@songsid/agend 2.1.5-beta.2 → 2.1.5-beta.21

package/dist/fleet-manager.js

@@ -1,13 +1,13 @@
 import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { spawnSync } from "node:child_process";
-import { freemem, totalmem } from "node:os";
+import { freemem, totalmem, cpus } from "node:os";
 import { createServer } from "node:http";
 import { join, dirname, basename } from "node:path";
 import { fileURLToPath } from "node:url";
 import { isDeepStrictEqual } from "node:util";
 import { getAgendHome, ensureWorkspaceGit } from "./paths.js";
-import { beginUpdateProgress as persistUpdateProgress, clearUpdateMarker, isUpdateInProgress, readUpdateProgress, setUpdateProgressStage, } from "./update-marker.js";
+import { beginFullRestartProgress as persistFullRestartProgress, beginUpdateProgress as persistUpdateProgress, clearUpdateMarker, isUpdateInProgress, readUpdateProgress, setUpdateProgressStage, updateProgressOperation, } from "./update-marker.js";
 import { formatUpdateProgress } from "./update-progress.js";
 import { sdNotify, sdNotifyBlocking } from "./sd-notify.js";
 import { readFleetMemory } from "./process-memory.js";
@@ -33,7 +33,7 @@ import { processAttachments } from "./channel/attachment-handler.js";
 import { routeToolCall } from "./channel/tool-router.js";
 import { Scheduler } from "./scheduler/index.js";
 import { DEFAULT_SCHEDULER_CONFIG } from "./scheduler/index.js";
-import { TopicCommands, saveCommandForBackend, parseSaveFilename, parsePauseWakeCommand, SAVE_FILENAME_RE, resolveInstanceContext, forgetInstanceContext } from "./topic-commands.js";
+import { TopicCommands, saveCommandForBackend, parseSaveFilename, parsePauseWakeCommand, SAVE_FILENAME_RE, resolveInstanceContext, forgetInstanceContext, readStatuslineModel } from "./topic-commands.js";
 import { DailySummary } from "./daily-summary.js";
 import { WebhookEmitter } from "./webhook-emitter.js";
 import { TmuxControlClient } from "./tmux-control.js";
@@ -48,19 +48,22 @@ import { handleViewRequest, isViewPath } from "./view-api.js";
 import { handleUsageRequest, isUsagePath, usageProviderIdForBackend } from "./usage/usage-api.js";
 import { LOGIN_FLOWS, LOGIN_BACKEND_ALIASES, checkAuthStatus } from "./login-flows.js";
 import { LoginSession } from "./login-manager.js";
-import { LoginController, LOGIN_TOKEN_RESEND_PREFIX } from "./login-controller.js";
+import { LoginController, LOGIN_TOKEN_RESEND_PREFIX, POST_LOGIN_RECOVERY_DEADLINE_MS, announcePostLoginRecovery } from "./login-controller.js";
+import { runBeforeDeadline } from "./deadline.js";
 import { LoginWindowLock } from "./login-window-lock.js";
 import { handleSettingsRequest } from "./settings-api.js";
 import { setLocale, detectLocale, getLocale, t } from "./locale.js";
 import { handleAgentRequest } from "./agent-endpoint.js";
 import { ClassicChannelManager, getClassicBackendChoices, isSelectableClassicBackend, readClassicLastActivityAt } from "./classic-channel-manager.js";
+import { assertExplicitInstanceRemoval } from "./instance-removal.js";
 import { validateFleetConfig } from "./config-validator.js";
 import { readLastInboundAt } from "./daemon.js";
 import { clearPausedMarker } from "./pause-marker.js";
 import { releaseProcessFleetLock } from "./fleet-lock.js";
 import { GENERAL_PAUSE_ERROR, isGeneralInstance } from "./general-instance.js";
 import { loadOrCreateWebToken, WEB_TOKEN_INVALID_MESSAGE } from "./web-auth.js";
-import { RestartProgress } from "./restart-progress.js";
+import { formatRestartProgressCompletion, RESTART_PROGRESS_TERMINAL_TIMEOUT_MS, RestartProgress, } from "./restart-progress.js";
+import { launchFullRestartHelper } from "./full-restart.js";
 import { collectRedundantInstanceDefaultPaths } from "./fleet-yaml-slim.js";
 import { StormWindow } from "./storm-window.js";
 import { SpawnGate } from "./spawn-gate.js";
@@ -218,7 +221,7 @@ const HANG_CALLBACK_PREFIX = "hang:";
 const CLEAR_CONFIRM_CALLBACK_PREFIX = "clear-confirm:";
 const TIP_DISMISS_CALLBACK_PREFIX = "tip-dismiss:";
 const TIP_UNLOCK_CALLBACK_PREFIX = "tip-unlock:";
-const LOGIN_CALLBACK_PREFIX = "login:";
+export const LOGIN_CALLBACK_PREFIX = "login:";
 const INSTALL_CALLBACK_PREFIX = "install-select:";
 const CLASSIC_APPROVE_CALLBACK_PREFIX = "classic-approve:";
 const LOGIN_MENU_CALLBACK_PREFIX = "login-menu:";
@@ -228,7 +231,51 @@ const CLEAR_CONFIRM_TIMEOUT_MS = 15_000;
 /** Default lifetime for long-lived nonce prompts (clear overrides this to 15s). */
 const NONCE_BUTTON_TIMEOUT_MS = 15 * 60_000;
 const TIP_BUTTON_TIMEOUT_MS = 24 * 60 * 60_000;
-const CLI_ENV_TTL_MS = 24 * 60 * 60 * 1000; // /model reads cached CLI env within 24h
+const CLI_ENV_TTL_MS = 24 * 60 * 60 * 1000; // hard validity bound for the cached CLI env
+/**
+ * How old the cached CLI env may be before `/model` re-probes it live.
+ *
+ * The cache is a file under AGEND_HOME, so it outlives the process, and the only
+ * thing that refreshed it was the startup probe. That is why a newly released
+ * model showed up only after `agend stop` + `agend start`: a bare `agend restart`
+ * signals SIGUSR2 and restarts the instances inside the *same* manager process,
+ * so nothing re-probed and `/model` kept serving a list up to 24h old.
+ */
+const CLI_ENV_FRESH_MS = 60 * 60 * 1000;
+/**
+ * Upper bound on a live probe driven by `/model`.
+ *
+ * A probe chains bounded leaves but is not itself bounded: claude-code runs
+ * `--version` (5s) then listModels then listApiModels (an 8s AbortController
+ * against api.anthropic.com), and several backends' probes carry no explicit
+ * timeout at all. Awaiting that inline would make `/model` the next thing to
+ * hang, so it races this deadline and falls back to the cached list.
+ *
+ * Must stay above CLI_PROBE_LONGEST_CHAIN_MS — the probe's bounded steps run
+ * back to back, so clearing only the longest single leaf would be false
+ * confidence: a deadline above 8s but below the 13s chain still truncates a
+ * probe that would have succeeded. Bounding the chain rather than the leaf is
+ * the lesson from the usage hang, and the tests assert against the derived
+ * chain constant so raising either step cannot silently break it.
+ *
+ * The deadline exists to stop a probe hanging forever, not to cut short one that
+ * would have finished: truncating a legitimate probe serves the previous list
+ * and hides exactly the newly released model the user opened `/model` to find.
+ * The wait is announced before it starts, so it reads as progress, not a stall.
+ */
+export const CLI_ENV_PROBE_DEADLINE_MS = 16_000;
+/**
+ * How many CLIs may cold-start at once, from BOTH memory and cores.
+ *
+ * Memory alone said 10 on any host with roughly 3GB free, so a three-core box
+ * started ten CLIs together, saturated the CPU, and healthy starts then missed
+ * their startup budget — which used to cost the user their conversation. Cores
+ * bound how many can actually make progress; memory bounds how many fit.
