@songsid/agend 2.1.5-beta.9 → 2.1.6-beta.1

package/dist/fleet-manager.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { spawnSync } from "node:child_process";
-import { freemem, totalmem } from "node:os";
+import { freemem, totalmem, cpus } from "node:os";
 import { createServer } from "node:http";
 import { join, dirname, basename } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -33,7 +33,7 @@ import { processAttachments } from "./channel/attachment-handler.js";
 import { routeToolCall } from "./channel/tool-router.js";
 import { Scheduler } from "./scheduler/index.js";
 import { DEFAULT_SCHEDULER_CONFIG } from "./scheduler/index.js";
-import { TopicCommands, saveCommandForBackend, parseSaveFilename, parsePauseWakeCommand, SAVE_FILENAME_RE, resolveInstanceContext, forgetInstanceContext } from "./topic-commands.js";
+import { TopicCommands, saveCommandForBackend, parseSaveFilename, parsePauseWakeCommand, SAVE_FILENAME_RE, resolveInstanceContext, forgetInstanceContext, readStatuslineModel } from "./topic-commands.js";
 import { DailySummary } from "./daily-summary.js";
 import { WebhookEmitter } from "./webhook-emitter.js";
 import { TmuxControlClient } from "./tmux-control.js";
@@ -48,12 +48,14 @@ import { handleViewRequest, isViewPath } from "./view-api.js";
 import { handleUsageRequest, isUsagePath, usageProviderIdForBackend } from "./usage/usage-api.js";
 import { LOGIN_FLOWS, LOGIN_BACKEND_ALIASES, checkAuthStatus } from "./login-flows.js";
 import { LoginSession } from "./login-manager.js";
-import { LoginController, LOGIN_TOKEN_RESEND_PREFIX } from "./login-controller.js";
+import { LoginController, LOGIN_TOKEN_RESEND_PREFIX, POST_LOGIN_RECOVERY_DEADLINE_MS, announcePostLoginRecovery } from "./login-controller.js";
+import { runBeforeDeadline } from "./deadline.js";
 import { LoginWindowLock } from "./login-window-lock.js";
 import { handleSettingsRequest } from "./settings-api.js";
 import { setLocale, detectLocale, getLocale, t } from "./locale.js";
 import { handleAgentRequest } from "./agent-endpoint.js";
 import { ClassicChannelManager, getClassicBackendChoices, isSelectableClassicBackend, readClassicLastActivityAt } from "./classic-channel-manager.js";
+import { assertExplicitInstanceRemoval } from "./instance-removal.js";
 import { validateFleetConfig } from "./config-validator.js";
 import { readLastInboundAt } from "./daemon.js";
 import { clearPausedMarker } from "./pause-marker.js";
@@ -179,6 +181,7 @@ const DELIVERY_STATUS_EMOJIS = new Set(["👀", "⏳", "✅", "❌"]);
 const IGNORED_REACTION_EMOJIS = new Set(["📷"]);
 const HOT_INSTANCE_CONFIG_KEYS = new Set([
     "tool_progress",
+    "reply_completion_guard",
     "mcp_proxy_reply",
     "auto_pause_after",
     "warm_cap",
@@ -219,7 +222,7 @@ const HANG_CALLBACK_PREFIX = "hang:";
 const CLEAR_CONFIRM_CALLBACK_PREFIX = "clear-confirm:";
 const TIP_DISMISS_CALLBACK_PREFIX = "tip-dismiss:";
 const TIP_UNLOCK_CALLBACK_PREFIX = "tip-unlock:";
-const LOGIN_CALLBACK_PREFIX = "login:";
+export const LOGIN_CALLBACK_PREFIX = "login:";
 const INSTALL_CALLBACK_PREFIX = "install-select:";
 const CLASSIC_APPROVE_CALLBACK_PREFIX = "classic-approve:";
 const LOGIN_MENU_CALLBACK_PREFIX = "login-menu:";
@@ -262,6 +265,18 @@ const CLI_ENV_FRESH_MS = 60 * 60 * 1000;
  * The wait is announced before it starts, so it reads as progress, not a stall.
  */
 export const CLI_ENV_PROBE_DEADLINE_MS = 16_000;
+/**
+ * How many CLIs may cold-start at once, from BOTH memory and cores.
+ *
+ * Memory alone said 10 on any host with roughly 3GB free, so a three-core box
+ * started ten CLIs together, saturated the CPU, and healthy starts then missed
+ * their startup budget — which used to cost the user their conversation. Cores
+ * bound how many can actually make progress; memory bounds how many fit.
+ */
+export function deriveSpawnConcurrency(freeMemMB, cores) {
+    const byMemory = Math.floor(freeMemMB / 300);
+    return Math.max(2, Math.min(10, byMemory, Math.max(1, cores)));
+}
 export class FleetManager {
     dataDir;
     static signalTarget = null;
@@ -303,6 +318,33 @@ export class FleetManager {
     reloadPending = false;
     /** A running reconciliation; only one may mutate lifecycle/config state at a time. */
     reconcileInFlight = null;
+    /** Topology checks are serialized separately from config reconciliation. */
+    topicCleanupInFlight = null;
+    topicCleanupGeneration = 0;
+    topicProbeWarnings = new Map();
+    /**
+     * Consecutive unknown probe results per route (or per adapter for outage
+     * class reasons). A single transient never reaches the operator; only a
+     * streak of TOPIC_PROBE_UNKNOWN_ESCALATION does.
+     */
+    topicProbeUnknownStreak = new Map();
+    /** Unknown results in a row before the operator is told. 3 × 5 min poller = 15 min. */
+    static TOPIC_PROBE_UNKNOWN_ESCALATION = 3;
+    /** Reasons that describe the adapter, not one topic — counted once per adapter. */
+    static TOPIC_PROBE_ADAPTER_SCOPED_REASONS = new Set([
+        "owner-adapter-unavailable",
+        "owner-adapter-not-ready",
+        "owner-adapter-generation-changed",
+        "owner-adapter-changed-before-action",
+        "adapter-not-ready",
+        "adapter-not-initialized",
+        "adapter-generation-changed",
+        "topic-close-from-unready-adapter",
+        "topic-close-generation-changed",
+        // Telegram probe: the transport or Telegram itself is down, not one topic.
+        "transport-failed",
+        "provider-unavailable",
+    ]);
     logger = createLogger("info");
     topicCommands;
     // sessionName → instanceName mapping for external sessions
@@ -341,6 +383,10 @@ export class FleetManager {
     // reply, on cancel, or when a newer button supersedes it for the same
     // instance. Per-button tracking means a failed delete never strands a button.
     cancelButtons = new Map();
+    /** Latest publication generation per instance. Late results from older
+     * generations are retired without touching the current button. */
+    cancelButtonPublications = new Map();
+    nextCancelButtonPublicationGeneration = 0;
     /** Pending idle-edge retirement, one timer per instance. */
     cancelButtonIdleRetireTimers = new Map();
     /** Duplicate-reply suppression across both the MCP and HTTP reply paths. */
@@ -452,8 +498,7 @@ export class FleetManager {
         const explicit = this.fleetConfig?.defaults?.startup?.concurrency;
         if (explicit != null)
             return Math.max(1, Math.min(20, explicit));
-        const freeMemMB = Math.round(freemem() / (1024 * 1024));
-        return Math.max(2, Math.min(10, Math.floor(freeMemMB / 300)));
+        return deriveSpawnConcurrency(Math.round(freemem() / (1024 * 1024)), cpus().length);
     }
     /** Wire the one fleet-wide storm into notification and recovery surfaces. */
     bindStormWindowEvents() {
@@ -916,6 +961,45 @@ export class FleetManager {
         }
         return channels[0];
     }
+    /**
+     * The configured world that owns `chatId`, when that is provably NOT the
+     * world `target` lives in. Returns undefined when they agree, when there is
+     * nothing to check, or when no configured channel claims the id.
+     *
+     * Deliberately one-sided: only a POSITIVE match against another channel's
+     * group id counts as foreign. A chat id that matches nothing may still be
+     * legitimate for this world (a classic channel, a DM), and treating
+     * "unrecognised" as "wrong" would stop seeding for cases that work today.
+     *
+     * Read from config rather than the live worlds map on purpose: a channel
+     * whose adapter failed to start still owns its group id, and the coordinates
+     * are just as unusable by the target's adapter either way.
+     *
+     * This is the other half of what scheduleSourceAdapter fixed. That one stops
+     * the trigger NOTICE being sent through the wrong bot; this one stops the
+     * same coordinates being planted as the target instance's reply context,
+     * which is what made its own replies fail until someone spoke to it (#752).
