@songsid/agend 2.1.6-beta.9 → 2.1.7-beta.1

package/dist/fleet-manager.d.ts

@@ -292,6 +292,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private eventLogPruneTimer;
     private logRotateTimer;
     private discordPresenceTimer;
+    private discordPresenceEagerTimer;
+    private discordPresenceEagerPending;
     private discordPresenceInFlight;
     private static readonly DISCORD_PRESENCE_REFRESH_MS;
     /** Days of event/activity history to keep. */
@@ -681,6 +683,12 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     startAll(configPath: string): Promise<void>;
     /** Keep Discord profile activity aligned with the same cached usage source as /usage. */
     private startDiscordUsagePresence;
+    /**
+     * Request one prompt presence refresh after an instance/adapter comes online.
+     * Startup can bring several instances up together; a short coalescing window
+     * keeps that herd on the existing shared refresh path and one usage fetch.
+     */
+    private requestDiscordUsagePresenceRefresh;
     private refreshDiscordUsagePresence;
     /**
      * Delete inbox files older than retentionDays (by mtime). Cleans the shared
@@ -918,6 +926,19 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private handleSetDisplayName;
     private handleSetDescription;
     handleScheduleCrudHttp(instance: string, op: string, args: Record<string, unknown>): Promise<unknown>;
+    /**
+     * The only place an agent's request creates, changes or removes a schedule
+     * (#895). The IPC handler (MCP calls, direct channel.sock writes) and the
+     * agent endpoint (agent-cli, HTTP agent mode) are adapters over this, so the
+     * target check cannot be present on one face and missing on the other — the
+     * shape #804 had to close twice.
+     *
+     * `caller` is the instance the server resolved for the request; any
+     * `source` in `args` is ignored, and a schedule's source is always its caller.
+     * A refusal is a ToolNotPermittedError: 403 on the agent endpoint, the error
+     * of the schedule response on IPC.
+     */
+    private performScheduleOp;
     handleDecisionCrudHttp(instance: string, op: string, args: Record<string, unknown>): Promise<unknown>;
     handleTaskCrudHttp(instance: string, args: Record<string, unknown>): Promise<unknown>;
     handleSetDisplayNameHttp(instance: string, name: string): Promise<unknown>;
@@ -994,7 +1015,29 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     removeInstance(name: string, authorization: ExplicitInstanceRemoval): Promise<void>;
     startStatuslineWatcher(name: string): void;
     stopStatuslineWatcher(name: string): void;
-    reactMessageStatus(instanceName: string, chatId: string, messageId: string, emoji: string): void;
+    /**
+     * Last delivery status applied per bot+message. Unbounded by design: any cap
+     * reintroduces the hole where a forgotten ❌ can never be cleared, and an
+     * entry is two short strings (id pair plus one emoji) — thousands of
+     * status-reacted messages cost kilobytes. A bot restart loses it, degrading
+     * to a plain add (never worse than the old behaviour).
+     */
+    private lastStatusEmoji;
+    /**
+     * One in-flight status update per bot+message: updates run strictly in call
+     * order, so a delayed ❌ add can never land after a newer ✅'s removal —
+     * the final state is always the latest call. Entries delete themselves when
+     * the chain drains, so idle messages hold no memory.
+     */
+    private deliveryStatusChains;
+    reactMessageStatus(instanceName: string, chatId: string, messageId: string, emoji: string, threadId?: string): void;
+    /**
+     * Apply a terminal delivery verdict. Telegram maps ✅ to 👀 and ❌ to 👎 in
+     * reactMessageStatus; Discord continues to show the verdict emoji directly.
+     */
+    finishDeliveryStatus(instanceName: string, chatId: string, messageId: string, emoji: string, threadId?: string): void;
+    private queueDeliveryStatusReaction;
+    private applyDeliveryStatusReaction;
     private static FAILOVER_TRIGGER_PCT;
     private static FAILOVER_RECOVER_PCT;
     checkModelFailover(name: string, fiveHourPct: number): void;
@@ -1335,13 +1378,6 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * Used by report_result, where the sender's self-derived name may not match
      * the target-address name the button was registered under. */
     clearCancelButtonByCorrelation(correlationId: string): void;
-    /**
-     * Reaction target chat id. Telegram reactions key on the supergroup chat_id
-     * (the topic thread is NOT a chat_id), so a forum-topic message must react on
-     * msg.chatId — reacting on threadId silently fails. Discord reactions key on
-     * the channel/thread id.