+ */
+export function deriveSpawnConcurrency(freeMemMB, cores) {
+    const byMemory = Math.floor(freeMemMB / 300);
+    return Math.max(2, Math.min(10, byMemory, Math.max(1, cores)));
+}
 export class FleetManager {
     dataDir;
     static signalTarget = null;
@@ -270,6 +317,10 @@ export class FleetManager {
     reloadPending = false;
     /** A running reconciliation; only one may mutate lifecycle/config state at a time. */
     reconcileInFlight = null;
+    /** Topology checks are serialized separately from config reconciliation. */
+    topicCleanupInFlight = null;
+    topicCleanupGeneration = 0;
+    topicProbeWarnings = new Map();
     logger = createLogger("info");
     topicCommands;
     // sessionName → instanceName mapping for external sessions
@@ -379,6 +430,8 @@ export class FleetManager {
     updateProgressEditRunning = false;
     lastUpdateProgressText = null;
     updateCompletionTipText = null;
+    /** Injectable only to keep the chat→CLI reload hand-off deterministic in tests. */
+    fullRestartLauncher = launchFullRestartHelper;
     eventLogPruneTimer = null;
     logRotateTimer = null;
     /** Days of event/activity history to keep. */
@@ -417,8 +470,7 @@ export class FleetManager {
         const explicit = this.fleetConfig?.defaults?.startup?.concurrency;
         if (explicit != null)
             return Math.max(1, Math.min(20, explicit));
-        const freeMemMB = Math.round(freemem() / (1024 * 1024));
-        return Math.max(2, Math.min(10, Math.floor(freeMemMB / 300)));
+        return deriveSpawnConcurrency(Math.round(freemem() / (1024 * 1024)), cpus().length);
     }
     /** Wire the one fleet-wide storm into notification and recovery surfaces. */
     bindStormWindowEvents() {
@@ -765,6 +817,28 @@ export class FleetManager {
         child.once("error", err => this.failUpdateProgress(err.message));
         child.unref();
     }
+    async handleRestartSlash(data, adapterId) {
+        if (!this.isFleetAdmin(data.userId, adapterId)) {
+            await data.respond(t("not_authorized"));
+            return;
+        }
+        if (data.options?.mode !== "full") {
+            await data.respond(t("restart.graceful"));
+            process.kill(process.pid, "SIGUSR2");
+            return;
+        }
+        // Discord exposes only `full` as a choice. Keep a runtime check anyway: a
+        // briefly stale command schema must never turn an unknown value into SIGUSR1.
+        const messageId = await data.respond(t("restart.full_preparing"));
+        const adapter = this.adapters.get(adapterId) ?? this.adapter;
+        if (!messageId || !adapter) {
+            this.logger.error({ adapterId, hasMessageId: !!messageId }, "Full restart response could not be persisted — reload refused");
+            await data.respond(t("restart.full_launch_failed"));
+            return;
+        }
+        const chatId = String(this.getChannelConfig(adapterId)?.group_id ?? data.channelId);
+        await this.requestFullRestart(adapter, chatId, data.channelId, messageId);
+    }
     async handleTipsSlash(data, adapterId) {
         if (!this.fleetConfig)
             return;
@@ -859,6 +933,45 @@ export class FleetManager {
         }
         return channels[0];
     }
+    /**
+     * The configured world that owns `chatId`, when that is provably NOT the
+     * world `target` lives in. Returns undefined when they agree, when there is
+     * nothing to check, or when no configured channel claims the id.
+     *
+     * Deliberately one-sided: only a POSITIVE match against another channel's
+     * group id counts as foreign. A chat id that matches nothing may still be
+     * legitimate for this world (a classic channel, a DM), and treating
+     * "unrecognised" as "wrong" would stop seeding for cases that work today.
+     *
+     * Read from config rather than the live worlds map on purpose: a channel
+     * whose adapter failed to start still owns its group id, and the coordinates
+     * are just as unusable by the target's adapter either way.
+     *
+     * This is the other half of what scheduleSourceAdapter fixed. That one stops
+     * the trigger NOTICE being sent through the wrong bot; this one stops the
+     * same coordinates being planted as the target instance's reply context,
+     * which is what made its own replies fail until someone spoke to it (#752).
+     */
+    scheduleChatWorldMismatch(target, chatId) {
+        if (!chatId)
+            return undefined;
+        const targetWorld = this.getInstanceAdapterId(target);
+        if (!targetWorld)
+            return undefined;
+        const channels = this.fleetConfig?.channels
+            ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+        // ALL owners, not the first: a persona bot shares the primary's guild
+        // (quickstart writes `group_id: primary.group_id`), so one group id is
+        // legitimately claimed by two channels. Taking the first match called a
+        // persona instance's own guild "another world" and stopped seeding a
+        // context it can address perfectly well.
+        const owners = channels.filter(ch => ch.group_id != null && String(ch.group_id) === String(chatId));
+        if (owners.length === 0)
+            return undefined;
+        if (owners.some(ch => (ch.id ?? ch.type) === targetWorld))
+            return undefined;
+        return owners[0].id ?? owners[0].type;
+    }
     /** Get the group_id for an instance's bound adapter */
     getGroupIdForInstance(name) {
         const adapterId = this.getInstanceAdapterId(name);
@@ -1688,15 +1801,31 @@ export class FleetManager {
     }
     backendNameOf(name) {
         const fleetDefault = this.fleetConfig?.defaults?.backend;
-        const configured = this.fleetConfig?.instances[name]?.backend;
-        if (configured)
-            return configured;
+        const fleetInstance = this.fleetConfig?.instances[name];
+        // A malformed/manual config can give a fleet and Classic entry the same
+        // instance name. Fleet ownership wins, including its inherited default;
+        // otherwise a Classic override could make backend-scoped recovery restart
+        // the shared process under the wrong login result.
+        if (fleetInstance)
+            return fleetInstance.backend ?? fleetDefault ?? "claude-code";
         // ClassicBot channels pick their own backend; the fleet default is only the fallback.
         if (this.classicChannels?.getAll().some(channel => channel.instanceName === name)) {
             return this.classicChannels.getBackendByInstance(name, fleetDefault);
         }
         return fleetDefault ?? "claude-code";
     }
+    /**
+     * Every configured instance whose backend may share credentials. ClassicBot
+     * rows live only in classicBot.yaml, so backend-wide operations must not use
+     * fleetConfig.instances as their roster. Set keeps a malformed name collision
+     * from restarting the same process twice; backendNameOf defines ownership.
+     */
+    configuredBackendInstanceNames() {
+        const names = new Set(Object.keys(this.fleetConfig?.instances ?? {}));
+        for (const channel of this.classicChannels?.getAll() ?? [])
+            names.add(channel.instanceName);
+        return [...names];
+    }
     /**
      * One fleet-level notice per burst, not one per instance: a post-update herd
      * fails many instances within the same second. Two notices per incident at
@@ -1751,16 +1880,60 @@ export class FleetManager {
         if (!generalName)
             return null;
         const adapter = this.getAdapterForInstance(generalName);
+        const adapterId = this.getInstanceAdapterId(generalName);
         const chatId = this.getGroupIdForInstance(generalName);
         if (!adapter || !chatId)
             return null;
         const topicId = this.fleetConfig?.instances[generalName]?.topic_id;
         return {
             adapter,
+            resolveAdapter: adapterId ? () => this.readyProgressAdapter(adapterId) : undefined,
             chatId,
             threadId: topicId != null ? String(topicId) : undefined,
         };
     }
+    /** Resolve only an adapter generation that can accept progress delivery.
+     * Discord exposes direct gateway readiness; adapters without a health
+     * snapshot use the fleet startup/retry state. */
+    readyProgressAdapter(adapterId) {
+        const adapter = this.adapters.get(adapterId);
+        if (!adapter)
+            return undefined;
+        const health = adapter.getHealthSnapshot?.();
+        if (health)
+            return health.isReady ? adapter : undefined;
+        return this.adapterState.get(adapterId)?.status === "connected" ? adapter : undefined;
+    }
+    /** Last-resort completion after RestartProgress could not deliver to its
+     * adopted target. It stays bounded and never wakes a not-ready gateway. */
+    async sendFleetStartCompletionFallback(chatId, text, threadId) {
+        const adapterId = this.getPrimaryAdapterId();
+        const adapter = adapterId ? this.readyProgressAdapter(adapterId) : undefined;
+        if (!adapter) {
+            this.logger.error({ adapterId }, "Fleet start completion fallback skipped because the primary adapter is not ready");
+            return false;
+        }
+        let timer;
+        const timeout = new Promise(resolve => {
+            timer = setTimeout(() => resolve({ status: "timeout" }), RESTART_PROGRESS_TERMINAL_TIMEOUT_MS);
+            timer.unref?.();
+        });
+        const delivery = Promise.resolve()
+            .then(() => adapter.sendText(chatId, text, { threadId }))
+            .then(() => ({ status: "sent" }), err => ({ status: "failed", err }));
+        const result = await Promise.race([delivery, timeout]);
+        if (timer)
+            clearTimeout(timer);
+        if (result.status === "sent")
+            return true;
+        if (result.status === "failed") {
+            this.logger.error({ err: result.err }, "Failed to send fleet start completion fallback");
+        }
+        else {
+            this.logger.error({ timeout_ms: RESTART_PROGRESS_TERMINAL_TIMEOUT_MS }, "Timed out sending fleet start completion fallback");
+        }
+        return false;
+    }
     async stopInstance(name) {
         this.explicitStopGeneration.set(name, (this.explicitStopGeneration.get(name) ?? 0) + 1);
         this.cancelStartupRetry(name);
@@ -1906,6 +2079,130 @@ export class FleetManager {
         this.updateCompletionTipText = null;
         this.startUpdateProgressMonitor(adapter);
     }
+    /** Persist the public response, wait for idle, then start the canonical service restart. */
+    async requestFullRestart(adapter, chatId, threadId, messageId) {
+        const target = {
+            adapterId: adapter.id,
+            chatId,
+            ...(threadId ? { threadId } : {}),
+            messageId,
+        };
+        // This check is synchronous with the marker write below. A second command
+        // cannot slip through between them on Node's event loop and replace the
+        // first command's delivery target or launch a competing restart helper.