+     */
+    scheduleChatWorldMismatch(target, chatId) {
+        if (!chatId)
+            return undefined;
+        const targetWorld = this.getInstanceAdapterId(target);
+        if (!targetWorld)
+            return undefined;
+        const channels = this.fleetConfig?.channels
+            ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+        // ALL owners, not the first: a persona bot shares the primary's guild
+        // (quickstart writes `group_id: primary.group_id`), so one group id is
+        // legitimately claimed by two channels. Taking the first match called a
+        // persona instance's own guild "another world" and stopped seeding a
+        // context it can address perfectly well.
+        const owners = channels.filter(ch => ch.group_id != null && String(ch.group_id) === String(chatId));
+        if (owners.length === 0)
+            return undefined;
+        if (owners.some(ch => (ch.id ?? ch.type) === targetWorld))
+            return undefined;
+        return owners[0].id ?? owners[0].type;
+    }
     /** Get the group_id for an instance's bound adapter */
     getGroupIdForInstance(name) {
         const adapterId = this.getInstanceAdapterId(name);
@@ -1101,12 +1185,17 @@ export class FleetManager {
     }
     scheduleIdleButtonRetirement(name) {
         this.cancelIdleButtonRetirement(name);
+        // Bind this edge to the publication that was current when idle was
+        // observed. A later inbound may start a new generation before this timer
+        // fires; the old edge must not mark that newer button for retirement.
+        const publication = this.cancelButtonPublications.get(name);
         const timer = setTimeout(() => {
             // Ignore a superseded timer even if it was already queued to run.
             if (this.cancelButtonIdleRetireTimers.get(name) !== timer)
                 return;
             this.cancelButtonIdleRetireTimers.delete(name);
             if (this.getInstanceExecutionState(name) === "idle") {
+                this.markCancelButtonPublicationForRetirement(name, publication);
                 this.retireInstanceButtons(name);
             }
         }, CANCEL_BTN_IDLE_RETIRE_GRACE_MS);
@@ -1426,8 +1515,27 @@ export class FleetManager {
         await this.lifecycle.pause(name);
         return this.lifecycle.isPaused(name) ? "paused" : "not_idle";
     }
+    /** Deliver an already-resolved hot snapshot without depending on IPC timing. */
+    applyHotConfigUpdate(instanceName, update) {
+        const daemon = this.daemons.get(instanceName);
+        if (!daemon)
+            return false;
+        const ipc = this.instanceIpcClients.get(instanceName);
+        const sent = ipc?.connected === true && ipc.send({ type: "config_update", config: update });
+        if (!sent) {
+            daemon.applyConfigUpdate(update);
+            this.logger.warn({ name: instanceName }, "Config-update IPC unavailable — applied hot config in-process");
+        }
+        return true;
+    }
+    classicBehaviorUpdate(instanceName) {
+        return {
+            tool_progress: this.classicChannels?.getToolProgressByInstance(instanceName, this.fleetConfig?.defaults?.tool_progress) ?? "off",
+            reply_completion_guard: this.classicChannels?.getReplyCompletionGuardByInstance(instanceName, this.fleetConfig?.defaults?.reply_completion_guard) ?? true,
+        };
+    }
     /** Apply a Settings edit to a ClassicBot channel without waiting for the poller. */
-    async restartClassicInstanceFromSettings(instanceName) {
+    async restartClassicInstanceFromSettings(instanceName, changedFields = []) {
         if (!this.classicChannels)
             throw new Error("Classic channel manager not initialized");
         const wasRunning = this.daemons.has(instanceName);
@@ -1439,10 +1547,77 @@ export class FleetManager {
             throw new Error("Classic channel not found after reload");
         if (!wasRunning)
             return;
+        const hotOnly = changedFields.length > 0
+            && changedFields.every(field => field === "tool_progress" || field === "reply_completion_guard");
+        if (hotOnly) {
+            this.applyHotConfigUpdate(instanceName, this.classicBehaviorUpdate(instanceName));
+            this.logger.info({ instanceName, fields: changedFields }, "Classic instance hot config reloaded");
+            return;
+        }
         await this.stopInstance(instanceName);
         await new Promise(resolve => setTimeout(resolve, 250));
         await this.startClassicInstance(instanceName, this.classicChannels.getBackendByInstance(instanceName, this.fleetConfig?.defaults?.backend), this.classicChannels.getPreTaskCommand(channel.channelId, channel.adapterId), this.classicChannels.getModel(channel.channelId, channel.adapterId, this.fleetConfig?.defaults?.model), this.classicChannels.getAutoPauseAfter(channel.channelId, channel.adapterId, this.fleetConfig?.defaults?.auto_pause_after));
     }
+    /** Reload classicBot.yaml once. Kept callable so the periodic production
+     * path is covered without relying on fake timers around startAll(). */
+    async reloadClassicConfigFromDisk() {
+        try {
+            if (!this.classicChannels)
+                return;
+            const fleetBackend = this.fleetConfig?.defaults?.backend;
+            const fleetModel = this.fleetConfig?.defaults?.model;
+            const oldBackends = new Map();
+            const oldModels = new Map();
+            const oldAutoPause = new Map();
+            const oldToolProgress = new Map();
+            const oldReplyGuard = new Map();
+            for (const ch of this.classicChannels.getAll()) {
+                oldBackends.set(ch.instanceName, this.classicChannels.getBackendByInstance(ch.instanceName, fleetBackend));
+                oldModels.set(ch.instanceName, this.classicChannels.getModel(ch.channelId, ch.adapterId, fleetModel));
+                oldAutoPause.set(ch.instanceName, this.classicChannels.getAutoPauseAfter(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.auto_pause_after));
+                oldToolProgress.set(ch.instanceName, this.classicChannels.getToolProgress(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.tool_progress));
+                oldReplyGuard.set(ch.instanceName, this.classicChannels.getReplyCompletionGuard(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.reply_completion_guard));
+            }
+            if (!this.classicChannels.checkReload())
+                return;
+            // A reload can introduce a bad id (hand edit) or clear one; the
+            // throttle keeps a repeated report from flooding the topic.
+            this.reportClassicUnrecoverableIds();
+            this.reregisterClassicChannels();
+            for (const ch of this.classicChannels.getAll()) {
+                const newBackend = this.classicChannels.getBackendByInstance(ch.instanceName, fleetBackend);
+                const newModel = this.classicChannels.getModel(ch.channelId, ch.adapterId, fleetModel);
+                const newAutoPause = this.classicChannels.getAutoPauseAfter(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.auto_pause_after);
+                const newToolProgress = this.classicChannels.getToolProgress(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.tool_progress);
+                const newReplyGuard = this.classicChannels.getReplyCompletionGuard(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.reply_completion_guard);
+                const backendChanged = oldBackends.get(ch.instanceName) !== newBackend;
+                const modelChanged = oldModels.get(ch.instanceName) !== newModel;
+                const autoPauseChanged = oldAutoPause.get(ch.instanceName) !== newAutoPause;
+                if (this.daemons.has(ch.instanceName) && (backendChanged || modelChanged || autoPauseChanged)) {
+                    this.logger.info({ instanceName: ch.instanceName, backendFrom: oldBackends.get(ch.instanceName), backendTo: newBackend, modelFrom: oldModels.get(ch.instanceName), modelTo: newModel }, "Backend/model changed — restarting");
+                    await this.stopInstance(ch.instanceName).catch(() => { });
+                    // Small delay to let tmux window clean up
+                    await new Promise(r => setTimeout(r, 2000));
+                    // The manager already holds the new backend/model/auto-pause; the
+                    // unattended helper reads them from it and schedules the delayed
+                    // retry on failure like every other unattended start.