-     */
-    private reactTarget;
     /** Remember the user message just delivered, so we can react ✅ when done. */
     private trackInboundMsg;
     /** Clear the tracked last-inbound message after the agent replies. The ✅
@@ -1655,7 +1691,15 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private customProviderFor;
     /** Ask a backend for its catalog using ONE instance's real config. Never throws. */
     private instanceScopedModels;
-    /** Account-wide catalog: probe cache first, live probe on miss. */
+    /**
+     * Account-wide catalog: probe cache first, live probe when the cache is
+     * missing or older than the same ~1h window `/model` uses (#888).
+     *
+     * Previously this served anything inside the 24h hard TTL, so `list_models`
+     * could answer with a day-old list `/model` had already re-probed past.
+     * The probe runs under the same deadline `/model` uses: a vendor that stops
+     * answering degrades to the previous list, never stalls the tool call.
+     */
     private globalModelCatalog;
     /** `/model` slash handler (admin only). No arg → DC menu; `/model <name>` → apply directly. */
     /** Label an effort choice, marking the one currently configured. */

package/dist/fleet-manager.js

@@ -16,6 +16,17 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 /** Fallback access policy for a channel with no `access:` block — open (no gate). */
 const DEFAULT_OPEN_ACCESS = { mode: "open", allowed_users: [], max_pending_codes: 0, code_expiry_minutes: 0 };
+/**
+ * Telegram bot reactions replace a single slot per message. Keep delivery state
+ * presentation here so supported emoji choices can change without altering the
+ * status reconciliation logic.
+ */
+const TELEGRAM_DELIVERY_STATUS_REACTIONS = new Map([
+    ["👀", "👀"], // queued / processing
+    ["⏳", "👀"],
+    ["✅", "👀"], // confirmed
+    ["❌", "👎"], // failed
+]);
 import { isProbeableRouteTarget } from "./fleet-context.js";
 import { loadFleetConfig, loadRawFleetConfig, DEFAULT_COST_GUARD, DEFAULT_DAILY_SUMMARY, DEFAULT_INSTANCE_CONFIG } from "./config.js";
 import { EventLog } from "./event-log.js";
@@ -25,6 +36,7 @@ import { TmuxManager } from "./tmux-manager.js";
 import { AccessManager } from "./channel/access-manager.js";
 import { IpcClient } from "./channel/ipc-bridge.js";
 import { createAdapter } from "./channel/factory.js";
+import { TelegramAdapter } from "./channel/adapters/telegram.js";
 import { createBackend } from "./backend/factory.js";
 import { isModelCompatible } from "./backend/types.js";
 import { createLogger, rotateLogIfNeeded } from "./logger.js";
@@ -52,7 +64,7 @@ import { runBeforeDeadline } from "./deadline.js";
 import { LoginWindowLock } from "./login-window-lock.js";
 import { handleSettingsRequest } from "./settings-api.js";
 import { setLocale, detectLocale, getLocale, t } from "./locale.js";
-import { handleAgentRequest } from "./agent-endpoint.js";
+import { handleAgentRequest, ToolNotPermittedError } from "./agent-endpoint.js";
 import { ClassicChannelManager, getClassicBackendChoices, isSelectableClassicBackend, readClassicLastActivityAt } from "./classic-channel-manager.js";
 import { assertExplicitInstanceRemoval } from "./instance-removal.js";
 import { validateFleetConfig } from "./config-validator.js";
@@ -63,7 +75,7 @@ import { isSetupComplete, markSetupComplete } from "./setup-marker.js";
 import { manualCleanupMessage, reapStaleTunnel } from "./tunnel/lease.js";
 import { buildToolPermissionsNotice } from "./tool-permissions-notice.js";
 import { GENERAL_PAUSE_ERROR, isGeneralInstance } from "./general-instance.js";
-import { mayUseTool, resolveToolSet, toolForIpcType, toolRefusedMessage, } from "./tool-permissions.js";
+import { mayUseTool, resolveToolSet, scheduleOpRefusal, toolForIpcType, toolRefusedMessage, } from "./tool-permissions.js";
 import { decideWebGate, loadOrCreateWebToken, readWebToken } from "./web-auth.js";
 import { fleetLevelDifferences, fleetLevelSignature } from "./fleet-level-config.js";