+        if (this.shuttingDown || isUpdateInProgress(this.dataDir)) {
+            this.logger.warn({ adapterId: adapter.id }, "Full restart refused because another planned restart is active");
+            await this.reportFullRestartFailure(adapter, chatId, threadId, messageId, t("restart.full_busy"));
+            return false;
+        }
+        if (!persistFullRestartProgress(this.dataDir, target)) {
+            this.logger.error({ adapterId: adapter.id }, "Full restart marker could not be persisted — reload refused");
+            await this.reportFullRestartFailure(adapter, chatId, threadId, messageId, t("restart.full_launch_failed"));
+            return false;
+        }
+        const ownedMarker = readUpdateProgress(this.dataDir);
+        if (!ownedMarker) {
+            this.logger.error({ adapterId: adapter.id }, "Full restart marker disappeared after persistence — reload refused");
+            await this.reportFullRestartFailure(adapter, chatId, threadId, messageId, t("restart.full_launch_failed"));
+            return false;
+        }
+        this.lastUpdateProgressText = null;
+        this.updateCompletionTipText = null;
+        this.startUpdateProgressMonitor(adapter);
+        await this.waitForFullRestartIdleGrace();
+        // An update can begin while the idle wait yields. Never launch a second
+        // process replacement against a marker we no longer own.
+        if (this.shuttingDown || !this.isOwnedFullRestartMarker(ownedMarker.startedAt, target)) {
+            this.logger.warn({ adapterId: adapter.id }, "Full restart superseded during idle wait — reload refused");
+            if (this.isOwnedFullRestartMarker(ownedMarker.startedAt, target))
+                clearUpdateMarker(this.dataDir);
+            await this.reportFullRestartFailure(adapter, chatId, threadId, messageId, t("restart.full_busy"));
+            return false;
+        }
+        let helper;
+        try {
+            helper = await this.fullRestartLauncher();
+        }
+        catch (err) {
+            this.logger.error({ err }, "Full restart helper failed to spawn — reload refused");
+            if (this.isOwnedFullRestartMarker(ownedMarker.startedAt, target))
+                clearUpdateMarker(this.dataDir);
+            await this.reportFullRestartFailure(adapter, chatId, threadId, messageId, t("restart.full_launch_failed"));
+            return false;
+        }
+        void helper.completion.then(result => {
+            // A zero exit means the service manager accepted the restart. launchd
+            // may report that before its SIGTERM reaches us, so only an explicit
+            // helper error/non-zero exit is evidence of failure. A signal is also
+            // ambiguous under systemd because this helper shares the old cgroup.
+            if (this.shuttingDown || !this.isOwnedFullRestartMarker(ownedMarker.startedAt, target))
+                return;
+            if (!result.error && (result.code === 0 || result.code === null))
+                return;
+            const detail = result.error
+                ? "reload helper failed after launch"
+                : `reload helper exited before process hand-off (code ${result.code ?? "null"}, signal ${result.signal ?? "none"})`;
+            this.logger.error({ result }, "Full restart helper exited before the fleet began shutting down");
+            setUpdateProgressStage(this.dataDir, "failed", { error: detail });
+        });
+        return true;
+    }
+    isOwnedFullRestartMarker(startedAt, target) {
+        const marker = readUpdateProgress(this.dataDir);
+        if (!marker || marker.startedAt !== startedAt || marker.pid !== process.pid)
+            return false;
+        if (updateProgressOperation(marker.progress) !== "full-restart")
+            return false;
+        const current = marker.progress.target;
+        return current.adapterId === target.adapterId
+            && current.chatId === target.chatId
+            && current.threadId === target.threadId
+            && current.messageId === target.messageId;
+    }
+    /** Give current work the same bounded idle grace used by graceful reload. */
+    async waitForFullRestartIdleGrace() {
+        const instanceNames = [...this.daemons.keys()];
+        if (instanceNames.length === 0)
+            return;
+        const IDLE_TIMEOUT_MS = 5 * 60_000;
+        let timeoutHandle;
+        const deadline = new Promise((_, reject) => {
+            timeoutHandle = setTimeout(() => reject(new Error("Idle wait timed out after 5 minutes")), IDLE_TIMEOUT_MS);
+        });
+        try {
+            await Promise.race([
+                Promise.all(instanceNames.map(async (name) => {
+                    const daemon = this.daemons.get(name);
+                    if (!daemon)
+                        return;
+                    this.logger.info(`Full restart: waiting for ${name} to idle...`);
+                    await daemon.waitForIdle(10_000);
+                })),
+                deadline,
+            ]);
+        }
+        catch (err) {
+            this.logger.warn({ err }, "Full restart idle wait timed out — continuing with service restart");
+        }
+        finally {
+            clearTimeout(timeoutHandle);
+        }
+    }
+    async reportFullRestartFailure(adapter, chatId, threadId, messageId, text) {
+        try {
+            await adapter.editMessage(chatId, messageId, text, threadId);
+            return;
+        }
+        catch (err) {
+            this.logger.warn({ err, adapterId: adapter.id }, "Failed to edit rejected full-restart request; posting a fresh notice");
+        }
+        try {
+            await adapter.sendText(chatId, text, { threadId });
+        }
+        catch (err) {
+            this.logger.error({ err, adapterId: adapter.id }, "Failed to deliver full-restart rejection");
+        }
+    }
     failUpdateProgress(message) {
         setUpdateProgressStage(this.dataDir, "failed", { error: message });
     }
@@ -1988,6 +2285,9 @@ export class FleetManager {
             && savedUpdateProgress.progress.stage !== "complete"
             ? savedUpdateProgress
             : null;
+        const pendingProgressOperation = pendingUpdateProgress
+            ? updateProgressOperation(pendingUpdateProgress.progress)
+            : null;
         if (pendingUpdateProgress) {
             setUpdateProgressStage(this.dataDir, "starting", { version: pendingUpdateProgress.progress.version });
         }
@@ -2125,10 +2425,7 @@ export class FleetManager {
             ...fleet.defaults.daily_summary,
         };
         this.dailySummary = new DailySummary(summaryConfig, costGuardConfig.timezone, (text) => {
-            if (!this.adapter || !this.fleetConfig?.channel?.group_id)
-                return;
-            this.adapter.sendText(String(this.fleetConfig.channel.group_id), text)
-                .catch(e => this.logger.warn({ err: e }, "Failed to send daily summary"));
+            this.postDailySummary(text);
             // Rotate classic channel chat logs daily
             this.classicChannels?.rotateLogs();
             this.rotateInboxes();
@@ -2268,7 +2565,7 @@ export class FleetManager {
         const allEntries = Object.entries(fleet.instances);
         const generals = allEntries.filter(([_, cfg]) => cfg.general_topic);
         const others = allEntries.filter(([_, cfg]) => !cfg.general_topic);
-        const startupProgress = new RestartProgress(this.runnableStartupCount(fleet, topicMode), pendingUpdateProgress?.startedAt ?? startupStartedAt, this.logger, { mode: pendingUpdateProgress ? "update" : "restart" });
+        const startupProgress = new RestartProgress(this.runnableStartupCount(fleet, topicMode), pendingUpdateProgress?.startedAt ?? startupStartedAt, this.logger, { mode: pendingProgressOperation === "full-restart" ? "reload" : pendingUpdateProgress ? "update" : "restart" });
         if (generals.length > 0) {
             for (const [name, cfg] of generals) {
                 try {
@@ -2317,12 +2614,17 @@ export class FleetManager {
             progressStart = adapterStartup.then(() => {
                 if (pendingUpdateProgress) {
                     const saved = pendingUpdateProgress.progress.target;
-                    const adapter = this.adapters.get(saved.adapterId);
-                    const target = adapter ? {
-                        adapter,
+                    const target = {
+                        adapter: this.adapters.get(saved.adapterId),
+                        // Adapter retries replace the failed object in this map. Resolve at
+                        // every progress delivery so the adopted update message follows the
+                        // live, ready generation instead of remaining pinned to a stopped
+                        // client. This also waits when the first generation failed before
+                        // any adapter object was registered.