+                    await this.startClassicInstanceUnattended(ch, "classic instance after backend/model change");
+                }
+                else if (this.daemons.has(ch.instanceName)
+                    && (oldToolProgress.get(ch.instanceName) !== newToolProgress
+                        || oldReplyGuard.get(ch.instanceName) !== newReplyGuard)) {
+                    this.applyHotConfigUpdate(ch.instanceName, {
+                        tool_progress: newToolProgress,
+                        reply_completion_guard: newReplyGuard,
+                    });
+                    this.logger.info({ instanceName: ch.instanceName }, "Classic instance hot config reloaded");
+                }
+            }
+        }
+        catch (err) {
+            this.logger.warn({ err }, "classicBot.yaml reload error");
+        }
+    }
     async startInstance(name, config, topicMode, kind = "fleet-topic", 
     /**
      * Explicit starts (CLI/API) may resume a paused or failed daemon.  Startup
@@ -2300,48 +2475,8 @@ export class FleetManager {
                 this.instanceWorldBinding.set(ch.instanceName, ch.adapterId);
         }
         // Poll classicBot.yaml for external changes every 30s
-        this.classicReloadTimer = setInterval(async () => {
-            try {
-                if (!this.classicChannels)
-                    return;
-                const fleetBackend = this.fleetConfig?.defaults?.backend;
-                const fleetModel = this.fleetConfig?.defaults?.model;
-                const oldBackends = new Map();
-                const oldModels = new Map();
-                const oldAutoPause = new Map();
-                for (const ch of this.classicChannels.getAll()) {
-                    oldBackends.set(ch.instanceName, this.classicChannels.getBackendByInstance(ch.instanceName, fleetBackend));
-                    oldModels.set(ch.instanceName, this.classicChannels.getModel(ch.channelId, ch.adapterId, fleetModel));
-                    oldAutoPause.set(ch.instanceName, this.classicChannels.getAutoPauseAfter(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.auto_pause_after));
-                }
-                if (!this.classicChannels.checkReload())
-                    return;
-                // A reload can introduce a bad id (hand edit) or clear one; the
-                // throttle keeps a repeated report from flooding the topic.
-                this.reportClassicUnrecoverableIds();
-                this.reregisterClassicChannels();
-                for (const ch of this.classicChannels.getAll()) {
-                    const newBackend = this.classicChannels.getBackendByInstance(ch.instanceName, fleetBackend);
-                    const newModel = this.classicChannels.getModel(ch.channelId, ch.adapterId, fleetModel);
-                    const newAutoPause = this.classicChannels.getAutoPauseAfter(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.auto_pause_after);
-                    const backendChanged = oldBackends.get(ch.instanceName) !== newBackend;
-                    const modelChanged = oldModels.get(ch.instanceName) !== newModel;
-                    const autoPauseChanged = oldAutoPause.get(ch.instanceName) !== newAutoPause;
-                    if (this.daemons.has(ch.instanceName) && (backendChanged || modelChanged || autoPauseChanged)) {
-                        this.logger.info({ instanceName: ch.instanceName, backendFrom: oldBackends.get(ch.instanceName), backendTo: newBackend, modelFrom: oldModels.get(ch.instanceName), modelTo: newModel }, "Backend/model changed — restarting");
-                        await this.stopInstance(ch.instanceName).catch(() => { });
-                        // Small delay to let tmux window clean up
-                        await new Promise(r => setTimeout(r, 2000));
-                        // The manager already holds the new backend/model/auto-pause; the
-                        // unattended helper reads them from it and schedules the delayed
-                        // retry on failure like every other unattended start.
-                        await this.startClassicInstanceUnattended(ch, "classic instance after backend/model change");
-                    }
-                }
-            }
-            catch (err) {
-                this.logger.warn({ err }, "classicBot.yaml reload error");
-            }
+        this.classicReloadTimer = setInterval(() => {
+            void this.reloadClassicConfigFromDisk();
         }, 30_000);
         const costGuardConfig = {
             ...DEFAULT_COST_GUARD,
@@ -2369,10 +2504,7 @@ export class FleetManager {
             ...fleet.defaults.daily_summary,
         };
         this.dailySummary = new DailySummary(summaryConfig, costGuardConfig.timezone, (text) => {
-            if (!this.adapter || !this.fleetConfig?.channel?.group_id)
-                return;
-            this.adapter.sendText(String(this.fleetConfig.channel.group_id), text)
-                .catch(e => this.logger.warn({ err: e }, "Failed to send daily summary"));
+            this.postDailySummary(text);
             // Rotate classic channel chat logs daily
             this.classicChannels?.rotateLogs();
             this.rotateInboxes();
@@ -2970,10 +3102,11 @@ export class FleetManager {
             accessManager,
             inboxDir,
         });
-        const world = new AdapterWorld(adapterId, this.adapter, accessManager, channelConfig);
+        const adapter = this.adapter;
+        const world = new AdapterWorld(adapterId, adapter, accessManager, channelConfig);
         this.worlds.set(adapterId, world);
-        this.adapters.set(adapterId, this.adapter);
-        this.bindAdapterHealth(this.adapter, adapterId);
+        this.adapters.set(adapterId, adapter);
+        this.bindAdapterHealth(adapter, adapterId);
         this.adapter.on("message", safeHandler(async (msg) => {
             await this.handleInboundMessage(msg);
         }, this.logger, "adapter.message"));
@@ -3018,12 +3151,7 @@ export class FleetManager {
                 return;
             }
         }, this.logger, "adapter.callback_query"));
-        this.adapter.on("topic_closed", safeHandler(async (data) => {
-            // Skip unbind if we archived this topic ourselves
-            if (this.topicArchiver.isArchived(data.threadId))
-                return;
-            await this.topicCommands.handleTopicDeleted(data.threadId);
-        }, this.logger, "adapter.topic_closed"));
+        this.bindTopicClosedHandler(adapter, adapterId, "adapter.topic_closed");
         // Handle classic bot slash commands (/start, /stop, /chat, /compact, /save, /load)
         this.adapter.on("slash_command", safeHandler(async (data) => {
             if (data.command === "start") {
@@ -3414,11 +3542,7 @@ export class FleetManager {
                 return;
             }
         }, this.logger, `adapter[${adapterId}].callback_query`));
-        adapter.on("topic_closed", safeHandler(async (data) => {
-            if (this.topicArchiver.isArchived(data.threadId))
-                return;
-            await this.topicCommands.handleTopicDeleted(data.threadId);
-        }, this.logger, `adapter[${adapterId}].topic_closed`));
+        this.bindTopicClosedHandler(adapter, adapterId, `adapter[${adapterId}].topic_closed`);
         // Slash commands: classic bot + admin commands
         adapter.on("slash_command", safeHandler(async (data) => {
             if (data.command === "start") {
@@ -4777,7 +4901,9 @@ export class FleetManager {
                 // The adapter resolves only after the platform POST returns. Keep
                 // outward-facing logs/cancel state on the same confirmation boundary:
                 // a routed-but-failed reply is not a delivered reply.
-                if (!error && result != null) {
+                // `statusOnly` is daemon-owned envelope metadata, not an MCP argument:
+                // an agent cannot invent it to suppress the normal completion marker.
+                if (!error && result != null && msg.statusOnly !== true) {
                     try {
                         this.afterReplyRouted(instanceName, args, senderSessionName);
                     }
@@ -4883,12 +5009,25 @@ export class FleetManager {
                 // the target instance's configured world so replies use its persona
                 // after a fresh start instead of falling back to channels[0].
                 const adapterId = this.getInstanceAdapterId(target);
+                // ...but the stored reply coordinates belong to the chat the schedule
+                // was CREATED in, which is not always the target's world. Pairing them
+                // with the target's adapter hands one platform's ids to another's API:
+                // a Telegram group + forum topic delivered to a Discord instance made
+                // every reply on that turn fetch `/channels/<telegram topic>` and fail
+                // with Unknown Channel, and because the seeding repeats on each trigger
+                // it stayed broken until a real inbound overwrote the context (#752).
+                const foreignWorld = this.scheduleChatWorldMismatch(target, reply_chat_id);
+                if (foreignWorld) {
+                    this.logger.warn({ scheduleId: id, target, foreignWorld, targetWorld: adapterId, chatId: reply_chat_id }, "Schedule reply target belongs to another channel world — not seeding chat context; the instance keeps its own last known chat");
+                }
                 await this.deliverToInstance(target, {
                     type: "fleet_schedule_trigger",
                     payload: { schedule_id: id, message: `[Scheduled] ${message}`, label },
                     meta: {
-                        chat_id: reply_chat_id,
-                        thread_id: reply_thread_id,
+                        // Omitted on a mismatch: the daemon then keeps its persisted
+                        // last-chat, which is in the right world, instead of being
+                        // overwritten with coordinates the target's adapter cannot address.
+                        ...(foreignWorld ? {} : { chat_id: reply_chat_id, thread_id: reply_thread_id }),
                         user: "scheduler",
                         ...(adapterId ? { adapter_id: adapterId } : {}),
                     },
@@ -4920,19 +5059,69 @@ export class FleetManager {
         this.scheduler.recordRun(id, "instance_offline", `retry ${retryCount}x failed`);
         this.notifyScheduleFailure(schedule);
     }
+    /**
+     * The adapter that can actually post into a chat, found by its group.
+     *
+     * A schedule records where it was created (reply_chat_id) separately from
+     * what it triggers (target). Those need not share a platform: a Telegram
+     * group can schedule a Discord-topic instance. Picking the adapter from the
+     * target then sends a Telegram chat id through the Discord bot, which fails
+     * with Unknown Channel — the source topic never hears that its schedule ran.