 import { checkSelfRestartAllowance, recordSelfRestartAttempt } from "./self-restart-limit.js";
@@ -488,6 +500,8 @@ export class FleetManager {
     eventLogPruneTimer = null;
     logRotateTimer = null;
     discordPresenceTimer = null;
+    discordPresenceEagerTimer = null;
+    discordPresenceEagerPending = false;
     discordPresenceInFlight = null;
     static DISCORD_PRESENCE_REFRESH_MS = 15 * 60_000;
     /** Days of event/activity history to keep. */
@@ -1839,6 +1853,7 @@ export class FleetManager {
         catch { /* consumed or absent */ }
         // Auto-connect IPC — daemon.start() ensures socket is ready before resolving
         await this.connectIpcToInstance(name);
+        this.requestDiscordUsagePresenceRefresh();
     }
     /** Recreate a daemon for a marker-only paused instance after an explicit wake/delivery. */
     async startPersistedPausedInstance(name) {
@@ -3058,12 +3073,37 @@ export class FleetManager {
     startDiscordUsagePresence() {
         if (this.discordPresenceTimer)
             clearInterval(this.discordPresenceTimer);
+        if (this.discordPresenceEagerTimer) {
+            clearTimeout(this.discordPresenceEagerTimer);
+            this.discordPresenceEagerTimer = null;
+        }
+        this.discordPresenceEagerPending = false;
         void this.refreshDiscordUsagePresence();
         this.discordPresenceTimer = setInterval(() => {
             void this.refreshDiscordUsagePresence();
         }, FleetManager.DISCORD_PRESENCE_REFRESH_MS);
         this.discordPresenceTimer.unref?.();
     }
+    /**
+     * Request one prompt presence refresh after an instance/adapter comes online.
+     * Startup can bring several instances up together; a short coalescing window
+     * keeps that herd on the existing shared refresh path and one usage fetch.
+     */
+    requestDiscordUsagePresenceRefresh() {
+        this.discordPresenceEagerPending = true;
+        // During early fleet startup the interval is not installed yet; its first
+        // refresh in startDiscordUsagePresence already covers all pending starts.
+        if (!this.discordPresenceTimer || this.discordPresenceEagerTimer)
+            return;
+        this.discordPresenceEagerTimer = setTimeout(() => {
+            this.discordPresenceEagerTimer = null;
+            if (!this.discordPresenceEagerPending || !this.discordPresenceTimer)
+                return;
+            this.discordPresenceEagerPending = false;
+            void this.refreshDiscordUsagePresence();
+        }, 50);
+        this.discordPresenceEagerTimer.unref?.();
+    }
     refreshDiscordUsagePresence() {
         if (this.discordPresenceInFlight)
             return this.discordPresenceInFlight;
@@ -3706,7 +3746,7 @@ export class FleetManager {
             this.adapter.setChatId(String(fleet.channel.group_id));
         }
         if (this.discordPresenceTimer && this.adapter.type === "discord") {
-            void this.refreshDiscordUsagePresence();
+            this.requestDiscordUsagePresenceRefresh();
         }
         this.startTopicCleanupPoller();
         // Prune stale external sessions every 5 minutes
@@ -4051,7 +4091,7 @@ export class FleetManager {
             adapter.setChatId(String(channelConfig.group_id));
         }
         if (this.discordPresenceTimer && adapter.type === "discord") {
-            void this.refreshDiscordUsagePresence();
+            this.requestDiscordUsagePresenceRefresh();
         }
         this.logger.info({ adapterId, type: channelConfig.type }, "Additional adapter started");
     }
@@ -4296,7 +4336,7 @@ export class FleetManager {
                     await adapter.reconnectGateway(previous?.lastError ?? "fleet adapter restart");
                     this.adapterState.set(id, { status: "connected", retryCount: 0 });
                     if (this.discordPresenceTimer && adapter.type === "discord") {
-                        void this.refreshDiscordUsagePresence();
+                        this.requestDiscordUsagePresenceRefresh();