+                        resolveAdapter: () => this.readyProgressAdapter(saved.adapterId),
                         chatId: saved.chatId,
                         threadId: saved.threadId,
-                    } : null;
+                    };
                     return startupProgress.resume(target, saved.messageId);
                 }
                 return startupProgress.start(this.restartProgressTarget());
@@ -2432,16 +2734,25 @@ export class FleetManager {
                 version: agendVersion,
                 pausedNames,
                 failedNames,
-                tipText: pendingUpdateProgress && this.tipsEnabled()
+                tipText: pendingProgressOperation === "update" && this.tipsEnabled()
                     ? (() => {
                         const tip = this.pickAvailableTip();
                         return tip ? this.formatTip(tip) : undefined;
                     })()
                     : undefined,
             });
-            if (!progressCompleted && this.adapter && fleet.channel?.group_id) {
+            if (!progressCompleted && fleet.channel?.group_id) {
                 let text;
-                if (failedNames.length === 0 && pausedNames.length === 0) {
+                if (pendingProgressOperation === "full-restart") {
+                    text = formatRestartProgressCompletion("reload", {
+                        running: started,
+                        total,
+                        version: agendVersion,
+                        pausedNames,
+                        failedNames,
+                    }, pendingUpdateProgress.startedAt);
+                }
+                else if (failedNames.length === 0 && pausedNames.length === 0) {
                     text = t("fleet.ready", started, total, agendVersion);
                 }
                 else if (failedNames.length === 0) {
@@ -2451,9 +2762,7 @@ export class FleetManager {
                     text = t("fleet.ready_with_failed", started, total, agendVersion, failedNames.join(", "))
                         + (pausedNames.length > 0 ? `\n⏸ Paused: ${pausedNames.join(", ")}` : "");
                 }
-                this.adapter.sendText(String(fleet.channel.group_id), text, {
-                    threadId: generalThreadId != null ? String(generalThreadId) : undefined,
-                }).catch(e => this.logger.warn({ err: e }, "Failed to send fleet start notification"));
+                await this.sendFleetStartCompletionFallback(String(fleet.channel.group_id), text, generalThreadId != null ? String(generalThreadId) : undefined);
             }
         }
         // Health HTTP endpoint
@@ -2714,10 +3023,11 @@ export class FleetManager {
             accessManager,
             inboxDir,
         });
-        const world = new AdapterWorld(adapterId, this.adapter, accessManager, channelConfig);
+        const adapter = this.adapter;
+        const world = new AdapterWorld(adapterId, adapter, accessManager, channelConfig);
         this.worlds.set(adapterId, world);
-        this.adapters.set(adapterId, this.adapter);
-        this.bindAdapterHealth(this.adapter, adapterId);
+        this.adapters.set(adapterId, adapter);
+        this.bindAdapterHealth(adapter, adapterId);
         this.adapter.on("message", safeHandler(async (msg) => {
             await this.handleInboundMessage(msg);
         }, this.logger, "adapter.message"));
@@ -2762,12 +3072,7 @@ export class FleetManager {
                 return;
             }
         }, this.logger, "adapter.callback_query"));
-        this.adapter.on("topic_closed", safeHandler(async (data) => {
-            // Skip unbind if we archived this topic ourselves
-            if (this.topicArchiver.isArchived(data.threadId))
-                return;
-            await this.topicCommands.handleTopicDeleted(data.threadId);
-        }, this.logger, "adapter.topic_closed"));
+        this.bindTopicClosedHandler(adapter, adapterId, "adapter.topic_closed");
         // Handle classic bot slash commands (/start, /stop, /chat, /compact, /save, /load)
         this.adapter.on("slash_command", safeHandler(async (data) => {
             if (data.command === "start") {
@@ -2989,13 +3294,7 @@ export class FleetManager {
                 await data.respond(this.topicCommands.getDashboardText());
             }
             else if (data.command === "restart") {
-                const allowed = this.fleetConfig?.channel?.access?.allowed_users ?? [];
-                if (allowed.length > 0 && !allowed.some(u => String(u) === String(data.userId))) {
-                    await data.respond(t("not_authorized"));
-                    return;
-                }
-                await data.respond(t("restart.graceful"));
-                process.kill(process.pid, "SIGUSR2");
+                await this.handleRestartSlash(data, adapterId);
             }
             else if (data.command === "compact") {
                 const name = this.resolveSlashTarget(data.channelId, adapterId);
@@ -3164,11 +3463,7 @@ export class FleetManager {
                 return;
             }
         }, this.logger, `adapter[${adapterId}].callback_query`));
-        adapter.on("topic_closed", safeHandler(async (data) => {
-            if (this.topicArchiver.isArchived(data.threadId))
-                return;
-            await this.topicCommands.handleTopicDeleted(data.threadId);
-        }, this.logger, `adapter[${adapterId}].topic_closed`));
+        this.bindTopicClosedHandler(adapter, adapterId, `adapter[${adapterId}].topic_closed`);
         // Slash commands: classic bot + admin commands
         adapter.on("slash_command", safeHandler(async (data) => {
             if (data.command === "start") {
@@ -3338,13 +3633,7 @@ export class FleetManager {
                 await data.respond(this.topicCommands.getDashboardText());
             }
             else if (data.command === "restart") {
-                const allowed = this.fleetConfig?.channel?.access?.allowed_users ?? [];
-                if (allowed.length > 0 && !allowed.some(u => String(u) === String(data.userId))) {
-                    await data.respond(t("not_authorized"));
-                    return;
-                }
-                await data.respond(t("restart.graceful"));
-                process.kill(process.pid, "SIGUSR2");
+                await this.handleRestartSlash(data, adapterId);
             }
             else if (data.command === "compact") {
                 const name = this.resolveSlashTarget(data.channelId, adapterId);
@@ -4533,7 +4822,9 @@ export class FleetManager {
                 // The adapter resolves only after the platform POST returns. Keep
                 // outward-facing logs/cancel state on the same confirmation boundary:
                 // a routed-but-failed reply is not a delivered reply.
-                if (!error && result != null) {
+                // `statusOnly` is daemon-owned envelope metadata, not an MCP argument:
+                // an agent cannot invent it to suppress the normal completion marker.
+                if (!error && result != null && msg.statusOnly !== true) {
                     try {
                         this.afterReplyRouted(instanceName, args, senderSessionName);
                     }
@@ -4639,12 +4930,25 @@ export class FleetManager {
                 // the target instance's configured world so replies use its persona
                 // after a fresh start instead of falling back to channels[0].
                 const adapterId = this.getInstanceAdapterId(target);
+                // ...but the stored reply coordinates belong to the chat the schedule
+                // was CREATED in, which is not always the target's world. Pairing them
+                // with the target's adapter hands one platform's ids to another's API:
+                // a Telegram group + forum topic delivered to a Discord instance made
+                // every reply on that turn fetch `/channels/<telegram topic>` and fail
+                // with Unknown Channel, and because the seeding repeats on each trigger
+                // it stayed broken until a real inbound overwrote the context (#752).
+                const foreignWorld = this.scheduleChatWorldMismatch(target, reply_chat_id);
+                if (foreignWorld) {
+                    this.logger.warn({ scheduleId: id, target, foreignWorld, targetWorld: adapterId, chatId: reply_chat_id }, "Schedule reply target belongs to another channel world — not seeding chat context; the instance keeps its own last known chat");
+                }
                 await this.deliverToInstance(target, {
                     type: "fleet_schedule_trigger",
                     payload: { schedule_id: id, message: `[Scheduled] ${message}`, label },
                     meta: {
-                        chat_id: reply_chat_id,
-                        thread_id: reply_thread_id,
+                        // Omitted on a mismatch: the daemon then keeps its persisted
+                        // last-chat, which is in the right world, instead of being
+                        // overwritten with coordinates the target's adapter cannot address.