+     *
+     * When several bots share one guild, the primary wins: a persona should not
+     * be the voice announcing fleet scheduling.
+     */
+    adapterForChat(chatId) {
+        const id = String(chatId);
+        const matches = [...this.worlds.values()].filter(world => String(world.groupId) === id);
+        if (matches.length === 0)
+            return undefined;
+        const primaryId = this.getPrimaryAdapterId();
+        return (matches.find(world => world.id === primaryId) ?? matches[0]).adapter;
+    }
+    /**
+     * The adapter that can answer a schedule in the chat it was created from.
+     *
+     * A schedule records its creator (source) and its trigger (target) separately,
+     * and they need not share a platform — the live fleet has a Telegram group
+     * scheduling a Discord-topic instance. Routing by target sends a Telegram chat
+     * id through the Discord bot, which is one half of the Unknown Channel errors.
+     *
+     * The creator's own adapter comes first, and only when its world actually owns
+     * that chat. Classic keeps its own identity, so a schedule made from a
+     * persona-bound Classic channel is answered by that persona: the primary bot
+     * may not even have access there, and would be the wrong voice if it did.
+     * Falling back to the target's adapter is deliberately NOT an option — that is
+     * the misroute itself; callers say why they stayed silent instead.
+     */
+    scheduleSourceAdapter(schedule) {
+        const chatId = String(schedule.reply_chat_id);
+        const sourceAdapterId = schedule.source ? this.getInstanceAdapterId(schedule.source) : undefined;
+        const sourceWorld = sourceAdapterId ? this.worlds.get(sourceAdapterId) : undefined;
+        if (sourceWorld && String(sourceWorld.groupId) === chatId)
+            return sourceWorld.adapter;
+        return this.adapterForChat(chatId);
+    }
     notifySourceTopic(schedule) {
-        const adapter = this.getAdapterForInstance(schedule.target) ?? this.adapter;
-        if (!adapter)
+        const adapter = this.scheduleSourceAdapter(schedule);
+        if (!adapter) {
+            this.logger.warn({ scheduleId: schedule.id, chatId: schedule.reply_chat_id, source: schedule.source }, "No adapter can reach the schedule's source chat — trigger notice not sent");
             return;
+        }
         const text = `⏰ Schedule "${schedule.label ?? schedule.id}" triggered, target: ${schedule.target}`;
         adapter.sendText(schedule.reply_chat_id, text, {
             threadId: schedule.reply_thread_id ?? undefined,
         }).catch((err) => this.logger.error({ err }, "Failed to send cross-instance notification"));
     }
     notifyScheduleFailure(schedule) {
-        const adapter = this.getAdapterForInstance(schedule.target) ?? this.adapter;
-        if (!adapter)
+        // Same resolver as the success path: a failure notice was still being sent
+        // through the target's adapter, so a Telegram-created schedule for a
+        // Discord target announced its failure into the wrong platform.
+        const adapter = this.scheduleSourceAdapter(schedule);
+        if (!adapter) {
+            this.logger.warn({ scheduleId: schedule.id, chatId: schedule.reply_chat_id, source: schedule.source }, "No adapter can reach the schedule's source chat — failure notice not sent");
             return;
+        }
         const text = `⏰ Schedule "${schedule.label ?? schedule.id}" trigger failed: instance ${schedule.target} is offline.`;
         adapter.sendText(schedule.reply_chat_id, text, {
             threadId: schedule.reply_thread_id ?? undefined,
@@ -5343,26 +5532,261 @@ export class FleetManager {
     sessionPruneTimer = null;
     classicReloadTimer = null;
     botUserId;
-    /** Periodically check if bound topics still exist */
+    /** Periodically check if bound topics still exist. Never deletes user data. */
     startTopicCleanupPoller() {
-        this.topicCleanupTimer = setInterval(async () => {
-            if (!this.fleetConfig?.channel?.group_id || !this.adapter?.topicExists)
+        if (this.topicCleanupTimer)
+            clearInterval(this.topicCleanupTimer);
+        const generation = ++this.topicCleanupGeneration;
+        this.topicCleanupTimer = setInterval(() => { void this.scheduleTopicCleanup(generation); }, 5 * 60_000);
+    }
+    /** Coalesce timer ticks; an outage must not create overlapping destructive-looking scans. */
+    scheduleTopicCleanup(generation = this.topicCleanupGeneration) {
+        if (this.topicCleanupInFlight)
+            return this.topicCleanupInFlight;
+        const run = this.runTopicCleanup(generation).finally(() => {
+            if (this.topicCleanupInFlight === run)
+                this.topicCleanupInFlight = null;
+        });
+        this.topicCleanupInFlight = run;
+        return run;
+    }
+    confirmedProbeFence(adapterId, adapter) {
+        const health = adapter.getHealthSnapshot?.();
+        if (health) {
+            return health.status === "connected" && health.isReady
+                ? { generation: health.generation }
+                : null;
+        }
+        return this.adapterState.get(adapterId)?.status === "connected" ? {} : null;
+    }
+    sameProbeFence(adapterId, adapter, before, result) {
+        const after = this.confirmedProbeFence(adapterId, adapter);
+        if (!after)
+            return false;
+        if (before.generation !== after.generation)
+            return false;
+        return result?.generation === undefined || result.generation === after.generation;
+    }
+    topicProbeStreakKey(threadId, adapterId, reason) {
+        return FleetManager.TOPIC_PROBE_ADAPTER_SCOPED_REASONS.has(reason)
+            ? `adapter:${adapterId ?? "unbound"}`
+            : `thread:${threadId}`;
+    }
+    /** A definite answer (present or missing) ends the unknown streak for that route and its adapter. */
+    clearTopicProbeUnknownStreak(threadId, adapterId) {
+        this.topicProbeUnknownStreak.delete(`thread:${threadId}`);
+        this.topicProbeUnknownStreak.delete(`adapter:${adapterId ?? "unbound"}`);
+    }
+    /**
+     * Record one unknown probe result. Nothing here can touch quarantine or
+     * removal: unknown is always retained data. The only question is whether
+     * the operator hears about it, and a single transient (one flaky HTTP call
+     * out of dozens per pass) must not — only a streak does.
+     *
+     * Used directly for single-route events (channelDelete, the pre-action
+     * fence). The periodic scan goes through a TopicProbePass instead, so one
+     * pass over N routes of a dead adapter counts as ONE check, not N.
+     */
+    warnTopicProbeUnknown(instanceName, threadId, adapterId, reason, detail) {
+        this.noteTopicProbeUnknown(this.topicProbeStreakKey(threadId, adapterId, reason), { instanceName, threadId, adapterId, reason, detail });
+    }
+    /** One scan's worth of probe outcomes, applied to the streaks after the loop. */
+    newTopicProbePass() {
+        return { unknown: new Map(), definite: new Set() };
+    }
+    passTopicProbeUnknown(pass, instanceName, threadId, adapterId, reason, detail) {
+        const key = this.topicProbeStreakKey(threadId, adapterId, reason);
+        // First unknown per key per pass wins; the rest of the routes on a dead
+        // adapter are the same observation, not additional checks.
+        if (!pass.unknown.has(key))
+            pass.unknown.set(key, { instanceName, threadId, adapterId, reason, detail });
+    }
+    passTopicProbeDefinite(pass, threadId, adapterId) {
+        pass.definite.add(`thread:${threadId}`);
+        pass.definite.add(`adapter:${adapterId ?? "unbound"}`);
+    }
+    /**
+     * Apply a pass: a definite answer resets its keys, and an adapter that
+     * answered for any route this pass is evidently alive, so an unknown for the
+     * same adapter key in the same pass does not count — regardless of the order
+     * the routes happened to be probed in.
