+    /** Consume a ClassicBot approval button. */
+    async handleClassicApproval(data, callbackAdapterId, receivingAdapter) {
+        const claimed = this.consumeNonceCallback(CLASSIC_APPROVE_CALLBACK_PREFIX, /^classic-approve:([0-9a-f]+):(allow|allow-admin|ignore)$/, data, callbackAdapterId, receivingAdapter);
+        if (claimed === null)
+            return false;
+        if (claimed === "consumed")
+            return true;
+        const { entry, action } = claimed;
+        const groupId = entry.classicGroupId ?? "";
+        const userId = entry.classicUserId;
+        if (action === "ignore") {
+            await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t("classic.approve_ignored", groupId));
+            return true;
+        }
+        const grantAdmin = action === "allow-admin" && !!userId;
+        await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, grantAdmin ? t("classic.approve_applying_admin", groupId, userId ?? "")
+            : t("classic.approve_applying", groupId));
+        await this.applyClassicApproval(entry, groupId, grantAdmin ? userId : undefined);
+        return true;
+    }
+    /**
+   * Backend chooser for a bare `/install-cli`, mirroring promptLoginBackends so
+   * both commands feel the same. Built on postNonceButtonPrompt rather than the
+   * `/model` selection coordinator: that is the mechanism `/login` already uses,
+   * and the one whose canonical-address binding (#682) makes the buttons answer
+   * in a Telegram General topic.
+   *
+   * Unlike the login chooser this does NOT filter to backends the fleet already
+   * runs. Installing is how you get a backend you do not have yet, so filtering
+   * by configured backends would hide the only entry the admin came for.
+   *
+   * gemini-cli is omitted: it is deprecated (see backend/factory.ts). Typing
+   * `/install-cli gemini-cli` still works — this only stops recommending it.
+   */
+    async promptInstallBackends(chat) {
+        const choices = Object.keys(BACKEND_INSTALLATION_INFO)
+            .filter(backend => backend !== "gemini-cli")
+            .map(backend => ({ action: backend, label: backend }));
+        await this.postNonceButtonPrompt({
+            prefix: INSTALL_CALLBACK_PREFIX,
+            alertType: "install",
+            instanceName: "install",
+            adapter: chat.adapter,
+            adapterId: chat.adapterId,
+            chatId: chat.chatId,
+            threadId: chat.threadId,
+            message: t("install.choose_backend"),
+            choices,
+            expiredText: t("buttons.stale"),
+        });
+    }
+    /** Backend chooser button → start that backend's install session. */
+    async handleInstallBackendSelect(data, callbackAdapterId, receivingAdapter) {
+        const claimed = this.consumeNonceCallback(INSTALL_CALLBACK_PREFIX, /^install-select:([0-9a-f]+):([a-z][a-z-]*)$/, data, callbackAdapterId, receivingAdapter);
+        if (claimed === null)
+            return false;
+        if (claimed === "consumed")
+            return true;
+        const { entry, action: backend } = claimed;
+        await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t("install.starting_backend", backend));
+        const text = await this.startInstallSession(backend, {
+            adapter: entry.adapter,
+            adapterId: entry.adapterId,
+            chatId: entry.chatId,
+            threadId: entry.threadId,
+        });
+        if (text)
+            await entry.adapter.sendText(entry.chatId, text, { threadId: entry.threadId }).catch(() => { });
+        return true;
+    }
+    /**
+     * Start a login session for one backend. Caller enforces admin.
+     * Returns a status line to post, or null when a confirmation prompt was
+     * posted instead (auth still valid — see the pre-check below).
+     */
+    async startLoginSession(backendArg, chat, opts = {}) {
+        const backend = LOGIN_BACKEND_ALIASES[backendArg.toLowerCase()] ?? backendArg.toLowerCase();
+        const flow = LOGIN_FLOWS[backend];
+        if (!flow)
+            return t("login.unsupported", backendArg);
+        if (this.activeLogin)
+            return t("login.busy", this.activeLogin.backend);
+        // Install sessions share the window namespace — never run both at once.
+        if (this.activeInstall)
+            return t("install.busy");
+        // Token-free pre-check (5s cap): re-login while auth still works is
+        // usually a mistake, so it needs a confirmed click. An invalid OR
+        // uncertain result (timeout, missing binary) proceeds straight to login —
+        // an unreliable probe must never block the re-login the admin asked for.
+        if (!opts.skipAuthCheck && flow.authCheck) {
+            const status = await checkAuthStatus(flow.authCheck);
+            if (status === "valid") {
+                await this.postNonceButtonPrompt({
+                    prefix: LOGIN_CONFIRM_CALLBACK_PREFIX,
+                    alertType: "login",
+                    instanceName: backend,
+                    adapter: chat.adapter,
+                    adapterId: chat.adapterId,
+                    chatId: chat.chatId,
+                    threadId: chat.threadId,
+                    message: t("login.still_valid", backend),
+                    choices: [
+                        { action: "go", label: t("login.relogin_go") },
+                        { action: "cancel", label: t("login.relogin_cancel") },
+                    ],
+                    expiredText: t("buttons.stale"),
+                });
+                return null;
+            }
+        }
+        return this.launchLoginSession(flow, backend, chat);
+    }
+    /** Create the login window and session (pre-check already settled). */
+    async launchLoginSession(flow, backend, chat) {
+        if (this.activeLogin)
+            return t("login.busy", this.activeLogin.backend);
+        // Install sessions share the window namespace — never run both at once.
+        if (this.activeInstall)
+            return t("install.busy");
+        const sessionName = getTmuxSession();
+        await TmuxManager.ensureSession(sessionName);
+        const tmux = new TmuxManager(sessionName, "");
+        const session = new LoginSession(flow, tmux, {
+            onMenu: async (options) => {
+                await this.postNonceButtonPrompt({
+                    prefix: LOGIN_MENU_CALLBACK_PREFIX,
+                    alertType: "login",
+                    instanceName: backend,
+                    adapter: chat.adapter,
+                    adapterId: chat.adapterId,
+                    chatId: chat.chatId,
+                    threadId: chat.threadId,
+                    message: t("login.choose_provider"),
+                    choices: options.map((label, index) => ({ action: String(index), label })),
+                    expiredText: t("buttons.stale"),
+                });
+            },
+            onAuthHint: async (url, code) => {
+                await this.sendLoginSecret(chat, backend, url, code);
+            },
+            onNeedInput: async (promptExcerpt) => {
+                await chat.adapter.sendText(chat.chatId, t("login.need_input", backend, promptExcerpt), { threadId: chat.threadId }).catch(() => { });
+            },
+            onDone: async ({ ok, detail }) => {
+                this.activeLogin = null;
+                let text;
+                if (ok) {
+                    const { woken, restarted } = await this.recoverBackendInstances(backend);
+                    const none = t("login.none");
+                    text = t("login.success", backend, woken.length ? woken.join(", ") : none, restarted.length ? restarted.join(", ") : none);
+                }
+                else if (detail === "cancelled") {
+                    // The cancel command's own reply already announced this — a second
+                    // message here was a duplicate.
+                    return;
+                }
+                else {
+                    text = t("login.failed", backend, detail);
+                }
+                await chat.adapter.sendText(chat.chatId, text, { threadId: chat.threadId }).catch(() => { });
+            },
+        }, this.logger);
+        // Claim the slot before the first await so two admins racing /login cannot
+        // both create windows; release on startup failure.
+        this.activeLogin = { session, backend, chat };
+        try {
+            await session.start();
+        }
+        catch (err) {
+            this.activeLogin = null;
+            return t("login.failed", backend, err.message);
+        }
+        return t("login.started", backend);
+    }
+    /** `/login code <text>` — paste admin-supplied text into the login window. */
+    async loginSubmitInput(text) {
+        if (!this.activeLogin)
+            return t("login.no_session");
+        const ok = await this.activeLogin.session.submitInput(text);
+        return ok ? t("login.input_sent") : t("login.input_failed");
+    }
+    /** `/login cancel` — abort the active session and remove its window. */
+    async cancelLoginSession() {
+        if (!this.activeLogin)
+            return t("login.no_session");
+        const backend = this.activeLogin.backend;
+        await this.activeLogin.session.cancel();
+        return t("login.cancelled", backend);
+    }
+    /**
+     * The URL (+ code) is a live credential: whoever completes it binds THEIR
+     * account to this fleet's CLI. Telegram gets an HTML spoiler (same treatment
+     * as the dashboard token); other adapters get plain text with the warning.