+                        ...(foreignWorld ? {} : { chat_id: reply_chat_id, thread_id: reply_thread_id }),
                         user: "scheduler",
                         ...(adapterId ? { adapter_id: adapterId } : {}),
                     },
@@ -4676,19 +4980,69 @@ export class FleetManager {
         this.scheduler.recordRun(id, "instance_offline", `retry ${retryCount}x failed`);
         this.notifyScheduleFailure(schedule);
     }
+    /**
+     * The adapter that can actually post into a chat, found by its group.
+     *
+     * A schedule records where it was created (reply_chat_id) separately from
+     * what it triggers (target). Those need not share a platform: a Telegram
+     * group can schedule a Discord-topic instance. Picking the adapter from the
+     * target then sends a Telegram chat id through the Discord bot, which fails
+     * with Unknown Channel — the source topic never hears that its schedule ran.
+     *
+     * When several bots share one guild, the primary wins: a persona should not
+     * be the voice announcing fleet scheduling.
+     */
+    adapterForChat(chatId) {
+        const id = String(chatId);
+        const matches = [...this.worlds.values()].filter(world => String(world.groupId) === id);
+        if (matches.length === 0)
+            return undefined;
+        const primaryId = this.getPrimaryAdapterId();
+        return (matches.find(world => world.id === primaryId) ?? matches[0]).adapter;
+    }
+    /**
+     * The adapter that can answer a schedule in the chat it was created from.
+     *
+     * A schedule records its creator (source) and its trigger (target) separately,
+     * and they need not share a platform — the live fleet has a Telegram group
+     * scheduling a Discord-topic instance. Routing by target sends a Telegram chat
+     * id through the Discord bot, which is one half of the Unknown Channel errors.
+     *
+     * The creator's own adapter comes first, and only when its world actually owns
+     * that chat. Classic keeps its own identity, so a schedule made from a
+     * persona-bound Classic channel is answered by that persona: the primary bot
+     * may not even have access there, and would be the wrong voice if it did.
+     * Falling back to the target's adapter is deliberately NOT an option — that is
+     * the misroute itself; callers say why they stayed silent instead.
+     */
+    scheduleSourceAdapter(schedule) {
+        const chatId = String(schedule.reply_chat_id);
+        const sourceAdapterId = schedule.source ? this.getInstanceAdapterId(schedule.source) : undefined;
+        const sourceWorld = sourceAdapterId ? this.worlds.get(sourceAdapterId) : undefined;
+        if (sourceWorld && String(sourceWorld.groupId) === chatId)
+            return sourceWorld.adapter;
+        return this.adapterForChat(chatId);
+    }
     notifySourceTopic(schedule) {
-        const adapter = this.getAdapterForInstance(schedule.target) ?? this.adapter;
-        if (!adapter)
+        const adapter = this.scheduleSourceAdapter(schedule);
+        if (!adapter) {
+            this.logger.warn({ scheduleId: schedule.id, chatId: schedule.reply_chat_id, source: schedule.source }, "No adapter can reach the schedule's source chat — trigger notice not sent");
             return;
+        }
         const text = `⏰ Schedule "${schedule.label ?? schedule.id}" triggered, target: ${schedule.target}`;
         adapter.sendText(schedule.reply_chat_id, text, {
             threadId: schedule.reply_thread_id ?? undefined,
         }).catch((err) => this.logger.error({ err }, "Failed to send cross-instance notification"));
     }
     notifyScheduleFailure(schedule) {
-        const adapter = this.getAdapterForInstance(schedule.target) ?? this.adapter;
-        if (!adapter)
+        // Same resolver as the success path: a failure notice was still being sent
+        // through the target's adapter, so a Telegram-created schedule for a
+        // Discord target announced its failure into the wrong platform.
+        const adapter = this.scheduleSourceAdapter(schedule);
+        if (!adapter) {
+            this.logger.warn({ scheduleId: schedule.id, chatId: schedule.reply_chat_id, source: schedule.source }, "No adapter can reach the schedule's source chat — failure notice not sent");
             return;
+        }
         const text = `⏰ Schedule "${schedule.label ?? schedule.id}" trigger failed: instance ${schedule.target} is offline.`;
         adapter.sendText(schedule.reply_chat_id, text, {
             threadId: schedule.reply_thread_id ?? undefined,
@@ -5099,26 +5453,176 @@ export class FleetManager {
     sessionPruneTimer = null;
     classicReloadTimer = null;
     botUserId;
-    /** Periodically check if bound topics still exist */
+    /** Periodically check if bound topics still exist. Never deletes user data. */
     startTopicCleanupPoller() {
-        this.topicCleanupTimer = setInterval(async () => {
-            if (!this.fleetConfig?.channel?.group_id || !this.adapter?.topicExists)
+        if (this.topicCleanupTimer)
+            clearInterval(this.topicCleanupTimer);
+        const generation = ++this.topicCleanupGeneration;
+        this.topicCleanupTimer = setInterval(() => { void this.scheduleTopicCleanup(generation); }, 5 * 60_000);
+    }
+    /** Coalesce timer ticks; an outage must not create overlapping destructive-looking scans. */
+    scheduleTopicCleanup(generation = this.topicCleanupGeneration) {
+        if (this.topicCleanupInFlight)
+            return this.topicCleanupInFlight;
+        const run = this.runTopicCleanup(generation).finally(() => {
+            if (this.topicCleanupInFlight === run)
+                this.topicCleanupInFlight = null;
+        });
+        this.topicCleanupInFlight = run;
+        return run;
+    }
+    confirmedProbeFence(adapterId, adapter) {
+        const health = adapter.getHealthSnapshot?.();
+        if (health) {
+            return health.status === "connected" && health.isReady
+                ? { generation: health.generation }
+                : null;
+        }
+        return this.adapterState.get(adapterId)?.status === "connected" ? {} : null;
+    }
+    sameProbeFence(adapterId, adapter, before, result) {
+        const after = this.confirmedProbeFence(adapterId, adapter);
+        if (!after)
+            return false;
+        if (before.generation !== after.generation)
+            return false;
+        return result?.generation === undefined || result.generation === after.generation;
+    }
+    warnTopicProbeUnknown(instanceName, threadId, adapterId, reason) {
+        const key = `${adapterId ?? "unbound"}:${reason}`;
+        const now = Date.now();
+        const last = this.topicProbeWarnings.get(key) ?? 0;
+        if (now - last < FleetManager.FLEET_ERROR_THROTTLE_MS)
+            return;
+        this.topicProbeWarnings.set(key, now);
+        this.logger.error({ instanceName, threadId, adapterId, reason }, "Topic presence could not be confirmed — retaining instance and all data");
+        this.notifyFleetError(t("fleet.topic_probe_unknown", instanceName, adapterId ?? "unbound"));
+    }
+    /** One fixed-snapshot topology pass. Automatic evidence can only quarantine. */
+    async runTopicCleanup(generation) {
+        if (generation !== this.topicCleanupGeneration || this.shuttingDown)
+            return;
+        const snapshot = [...this.routing.entries()].filter(([, target]) => isProbeableRouteTarget(target));
+        const missing = [];
+        for (const [threadId, target] of snapshot) {
+            if (generation !== this.topicCleanupGeneration || this.shuttingDown)
                 return;
-            for (const [threadId, target] of this.routing.entries()) {
-                try {
-                    if (!isProbeableRouteTarget(target)) {
-                        continue;
-                    }
-                    const exists = await this.adapter.topicExists(threadId);
-                    if (!exists) {
-                        await this.topicCommands.handleTopicDeleted(threadId);
-                    }
-                }
-                catch (err) {
-                    this.logger.debug({ err, threadId }, "Topic existence check failed");
-                }
+            // The route may have been replaced while an earlier probe was in flight.