                     }
                     this.logger.info({ id }, "Adapter gateway rebuilt successfully");
                 }
@@ -4324,7 +4364,7 @@ export class FleetManager {
                     this.logger.info({ id, attempt }, "Adapter restarted successfully");
                     this.adapterState.set(id, { status: "connected", retryCount: 0 });
                     if (this.discordPresenceTimer && adapter.type === "discord") {
-                        void this.refreshDiscordUsagePresence();
+                        this.requestDiscordUsagePresenceRefresh();
                     }
                     return;
                 }
@@ -4922,13 +4962,11 @@ export class FleetManager {
                 if (msg.adapterId)
                     this.bindInstanceAdapter(generalInstance, msg.adapterId, true);
                 const inboundAdapter = this.worlds.get(msg.adapterId ?? "")?.adapter ?? this.adapter;
-                // React immediately — before any other API calls. Use the adapter BOUND to
-                // the instance (not whichever same-guild bot received the event first) so
-                // exactly the owning bot reacts — no duplicate 👀 from a sibling bot.
+                // React immediately — before any other API calls — through the status
+                // path, so a later delivery status replaces (not stacks onto) this
+                // acknowledgement.
                 if (msg.chatId && msg.messageId) {
-                    const reactAdapter = this.getAdapterForInstance(generalInstance) ?? inboundAdapter;
-                    reactAdapter.react(msg.threadId ?? msg.chatId, msg.messageId, "👀")
-                        .catch(e => this.logger.debug({ err: e.message }, "Auto-react failed"));
+                    this.reactMessageStatus(generalInstance, msg.chatId, msg.messageId, "👀", msg.threadId || undefined);
                 }
                 this.warnIfRateLimited(generalInstance, msg);
                 const { text, extraMeta } = await processAttachments(msg, inboundAdapter, this.logger, generalInstance);
@@ -5016,13 +5054,11 @@ export class FleetManager {
         if (msg.adapterId)
             this.bindInstanceAdapter(instanceName, msg.adapterId, true);
         const inboundAdapter = this.worlds.get(msg.adapterId ?? "")?.adapter ?? this.adapter;
-        // React immediately — before any other Discord API calls. Use the adapter
-        // BOUND to the instance (not whichever same-guild bot received the event
-        // first) so exactly the owning bot reacts — no duplicate 👀 from a sibling.
+        // React immediately — before any other Discord API calls — through the
+        // status path, so a later delivery status replaces (not stacks onto) this
+        // acknowledgement. Same bound-adapter routing as the status path itself.
         if (msg.chatId && msg.messageId) {
-            const reactAdapter = this.getAdapterForInstance(instanceName) ?? inboundAdapter;
-            reactAdapter.react(this.reactTarget(msg), msg.messageId, "👀")
-                .catch(e => this.logger.debug({ err: e.message }, "Auto-react failed"));
+            this.reactMessageStatus(instanceName, msg.chatId, msg.messageId, "👀", msg.threadId || undefined);
         }
         // These may hit Discord API (topic icon, archive) — do after react
         if (this.topicArchiver.isArchived(threadId)) {
@@ -5061,8 +5097,10 @@ export class FleetManager {
         catch (err) {
             this.logger.warn({ err: err.message, instanceName }, "Wake/delivery failed");
             if (msg.chatId && msg.messageId) {
-                const reactAdapter = this.getAdapterForInstance(instanceName) ?? inboundAdapter;
-                reactAdapter.react(this.reactTarget(msg), msg.messageId, "❌").catch(() => { });
+                // Reconciled status path (not a bare add): a retry that later
+                // succeeds replaces this ❌ with ✅ instead of leaving both. Chat and
+                // thread travel separately so Telegram addresses the supergroup.