+     */
+    async sendLoginSecret(chat, backend, url, code) {
+        const codeLine = code ? `\n${t("login.auth_code", code)}` : "";
+        try {
+            if (chat.adapter.type === "telegram") {
+                const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+                await chat.adapter.sendText(chat.chatId, `${esc(t("login.auth_hint", backend))}\n<tg-spoiler>${esc(url)}${esc(codeLine)}</tg-spoiler>`, { threadId: chat.threadId, format: "html" });
+            }
+            else {
+                await chat.adapter.sendText(chat.chatId, `${t("login.auth_hint", backend)}\n${url}${codeLine}`, { threadId: chat.threadId });
+            }
+        }
+        catch (err) {
+            this.logger.warn({ err: err.message, backend }, "Failed to deliver login URL");
+        }
+    }
+    /**
+     * After a successful login: wake the paused instances of that backend AND
+     * restart the running ones — a live CLI holds the old token in memory and
+     * only re-reads credentials on process start (a paused instance's CLI is
+     * already dead, so waking it respawns with the new token for free).
+     */
+    async recoverBackendInstances(backend) {
+        const woken = [];
+        const restarted = [];
+        for (const [name, config] of Object.entries(this.fleetConfig?.instances ?? {})) {
+            const effective = config.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code";
+            if (effective !== backend)
+                continue;
+            const status = this.getInstanceStatus(name);
+            try {
+                if (status === "paused") {
+                    if (this.daemons.has(name))
+                        await this.lifecycle.wake(name, 30_000);
+                    else
+                        await this.startPersistedPausedInstance(name);
+                    woken.push(name);
+                }
+                else if (status === "running") {
+                    await this.restartSingleInstance(name);
+                    restarted.push(name);
+                }
+            }
+            catch (err) {
+                this.logger.warn({ err: err.message, name, status }, "Post-login recovery failed");
+            }
+        }
+        return { woken, restarted };
+    }
+    /** Backend chooser button → start that backend's login session. */
+    async handleLoginBackendSelect(data, callbackAdapterId, receivingAdapter) {
+        const claimed = this.consumeNonceCallback(LOGIN_CALLBACK_PREFIX, /^login:([0-9a-f]+):([a-z][a-z-]*)$/, data, callbackAdapterId, receivingAdapter);
+        if (claimed === null)
+            return false;
+        if (claimed === "consumed")
+            return true;
+        const { entry, action: backend } = claimed;
+        await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t("login.starting_backend", backend));
+        const text = await this.startLoginSession(backend, {
+            adapter: entry.adapter,
+            adapterId: entry.adapterId,
+            chatId: entry.chatId,
+            threadId: entry.threadId,
+        });
+        if (text)
+            await entry.adapter.sendText(entry.chatId, text, { threadId: entry.threadId }).catch(() => { });
+        return true;
+    }
+    /** Re-login confirmation (auth pre-check said credentials still work). */
+    async handleLoginConfirm(data, callbackAdapterId, receivingAdapter) {
+        const claimed = this.consumeNonceCallback(LOGIN_CONFIRM_CALLBACK_PREFIX, /^login-confirm:([0-9a-f]+):(go|cancel)$/, data, callbackAdapterId, receivingAdapter);
+        if (claimed === null)
+            return false;
+        if (claimed === "consumed")
+            return true;
+        const { entry, action } = claimed;
+        const backend = entry.instanceName;
+        if (action === "cancel") {
+            await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t("login.cancelled", backend));
+            return true;
+        }
+        await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t("login.starting_backend", backend));
+        const text = await this.startLoginSession(backend, {
+            adapter: entry.adapter,
+            adapterId: entry.adapterId,
+            chatId: entry.chatId,
+            threadId: entry.threadId,
+        }, { skipAuthCheck: true });
+        if (text)
+            await entry.adapter.sendText(entry.chatId, text, { threadId: entry.threadId }).catch(() => { });
+        return true;
+    }
+    /** Kiro provider button → drive the CLI's arrow-key selector. */
+    async handleLoginMenuSelect(data, callbackAdapterId, receivingAdapter) {
+        const claimed = this.consumeNonceCallback(LOGIN_MENU_CALLBACK_PREFIX, /^login-menu:([0-9a-f]+):(\d)$/, data, callbackAdapterId, receivingAdapter);
+        if (claimed === null)
+            return false;
+        if (claimed === "consumed")
+            return true;
+        const { entry, action } = claimed;
+        const index = Number(action);
+        const label = this.activeLogin?.session.flow.menu?.options[index] ?? action;
+        const ok = await this.activeLogin?.session.selectMenuOption(index) ?? false;
+        await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, ok ? t("login.provider_selected", label) : t("login.no_session"));
+        return true;
+    }
+    // ── Remote CLI install (`/install-cli`) ──────────────────────────────────
+    //
+    // Same dedicated-window model as /login (and the same LoginSession state
+    // machine — an install is a login flow with no auth hints): run the
+    // installer, judge by exit code, verify the binary on a fresh login shell,
+    // then offer to chain straight into /login.
+    activeInstall = null;
+    /** Start a CLI install session. Caller enforces admin. */
+    async startInstallSession(backendArg, chat) {
+        const backend = LOGIN_BACKEND_ALIASES[backendArg.toLowerCase()] ?? backendArg.toLowerCase();
+        const info = BACKEND_INSTALLATION_INFO[backend];
+        if (!info)
+            return t("install.unsupported", backendArg);
+        if (checkBinaryInstalled(info.binary))
+            return t("install.already", backend, info.binary);
+        if (this.activeInstall)
+            return t("install.busy");
+        if (this.activeLogin)
+            return t("login.busy", this.activeLogin.backend);
+        const sessionName = getTmuxSession();
+        await TmuxManager.ensureSession(sessionName);
+        const tmux = new TmuxManager(sessionName, "");
+        // A synthetic login flow: success is decided by the installer's exit code
+        // (LoginSession treats a clean exit as success), never by pane text — and
+        // installer output that happens to contain a URL must not be forwarded as
+        // an auth hint, hence the no-op events below.
+        const flow = {
+            backend,
+            command: info.install,
+            successPattern: /$^/,
+            timeoutMs: 10 * 60 * 1000,
+        };
+        const session = new LoginSession(flow, tmux, {
+            onMenu: () => { },
+            onAuthHint: () => { },
+            onNeedInput: () => { },
+            onDone: async ({ ok, detail }) => {
+                this.activeInstall = null;
+                if (!ok) {
+                    // A cancel is user-initiated — the cancel command's own reply already
+                    // said so; a second message here would be a duplicate.
+                    if (detail !== "cancelled") {
+                        await chat.adapter.sendText(chat.chatId, t("install.failed", backend, detail), { threadId: chat.threadId }).catch(() => { });
+                    }
+                    return;
+                }
+                // The installer may only have added the binary to a profile PATH; a
+                // fresh login shell sees that, the fleet process's PATH may not.