+            if (this.routing.resolve(threadId) !== target)
+                continue;
+            const adapterId = this.getInstanceAdapterId(target.name);
+            const adapter = adapterId ? this.adapters.get(adapterId) : undefined;
+            if (!adapterId || !adapter?.probeTopicPresence) {
+                this.warnTopicProbeUnknown(target.name, threadId, adapterId, "owner-adapter-unavailable");
+                continue;
             }
-        }, 5 * 60_000);
+            const before = this.confirmedProbeFence(adapterId, adapter);
+            if (!before) {
+                this.warnTopicProbeUnknown(target.name, threadId, adapterId, "owner-adapter-not-ready");
+                continue;
+            }
+            let result;
+            try {
+                result = await adapter.probeTopicPresence(threadId);
+            }
+            catch {
+                result = { status: "unknown", reason: "provider-probe-threw" };
+            }
+            if (generation !== this.topicCleanupGeneration || this.shuttingDown)
+                return;
+            if (!this.sameProbeFence(adapterId, adapter, before, result)) {
+                this.warnTopicProbeUnknown(target.name, threadId, adapterId, "owner-adapter-generation-changed");
+                continue;
+            }
+            if (result.status === "unknown") {
+                this.warnTopicProbeUnknown(target.name, threadId, adapterId, result.reason);
+            }
+            else if (result.status === "missing") {
+                missing.push({ threadId, target, adapterId, adapter, generation: result.generation });
+            }
+        }
+        if (generation !== this.topicCleanupGeneration || this.shuttingDown || missing.length === 0)
+            return;
+        if (missing.length > 1) {
+            this.logger.error({ missing: missing.map(item => ({ instanceName: item.target.name, threadId: item.threadId, adapterId: item.adapterId })) }, "Multiple topics appeared missing in one pass — treating topology evidence as untrusted and retaining all data");
+            this.notifyFleetError(t("fleet.topic_probe_bulk", missing.length));
+            return;
+        }
+        const item = missing[0];
+        if (this.routing.resolve(item.threadId) !== item.target
+            || this.getInstanceAdapterId(item.target.name) !== item.adapterId
+            || this.adapters.get(item.adapterId) !== item.adapter)
+            return;
+        const current = this.confirmedProbeFence(item.adapterId, item.adapter);
+        if (!current || (item.generation !== undefined && current.generation !== item.generation)) {
+            this.warnTopicProbeUnknown(item.target.name, item.threadId, item.adapterId, "owner-adapter-changed-before-action");
+            return;
+        }
+        this.topicCommands.handleTopicDeleted(item.threadId, {
+            source: "provider-probe",
+            adapterId: item.adapterId,
+            generation: item.generation,
+        });
+    }
+    /**
+     * A gateway event is only a hint. Confirm it through the passive REST probe;
+     * reconnecting gateways have emitted false channelDelete events in practice.
+     */
+    async handleProviderTopicClosed(threadId, adapterId, adapter) {
+        const target = this.routing.resolve(threadId);
+        if (!target || !isProbeableRouteTarget(target))
+            return;
+        if (this.getInstanceAdapterId(target.name) !== adapterId)
+            return;
+        if (this.adapters.get(adapterId) !== adapter)
+            return;
+        const before = this.confirmedProbeFence(adapterId, adapter);
+        if (!before || !adapter.probeTopicPresence) {
+            this.warnTopicProbeUnknown(target.name, threadId, adapterId, "topic-close-from-unready-adapter");
+            return;
+        }
+        let result;
+        try {
+            result = await adapter.probeTopicPresence(threadId);
+        }
+        catch {
+            result = { status: "unknown", reason: "provider-probe-threw" };
+        }
+        if (this.routing.resolve(threadId) !== target
+            || this.getInstanceAdapterId(target.name) !== adapterId
+            || this.adapters.get(adapterId) !== adapter
+            || !this.sameProbeFence(adapterId, adapter, before, result)) {
+            this.warnTopicProbeUnknown(target.name, threadId, adapterId, "topic-close-generation-changed");
+            return;
+        }
+        if (result.status !== "missing") {
+            this.warnTopicProbeUnknown(target.name, threadId, adapterId, result.status === "unknown" ? result.reason : "topic-close-not-confirmed-missing");
+            return;
+        }
+        this.topicCommands.handleTopicDeleted(threadId, {
+            source: "provider-event",
+            adapterId,
+            generation: result.generation,
+        });
+    }
+    bindTopicClosedHandler(adapter, adapterId, label) {
+        adapter.on("topic_closed", safeHandler(async (data) => {
+            if (this.topicArchiver.isArchived(data.threadId))
+                return;
+            await this.handleProviderTopicClosed(data.threadId, adapterId, adapter);
+        }, this.logger, label));
+    }
+    /**
+     * Remove only the volatile route. The instance config, daemon, schedules,
+     * teams, metadata directory, and working tree remain untouched until an
+     * authenticated explicit deletion is requested.
+     */
+    quarantineMissingTopic(threadId, target, evidence) {
+        if (!isProbeableRouteTarget(target) || this.routing.resolve(threadId) !== target)
+            return;
+        this.routing.unregister(threadId);
+        this.logger.error({ instanceName: target.name, threadId, ...evidence }, "Topic is confirmed missing — route quarantined; instance configuration and user data were retained");
+        this.notifyFleetError(t("fleet.topic_quarantined", target.name, threadId));
     }
     /**
      * Patch only values changed in the effective config into the original YAML
@@ -5271,7 +5775,8 @@ export class FleetManager {
             }
         }
     }
-    async removeInstance(name) {
+    async removeInstance(name, authorization) {
+        assertExplicitInstanceRemoval(authorization);
         // Drop cached pane context — the map is keyed by instance name and nothing
         // else evicted deleted entries, so it grew for the life of the process.
         forgetInstanceContext(name);
@@ -5297,7 +5802,7 @@ export class FleetManager {
                 }
             }
         }
-        await this.lifecycle.remove(name);
+        await this.lifecycle.remove(name, authorization);
         // Clean up per-instance tracking maps so they don't grow unbounded
         // as instances are created and deleted over the lifetime of the fleet.
         this.lastActivity.delete(name);
@@ -5534,6 +6039,65 @@ export class FleetManager {
         this.logger.error({ ids: bad }, "classicBot.yaml holds ids that can never match");
         this.notifyFleetError(t("classic.unrecoverable_ids", list));
     }
+    /**
+     * Where a fleet-wide notice can actually be posted, or null if nowhere.
+     *
+     * On Telegram a group id is itself a chat, so posting straight to it is
+     * right. On Discord it is a *guild* id, and sending there makes the adapter
+     * fetch a channel that does not exist — DiscordAPIError 10003 Unknown
+     * Channel. That is why the daily summary never arrived on a Discord fleet:
+     * it had been posting to the guild every night and only the catch handler
+     * ever saw it.
+     *
+     * Discord therefore needs a real channel: the General topic (resolved from
+     * config rather than findGeneralInstance, so a fleet-level fault can still be
+     * reported while the General daemon is down), else the adapter's configured
+     * general_channel_id. With neither, there is no safe target and the caller
+     * should say so rather than send into a guaranteed failure.
+     */
+    fleetNoticeTarget(adapterId) {
+        const cfg = this.getChannelConfig(adapterId);
+        const groupId = cfg?.group_id;
+        if (groupId == null)
+            return null;
+        const chatId = String(groupId);
+        // The General must belong to the SAME adapter as the group above. Taking
+        // whichever General comes first in the instance map produced a mixed target
+        // on a dual-platform fleet — a Telegram group id carrying a Discord channel
+        // as its thread — and made the result depend on map insertion order.
+        // Resolved from config, not from a live daemon, so a fleet-level fault is
+        // still reportable while the General itself is down.
+        const ownerId = cfg?.id ?? cfg?.type;
+        const generalTopic = Object.entries(this.fleetConfig?.instances ?? {})
+            .find(([name, instance]) => instance.general_topic === true
+            && this.getInstanceAdapterId(name) === ownerId)?.[1]?.topic_id;
+        if (generalTopic != null)
+            return { chatId, opts: { threadId: String(generalTopic) } };
+        if (cfg?.type === "discord") {
+            const configured = cfg.options?.general_channel_id;
+            if (configured != null && String(configured)) {
+                return { chatId, opts: { threadId: String(configured) } };
+            }
+            return null; // a guild id is not a channel; sending would always fail
+        }
+        return { chatId, opts: {} };
+    }
+    /**
+     * Post the daily summary where fleet-wide notices go.
+     *
+     * A named method rather than an inline closure so a test can drive the real
+     * thing: asserting on fleetNoticeTarget alone leaves the call site free to go
+     * back to posting at the bare group id, which is the defect this replaced.
+     */
+    postDailySummary(text) {
+        const target = this.fleetNoticeTarget();
+        if (!this.adapter || !target) {
+            this.logger.warn("Daily summary has no postable target — set a General topic or channel.options.general_channel_id");
+            return;
+        }
+        this.adapter.sendText(target.chatId, text, target.opts)
+            .catch(e => this.logger.warn({ err: e }, "Failed to send daily summary"));
+    }
     notifyFleetError(text) {
         const now = Date.now();
         const key = text.slice(0, 200);
@@ -5560,10 +6124,12 @@ export class FleetManager {
             dispatched = this.notifyInstanceTopic(general, body);
         }
         else {
-            // No General instance — fall back to the primary channel's group.