+     */
+    applyTopicProbePass(pass) {
+        for (const key of pass.definite)
+            this.topicProbeUnknownStreak.delete(key);
+        for (const [key, ctx] of pass.unknown) {
+            if (pass.definite.has(key))
+                continue;
+            this.noteTopicProbeUnknown(key, ctx);
+        }
+    }
+    noteTopicProbeUnknown(streakKey, { instanceName, threadId, adapterId, reason, detail }) {
+        const streak = (this.topicProbeUnknownStreak.get(streakKey) ?? 0) + 1;
+        this.topicProbeUnknownStreak.set(streakKey, streak);
+        if (streak < FleetManager.TOPIC_PROBE_UNKNOWN_ESCALATION) {
+            this.logger.debug({ instanceName, threadId, adapterId, reason, detail, streak }, "Topic presence not confirmed this pass — transient, retaining instance and all data");
+            return;
+        }
+        const key = `${adapterId ?? "unbound"}:${reason}`;
+        const now = Date.now();
+        const last = this.topicProbeWarnings.get(key) ?? 0;
+        if (now - last < FleetManager.FLEET_ERROR_THROTTLE_MS)
+            return;
+        this.topicProbeWarnings.set(key, now);
+        this.logger.error({ instanceName, threadId, adapterId, reason, detail, streak }, "Topic presence could not be confirmed repeatedly — retaining instance and all data");
+        this.notifyFleetError(t("fleet.topic_probe_unknown", instanceName, adapterId ?? "unbound", streak));
+    }
+    /** One fixed-snapshot topology pass. Automatic evidence can only quarantine. */
+    async runTopicCleanup(generation) {
+        if (generation !== this.topicCleanupGeneration || this.shuttingDown)
+            return;
+        const snapshot = [...this.routing.entries()].filter(([, target]) => isProbeableRouteTarget(target));
+        const missing = [];
+        const pass = this.newTopicProbePass();
+        const skippedOnDemand = new Set();
+        for (const [threadId, target] of snapshot) {
+            if (generation !== this.topicCleanupGeneration || this.shuttingDown)
                 return;
-            for (const [threadId, target] of this.routing.entries()) {
-                try {
-                    if (!isProbeableRouteTarget(target)) {
-                        continue;
-                    }
-                    const exists = await this.adapter.topicExists(threadId);
-                    if (!exists) {
-                        await this.topicCommands.handleTopicDeleted(threadId);
-                    }
+            // The route may have been replaced while an earlier probe was in flight.
+            if (this.routing.resolve(threadId) !== target)
+                continue;
+            const adapterId = this.getInstanceAdapterId(target.name);
+            const adapter = adapterId ? this.adapters.get(adapterId) : undefined;
+            if (!adapterId || !adapter?.probeTopicPresence) {
+                this.passTopicProbeUnknown(pass, target.name, threadId, adapterId, "owner-adapter-unavailable");
+                continue;
+            }
+            // An on-demand adapter's probe is reserved for confirming a delivery
+            // failure hint (handleProviderTopicClosed); the periodic scan leaves its
+            // routes alone — no probe, no unknown, no streak, no notice.
+            if (adapter.topicProbePolicy?.() === "on-demand") {
+                if (!skippedOnDemand.has(adapterId)) {
+                    skippedOnDemand.add(adapterId);
+                    this.logger.debug({ adapterId }, "Topic scan skipping on-demand adapter — presence is confirmed only on delivery failure");
                 }
-                catch (err) {
-                    this.logger.debug({ err, threadId }, "Topic existence check failed");
+                continue;
+            }
+            const before = this.confirmedProbeFence(adapterId, adapter);
+            if (!before) {
+                this.passTopicProbeUnknown(pass, target.name, threadId, adapterId, "owner-adapter-not-ready");
+                continue;
+            }
+            let result;
+            try {
+                result = await adapter.probeTopicPresence(threadId);
+            }
+            catch {
+                result = { status: "unknown", reason: "provider-probe-threw" };
+            }
+            if (generation !== this.topicCleanupGeneration || this.shuttingDown)
+                return;
+            if (!this.sameProbeFence(adapterId, adapter, before, result)) {
+                this.passTopicProbeUnknown(pass, target.name, threadId, adapterId, "owner-adapter-generation-changed");
+                continue;
+            }
+            if (result.status === "unknown") {
+                this.passTopicProbeUnknown(pass, target.name, threadId, adapterId, result.reason, result.detail);
+            }
+            else {
+                this.passTopicProbeDefinite(pass, threadId, adapterId);
+                if (result.status === "missing") {
+                    missing.push({ threadId, target, adapterId, adapter, generation: result.generation });
                 }
             }
-        }, 5 * 60_000);
+        }
+        if (generation !== this.topicCleanupGeneration || this.shuttingDown)
+            return;
+        // One pass, one check: streaks move by at most one per key here.
+        this.applyTopicProbePass(pass);
+        if (missing.length === 0)
+            return;
+        if (missing.length > 1) {
+            this.logger.error({ missing: missing.map(item => ({ instanceName: item.target.name, threadId: item.threadId, adapterId: item.adapterId })) }, "Multiple topics appeared missing in one pass — treating topology evidence as untrusted and retaining all data");
+            this.notifyFleetError(t("fleet.topic_probe_bulk", missing.length));
+            return;
+        }
+        const item = missing[0];
+        if (this.routing.resolve(item.threadId) !== item.target
+            || this.getInstanceAdapterId(item.target.name) !== item.adapterId
+            || this.adapters.get(item.adapterId) !== item.adapter)
+            return;
+        const current = this.confirmedProbeFence(item.adapterId, item.adapter);
+        if (!current || (item.generation !== undefined && current.generation !== item.generation)) {
+            this.warnTopicProbeUnknown(item.target.name, item.threadId, item.adapterId, "owner-adapter-changed-before-action");
+            return;
+        }
+        this.topicCommands.handleTopicDeleted(item.threadId, {
+            source: "provider-probe",
+            adapterId: item.adapterId,
+            generation: item.generation,
+        });
+    }
+    /**
+     * A gateway event is only a hint. Confirm it through the passive REST probe;
+     * reconnecting gateways have emitted false channelDelete events in practice.
+     */
+    async handleProviderTopicClosed(threadId, adapterId, adapter) {
+        const target = this.routing.resolve(threadId);
+        if (!target || !isProbeableRouteTarget(target))
+            return;
+        if (this.getInstanceAdapterId(target.name) !== adapterId)
+            return;
+        if (this.adapters.get(adapterId) !== adapter)
+            return;
+        const before = this.confirmedProbeFence(adapterId, adapter);
+        if (!before || !adapter.probeTopicPresence) {
+            this.warnTopicProbeUnknown(target.name, threadId, adapterId, "topic-close-from-unready-adapter");
+            return;
+        }
+        let result;
+        try {
+            result = await adapter.probeTopicPresence(threadId);
+        }
+        catch {
+            result = { status: "unknown", reason: "provider-probe-threw" };
+        }
+        if (this.routing.resolve(threadId) !== target
+            || this.getInstanceAdapterId(target.name) !== adapterId
+            || this.adapters.get(adapterId) !== adapter
+            || !this.sameProbeFence(adapterId, adapter, before, result)) {
+            this.warnTopicProbeUnknown(target.name, threadId, adapterId, "topic-close-generation-changed");
+            return;
+        }
+        if (result.status === "unknown") {
+            this.warnTopicProbeUnknown(target.name, threadId, adapterId, result.reason, result.detail);
+            return;
+        }
+        this.clearTopicProbeUnknownStreak(threadId, adapterId);
+        if (result.status !== "missing") {
+            // The gateway said deleted, REST says present: a definite answer, so it
+            // is not an unknown streak — but it is worth one debug line.
+            this.logger.debug({ instanceName: target.name, threadId, adapterId }, "channelDelete hint contradicted by REST — topic present, nothing to do");
+            return;
+        }
+        this.topicCommands.handleTopicDeleted(threadId, {
+            source: "provider-event",
+            adapterId,
+            generation: result.generation,
+        });
+    }
+    bindTopicClosedHandler(adapter, adapterId, label) {
+        adapter.on("topic_closed", safeHandler(async (data) => {
+            if (this.topicArchiver.isArchived(data.threadId))
+                return;
+            await this.handleProviderTopicClosed(data.threadId, adapterId, adapter);
+        }, this.logger, label));
+    }
+    /**
+     * Remove only the volatile route. The instance config, daemon, schedules,
+     * teams, metadata directory, and working tree remain untouched until an
+     * authenticated explicit deletion is requested.
+     */
+    quarantineMissingTopic(threadId, target, evidence) {
+        if (!isProbeableRouteTarget(target) || this.routing.resolve(threadId) !== target)
+            return;
+        this.routing.unregister(threadId);
+        this.logger.error({ instanceName: target.name, threadId, ...evidence }, "Topic is confirmed missing — route quarantined; instance configuration and user data were retained");
+        this.notifyFleetError(t("fleet.topic_quarantined", target.name, threadId));
     }
     /**
      * Patch only values changed in the effective config into the original YAML
@@ -5515,7 +5939,8 @@ export class FleetManager {
             }
         }
     }
-    async removeInstance(name) {
+    async removeInstance(name, authorization) {
+        assertExplicitInstanceRemoval(authorization);
         // Drop cached pane context — the map is keyed by instance name and nothing
         // else evicted deleted entries, so it grew for the life of the process.
         forgetInstanceContext(name);
@@ -5541,7 +5966,7 @@ export class FleetManager {
                 }
             }
         }
-        await this.lifecycle.remove(name);
+        await this.lifecycle.remove(name, authorization);
         // Clean up per-instance tracking maps so they don't grow unbounded
         // as instances are created and deleted over the lifetime of the fleet.
         this.lastActivity.delete(name);
@@ -5778,6 +6203,65 @@ export class FleetManager {
         this.logger.error({ ids: bad }, "classicBot.yaml holds ids that can never match");
         this.notifyFleetError(t("classic.unrecoverable_ids", list));
     }
+    /**
+     * Where a fleet-wide notice can actually be posted, or null if nowhere.