+                if (!this.verifyBinaryOnLoginShell(info.binary)) {
+                    await chat.adapter.sendText(chat.chatId, t("install.verify_failed", backend, info.binary), { threadId: chat.threadId }).catch(() => { });
+                    return;
+                }
+                if (!LOGIN_FLOWS[backend]) {
+                    await chat.adapter.sendText(chat.chatId, t("install.success_no_login", backend), { threadId: chat.threadId }).catch(() => { });
+                    return;
+                }
+                await this.postNonceButtonPrompt({
+                    prefix: INSTALL_LOGIN_CALLBACK_PREFIX,
+                    alertType: "login",
+                    instanceName: backend,
+                    adapter: chat.adapter,
+                    adapterId: chat.adapterId,
+                    chatId: chat.chatId,
+                    threadId: chat.threadId,
+                    message: t("install.login_prompt", backend),
+                    choices: [
+                        { action: "go", label: t("install.login_now") },
+                        { action: "later", label: t("install.later") },
+                    ],
+                    expiredText: t("install.later_ack", backend),
+                });
+            },
+        }, this.logger);
+        this.activeInstall = { session, backend, chat };
+        try {
+            await session.start();
+        }
+        catch (err) {
+            this.activeInstall = null;
+            return t("install.failed", backend, err.message);
+        }
+        return t("install.started", backend);
+    }
+    /** `/install-cli cancel` — abort the active install and remove its window. */
+    async cancelInstallSession() {
+        if (!this.activeInstall)
+            return t("install.no_session");
+        const backend = this.activeInstall.backend;
+        await this.activeInstall.session.cancel();
+        return t("install.cancelled", backend);
+    }
+    /** `command -v` on a login shell, so PATH additions from rc files count. */
+    verifyBinaryOnLoginShell(binary) {
+        try {
+            const result = spawnSync("bash", ["-lc", `command -v ${binary}`], { timeout: 10_000, stdio: "pipe" });
+            return result.status === 0;
+        }
+        catch {
+            return false;
+        }
+    }
+    /** "Sign in now?" button after a successful install. */
+    async handleInstallLoginConfirm(data, callbackAdapterId, receivingAdapter) {
+        const claimed = this.consumeNonceCallback(INSTALL_LOGIN_CALLBACK_PREFIX, /^install-login:([0-9a-f]+):(go|later)$/, data, callbackAdapterId, receivingAdapter);
+        if (claimed === null)
+            return false;
+        if (claimed === "consumed")
+            return true;
+        const { entry, action } = claimed;
+        const backend = entry.instanceName;
+        if (action === "later") {
+            await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t("install.later_ack", backend));
+            return true;
+        }
+        await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t("login.starting_backend", backend));
+        const text = await this.startLoginSession(backend, {
+            adapter: entry.adapter,
+            adapterId: entry.adapterId,
+            chatId: entry.chatId,
+            threadId: entry.threadId,
+        });
+        if (text)
+            await entry.adapter.sendText(entry.chatId, text, { threadId: entry.threadId }).catch(() => { });
+        return true;
+    }
+    /** Discord native `/login` slash — shared by every adapter dispatch block. */
+    async handleLoginSlash(data, adapterId, adapter) {
+        if (!data.userId || !this.isFleetAdmin(data.userId, adapterId)) {
+            await data.respond(t("permission.denied"));
+            return;
+        }
+        const chat = { adapter, adapterId, chatId: data.channelId };
+        if (data.options?.cancel === true) {
+            await data.respond(await this.cancelLoginSession());
+            return;
+        }
+        const code = String(data.options?.code ?? "").trim();
+        if (code) {
+            await data.respond(await this.loginSubmitInput(code));
+            return;
+        }
+        const backend = String(data.options?.backend ?? "").trim();
+        if (backend) {
+            const text = await this.startLoginSession(backend, chat);
+            await data.respond(text ?? t("login.confirm_posted"));
+            return;
+        }
+        await this.promptLoginBackends(chat);
+        await data.respond(t("login.chooser_posted"));
+    }
+    /** Discord native `/install-cli` slash — shared by every dispatch block. */
+    async handleInstallCliSlash(data, adapterId, adapter) {
+        if (!data.userId || !this.isFleetAdmin(data.userId, adapterId)) {
+            await data.respond(t("permission.denied"));
+            return;
+        }
+        if (data.options?.cancel === true) {
+            await data.respond(await this.cancelInstallSession());
+            return;
+        }
+        const backend = String(data.options?.backend ?? "").trim();
+        if (!backend) {
+            // Bare call: offer the backends instead of printing a usage line the user
+            // then has to retype. A Discord slash that DID pick the native `backend`
+            // choice never lands here, so the two paths cannot both fire.
+            await this.promptInstallBackends({ adapter, adapterId, chatId: data.channelId });
+            await data.respond(t("install.chooser_posted"));
+            return;
+        }
+        await data.respond(await this.startInstallSession(backend, { adapter, adapterId, chatId: data.channelId }));
+    }
     queueMirrorMessage(text) {
         const mirrorTopicId = this.fleetConfig?.channel?.mirror_topic_id;
         if (mirrorTopicId == null || !this.adapter)
@@ -5686,9 +7599,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     }
     /** Resolve the workspace path a backend actually uses before publishing knowledge. */
     resolveKnowledgeWorkDir(workDir, backend, instanceName) {
-        // Some backends relocate their real cwd (agy moves hidden paths to
-        // ~/agend-workspaces/<name>). Instructions and skills must land where the
-        // CLI actually runs, not where fleet.yaml points.
+        // Backend resolution may create/normalize the real cwd. Instructions and
+        // skills must land where the CLI actually runs, not an assumed path.
         try {
             const resolved = createBackend(backend, join(getAgendHome(), "cli-env"))
                 .resolveWorkingDirectory?.(workDir, instanceName);
@@ -6344,6 +8256,24 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 return null;
             const probed = await be.probeCLIEnv({ workingDirectory: "", instanceDir: join(getAgendHome(), "cli-env"), instanceName: `probe-${backend}`, mcpServers: {} });
             const env = { backend, probedAt: Date.now(), ...probed };
+            // An empty result must never overwrite a catalog we already have. Some
+            // probes hit the network (`agy models` fetches, 5s cap), so a slow moment
+            // returns [] — and writing that would blank the list for the whole 24h
+            // TTL, long after the CLI recovered. Observed live: a good 11-model
+            // antigravity cache replaced by an empty one. Keep the known models and
+            // let the fresher currentModel/version through.
+            if (!env.models?.length) {
+                const previous = this.readCliEnv(backend);
+                if (previous?.models?.length)
+                    env.models = previous.models;
+            }
+            // Same protection for the extended catalog: one offline moment must not
+            // blank a good account list for the whole cache TTL.
+            if (!env.apiModels?.length) {
+                const previous = this.readCliEnv(backend);
+                if (previous?.apiModels?.length)
+                    env.apiModels = previous.apiModels;
+            }
             const path = this.cliEnvPath(backend);
             mkdirSync(dirname(path), { recursive: true });
             writeFileSync(path, JSON.stringify(env, null, 2));
@@ -6382,6 +8312,108 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const env = await this.probeBackend(backendName);
         return env?.models ?? [];
     }
+    /**
+     * Model catalog behind the `list_models` tool.
+     *
+     * The two scopes are not cosmetic. "global" is the account/CLI catalog served
+     * from the startup probe cache; "instance" is resolved through that instance's
+     * OWN backend config, and for a Codex instance on a custom provider that is a
+     * different catalog entirely — `listModels()` reads models_cache.json out of
+     * the instance's private CODEX_HOME. Answering such an instance with the
+     * account list would name models its CLI rejects, which is exactly the
+     * mistake this tool exists to prevent.
+     *
+     * `scope` always describes where the returned LIST came from, not what was
+     * asked for: an instance query that falls back to the account catalog reports
+     * scope "global" and says so in `note`, rather than implying instance-level
+     * accuracy it does not have.
+     *
+     * Never throws — a model listing is an aid, and failing it must not fail a turn.
+     */
+    async listModelCatalog(opts = {}) {
+        const { instanceName } = opts;
+        if (instanceName) {
+            const backend = this.backendNameForInstance(instanceName);
+            const resolved = this.resolveInstanceModel(instanceName);
+            const currentModel = resolved.source === "unresolved" ? null : resolved.model;
+            const provider = this.customProviderFor(instanceName, backend);
+            const scoped = await this.instanceScopedModels(instanceName, backend);
+            if (scoped.length) {
+                return {
+                    backend, scope: "instance", instance: instanceName,
+                    current_model: currentModel, models: scoped, source: "live",
+                    ...(provider ? { note: `Catalog read through this instance's ${backend} provider "${provider}" — it may differ from the account catalog.` } : {}),
+                };
+            }
+            // No instance-local catalog (never launched, or the backend has no
+            // per-instance list). The account catalog is the best available answer,
+            // but it is labelled honestly rather than dressed up as instance scope.