-            const groupId = this.getChannelConfig()?.group_id;
-            if (this.adapter && groupId) {
-                this.adapter.sendText(String(groupId), body)
+            // No General instance — fall back to the primary channel's own notice
+            // target. Posting to the bare group id looked right but is a guild id on
+            // Discord, so every such fallback failed inside the catch handler.
+            const target = this.fleetNoticeTarget();
+            if (this.adapter && target) {
+                this.adapter.sendText(target.chatId, body, target.opts)
                     .catch(err => this.logger.warn({ err }, "Failed to send fleet error notification"));
                 dispatched = true;
             }
@@ -5622,13 +6188,16 @@ export class FleetManager {
                 .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send classic notification"));
             return true;
         }
-        // Fallback: send to group without threadId
-        if (groupId) {
-            adapter.sendText(String(groupId), text, extraOpts)
+        // Fallback: the instance has neither a topic nor a classic channel, so post
+        // where fleet-wide notices go. Not the bare group id: on Discord that is a
+        // guild, and the send fails inside the catch handler.
+        const target = this.fleetNoticeTarget(this.getInstanceAdapterId(instanceName));
+        if (target) {
+            adapter.sendText(target.chatId, text, { ...target.opts, ...extraOpts })
                 .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send notification (no topic)"));
             return true;
         }
-        this.logger.warn({ instanceName }, "No group id — instance topic notification not sent");
+        this.logger.warn({ instanceName }, "No postable target — instance topic notification not sent");
         return false;
     }
     // ── Nonce-armed button prompts (hang / assist / exit / clear) ──
@@ -6189,6 +6758,41 @@ export class FleetManager {
             extra: { generalName, promptKind: kind },
         });
     }
+    /**
+     * Offer a one-tap re-login next to an auth alert.
+     *
+     * The alert already names the remedy in words (`/login <backend>`), which
+     * still leaves the user to retype it somewhere. The button routes into the
+     * same chooser `/login` uses, so pressing it starts the flow in place.
+     *
+     * Backends with no remote login flow (opencode logs in from a terminal) get
+     * no button — the alert's own wording already tells them what to run.
+     */
+    async offerBackendLogin(targetInstance, backend) {
+        if (!LOGIN_FLOWS[backend])
+            return;
+        const adapterId = this.getInstanceAdapterId(targetInstance);
+        const adapter = this.getAdapterForInstance(targetInstance);
+        const chatId = this.getGroupIdForInstance(targetInstance);
+        const topicId = this.fleetConfig?.instances[targetInstance]?.topic_id;
+        const threadId = topicId != null ? String(topicId) : undefined;
+        if (!adapter || !adapterId || !chatId) {
+            this.logger.warn({ targetInstance, backend, adapterId, chatId }, "Cannot address the re-login button — the alert text still names the command");
+            return;
+        }
+        await this.postNonceButtonPrompt({
+            prefix: LOGIN_CALLBACK_PREFIX,
+            alertType: "login",
+            instanceName: "login",
+            adapter,
+            adapterId,
+            chatId,
+            threadId,
+            message: t("login.offer", backend),
+            choices: [{ action: backend, label: t("login.offer_action", backend) }],
+            expiredText: t("buttons.stale"),
+        });
+    }
     /** Consume a General assist button exactly once. */
     async handleInteractivePromptAssist(data, callbackAdapterId, receivingAdapter) {
         const claimed = this.consumeNonceCallback(INTERACTIVE_ASSIST_CALLBACK_PREFIX, /^interactive-assist:([0-9a-f]+):(confirm|cancel)$/, data, callbackAdapterId, receivingAdapter);
@@ -6904,8 +7508,8 @@ export class FleetManager {
     /** Post the backend chooser for a bare `/login`. Caller enforces admin. */
     async promptLoginBackends(chat) {
         const configured = new Set();
-        for (const [, config] of Object.entries(this.fleetConfig?.instances ?? {})) {
-            configured.add(config.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code");
+        for (const name of this.configuredBackendInstanceNames()) {
+            configured.add(this.backendNameOf(name));
         }
         const choices = Object.keys(LOGIN_FLOWS)
             .filter(backend => configured.size === 0 || configured.has(backend))
@@ -7177,11 +7781,15 @@ export class FleetManager {
                 if (cleanupFailed) {
                     await chat.adapter.sendText(chat.chatId, t("login.web_cleanup_failed", backend), { threadId: chat.threadId }).catch(() => { });
                 }
+                const send = (text) => chat.adapter.sendText(chat.chatId, text, { threadId: chat.threadId }).catch(() => { });
                 let text;
                 if (ok) {
-                    const { woken, restarted } = await this.recoverBackendInstances(backend);
-                    const none = t("login.none");
-                    text = t("login.success", backend, woken.length ? woken.join(", ") : none, restarted.length ? restarted.join(", ") : none);
+                    // Same order as the web-login path: the login result goes out first,
+                    // then the recovery reports its own outcome. Waiting for recovery to
+                    // build this message is what made a successful login look hung.
+                    await send(t("login.completed", backend));
+                    await announcePostLoginRecovery(backend, () => this.recoverBackendInstances(backend), send);
+                    return;
                 }
                 else if (detail === "cancelled") {
                     // The cancel command's own reply already announced this — a second
@@ -7305,32 +7913,53 @@ export class FleetManager {
      * only re-reads credentials on process start (a paused instance's CLI is
      * already dead, so waking it respawns with the new token for free).
      */
-    async recoverBackendInstances(backend) {
+    /**
+     * Wake/restart every instance of a backend after a successful re-login.
+     *
+     * Bounded by a wall-clock deadline. This used to be an unbounded sequential
+     * loop, and the caller only built its "login completed" message AFTER it
+     * returned — so with several instances (or one slow restart) the user was
+     * told nothing at all for minutes, concluded the login had hung, and
+     * restarted things by hand. Instances that do not finish in time are NOT
+     * cancelled: they are still coming back, and are reported as pending so the
+     * message can say so instead of implying failure.
+     */
+    async recoverBackendInstances(backend, deadlineMs = POST_LOGIN_RECOVERY_DEADLINE_MS) {
         const woken = [];
         const restarted = [];
-        for (const [name, config] of Object.entries(this.fleetConfig?.instances ?? {})) {
-            const effective = config.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code";
-            if (effective !== backend)
+        const pending = [];
+        const deadline = Date.now() + deadlineMs;
+        for (const name of this.configuredBackendInstanceNames()) {
+            if (this.backendNameOf(name) !== backend)
                 continue;
             const status = this.getInstanceStatus(name);
-            try {
+            if (status !== "paused" && status !== "running")
+                continue;
+            const result = await runBeforeDeadline(async () => {
                 if (status === "paused") {
                     if (this.daemons.has(name))
                         await this.lifecycle.wake(name, 30_000);
                     else
                         await this.startPersistedPausedInstance(name);
-                    woken.push(name);
                 }
-                else if (status === "running") {
+                else {
                     await this.restartSingleInstance(name);
-                    restarted.push(name);
                 }
+            }, deadline);
+            if (result.status === "fulfilled") {
+                (status === "paused" ? woken : restarted).push(name);
             }
-            catch (err) {
-                this.logger.warn({ err: err.message, name, status }, "Post-login recovery failed");
+            else if (result.status === "timeout") {
+                // Out of time: record it and stop waiting, but keep walking the list —
+                // the remaining instances are checked against the same deadline and
+                // fall straight through, so the caller still learns about all of them.
+                pending.push(name);
+            }
+            else {
+                this.logger.warn({ err: result.reason?.message, name, status }, "Post-login recovery failed");
             }
         }
-        return { woken, restarted };
+        return { woken, restarted, pending };
     }
     /** Backend chooser button → start that backend's login session. */
     async handleLoginBackendSelect(data, callbackAdapterId, receivingAdapter) {
@@ -7742,7 +8371,7 @@ You CAN write code snippets, explain code, and answer technical questions direct
 - **Delegate to 1 instance**: scoped to one project/repo, needs file access or execution.
 - **Coordinate multiple**: spans repos, outputs feed each other, or parallel helps (max 3 per task).
 
-Instance discovery order: list_teams() → list_instances() → describe_instance() → create_instance() only if nothing fits. Prefer reuse; never duplicate a running instance.
+Instance discovery: start with list_instances(); follow the guidance in its response. Prefer reuse; never duplicate a running instance.