+     *
+     * On Telegram a group id is itself a chat, so posting straight to it is
+     * right. On Discord it is a *guild* id, and sending there makes the adapter
+     * fetch a channel that does not exist — DiscordAPIError 10003 Unknown
+     * Channel. That is why the daily summary never arrived on a Discord fleet:
+     * it had been posting to the guild every night and only the catch handler
+     * ever saw it.
+     *
+     * Discord therefore needs a real channel: the General topic (resolved from
+     * config rather than findGeneralInstance, so a fleet-level fault can still be
+     * reported while the General daemon is down), else the adapter's configured
+     * general_channel_id. With neither, there is no safe target and the caller
+     * should say so rather than send into a guaranteed failure.
+     */
+    fleetNoticeTarget(adapterId) {
+        const cfg = this.getChannelConfig(adapterId);
+        const groupId = cfg?.group_id;
+        if (groupId == null)
+            return null;
+        const chatId = String(groupId);
+        // The General must belong to the SAME adapter as the group above. Taking
+        // whichever General comes first in the instance map produced a mixed target
+        // on a dual-platform fleet — a Telegram group id carrying a Discord channel
+        // as its thread — and made the result depend on map insertion order.
+        // Resolved from config, not from a live daemon, so a fleet-level fault is
+        // still reportable while the General itself is down.
+        const ownerId = cfg?.id ?? cfg?.type;
+        const generalTopic = Object.entries(this.fleetConfig?.instances ?? {})
+            .find(([name, instance]) => instance.general_topic === true
+            && this.getInstanceAdapterId(name) === ownerId)?.[1]?.topic_id;
+        if (generalTopic != null)
+            return { chatId, opts: { threadId: String(generalTopic) } };
+        if (cfg?.type === "discord") {
+            const configured = cfg.options?.general_channel_id;
+            if (configured != null && String(configured)) {
+                return { chatId, opts: { threadId: String(configured) } };
+            }
+            return null; // a guild id is not a channel; sending would always fail
+        }
+        return { chatId, opts: {} };
+    }
+    /**
+     * Post the daily summary where fleet-wide notices go.
+     *
+     * A named method rather than an inline closure so a test can drive the real
+     * thing: asserting on fleetNoticeTarget alone leaves the call site free to go
+     * back to posting at the bare group id, which is the defect this replaced.
+     */
+    postDailySummary(text) {
+        const target = this.fleetNoticeTarget();
+        if (!this.adapter || !target) {
+            this.logger.warn("Daily summary has no postable target — set a General topic or channel.options.general_channel_id");
+            return;
+        }
+        this.adapter.sendText(target.chatId, text, target.opts)
+            .catch(e => this.logger.warn({ err: e }, "Failed to send daily summary"));
+    }
     notifyFleetError(text) {
         const now = Date.now();
         const key = text.slice(0, 200);
@@ -5804,10 +6288,12 @@ export class FleetManager {
             dispatched = this.notifyInstanceTopic(general, body);
         }
         else {
-            // No General instance — fall back to the primary channel's group.
-            const groupId = this.getChannelConfig()?.group_id;
-            if (this.adapter && groupId) {
-                this.adapter.sendText(String(groupId), body)
+            // No General instance — fall back to the primary channel's own notice
+            // target. Posting to the bare group id looked right but is a guild id on
+            // Discord, so every such fallback failed inside the catch handler.
+            const target = this.fleetNoticeTarget();
+            if (this.adapter && target) {
+                this.adapter.sendText(target.chatId, body, target.opts)
                     .catch(err => this.logger.warn({ err }, "Failed to send fleet error notification"));
                 dispatched = true;
             }
@@ -5866,13 +6352,16 @@ export class FleetManager {
                 .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send classic notification"));
             return true;
         }
-        // Fallback: send to group without threadId
-        if (groupId) {
-            adapter.sendText(String(groupId), text, extraOpts)
+        // Fallback: the instance has neither a topic nor a classic channel, so post
+        // where fleet-wide notices go. Not the bare group id: on Discord that is a
+        // guild, and the send fails inside the catch handler.
+        const target = this.fleetNoticeTarget(this.getInstanceAdapterId(instanceName));
+        if (target) {
+            adapter.sendText(target.chatId, text, { ...target.opts, ...extraOpts })
                 .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send notification (no topic)"));
             return true;
         }
-        this.logger.warn({ instanceName }, "No group id — instance topic notification not sent");
+        this.logger.warn({ instanceName }, "No postable target — instance topic notification not sent");
         return false;
     }
     // ── Nonce-armed button prompts (hang / assist / exit / clear) ──
@@ -6433,6 +6922,41 @@ export class FleetManager {
             extra: { generalName, promptKind: kind },
         });
     }
+    /**
+     * Offer a one-tap re-login next to an auth alert.
+     *
+     * The alert already names the remedy in words (`/login <backend>`), which
+     * still leaves the user to retype it somewhere. The button routes into the
+     * same chooser `/login` uses, so pressing it starts the flow in place.
+     *
+     * Backends with no remote login flow (opencode logs in from a terminal) get
+     * no button — the alert's own wording already tells them what to run.
+     */
+    async offerBackendLogin(targetInstance, backend) {
+        if (!LOGIN_FLOWS[backend])
+            return;
+        const adapterId = this.getInstanceAdapterId(targetInstance);
+        const adapter = this.getAdapterForInstance(targetInstance);
+        const chatId = this.getGroupIdForInstance(targetInstance);
+        const topicId = this.fleetConfig?.instances[targetInstance]?.topic_id;
+        const threadId = topicId != null ? String(topicId) : undefined;
+        if (!adapter || !adapterId || !chatId) {
+            this.logger.warn({ targetInstance, backend, adapterId, chatId }, "Cannot address the re-login button — the alert text still names the command");
+            return;
+        }
+        await this.postNonceButtonPrompt({
+            prefix: LOGIN_CALLBACK_PREFIX,
+            alertType: "login",
+            instanceName: "login",
+            adapter,
+            adapterId,
+            chatId,
+            threadId,
+            message: t("login.offer", backend),
+            choices: [{ action: backend, label: t("login.offer_action", backend) }],
+            expiredText: t("buttons.stale"),
+        });
+    }
     /** Consume a General assist button exactly once. */
     async handleInteractivePromptAssist(data, callbackAdapterId, receivingAdapter) {
         const claimed = this.consumeNonceCallback(INTERACTIVE_ASSIST_CALLBACK_PREFIX, /^interactive-assist:([0-9a-f]+):(confirm|cancel)$/, data, callbackAdapterId, receivingAdapter);
@@ -6583,6 +7107,30 @@ export class FleetManager {
         }
         return false;
     }
+    beginCancelButtonPublication(instanceName, correlationId) {
+        // A new handoff supersedes any idle timer left by the previous turn. If the
+        // instance is still idle after this publication, the post-await level check
+        // below starts a fresh grace period for this generation.
+        this.cancelIdleButtonRetirement(instanceName);
+        const publication = {
+            generation: ++this.nextCancelButtonPublicationGeneration,
+            correlationId,
+            inFlight: true,
+            retirePending: false,
+        };
+        this.cancelButtonPublications.set(instanceName, publication);
+        return publication;
+    }
+    /** Remember a clear/cancel/idle decision that arrived before notifyAlert
+     * returned a message id. `expected` fences an idle timer to its generation. */
+    markCancelButtonPublicationForRetirement(instanceName, expected) {
+        const publication = this.cancelButtonPublications.get(instanceName);
+        if (!publication?.inFlight)
+            return;
+        if (expected && publication !== expected)
+            return;
+        publication.retirePending = true;
+    }
     async sendCancelButton(instanceName, correlationId, preserveProgress = false) {
         // Post first, retire after (see the tail of this method). Retiring up front
         // meant that from the delete until the new message came back — a chat API
@@ -6621,6 +7169,7 @@ export class FleetManager {
             this.logger.warn({ instanceName, topicId, groupId }, "Cannot address cancel button (no chat id resolved)");
             return;
         }
+        const publication = this.beginCancelButtonPublication(instanceName, correlationId);
         try {
             const sent = await adapter.notifyAlert(chatId, {
                 type: "cancel",
@@ -6628,6 +7177,7 @@ export class FleetManager {
                 message: "👀 處理中…",
                 choices: [{ id: `cancel:${instanceName}`, label: t("cancel.button") }],
             }, threadId ? { threadId } : undefined);
+            publication.inFlight = false;
             const entry = {
                 instanceName,
                 adapterId,
@@ -6649,6 +7199,16 @@ export class FleetManager {
                 // empty even if the daemon's reset broadcast is still in flight.
                 toolProgress: preserveProgress ? this.instanceProgress.get(instanceName) : undefined,
             };
+            // A newer send started while this API call was pending. Track this late
+            // message just long enough for the normal bounded delete/retry machinery
+            // to remove it; critically, do not sweep the newer generation.