+            const global = await this.globalModelCatalog(backend);
+            return {
+                ...global, instance: instanceName, current_model: currentModel,
+                note: provider
+                    ? `No instance-local catalog yet; showing the account catalog, which may NOT match this instance's ${backend} provider "${provider}".`
+                    : "No instance-local catalog yet; showing the account catalog.",
+            };
+        }
+        return this.globalModelCatalog(opts.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code");
+    }
+    /** The custom provider an instance overrides its backend with, if any. */
+    customProviderFor(instanceName, backend) {
+        const opts = this.fleetConfig?.instances?.[instanceName]?.backend_options?.[backend]
+            ?? this.fleetConfig?.defaults?.backend_options?.[backend];
+        const provider = opts?.provider;
+        return typeof provider === "string" && provider.trim() ? provider.trim() : null;
+    }
+    /** Ask a backend for its catalog using ONE instance's real config. Never throws. */
+    async instanceScopedModels(instanceName, backend) {
+        try {
+            const inst = this.fleetConfig?.instances?.[instanceName];
+            const instanceDir = this.getInstanceDir(instanceName);
+            const be = createBackend(backend, instanceDir);
+            if (!be.listModels)
+                return [];
+            return await be.listModels({
+                workingDirectory: inst?.working_directory ?? "",
+                instanceDir,
+                instanceName,
+                mcpServers: {},
+                model: inst?.model,
+                backendOptions: inst?.backend_options?.[backend] ?? this.fleetConfig?.defaults?.backend_options?.[backend],
+            }) ?? [];
+        }
+        catch {
+            // listModels is documented never to throw, but a backend constructor can
+            // (missing binary). A catalog is an aid; degrade to the account list.
+            return [];
+        }
+    }
+    /** Account-wide catalog: probe cache first, live probe on miss. */
+    async globalModelCatalog(backend) {
+        const cached = this.readCliEnv(backend);
+        if (cached?.models?.length) {
+            return {
+                backend, scope: "global", current_model: cached.currentModel ?? null,
+                models: cached.models, source: "cache",
+                probed_at: new Date(cached.probedAt).toISOString(),
+            };
+        }
+        const env = await this.probeBackend(backend);
+        if (env?.models?.length) {
+            return {
+                backend, scope: "global", current_model: env.currentModel ?? null,
+                models: env.models, source: "live",
+                probed_at: new Date(env.probedAt).toISOString(),
+            };
+        }
+        // Reported rather than thrown: "we could not enumerate" is a useful answer,
+        // and the caller can still set a model by name (AgEnD passes it through).
+        return {
+            backend, scope: "global", current_model: env?.currentModel ?? null,
+            models: [], source: "fallback",
+            note: `Could not enumerate models for ${backend} (CLI missing, not logged in, or it offers no list). Model names are passed through to the CLI, so a known-good name still works.`,
+        };
+    }
     /** `/model` slash handler (admin only). No arg → DC menu; `/model <name>` → apply directly. */
     /** Label an effort choice, marking the one currently configured. */
     effortChoiceLabel(level, current) {
@@ -6390,10 +8422,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     effortMenuHeader(instanceName) {
         const { effort, source } = this.resolveInstanceEffort(instanceName);
         if (!effort)
-            return "Current effort: (CLI default)";
+            return t("effort.current_default");
         return source === "fleet-default"
-            ? `Current effort: ${effort} (fleet default)`
-            : `Current effort: ${effort}`;
+            ? t("effort.current_fleet", effort)
+            : t("effort.current", effort);
     }
     /** `/effort` — DC Select Menu, or apply directly when a level is given. */
     async handleEffortSlash(data, adapterId) {
@@ -6414,11 +8446,11 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
         const levels = this.effortLevelsFor(name);
         if (levels.length === 0) {
-            await data.respond(`❌ ${this.backendNameForInstance(name)} has no reasoning-effort setting.`);
+            await data.respond(t("effort.unsupported", this.backendNameForInstance(name)));
             return;
         }
         if (!data.respondChoices) {
-            await data.respond(`Usage: /effort <${levels.join("|")}>`);
+            await data.respond(t("effort.usage", levels.join("|")));
             return;
         }
         const current = this.resolveInstanceEffort(name).effort;
@@ -6431,20 +8463,20 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         timer.unref?.();
         this.pendingEffortSelects.set(nonce, { instanceName: name, userId: data.userId, channelId: data.channelId, timer, respond: data.respond });
         try {
-            await data.respondChoices(`${this.effortMenuHeader(name)}\nSelect a new effort level:`, choices);
+            await data.respondChoices(t("effort.menu", this.effortMenuHeader(name)), choices);
         }
         catch (err) {
             this.pendingEffortSelects.delete(nonce);
             clearTimeout(timer);
             this.logger.warn({ err, instanceName: name }, "effort menu failed");
-            await data.respond(`Usage: /effort <${levels.join("|")}>`);
+            await data.respond(t("effort.usage", levels.join("|")));
         }
     }
     /** TG inline-keyboard effort menu. Returns null on success, else a fallback string. */
     async promptEffortMenu(instanceName, userId, channelId, adapter, chatId, threadId) {
         const levels = this.effortLevelsFor(instanceName);
         if (levels.length === 0) {
-            return `❌ ${this.backendNameForInstance(instanceName)} has no reasoning-effort setting.`;
+            return t("effort.unsupported", this.backendNameForInstance(instanceName));
         }
         const current = this.resolveInstanceEffort(instanceName).effort;
         const nonce = randomBytes(6).toString("hex");
@@ -6460,13 +8492,13 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             const p = this.pendingEffortSelects.get(nonce);
             if (p) {
                 this.pendingEffortSelects.delete(nonce);
-                p.respond("⏰ Effort selection expired.").catch(() => { });
+                p.respond(t("effort.selection_expired")).catch(() => { });
             }
         }, CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
         timer.unref?.();
         this.pendingEffortSelects.set(nonce, { instanceName, userId, channelId, timer, respond, adapter, adapterChatId: chatId, adapterThreadId: threadId });
         try {
-            const menuMessageId = await adapter.promptUser(chatId, `${this.effortMenuHeader(instanceName)}\nSelect a new effort level:`, choices, { threadId });
+            const menuMessageId = await adapter.promptUser(chatId, t("effort.menu", this.effortMenuHeader(instanceName)), choices, { threadId });
             const pending = this.pendingEffortSelects.get(nonce);
             if (pending)
                 pending.menuMessageId = menuMessageId;
@@ -6476,7 +8508,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.pendingEffortSelects.delete(nonce);
             clearTimeout(timer);
             this.logger.warn({ err, instanceName }, "TG effort menu failed");
-            return `Usage: /effort <${levels.join("|")}>`;
+            return t("effort.usage", levels.join("|"));
         }
     }
     /** Consume an `/effort` selection callback. Mirrors handleModelSelection. */
@@ -6497,7 +8529,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.pendingEffortSelects.delete(match[1]);
         clearTimeout(pending.timer);
         const level = match[2];
-        const progressText = `⏳ Setting ${pending.instanceName} effort to \`${level}\`…`;
+        const progressText = t("effort.setting", pending.instanceName, level);
         let progressMsgId;
         if (pending.adapter && pending.adapterChatId) {
             const menuMessageId = pending.menuMessageId ?? data.messageId;
@@ -6529,7 +8561,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             }
             catch (err) {
                 this.logger.error({ err, instance: pending.instanceName, level }, "Effort switch failed");
-                result = `Effort switch to \`${level}\` failed: ${err instanceof Error ? err.message : String(err)}`;
+                result = t("effort.switch_failed", level, err instanceof Error ? err.message : String(err));
             }
             if (pending.adapter && pending.adapterChatId) {
                 if (progressMsgId) {
@@ -6566,32 +8598,36 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
         // No arg (or --refresh) → menu. Menu is DC-only this round (respondChoices); TG uses `/model <name>`.
         if (!data.respondChoices) {
-            await data.respond("Usage: /model <name> — e.g. /model sonnet");
+            await data.respond(t("model.usage"));
             return;
         }
         const options = await this.getModelOptions(name, isRefresh);
         if (options.length === 0) {
-            await data.respond(`No model list available for ${name}. Type \`/model <name>\` to set one directly.`);
+            await data.respond(t("model.list_unavailable", name));
             return;
         }
         // Raw id for ✓-matching options; display resolves an inherited CLI default.