 
 ## Reply Contract
 
@@ -8376,6 +9005,32 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         catch { /* missing / stale / corrupt */ }
         return null;
     }
+    /** True when a cached CLI env is old enough that `/model` should re-probe. */
+    cliEnvNeedsRefresh(env) {
+        return !env || typeof env.probedAt !== "number" || Date.now() - env.probedAt >= CLI_ENV_FRESH_MS;
+    }
+    /**
+     * Run a live probe under a deadline, falling back to whatever the cache holds.
+     * A model list is an aid: a vendor that stops answering must degrade to the
+     * previous list, never stall the command that asked for it.
+     */
+    async probeBackendBounded(backend) {
+        const work = this.probeBackend(backend);
+        work.catch(() => { });
+        let timer;
+        const deadline = new Promise(resolve => {
+            timer = setTimeout(() => {
+                this.logger.warn({ backend, deadlineMs: CLI_ENV_PROBE_DEADLINE_MS }, "CLI env live probe exceeded its deadline — serving the cached model list");
+                resolve(null);
+            }, CLI_ENV_PROBE_DEADLINE_MS);
+        });
+        try {
+            return await Promise.race([work, deadline]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
     /**
      * Resolve the effective model for a fleet or ClassicBot instance, plus where it
      * came from. Single source of truth for `/model` and `/ctx` — precedence:
@@ -8477,16 +9132,23 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             void this.probeBackend(b);
     }
     /** Best-effort model list for `/model`: cached CLI env first, else live probe. Never throws. */
-    async getModelOptions(instanceName, refresh = false) {
+    async getModelOptions(instanceName, refresh = false, onLiveProbe) {
         const backendName = this.backendNameForInstance(instanceName);
-        if (!refresh) {
-            const cached = this.readCliEnv(backendName);
-            if (cached && cached.models.length)
-                return cached.models;
-        }
-        // Cache miss / stale / forced refresh → probe live (also refreshes the cache).
-        const env = await this.probeBackend(backendName);
-        return env?.models ?? [];
+        const cached = this.readCliEnv(backendName);
+        if (!refresh && cached?.models.length && !this.cliEnvNeedsRefresh(cached))
+            return cached.models;
+        // About to go to the vendor: let the caller say so. A silent 1–10s pause on
+        // an interactive command reads as another hang, which is the wrong lesson to
+        // teach a user who has just been bitten by one.
+        onLiveProbe?.();
+        // Stale, missing, or a forced refresh → probe live (also refreshes the cache).
+        // A newly released model is invisible until this runs, which is why staleness
+        // triggers it rather than waiting for the 24h hard expiry or a cold start.
+        const env = await this.probeBackendBounded(backendName);
+        if (env?.models.length)
+            return env.models;
+        // Probe failed or timed out: the previous list is still the best answer.
+        return cached?.models ?? [];
     }
     /**
      * Model catalog behind the `list_models` tool.
@@ -8777,7 +9439,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             await data.respond(t("model.usage"));
             return;
         }
-        const options = await this.getModelOptions(name, isRefresh);
+        const options = await this.getModelOptions(name, isRefresh, () => {
+            void data.respond(t("model.refreshing")).catch(() => { });
+        });
         if (options.length === 0) {
             await data.respond(t("model.list_unavailable", name));
             return;
@@ -9479,6 +10143,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             clearInterval(this.topicCleanupTimer);
             this.topicCleanupTimer = null;
         }
+        this.topicCleanupGeneration++;
         if (this.sessionPruneTimer) {
             clearInterval(this.sessionPruneTimer);
             this.sessionPruneTimer = null;
@@ -9611,10 +10276,27 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             return;
         }
         this.logger.info(`Full restart: waiting for ${instanceNames.length} instances to idle...`);
-        const groupId = this.fleetConfig?.channel?.group_id;
-        if (groupId && this.adapter) {
-            await this.adapter.sendText(String(groupId), t("restart.full_initiated"))
-                .catch(e => this.logger.warn({ err: e }, "Failed to post full restart notification"));
+        const trackedProgress = readUpdateProgress(this.dataDir);
+        const trackedFullRestart = trackedProgress
+            && updateProgressOperation(trackedProgress.progress) === "full-restart"
+            && trackedProgress.progress.stage !== "failed"
+            && trackedProgress.progress.stage !== "complete";
+        if (trackedFullRestart) {
+            // `/restart full` already posted and persisted one public progress message.
+            // Keep that single message; the new process will adopt and finish it.
+            setUpdateProgressStage(this.dataDir, "stopping");
+        }
+        const restartTarget = this.fleetNoticeTarget();
+        if (!trackedFullRestart && this.adapter) {
+            if (restartTarget) {
+                await this.adapter.sendText(restartTarget.chatId, t("restart.full_initiated"), restartTarget.opts)
+                    .catch(e => this.logger.warn({ err: e }, "Failed to post full restart notification"));
+            }
+            else {
+                // Say why nothing was posted. A restart that announces itself nowhere,
+                // for a reason nobody logged, is the harder version of this bug.
+                this.logger.warn("Full restart notice has no postable target — set a General topic or channel.options.general_channel_id");
+            }
         }
         // Wait for idle with 5-minute timeout
         const IDLE_TIMEOUT_MS = 5 * 60 * 1000;
@@ -9788,6 +10470,13 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.logger.error("Cannot restart: no config path (was startAll called?)");
             return;
         }
+        // A graceful restart keeps this manager process, so the startup probe does
+        // not run again. Without this, `agend restart` left the cached CLI env
+        // untouched and `/model` kept serving an old list until a cold start —
+        // exactly the "only stop+start works" report. Background, never blocking:
+        // /model re-probes on staleness anyway, this just makes a restart do the
+        // refreshing a user expects of it.
+        this.probeCliEnvs();
         const instanceNames = [...this.daemons.keys()];
         if (instanceNames.length === 0) {
             this.logger.info("No instances to restart");
@@ -10388,11 +11077,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const instances = names.map(name => {
             const statusFile = join(this.getInstanceDir(name), "statusline.json");
             let cost = 0;
-            let model = "";
             try {
                 const data = JSON.parse(readFileSync(statusFile, "utf-8"));
                 cost = data.cost?.total_cost_usd ?? 0;
-                model = data.model?.display_name ?? "";
             }
             catch (err) {
                 this.logger.debug({ err, name }, "statusline.json read failed (getUiStatus)");
@@ -10405,8 +11092,40 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                     ?? this.fleetConfig?.defaults?.backend
                     ?? "claude-code");
             const { context } = resolveInstanceContext(this.dataDir, name, backend);
-            const context_pct = context ?? 0;
-            return { name, status: this.getInstanceStatus(name), context_pct, cost, model };
+            // context_pct: null when unavailable, not 0
+            const context_pct = context ?? null;
+            // Model: Only Claude Code has live statusline; others use the effective resolver.
+            // readStatuslineModel provides the /ctx-aligned display_name+id combo for Claude.
+            // Non-Claude backends must NOT read statusline.json model (may be stale from previous Claude run).
+            const resolved = this.resolveInstanceModel(name);
+            const liveModel = backend === "claude-code" ? readStatuslineModel(this.dataDir, name) : null;
+            // Display value: live model for Claude, resolved.display for others (includes "auto (default)" for Kiro)
+            const model = liveModel ?? resolved.display;
+            // model_source: "live" when Claude statusline succeeded, else the resolver's source
+            const model_source = liveModel ? "live" : resolved.source;
+            // Effort: aligned with /ctx's effortLineFor — unsupported and antigravity don't show effort.
+            const effortStrategy = this.effortStrategyFor(name);
+            const isAgy = backend === "antigravity" || backend === "agy";
+            const effortResolved = this.resolveInstanceEffort(name);
+            // Only show effort if backend supports it and it's not antigravity
+            const effort = (effortStrategy === "unsupported" || isAgy) ? null : effortResolved.effort;
+            const effort_source = (effortStrategy === "unsupported" || isAgy) ? null : effortResolved.source;
+            // Display name: fleet config → classic channel → undefined
+            const display_name = classic
+                ? this.classicChannels?.getAll().find(ch => ch.instanceName === name)?.displayName
+                : this.fleetConfig?.instances[name]?.display_name;
+            return {
+                name,
+                display_name: display_name || undefined,
+                status: this.getInstanceStatus(name),
+                context_pct,
+                cost,
+                model,
+                model_source,
+                backend,
+                effort,
+                effort_source,
+            };
         });
         return {
             instances,