+                this.finishDeliveryStatus(instanceName, msg.chatId, msg.messageId, "❌", msg.threadId || undefined);
             }
             return;
         }
@@ -5550,36 +5588,18 @@ export class FleetManager {
             return;
         }
         try {
-            let result;
-            switch (msg.type) {
-                case "fleet_schedule_create": {
-                    const params = {
-                        cron: payload.cron,
-                        at: payload.at,
-                        message: payload.message,
-                        source: instanceName,
-                        target: payload.target || instanceName,
-                        reply_chat_id: meta.chat_id,
-                        reply_thread_id: meta.thread_id || null,
-                        reply_adapter_id: meta.adapter_id || null,
-                        label: payload.label,
-                        timezone: payload.timezone,
-                        silent: !!(payload.silent),
-                    };
-                    result = this.scheduler.create(params);
-                    break;
-                }
-                case "fleet_schedule_list":
-                    result = this.scheduler.list(payload.target);
-                    break;
-                case "fleet_schedule_update":
-                    result = this.scheduler.update(payload.id, payload);
-                    break;
-                case "fleet_schedule_delete":
-                    this.scheduler.delete(payload.id);
-                    result = "ok";
-                    break;
-            }
+            const op = String(msg.type).replace("fleet_schedule_", "");
+            const result = this.performScheduleOp(instanceName, op, payload, {
+                // The daemon sends its last chat id, which is unset until the instance
+                // has had a chat message — and cross-instance traffic never sets it. So
+                // a worker that only takes delegated tasks, the very instance #895 lets
+                // self-schedule, hit "NOT NULL constraint failed: schedules.reply_chat_id".
+                // No chat means no reply chat, exactly as on the agent endpoint.
+                chatId: meta.chat_id ?? "",
+                threadId: meta.thread_id || null,
+                adapterId: meta.adapter_id || null,
+                silent: !!(payload.silent),
+            });
             ipc.send({ type: "fleet_schedule_response", fleetRequestId, result });
         }
         catch (err) {
@@ -5715,23 +5735,76 @@ export class FleetManager {
     async handleScheduleCrudHttp(instance, op, args) {
         if (!this.scheduler)
             return { error: "Scheduler not available" };
+        if (op !== "create" && op !== "list" && op !== "update" && op !== "delete") {
+            return { error: `Unknown schedule op: ${op}` };
+        }
+        // No bound chat on this path, as before: a schedule made through the agent
+        // endpoint has nowhere of its own to reply.
+        return this.performScheduleOp(instance, op, args, { chatId: "", threadId: null });
+    }
+    /**
+     * The only place an agent's request creates, changes or removes a schedule
+     * (#895). The IPC handler (MCP calls, direct channel.sock writes) and the
+     * agent endpoint (agent-cli, HTTP agent mode) are adapters over this, so the
+     * target check cannot be present on one face and missing on the other — the
+     * shape #804 had to close twice.
+     *
+     * `caller` is the instance the server resolved for the request; any
+     * `source` in `args` is ignored, and a schedule's source is always its caller.
+     * A refusal is a ToolNotPermittedError: 403 on the agent endpoint, the error
+     * of the schedule response on IPC.
+     */
+    performScheduleOp(caller, op, args, reply) {
+        const scheduler = this.scheduler;
+        // Shape first, so the value the permission decision reads is the value the
+        // scheduler gets. `target` used to be filtered through typeof for the
+        // decision and passed raw to the scheduler, whose `target.startsWith`
+        // then threw a TypeError for `target: 123` (#897). A non-string is refused
+        // — never coerced: turning 123 into "123" would decide an identity
+        // question on a value the caller did not send. `null` means absent, as
+        // omitting it always did, and is removed before the scheduler sees it.