         const { model: currentModel, display: currentDisplay } = this.resolveInstanceModel(name);
         const nonce = randomBytes(6).toString("hex");
-        const choices = options.slice(0, 25).map(o => ({
+        const isClaude = this.backendNameForInstance(name) === "claude-code";
+        const choices = options.slice(0, isClaude ? 24 : 25).map(o => ({
             id: `${MODEL_SELECT_CALLBACK_PREFIX}${nonce}:${o.id}`,
             label: this.modelChoiceLabel(o, currentModel),
         }));
+        if (isClaude) {
+            choices.push({ id: `${MODEL_SELECT_CALLBACK_PREFIX}${nonce}:__more__`, label: t("model.more") });
+        }
         const timer = setTimeout(() => this.pendingModelSelects.delete(nonce), CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
         timer.unref?.();
-        this.pendingModelSelects.set(nonce, { instanceName: name, model: "", userId: data.userId, channelId: data.channelId, timer, respond: data.respond });
+        this.pendingModelSelects.set(nonce, { instanceName: name, model: "", userId: data.userId, channelId: data.channelId, timer, respond: data.respond, respondChoices: data.respondChoices });
         try {
-            await data.respondChoices(`Current model: **${currentDisplay}**\nSelect a new model:`, choices);
+            await data.respondChoices(t("model.menu", `**${currentDisplay}**`), choices);
         }
         catch (err) {
             this.pendingModelSelects.delete(nonce);
             clearTimeout(timer);
             this.logger.warn({ err, instanceName: name }, "model menu failed");
-            await data.respond("Usage: /model <name> — e.g. /model sonnet");
+            await data.respond(t("model.usage"));
         }
     }
     /**
@@ -6602,14 +8638,19 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     async promptModelMenu(instanceName, userId, channelId, adapter, chatId, threadId) {
         const options = await this.getModelOptions(instanceName);
         if (options.length === 0) {
-            return `No model list available for ${instanceName}. Use \`/model <name>\` to set one directly.`;
+            return t("model.list_unavailable", instanceName);
         }
         const { model: currentModel, display: currentDisplay } = this.resolveInstanceModel(instanceName);
         const nonce = randomBytes(6).toString("hex");
-        const choices = options.slice(0, 25).map(o => ({
+        const isClaude = this.backendNameForInstance(instanceName) === "claude-code";
+        // Keep the more-models entry inside Discord's 25-option select cap.
+        const choices = options.slice(0, isClaude ? 24 : 25).map(o => ({
             id: `${MODEL_SELECT_CALLBACK_PREFIX}${nonce}:${o.id}`,
             label: this.modelChoiceLabel(o, currentModel),
         }));
+        if (isClaude) {
+            choices.push({ id: `${MODEL_SELECT_CALLBACK_PREFIX}${nonce}:__more__`, label: t("model.more") });
+        }
         const respond = async (text) => {
             await adapter.sendText(chatId, text, { threadId });
             return undefined;
@@ -6618,13 +8659,13 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             const p = this.pendingModelSelects.get(nonce);
             if (p) {
                 this.pendingModelSelects.delete(nonce);
-                p.respond("⏰ Model selection expired.").catch(() => { });
+                p.respond(t("model.selection_expired")).catch(() => { });
             }
         }, CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
         timer.unref?.();
         this.pendingModelSelects.set(nonce, { instanceName, model: "", userId, channelId, timer, respond, adapter, adapterChatId: chatId, adapterThreadId: threadId });
         try {
-            const menuMessageId = await adapter.promptUser(chatId, `Current model: ${currentDisplay}\nSelect a new model:`, choices, { threadId });
+            const menuMessageId = await adapter.promptUser(chatId, t("model.menu", currentDisplay), choices, { threadId });
             const pending = this.pendingModelSelects.get(nonce);
             if (pending)
                 pending.menuMessageId = menuMessageId;
@@ -6634,7 +8675,63 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.pendingModelSelects.delete(nonce);
             clearTimeout(timer);
             this.logger.warn({ err, instanceName }, "TG model menu failed");
-            return `Usage: /model <name> — e.g. /model sonnet`;
+            return t("model.usage");
+        }
+    }
+    /** Cached-or-live account catalog behind "/model → more models" (claude). */
+    async claudeApiModelOptions() {
+        const cached = this.readCliEnv("claude-code");
+        if (cached?.apiModels?.length)
+            return cached.apiModels;
+        const env = await this.probeBackend("claude-code");
+        return env?.apiModels ?? [];
+    }
+    /** Replace a consumed "/model" menu with the full account catalog tier. */
+    async expandClaudeModelMenu(pending) {
+        const expanded = await this.claudeApiModelOptions();
+        if (!expanded.length) {
+            await pending.respond(t("model.more_unavailable")).catch(() => { });
+            return;
+        }
+        const { model: currentModel, display: currentDisplay } = this.resolveInstanceModel(pending.instanceName);
+        const nonce = randomBytes(6).toString("hex");
+        const choices = expanded.slice(0, 25).map(o => ({
+            id: `${MODEL_SELECT_CALLBACK_PREFIX}${nonce}:${o.id}`,
+            label: this.modelChoiceLabel(o, currentModel),
+        }));
+        const timer = setTimeout(() => {
+            const p = this.pendingModelSelects.get(nonce);
+            if (p) {
+                this.pendingModelSelects.delete(nonce);
+                p.respond(t("model.selection_expired")).catch(() => { });
+            }
+        }, CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
+        timer.unref?.();
+        this.pendingModelSelects.set(nonce, { ...pending, model: "", timer });
+        try {
+            if (pending.respondChoices) {
+                // Discord select menu: edit the same interaction reply in place.
+                await pending.respondChoices(t("model.menu", `**${currentDisplay}**`), choices);
+                return;
+            }
+            if (pending.adapter && pending.adapterChatId) {
+                // Telegram: retire the tier-1 keyboard, then post the expanded menu.
+                if (pending.menuMessageId && pending.adapter.editMessageRemoveButtons) {
+                    await pending.adapter.editMessageRemoveButtons(pending.adapterChatId, pending.menuMessageId, t("model.more"), pending.adapterThreadId).catch(() => { });
+                }
+                const menuMessageId = await pending.adapter.promptUser(pending.adapterChatId, t("model.menu", currentDisplay), choices, { threadId: pending.adapterThreadId });
+                const fresh = this.pendingModelSelects.get(nonce);
+                if (fresh)
+                    fresh.menuMessageId = menuMessageId;
+                return;
+            }
+            await pending.respond(t("model.more_unavailable")).catch(() => { });
+        }
+        catch (err) {
+            this.pendingModelSelects.delete(nonce);
+            clearTimeout(timer);
+            this.logger.warn({ err, instanceName: pending.instanceName }, "Expanded model menu failed");
+            await pending.respond(t("model.more_unavailable")).catch(() => { });
         }
     }
     /** Consume a `/model` selection callback. Returns true for all model-select ids (incl. stale). */
@@ -6656,8 +8753,14 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.pendingModelSelects.delete(match[1]);
         clearTimeout(pending.timer);
         const model = match[2];
+        // "More models…" is a navigation choice, not a model: swap the menu for the
+        // full account catalog (live /v1/models with [1m] variants).
+        if (model === "__more__") {
+            await this.expandClaudeModelMenu(pending);
+            return true;
+        }
         // Send immediate "⏳ Switching..." feedback, then apply in background.