+            if (this.cancelButtonPublications.get(instanceName) !== publication) {
+                this.cancelButtons.set(sent.messageId, entry);
+                this.persistCancelButtons();
+                this.logger.debug({ instanceName, messageId: sent.messageId, generation: publication.generation }, "Retiring superseded cancel-button publication");
+                this.retireButton(entry);
+                return;
+            }
             this.startProgressTicker(entry);
             // Idle-check backstop: every 5min, if the instance is idle, retire the
             // button. Covers turns that end without hitting a clear trigger (reply /
@@ -6685,8 +7245,30 @@ export class FleetManager {
             }
             this.persistCancelButtons();
             this.logger.info({ instanceName, messageId: sent.messageId }, "Cancel button sent");
+            // Retirement is normally edge-triggered, but the edge (or an explicit
+            // reply/cancel clear) may have happened while notifyAlert was in flight.
+            // Reconcile the level after publication so a late button cannot resurrect
+            // on an already-idle instance. Preserve the existing two-second grace:
+            // a working transition cancels this timer just as it does for a normal
+            // idle edge.
+            if (publication.retirePending) {
+                this.retireButton(entry);
+            }
+            else if (this.getInstanceExecutionState(instanceName) === "idle") {
+                this.scheduleIdleButtonRetirement(instanceName);
+            }
         }
         catch (e) {
+            if (this.cancelButtonPublications.get(instanceName) === publication) {
+                this.cancelButtonPublications.delete(instanceName);
+                // beginCancelButtonPublication cancelled the previous turn's idle
+                // timer so it could not act on this generation. If the provider POST
+                // failed while the instance remained idle, restore that retirement
+                // opportunity for any older button still on screen.
+                if (this.getInstanceExecutionState(instanceName) === "idle") {
+                    this.scheduleIdleButtonRetirement(instanceName);
+                }
+            }
             this.logger.warn({ err: e.message, instanceName }, "Failed to send cancel button");
         }
     }
@@ -7039,6 +7621,7 @@ export class FleetManager {
     }
     /** Retire all cancel buttons for an instance — on reply or cancel. */
     clearCancelButton(instanceName) {
+        this.markCancelButtonPublicationForRetirement(instanceName);
         this.retireInstanceButtons(instanceName);
     }
     /** Retire the cross-instance button matching a delegate→report correlation id.
@@ -7047,6 +7630,11 @@ export class FleetManager {
     clearCancelButtonByCorrelation(correlationId) {
         if (!correlationId)
             return;
+        for (const [instanceName, publication] of this.cancelButtonPublications) {
+            if (publication.inFlight && publication.correlationId === correlationId) {
+                this.markCancelButtonPublicationForRetirement(instanceName, publication);
+            }
+        }
         for (const e of [...this.cancelButtons.values()]) {
             if (e.correlationId === correlationId)
                 this.retireButton(e);
@@ -7421,11 +8009,15 @@ export class FleetManager {
                 if (cleanupFailed) {
                     await chat.adapter.sendText(chat.chatId, t("login.web_cleanup_failed", backend), { threadId: chat.threadId }).catch(() => { });
                 }
+                const send = (text) => chat.adapter.sendText(chat.chatId, text, { threadId: chat.threadId }).catch(() => { });
                 let text;
                 if (ok) {
-                    const { woken, restarted } = await this.recoverBackendInstances(backend);
-                    const none = t("login.none");
-                    text = t("login.success", backend, woken.length ? woken.join(", ") : none, restarted.length ? restarted.join(", ") : none);
+                    // Same order as the web-login path: the login result goes out first,
+                    // then the recovery reports its own outcome. Waiting for recovery to
+                    // build this message is what made a successful login look hung.
+                    await send(t("login.completed", backend));
+                    await announcePostLoginRecovery(backend, () => this.recoverBackendInstances(backend), send);
+                    return;
                 }
                 else if (detail === "cancelled") {
                     // The cancel command's own reply already announced this — a second
@@ -7549,31 +8141,53 @@ export class FleetManager {
      * only re-reads credentials on process start (a paused instance's CLI is
      * already dead, so waking it respawns with the new token for free).
      */
-    async recoverBackendInstances(backend) {
+    /**
+     * Wake/restart every instance of a backend after a successful re-login.
+     *
+     * Bounded by a wall-clock deadline. This used to be an unbounded sequential
+     * loop, and the caller only built its "login completed" message AFTER it
+     * returned — so with several instances (or one slow restart) the user was
+     * told nothing at all for minutes, concluded the login had hung, and
+     * restarted things by hand. Instances that do not finish in time are NOT
+     * cancelled: they are still coming back, and are reported as pending so the
+     * message can say so instead of implying failure.
+     */
+    async recoverBackendInstances(backend, deadlineMs = POST_LOGIN_RECOVERY_DEADLINE_MS) {
         const woken = [];
         const restarted = [];
+        const pending = [];
+        const deadline = Date.now() + deadlineMs;
         for (const name of this.configuredBackendInstanceNames()) {
             if (this.backendNameOf(name) !== backend)
                 continue;
             const status = this.getInstanceStatus(name);
-            try {
+            if (status !== "paused" && status !== "running")
+                continue;
+            const result = await runBeforeDeadline(async () => {
                 if (status === "paused") {
                     if (this.daemons.has(name))
                         await this.lifecycle.wake(name, 30_000);
                     else
                         await this.startPersistedPausedInstance(name);
-                    woken.push(name);
                 }
-                else if (status === "running") {
+                else {
                     await this.restartSingleInstance(name);
-                    restarted.push(name);
                 }
+            }, deadline);
+            if (result.status === "fulfilled") {
+                (status === "paused" ? woken : restarted).push(name);
             }
-            catch (err) {
-                this.logger.warn({ err: err.message, name, status }, "Post-login recovery failed");
+            else if (result.status === "timeout") {
+                // Out of time: record it and stop waiting, but keep walking the list —
+                // the remaining instances are checked against the same deadline and
+                // fall straight through, so the caller still learns about all of them.
+                pending.push(name);
+            }
+            else {
+                this.logger.warn({ err: result.reason?.message, name, status }, "Post-login recovery failed");
             }
         }
-        return { woken, restarted };
+        return { woken, restarted, pending };
     }
     /** Backend chooser button → start that backend's login session. */
     async handleLoginBackendSelect(data, callbackAdapterId, receivingAdapter) {
@@ -7985,7 +8599,7 @@ You CAN write code snippets, explain code, and answer technical questions direct
 - **Delegate to 1 instance**: scoped to one project/repo, needs file access or execution.
 - **Coordinate multiple**: spans repos, outputs feed each other, or parallel helps (max 3 per task).
 
-Instance discovery order: list_teams() → list_instances() → describe_instance() → create_instance() only if nothing fits. Prefer reuse; never duplicate a running instance.
+Instance discovery: start with list_instances(); follow the guidance in its response. Prefer reuse; never duplicate a running instance.