+        if (args.target === null) {
+            args = { ...args };
+            delete args.target;
+        }
+        if (args.target !== undefined && typeof args.target !== "string") {
+            throw new Error(`${op}_schedule: "target" must be an instance name (a string), not ${typeof args.target}.`);
+        }
+        if ((op === "update" || op === "delete") && typeof args.id !== "string") {
+            throw new Error(`${op}_schedule: "id" must be a schedule id (a string) — get one from list_schedules.`);
+        }
+        const requestedTarget = args.target;
+        if (op !== "list") {
+            const profile = resolveToolSet(this.fleetConfig?.instances[caller], caller);
+            const existing = op === "create" ? null : scheduler.get(args.id);
+            const refusal = scheduleOpRefusal(profile, caller, op, { requestedTarget, existing });
+            if (refusal) {
+                this.logger.warn({ instance: caller, profile, op, target: requestedTarget ?? existing?.target, scheduleId: args.id }, "tool-permissions: schedule op refused");
+                throw new ToolNotPermittedError(refusal);
+            }
+        }
         switch (op) {
             case "create":
-                return this.scheduler.create({
+                return scheduler.create({
                     cron: args.cron,
                     at: args.at,
                     message: args.message,
-                    source: instance, target: args.target || instance,
-                    reply_chat_id: "", reply_thread_id: null,
+                    source: caller,
+                    target: requestedTarget || caller,
+                    reply_chat_id: reply.chatId,
+                    reply_thread_id: reply.threadId,
+                    ...(reply.adapterId !== undefined ? { reply_adapter_id: reply.adapterId } : {}),
                     label: args.label,
                     timezone: args.timezone,
+                    ...(reply.silent !== undefined ? { silent: reply.silent } : {}),
                 });
-            case "list": return this.scheduler.list(args.target);
-            case "update": return this.scheduler.update(args.id, args);
+            case "list":
+                return scheduler.list(requestedTarget);
+            case "update":
+                return scheduler.update(args.id, args);
             case "delete":
-                this.scheduler.delete(args.id);
+                scheduler.delete(args.id);
                 return "ok";
-            default: return { error: `Unknown schedule op: ${op}` };
         }
     }
     async handleDecisionCrudHttp(instance, op, args) {
@@ -6396,6 +6469,9 @@ export class FleetManager {
                 }
             }
         }
+        // Capture instance dir BEFORE lifecycle.remove, which deletes the instance
+        // from fleetConfig. (The backend would be unresolvable afterwards.)
+        const instanceDirToClean = this.getInstanceDir(name);
         await this.lifecycle.remove(name, authorization);
         // Clean up per-instance tracking maps so they don't grow unbounded
         // as instances are created and deleted over the lifetime of the fleet.
@@ -6404,12 +6480,29 @@ export class FleetManager {
         this.rateLimitWarnedAt.delete(name);
         // Clean up statusline watcher + instance directory
         this.statuslineWatcher.unwatch(name);
+        // instanceDirToClean and effectiveBackend are captured before lifecycle.remove
+        // (which deletes the instance from fleetConfig).
         try {
-            rmSync(this.getInstanceDir(name), { recursive: true, force: true });
+            rmSync(instanceDirToClean, { recursive: true, force: true });
         }
         catch (err) {
             this.logger.debug({ err, name }, "Instance dir cleanup failed");
         }
+        // Remove the codex short home (~/.agend/cx/<hash>/) unconditionally.
+        // (#953). CodexBackend.shortHomeFor is a pure path computation; the existsSync
+        // guard makes this a no-op for instances that never used a short home (non-codex,
+        // or codex instances on a short-enough path). Unconditional also covers instances
+        // whose backend was switched away from codex before deletion — they still have a
+        // short home that would otherwise be inherited by a later same-name instance.