-        const progressText = `⏳ Switching ${pending.instanceName} to \`${model}\`…`;
+        const progressText = t("model.switching", pending.instanceName, model);
         let progressMsgId;
         if (pending.adapter && pending.adapterChatId) {
             // TG path: turn the original menu into the progress message. This both
@@ -6694,7 +8797,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             }
             catch (err) {
                 this.logger.error({ err, instance: pending.instanceName, model }, "Model switch failed");
-                result = `Model switch to \`${model}\` failed: ${err instanceof Error ? err.message : String(err)}`;
+                result = t("model.switch_failed", model, err instanceof Error ? err.message : String(err));
             }
             if (pending.adapter && pending.adapterChatId) {
                 if (progressMsgId) {
@@ -6791,17 +8894,17 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
         catch { /* treated as unsupported below */ }
         if (strategy === "unsupported" || supported.length === 0) {
-            return `❌ ${backendName} has no reasoning-effort setting.`;
+            return t("effort.unsupported", backendName);
         }
         if (!FleetManager.EFFORT_LEVELS.includes(level)) {
-            return `❌ Unknown effort level \`${level}\`. Use: ${FleetManager.EFFORT_LEVELS.join(", ")}.`;
+            return t("effort.unknown", level, FleetManager.EFFORT_LEVELS.join(", "));
         }
         const applied = FleetManager.clampEffort(level, supported);
         if (!applied)
-            return `❌ ${backendName} accepts none of the canonical effort levels.`;
+            return t("effort.no_canonical", backendName);
         const warn = applied === level
             ? ""
-            : `⚠️ Clamped to \`${applied}\` (\`${level}\` not supported by ${backendName}).\n`;
+            : t("effort.clamped", applied, level, backendName);
         // Persist either way: a runtime switch must survive the next respawn too,
         // or the instance silently reverts on restart.
         if (this.fleetConfig?.instances[instanceName]) {
@@ -6810,12 +8913,12 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
         if (strategy === "runtime") {
             if (!this.instanceIpcClients.get(instanceName))
-                return `${warn}❌ ${instanceName} is not running.`;
+                return `${warn}${t("effort.not_running", instanceName)}`;
             this.pasteRawToClassicInstance(instanceName, `/effort ${applied}`);
-            return `${warn}✅ Set ${instanceName} effort to \`${applied}\` (runtime).`;
+            return `${warn}${t("effort.runtime_success", instanceName, applied)}`;
         }
         await this.restartSingleInstance(instanceName);
-        return `${warn}✅ Set ${instanceName} effort to \`${applied}\` and restarted.`;
+        return `${warn}${t("effort.restart_success", instanceName, applied)}`;
     }
     async applyModel(instanceName, model) {
         const backendName = this.backendNameForInstance(instanceName);
@@ -6824,9 +8927,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             strategy = createBackend(backendName, this.getInstanceDir(instanceName)).getModelSwitchStrategy?.(model) ?? "restart";
         }
         catch { /* default restart */ }
-        const warn = isModelCompatible(backendName, model) ? "" : `⚠️ "${model}" doesn't match ${backendName}'s usual pattern — passing through anyway.\n`;
+        const warn = isModelCompatible(backendName, model) ? "" : t("model.pattern_warning", model, backendName);
         if (strategy === "runtime" && !this.instanceIpcClients.get(instanceName)) {
-            return `${warn}❌ ${instanceName} is not running.`;
+            return `${warn}${t("effort.not_running", instanceName)}`;
         }
         // Persist either way: a runtime switch must survive the next respawn too,
         // or the instance silently reverts to the CLI default after a fleet restart.
@@ -6840,13 +8943,13 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             persisted = true;
         }
         if (!persisted)
-            return `${warn}❌ Could not set model for ${instanceName}.`;
+            return `${warn}${t("model.persist_failed", instanceName)}`;
         if (strategy === "runtime") {
             this.pasteRawToClassicInstance(instanceName, `/model ${model}`);
-            return `${warn}✅ Switched ${instanceName} to \`${model}\` (runtime).${this.effortSuffix(instanceName)}`;
+            return `${warn}${t("model.runtime_success", instanceName, model)}${this.effortSuffix(instanceName)}`;
         }
         await this.restartSingleInstance(instanceName);
-        return `${warn}✅ Set ${instanceName} to \`${model}\` and restarted.${this.effortSuffix(instanceName)}`;
+        return `${warn}${t("model.restart_success", instanceName, model)}${this.effortSuffix(instanceName)}`;
     }
     /**
      * The trailing "Current effort: …" line for a /model reply.
@@ -6860,10 +8963,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             return "";
         const { effort, source } = this.resolveInstanceEffort(instanceName);
         if (!effort)
-            return "\nCurrent effort: (CLI default)";
+            return `\n${t("effort.current_default")}`;
         return source === "fleet-default"
-            ? `\nCurrent effort: ${effort} (fleet default)`
-            : `\nCurrent effort: ${effort}`;
+            ? `\n${t("effort.current_fleet", effort)}`
+            : `\n${t("effort.current", effort)}`;
     }
     /** Read recent chat log for agent context */
     getRecentChatLog(instanceName, maxLines = 10) {
@@ -6898,11 +9001,21 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     /** Return a user-facing blocker without mutating ClassicBot state. */
     validateClassicStart(channelId, userId, guildId, adapterId) {
         if (!this.classicChannels)
-            return "Classic channel manager not initialized.";
+            return t("classic.manager_unavailable");
         if (guildId && !this.classicChannels.isGuildAllowed(guildId)) {
             const generalId = this.findGeneralInstance(adapterId);
-            if (generalId)
-                this.notifyInstanceTopic(generalId, t("alert.unauth_guild", guildId, userId));
+            if (generalId) {
+                // Fire-and-forget, exactly as the notifyInstanceTopic it replaces: this
+                // function's return value is the rejection shown to the user, and it
+                // must not wait on posting buttons into the General topic.
+                void this.promptClassicApproval({
+                    generalName: generalId,
+                    message: t("alert.unauth_guild", guildId, userId),
+                    groupId: String(guildId),
+                    scope: "guild",
+                    userId: userId ? String(userId) : undefined,
+                }).catch(err => this.logger.warn({ err, guildId }, "Classic approval prompt failed"));
+            }
             return t("classic.not_authorized_guild");
         }
         if (this.classicChannels.isClassicChannel(channelId, adapterId))
@@ -7045,6 +9158,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             return;
         const workDir = join(getAgendHome(), "workspaces", instanceName);
         ensureWorkspaceGit(workDir);
+        const classicIdentity = this.classicChannels?.getAll().find(ch => ch.instanceName === instanceName);
         const config = {
             ...DEFAULT_INSTANCE_CONFIG,
             ...this.fleetConfig?.defaults,
@@ -7052,6 +9166,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             lightweight: true,
             ...(backend ? { backend } : {}),
             ...(model ? { model } : {}),
+            ...(classicIdentity?.displayName ? { display_name: classicIdentity.displayName } : {}),
+            ...(classicIdentity?.description ? { description: classicIdentity.description } : {}),
             ...(autoPauseAfter !== undefined ? { auto_pause_after: autoPauseAfter } : {}),
             ...(preTaskCommand ? { pre_task_command: preTaskCommand } : {}),
         };
@@ -7065,7 +9181,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             return blocker;
         const classicChannels = this.classicChannels;
         if (!classicChannels)
-            return "Classic channel manager not initialized.";
+            return t("classic.manager_unavailable");
         const instanceName = classicChannels.deriveInstanceName(channelName || channelId, channelId, adapterId);
         clearPausedMarker(this.getInstanceDir(instanceName));
         const selectedBackend = isSelectableClassicBackend(backend) ? backend : undefined;
@@ -7087,7 +9203,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     /** Handle /stop slash command — unregister classic channel */
     async handleClassicStop(channelId, adapterId) {
         if (!this.classicChannels)
-            return "Classic channel manager not initialized.";
+            return t("classic.manager_unavailable");
         const ch = this.classicChannels.unregister(channelId, adapterId);
         if (!ch)
             return t("classic.no_agent");
@@ -7119,6 +9235,21 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // await in the same tick as the signal handler, so no event can slip in.
         this.shuttingDown = true;
         this.ipcStoppingInstances.add("__fleet_stopping__");
+        // Release held delivery promises before awaiting daemon shutdown, then
+        // reject spawn work which has not started. Otherwise a storm backoff could
+        // make `agend stop` wait forever for its own queue.