 
 ## Reply Contract
 
@@ -9613,11 +10227,19 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const workDir = join(getAgendHome(), "workspaces", instanceName);
         ensureWorkspaceGit(workDir);
         const classicIdentity = this.classicChannels?.getAll().find(ch => ch.instanceName === instanceName);
+        const toolProgress = classicIdentity
+            ? this.classicChannels?.getToolProgress(classicIdentity.channelId, classicIdentity.adapterId, this.fleetConfig?.defaults?.tool_progress)
+            : this.fleetConfig?.defaults?.tool_progress;
+        const replyCompletionGuard = classicIdentity
+            ? this.classicChannels?.getReplyCompletionGuard(classicIdentity.channelId, classicIdentity.adapterId, this.fleetConfig?.defaults?.reply_completion_guard)
+            : this.fleetConfig?.defaults?.reply_completion_guard;
         const config = {
             ...DEFAULT_INSTANCE_CONFIG,
             ...this.fleetConfig?.defaults,
             working_directory: workDir,
             lightweight: true,
+            tool_progress: toolProgress ?? "off",
+            reply_completion_guard: replyCompletionGuard ?? true,
             ...(backend ? { backend } : {}),
             ...(model ? { model } : {}),
             ...(classicIdentity?.displayName ? { display_name: classicIdentity.displayName } : {}),
@@ -9750,6 +10372,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 clearInterval(entry.progressTimer);
         }
         this.cancelButtons.clear();
+        this.cancelButtonPublications.clear();
         for (const timer of this.cancelButtonIdleRetireTimers.values())
             clearTimeout(timer);
         this.cancelButtonIdleRetireTimers.clear();
@@ -9757,6 +10380,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             clearInterval(this.topicCleanupTimer);
             this.topicCleanupTimer = null;
         }
+        this.topicCleanupGeneration++;
         if (this.sessionPruneTimer) {
             clearInterval(this.sessionPruneTimer);
             this.sessionPruneTimer = null;
@@ -9899,10 +10523,17 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             // Keep that single message; the new process will adopt and finish it.
             setUpdateProgressStage(this.dataDir, "stopping");
         }
-        const groupId = this.fleetConfig?.channel?.group_id;
-        if (!trackedFullRestart && groupId && this.adapter) {
-            await this.adapter.sendText(String(groupId), t("restart.full_initiated"))
-                .catch(e => this.logger.warn({ err: e }, "Failed to post full restart notification"));
+        const restartTarget = this.fleetNoticeTarget();
+        if (!trackedFullRestart && this.adapter) {
+            if (restartTarget) {
+                await this.adapter.sendText(restartTarget.chatId, t("restart.full_initiated"), restartTarget.opts)
+                    .catch(e => this.logger.warn({ err: e }, "Failed to post full restart notification"));
+            }
+            else {
+                // Say why nothing was posted. A restart that announces itself nowhere,
+                // for a reason nobody logged, is the harder version of this bug.
+                this.logger.warn("Full restart notice has no postable target — set a General topic or channel.options.general_channel_id");
+            }
         }
         // Wait for idle with 5-minute timeout
         const IDLE_TIMEOUT_MS = 5 * 60 * 1000;
@@ -10002,6 +10633,30 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.notifyFleetError(t("fleet.reload_rejected", why));
             return;
         }
+        // Classic behavior settings share the fleet defaults but are not entries
+        // in fleet.yaml. Snapshot the old effective chain before reloading the
+        // Classic file so SIGHUP can hot-apply either source without waiting for
+        // the 30-second Classic poller.
+        const oldClassicBehavior = new Map();
+        if (this.classicChannels) {
+            for (const ch of this.classicChannels.getAll()) {
+                const runtimeConfig = this.daemons.get(ch.instanceName)?.getConfigSnapshot?.();
+                oldClassicBehavior.set(ch.instanceName, {
+                    backend: this.classicChannels.getBackend(ch.channelId, ch.adapterId, oldConfig?.defaults?.backend),
+                    model: this.classicChannels.getModel(ch.channelId, ch.adapterId, oldConfig?.defaults?.model),
+                    autoPauseAfter: this.classicChannels.getAutoPauseAfter(ch.channelId, ch.adapterId, oldConfig?.defaults?.auto_pause_after),
+                    // Settings mutates FleetManager's in-memory defaults before SIGHUP.
+                    // The live daemon is therefore the authority for the previous hot
+                    // values, exactly as in the fleet-topic reconciliation below.
+                    toolProgress: runtimeConfig?.tool_progress
+                        ?? this.classicChannels.getToolProgress(ch.channelId, ch.adapterId, oldConfig?.defaults?.tool_progress),
+                    replyCompletionGuard: runtimeConfig?.reply_completion_guard
+                        ?? this.classicChannels.getReplyCompletionGuard(ch.channelId, ch.adapterId, oldConfig?.defaults?.reply_completion_guard),
+                });
+            }
+            if (this.classicChannels.checkReload())
+                this.reportClassicUnrecoverableIds();
+        }
         this.routing.rebuild(this.fleetConfig);
         this.reregisterClassicChannels();
         this.scheduler?.reload();
@@ -10066,6 +10721,35 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 }
             }
         }
+        // A Classic channel inherits fleet defaults beneath its own two levels.
+        // Recompute that complete chain on SIGHUP. Only the two behavior switches
+        // are hot; changes to backend/model/auto-pause retain the existing restart
+        // semantics.
+        if (this.classicChannels) {
+            for (const ch of this.classicChannels.getAll()) {
+                const old = oldClassicBehavior.get(ch.instanceName);
+                if (!old || !this.daemons.has(ch.instanceName))
+                    continue;
+                const backend = this.classicChannels.getBackend(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.backend);
+                const model = this.classicChannels.getModel(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.model);
+                const autoPauseAfter = this.classicChannels.getAutoPauseAfter(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.auto_pause_after);
+                if (old.backend !== backend || old.model !== model || old.autoPauseAfter !== autoPauseAfter) {
+                    this.logger.info({ instanceName: ch.instanceName }, "Classic cold config changed — restarting");
+                    await this.stopInstance(ch.instanceName).catch(() => { });
+                    await this.startClassicInstanceUnattended(ch, "classic instance after fleet reload");
+                    continue;
+                }
+                const toolProgress = this.classicChannels.getToolProgress(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.tool_progress);
+                const replyCompletionGuard = this.classicChannels.getReplyCompletionGuard(ch.channelId, ch.adapterId, this.fleetConfig?.defaults?.reply_completion_guard);
+                if (old.toolProgress !== toolProgress || old.replyCompletionGuard !== replyCompletionGuard) {
+                    this.applyHotConfigUpdate(ch.instanceName, {
+                        tool_progress: toolProgress,
+                        reply_completion_guard: replyCompletionGuard,
+                    });
+                    this.logger.info({ instanceName: ch.instanceName }, "Classic inherited hot config reloaded");
+                }
+            }
+        }
         // warm_cap is fleet-owned; enforce the reloaded value immediately against
         // currently idle instances instead of waiting for a future state edge.
         this.enforceWarmCap();
@@ -10683,11 +11367,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const instances = names.map(name => {
             const statusFile = join(this.getInstanceDir(name), "statusline.json");
             let cost = 0;
-            let model = "";
             try {
                 const data = JSON.parse(readFileSync(statusFile, "utf-8"));
                 cost = data.cost?.total_cost_usd ?? 0;
-                model = data.model?.display_name ?? "";
             }
             catch (err) {
                 this.logger.debug({ err, name }, "statusline.json read failed (getUiStatus)");
@@ -10700,8 +11382,40 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                     ?? this.fleetConfig?.defaults?.backend
                     ?? "claude-code");
             const { context } = resolveInstanceContext(this.dataDir, name, backend);
-            const context_pct = context ?? 0;
-            return { name, status: this.getInstanceStatus(name), context_pct, cost, model };
+            // context_pct: null when unavailable, not 0
+            const context_pct = context ?? null;
+            // Model: Only Claude Code has live statusline; others use the effective resolver.
+            // readStatuslineModel provides the /ctx-aligned display_name+id combo for Claude.
+            // Non-Claude backends must NOT read statusline.json model (may be stale from previous Claude run).
+            const resolved = this.resolveInstanceModel(name);
+            const liveModel = backend === "claude-code" ? readStatuslineModel(this.dataDir, name) : null;
+            // Display value: live model for Claude, resolved.display for others (includes "auto (default)" for Kiro)
+            const model = liveModel ?? resolved.display;
+            // model_source: "live" when Claude statusline succeeded, else the resolver's source
+            const model_source = liveModel ? "live" : resolved.source;
+            // Effort: aligned with /ctx's effortLineFor — unsupported and antigravity don't show effort.
+            const effortStrategy = this.effortStrategyFor(name);
+            const isAgy = backend === "antigravity" || backend === "agy";
+            const effortResolved = this.resolveInstanceEffort(name);
+            // Only show effort if backend supports it and it's not antigravity
+            const effort = (effortStrategy === "unsupported" || isAgy) ? null : effortResolved.effort;
+            const effort_source = (effortStrategy === "unsupported" || isAgy) ? null : effortResolved.source;
+            // Display name: fleet config → classic channel → undefined
+            const display_name = classic
+                ? this.classicChannels?.getAll().find(ch => ch.instanceName === name)?.displayName
+                : this.fleetConfig?.instances[name]?.display_name;
+            return {
+                name,
+                display_name: display_name || undefined,
+                status: this.getInstanceStatus(name),
+                context_pct,
+                cost,
+                model,
+                model_source,
+                backend,
+                effort,
+                effort_source,
+            };
         });
         return {
             instances,