+        try {
+            const { CodexBackend } = await import("./backend/codex.js");
+            const shortHome = CodexBackend.shortHomeFor(instanceDirToClean);
+            if (existsSync(shortHome))
+                rmSync(shortHome, { recursive: true, force: true });
+        }
+        catch (err) {
+            this.logger.debug({ err, name }, "Codex short home cleanup failed");
+        }
     }
     startStatuslineWatcher(name) {
         if (this.lifecycle.isPaused(name))
@@ -6420,17 +6513,89 @@ export class FleetManager {
         // Pausing stops I/O but retains the last observed limits for status views.
         this.statuslineWatcher.unwatch(name, true);
     }
-    reactMessageStatus(instanceName, chatId, messageId, emoji) {
+    /**
+     * Last delivery status applied per bot+message. Unbounded by design: any cap
+     * reintroduces the hole where a forgotten ❌ can never be cleared, and an
+     * entry is two short strings (id pair plus one emoji) — thousands of
+     * status-reacted messages cost kilobytes. A bot restart loses it, degrading
+     * to a plain add (never worse than the old behaviour).
+     */
+    lastStatusEmoji = new Map();
+    /**
+     * One in-flight status update per bot+message: updates run strictly in call
+     * order, so a delayed ❌ add can never land after a newer ✅'s removal —
+     * the final state is always the latest call. Entries delete themselves when
+     * the chain drains, so idle messages hold no memory.
+     */
+    deliveryStatusChains = new Map();
+    reactMessageStatus(instanceName, chatId, messageId, emoji, threadId) {
         // React via the adapter BOUND to this instance — NOT the first discord world.
         // Otherwise, in a same-channel/same-guild multi-bot setup, the inbound 👀
         // (bound bot) and the delivery/confirm reactions (some other bot) come from
         // different bots, leaving a duplicate 👀 that never turns into ✅.
         const adapter = this.getAdapterForInstance(instanceName) ?? this.adapter;
-        // Status reactions are Discord-only (TG/others use the inbound react path).
-        if (!adapter || adapter.type !== "discord")
+        if (!adapter)
             return;
-        adapter.react(chatId, messageId, emoji)
-            .catch(e => this.logger.debug({ err: e.message }, "Message status react failed"));
+        const statusEmoji = adapter instanceof TelegramAdapter
+            ? TELEGRAM_DELIVERY_STATUS_REACTIONS.get(emoji)
+            : emoji;
+        // Telegram has a deliberately smaller status vocabulary, and every mapped
+        // value is accepted by ReactionTypeEmoji. Unknown statuses stay a no-op.
+        if (!statusEmoji)
+            return;
+        // Bot-scoped: sibling bots reacting on the same message must not clear
+        // each other's state — every removal below targets this adapter's own
+        // reactions (@me on Discord, the bot's list on Telegram).
+        const adapterId = typeof adapter.id === "string"
+            ? adapter.id : "?";
+        const key = `${adapterId}:${chatId}:${threadId ?? ""}:${messageId}`;
+        this.queueDeliveryStatusReaction(adapter, key, chatId, messageId, statusEmoji, threadId);
+    }
+    /**
+     * Apply a terminal delivery verdict. Telegram maps ✅ to 👀 and ❌ to 👎 in
+     * reactMessageStatus; Discord continues to show the verdict emoji directly.
+     */
+    finishDeliveryStatus(instanceName, chatId, messageId, emoji, threadId) {
+        this.reactMessageStatus(instanceName, chatId, messageId, emoji, threadId);
+    }
+    queueDeliveryStatusReaction(adapter, key, chatId, messageId, emoji, threadId) {
+        const prev = this.deliveryStatusChains.get(key) ?? Promise.resolve();
+        const run = prev.then(() => this.applyDeliveryStatusReaction(adapter, key, chatId, messageId, emoji, threadId));
+        this.deliveryStatusChains.set(key, run);
+        void run.then(() => { if (this.deliveryStatusChains.get(key) === run)
+            this.deliveryStatusChains.delete(key); }, () => { if (this.deliveryStatusChains.get(key) === run)
+            this.deliveryStatusChains.delete(key); });
+    }
+    async applyDeliveryStatusReaction(adapter, key, chatId, messageId, emoji, threadId) {
+        try {
+            const target = adapter instanceof TelegramAdapter ? chatId : (threadId ?? chatId);
+            const prev = this.lastStatusEmoji.get(key);
+            if (emoji == null) {
+                if (prev && adapter.unreact) {
+                    await adapter.unreact(target, messageId, prev, threadId);
+                    this.lastStatusEmoji.delete(key);
+                }
+                return;
+            }
+            // A Telegram status may map multiple lifecycle states to the same
+            // reaction. Avoid resending it: an agent may have replaced the one
+            // reaction slot with its own 👍 between delivered and confirmed.