+        this.stormWindow.shutdown();
+        this.spawnGate.shutdown();
+        for (const pending of this.startupRetries.values())
+            clearTimeout(pending.timer);
+        this.startupRetries.clear();
+        for (const pending of this.startupRetryNotices.values())
+            clearTimeout(pending.timer);
+        this.startupRetryNotices.clear();
+        if (this.stormOpenNotifyTimer) {
+            clearTimeout(this.stormOpenNotifyTimer);
+            this.stormOpenNotifyTimer = null;
+        }
         sdNotifyBlocking("STOPPING=1");
         if (this.watchdogTimer) {
             clearInterval(this.watchdogTimer);
@@ -7134,6 +9265,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.clearStatuslineWatchers();
         this.costGuard?.stop();
         this.dailySummary?.stop();
+        this.dailyTipScheduler?.stop();
+        this.dailyTipScheduler = null;
         if (this.updateCheckTimer) {
             clearTimeout(this.updateCheckTimer);
             clearInterval(this.updateCheckTimer);
@@ -7351,7 +9484,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     /**
      * Hot-reload: re-read fleet.yaml and reconcile running instances.
      * Starts new, stops removed, restarts modified instances.
-     * Fleet-level config (access, cost_guard, etc.) requires /restart to take effect.
+     * Whitelisted runtime fields are pushed into live daemons; all other instance
+     * fields, plus cold fleet-level settings, retain restart semantics.
      */
     async reconcileInstances() {
         if (!this.configPath)
@@ -7393,11 +9527,11 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             // possible outcome: they change fleet.yaml, send SIGHUP, and nothing happens
             // with no explanation anywhere they are looking.
             const why = !validation.valid
-                ? `validation failed:\n${validation.errors.map(e => `• ${e.path}: ${e.message}`).join("\n")}`
+                ? t("fleet.reload_validation", validation.errors.map(e => `• ${e.path}: ${e.message}`).join("\n"))
                 : unsafeEmpty
-                    ? `it removed every instance (${oldCount} → 0)`
-                    : `it removed more than half the instances (${oldCount} → ${newCount})`;
-            this.notifyFleetError(`⚠️ fleet.yaml reload REJECTED — ${why}\nThe previous configuration is still running.`);
+                    ? t("fleet.reload_removed_all", oldCount)
+                    : t("fleet.reload_removed_half", oldCount, newCount);
+            this.notifyFleetError(t("fleet.reload_rejected", why));
             return;
         }
         this.routing.rebuild(this.fleetConfig);
@@ -7405,9 +9539,20 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.scheduler?.reload();
         const newInstances = this.fleetConfig.instances;
         const topicMode = this.fleetConfig?.channel?.mode === "topic";
-        // Detect fleet-level config changes and warn
-        const oldFleetLevel = JSON.stringify({ channel: oldConfig?.channel, defaults: oldConfig?.defaults });
-        const newFleetLevel = JSON.stringify({ channel: this.fleetConfig?.channel, defaults: this.fleetConfig?.defaults });
+        // Detect fleet-level changes which still need a restart. Hot defaults are
+        // reconciled below and must not produce a misleading restart warning.
+        const oldDefaultColdWithFleetFields = oldConfig?.defaults
+            ? splitHotColdConfig(oldConfig.defaults).cold
+            : {};
+        const newDefaultColdWithFleetFields = this.fleetConfig?.defaults
+            ? splitHotColdConfig(this.fleetConfig.defaults).cold
+            : {};
+        // `tips` is a fleet-owned hot switch; it is read at post time and never
+        // belongs in a daemon config or a "restart required" warning.
+        const { tips: _oldTips, ...oldDefaultCold } = oldDefaultColdWithFleetFields;
+        const { tips: _newTips, ...newDefaultCold } = newDefaultColdWithFleetFields;
+        const oldFleetLevel = JSON.stringify({ channel: oldConfig?.channel, defaults: oldDefaultCold });
+        const newFleetLevel = JSON.stringify({ channel: this.fleetConfig?.channel, defaults: newDefaultCold });
         if (oldFleetLevel !== newFleetLevel) {
             this.logger.warn("Fleet-level config changed (channel/defaults) — use /restart for full effect");
         }
@@ -7419,22 +9564,43 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 await this.stopInstance(name).catch(err => this.logger.error({ err, name }, "Failed to stop removed instance"));
             }
         }
-        // Start new + restart modified instances
+        // Start new + reconcile modified instances. Hot values are always sent as a
+        // complete snapshot: Settings mutates FleetManager's config before SIGHUP,
+        // so an old/new diff alone can miss the live daemon's stale value.
         for (const [name, config] of Object.entries(newInstances)) {
             if (!this.daemons.has(name)) {
                 // New instance — startInstance already calls connectIpcToInstance
                 this.logger.info({ name }, "New instance in config — starting");
-                await this.startInstance(name, config, topicMode).catch(err => this.logger.error({ err, name }, "Failed to start new instance"));
+                await this.startInstanceUnattended(name, config, topicMode, "new instance");
             }
             else if (oldConfig?.instances[name]) {
-                // Restart if any config field changed
-                if (JSON.stringify(oldConfig.instances[name]) !== JSON.stringify(config)) {
+                const daemon = this.daemons.get(name);
+                const runtimeConfig = daemon.getConfigSnapshot?.() ?? oldConfig.instances[name];
+                const oldParts = splitHotColdConfig(runtimeConfig);
+                const newParts = splitHotColdConfig(config);
+                // Every field not explicitly classified hot is cold by default.
+                if (!isDeepStrictEqual(oldParts.cold, newParts.cold)) {
                     this.logger.info({ name }, "Instance config changed — restarting");
                     await this.stopInstance(name).catch(() => { });
-                    await this.startInstance(name, config, topicMode).catch(err => this.logger.error({ err, name }, "Failed to restart modified instance"));
+                    await this.startInstanceUnattended(name, config, topicMode, "modified instance");
+                }
+                else if (!isDeepStrictEqual(oldParts.hot, newParts.hot)) {
+                    const update = hotConfigUpdate(config);
+                    const ipc = this.instanceIpcClients.get(name);
+                    const sent = ipc?.connected === true && ipc.send({ type: "config_update", config: update });
+                    if (!sent) {
+                        // Daemon is in-process, so a reconnect gap must not leave runtime
+                        // state stale. Normal operation still uses the explicit IPC contract.
+                        daemon.applyConfigUpdate(update);
+                        this.logger.warn({ name }, "Config-update IPC unavailable — applied hot config in-process");
+                    }
+                    this.logger.info({ name, fields: [...HOT_INSTANCE_CONFIG_KEYS] }, "Instance hot config reloaded");
                 }
             }
         }
+        // warm_cap is fleet-owned; enforce the reloaded value immediately against
+        // currently idle instances instead of waiting for a future state edge.
+        this.enforceWarmCap();
         this.logger.info({ running: this.daemons.size, configured: Object.keys(newInstances).length }, "Reconcile complete");
     }
     async restartInstances() {
@@ -7515,14 +9681,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const restartGenerals = restartEntries.filter(([_, cfg]) => cfg.general_topic);
         const restartOthers = restartEntries.filter(([_, cfg]) => !cfg.general_topic);
         for (const [name, cfg] of restartGenerals) {
-            try {
-                await this.startInstance(name, cfg, topicMode);
-                if (this.daemons.has(name))
-                    restartProgress.markReady();
-            }
-            catch (err) {
-                this.logger.error({ err, name }, "Failed to start general instance");
-            }
+            if (await this.startInstanceUnattended(name, cfg, topicMode, "general instance"))
+                restartProgress.markReady();
         }
         // General is ready again; now its topic can own the live progress message.
         await restartProgress.start(progressTarget);
@@ -7543,14 +9703,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 while (idx < channels.length) {
                     const batch = channels.slice(idx, idx + concurrency);
                     await Promise.allSettled(batch.map(async (ch) => {
-                        try {
-                            await this.startClassicInstance(ch.instanceName, this.classicChannels.getBackendByInstance(ch.instanceName, fleetBackend), this.classicChannels.getPreTaskCommand(ch.channelId, ch.adapterId), this.classicChannels.getModel(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.model), this.classicChannels.getAutoPauseAfter(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.auto_pause_after));
-                            if (this.daemons.has(ch.instanceName))
-                                restartProgress.markReady();
-                        }
-                        catch (err) {
-                            this.logger.warn({ err, instanceName: ch.instanceName }, "Failed to start classic instance");
-                        }
+                        if (await this.startClassicInstanceUnattended(ch, "classic instance"))
+                            restartProgress.markReady();
                     }));
                     idx += concurrency;
                 }
@@ -7674,7 +9828,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 if (generalId) {
                     // No release URL — Discord's SuppressEmbeds proved unreliable and the
                     // link preview looked bad. Version + /update instruction is enough.
-                    this.notifyInstanceTopic(generalId, t("update.available", `v${target}`) + ` (current: v${currentVersion})`);
+                    this.notifyInstanceTopic(generalId, t("update.available_current", `v${target}`, `v${currentVersion}`));
                 }
             }
         }
@@ -7808,63 +9962,81 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             }
             // Fleet API (enriched for agent board)
             if (req.method === "GET" && req.url === "/api/fleet") {
-                const sysInfo = this.getSysInfo();
-                const fleetInstances = sysInfo.instances.map(inst => ({ ...inst, classic: false }));
-                const fleetNames = new Set(fleetInstances.map(inst => inst.name));
-                const classicInstances = (this.classicChannels?.getAll() ?? [])
-                    .filter(channel => !fleetNames.has(channel.instanceName))
-                    .map(channel => ({
-                    name: channel.instanceName,
-                    status: this.getInstanceStatus(channel.instanceName),
-                    state: this.getInstanceExecutionState(channel.instanceName),
-                    ipc: this.instanceIpcClients.has(channel.instanceName),
-                    costCents: this.costGuard?.getDailyCostCents(channel.instanceName) ?? 0,
-                    rateLimits: this.statuslineWatcher.getRateLimits(channel.instanceName) ?? null,
-                    classic: true,
-                    classicName: channel.name,
-                    channelId: channel.channelId,
-                    adapterId: channel.adapterId ?? null,
-                }));
-                const enriched = [...fleetInstances, ...classicInstances].map(inst => {
-                    const config = this.fleetConfig?.instances[inst.name];
-                    const persistedInboundAt = readLastInboundAt(this.getInstanceDir(inst.name));
-                    const lastActivity = inst.classic
-                        ? Math.max(persistedInboundAt ?? 0, readClassicLastActivityAt(this.dataDir, inst.name) ?? 0) || null
-                        : (persistedInboundAt ?? this.lastActivityMs(inst.name)) || null;
-                    const backend = inst.classic
-                        ? this.classicChannels?.getBackendByInstance(inst.name, this.fleetConfig?.defaults.backend) ?? "claude-code"
-                        : config?.backend ?? "claude-code";
-                    // Find claimed tasks for this instance
-                    let currentTask = null;
-                    try {
-                        const tasks = this.scheduler?.db.listTasks({ assignee: inst.name, status: "claimed" });
-                        if (tasks?.length)
-                            currentTask = tasks[0].title;
-                    }
-                    catch (err) {
-                        this.logger.debug({ err, name: inst.name }, "Scheduler listTasks failed (/api/fleet)");
+                try {
+                    const sysInfo = this.getSysInfo();
+                    const fleetInstances = sysInfo.instances.map(inst => ({ ...inst, classic: false }));
+                    const fleetNames = new Set(fleetInstances.map(inst => inst.name));
+                    const classicInstances = (this.classicChannels?.getAll() ?? [])
+                        .filter(channel => !fleetNames.has(channel.instanceName))
+                        .map(channel => ({
+                        name: channel.instanceName,
+                        status: this.getInstanceStatus(channel.instanceName),
+                        state: this.getInstanceExecutionState(channel.instanceName),
+                        ipc: this.instanceIpcClients.has(channel.instanceName),
+                        costCents: this.costGuard?.getDailyCostCents(channel.instanceName) ?? 0,
+                        rateLimits: this.statuslineWatcher.getRateLimits(channel.instanceName) ?? null,
+                        classic: true,
+                        classicName: channel.name,
+                        channelId: channel.channelId,
+                        adapterId: channel.adapterId ?? null,
+                    }));
+                    const enriched = [...fleetInstances, ...classicInstances].map(inst => {
+                        const config = this.fleetConfig?.instances[inst.name];
+                        const persistedInboundAt = readLastInboundAt(this.getInstanceDir(inst.name));
+                        const lastActivity = inst.classic
+                            ? Math.max(persistedInboundAt ?? 0, readClassicLastActivityAt(this.dataDir, inst.name) ?? 0) || null
+                            : (persistedInboundAt ?? this.lastActivityMs(inst.name)) || null;
+                        const backend = this.backendNameForInstance(inst.name);
+                        const resolvedModel = this.resolveInstanceModel(inst.name);
+                        const effortStrategy = this.effortStrategyFor(inst.name);
+                        const resolvedEffort = this.resolveInstanceEffort(inst.name);
+                        // Find claimed tasks for this instance
+                        let currentTask = null;
+                        try {
+                            const tasks = this.scheduler?.db.listTasks({ assignee: inst.name, status: "claimed" });
+                            if (tasks?.length)
+                                currentTask = tasks[0].title;
+                        }
+                        catch (err) {
+                            this.logger.debug({ err, name: inst.name }, "Scheduler listTasks failed (/api/fleet)");
+                        }
+                        return {
+                            ...inst,
+                            description: config?.description ?? ("classicName" in inst ? inst.classicName : null),
+                            backend,
+                            // Settings renders these runtime-effective values rather than the
+                            // sparse user-authored YAML. `auto` means the supported CLI is
+                            // using its own effort default; null is reserved for unsupported.
+                            model: resolvedModel.model,
+                            model_display: resolvedModel.display,
+                            model_source: resolvedModel.source,
+                            effort: effortStrategy === "unsupported" ? null : (resolvedEffort.effort ?? "auto"),
+                            effort_supported: effortStrategy !== "unsupported",
+                            tool_set: config?.tool_set ?? "full",
+                            general_topic: config?.general_topic ?? false,
+                            // User activity is persisted by the daemon, so both the board and
+                            // auto-pause retain an accurate age across fleet restarts.
+                            lastActivity,
+                            currentTask,
+                            idle: this.getInstanceIdle(inst.name),
+                            state: this.getInstanceExecutionState(inst.name),
+                        };
+                    });
+                    res.setHeader("Access-Control-Allow-Origin", "*");
+                    res.writeHead(200);
+                    res.end(JSON.stringify({
+                        ...sysInfo,
+                        version: this.currentVersion,
+                        instances: enriched,
+                    }));
+                }
+                catch (err) {
+                    this.logger.error({ err }, "/api/fleet failed");
+                    if (!res.headersSent) {
+                        res.writeHead(500);
+                        res.end("Internal Server Error");
                     }
-                    return {
-                        ...inst,
-                        description: config?.description ?? ("classicName" in inst ? inst.classicName : null),
-                        backend,
-                        tool_set: config?.tool_set ?? "full",
-                        general_topic: config?.general_topic ?? false,
-                        // User activity is persisted by the daemon, so both the board and
-                        // auto-pause retain an accurate age across fleet restarts.
-                        lastActivity,
-                        currentTask,
-                        idle: this.getInstanceIdle(inst.name),
-                        state: this.getInstanceExecutionState(inst.name),
-                    };
-                });
-                res.setHeader("Access-Control-Allow-Origin", "*");
-                res.writeHead(200);
-                res.end(JSON.stringify({
-                    ...sysInfo,
-                    version: this.currentVersion,
-                    instances: enriched,
-                }));
+                }
                 return;
             }
             // Activity API
@@ -7994,7 +10166,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             if (err.code === "EADDRINUSE") {
                 if (this.healthPortRetried) {
                     this.logger.error({ err, port }, "Health port still in use after takeover — dashboard disabled");
-                    this.notifyFleetError(`⚠️ Dashboard unavailable — health port ${port} is already in use. Stop the conflicting process or configure a different health_port.`);
+                    this.notifyFleetError(t("dashboard.port_in_use", port));
                     return;
                 }
                 this.healthPortRetried = true;
@@ -8020,7 +10192,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 return;
             }
             this.logger.error({ err, port }, "Health server error");
-            this.notifyFleetError(`⚠️ Dashboard unavailable — health server failed: ${err.message}`);
+            this.notifyFleetError(t("dashboard.server_failed", err.message));
         });
         this.healthServer.listen(port, "127.0.0.1", () => markListening());
     }