+            if (prev === emoji)
+                return;
+            // Thread-aware adapters (Discord) react where the thread is; Telegram
+            // addresses the supergroup chat and ignores the thread part.
+            // Discord needs the old reaction removed before the new one is added.
+            // Telegram's setMessageReaction replaces the bot's one current reaction.
+            if (prev && prev !== emoji && adapter.unreact && !(adapter instanceof TelegramAdapter)) {
+                // Best effort: a failed removal must not block the new status.
+                await adapter.unreact(target, messageId, prev, threadId).catch(e => this.logger.debug({ err: e.message }, "Delivery status reaction removal failed"));
+            }
+            await adapter.react(target, messageId, emoji, threadId);
+            this.lastStatusEmoji.set(key, emoji);
+        }
+        catch (e) {
+            this.logger.debug({ err: e.message }, "Message status react failed");
+        }
     }
     // ── Model failover ──────────────────────────────────────────────────────
     static FAILOVER_TRIGGER_PCT = 90;
@@ -8103,15 +8268,6 @@ export class FleetManager {
                 this.retireButton(e);
         }
     }
-    /**
-     * Reaction target chat id. Telegram reactions key on the supergroup chat_id
-     * (the topic thread is NOT a chat_id), so a forum-topic message must react on
-     * msg.chatId — reacting on threadId silently fails. Discord reactions key on
-     * the channel/thread id.
-     */
-    reactTarget(msg) {
-        return msg.source === "telegram" ? msg.chatId : (msg.threadId ?? msg.chatId);
-    }
     /** Remember the user message just delivered, so we can react ✅ when done. */
     trackInboundMsg(instanceName, msg) {
         if (!msg.chatId || !msg.messageId)
@@ -9993,17 +10149,25 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             return [];
         }
     }
-    /** Account-wide catalog: probe cache first, live probe on miss. */
+    /**
+     * Account-wide catalog: probe cache first, live probe when the cache is
+     * missing or older than the same ~1h window `/model` uses (#888).
+     *
+     * Previously this served anything inside the 24h hard TTL, so `list_models`
+     * could answer with a day-old list `/model` had already re-probed past.
+     * The probe runs under the same deadline `/model` uses: a vendor that stops
+     * answering degrades to the previous list, never stalls the tool call.
+     */
     async globalModelCatalog(backend) {
         const cached = this.readCliEnv(backend);
-        if (cached?.models?.length) {
+        if (cached?.models?.length && !this.cliEnvNeedsRefresh(cached)) {
             return {
                 backend, scope: "global", current_model: cached.currentModel ?? null,
                 models: cached.models, source: "cache",
                 probed_at: new Date(cached.probedAt).toISOString(),
             };
         }
-        const env = await this.probeBackend(backend);
+        const env = await this.probeBackendBounded(backend);
         if (env?.models?.length) {
             return {
                 backend, scope: "global", current_model: env.currentModel ?? null,
@@ -10011,6 +10175,15 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 probed_at: new Date(env.probedAt).toISOString(),
             };
         }
+        // Probe failed or timed out: like `/model`, the previous list is still the
+        // best answer — a stale list beats an empty one.
+        if (cached?.models?.length) {
+            return {
+                backend, scope: "global", current_model: cached.currentModel ?? null,
+                models: cached.models, source: "cache",
+                probed_at: new Date(cached.probedAt).toISOString(),
+            };
+        }
         // Reported rather than thrown: "we could not enumerate" is a useful answer,
         // and the caller can still set a model by name (AgEnD passes it through).
         return {
@@ -10952,6 +11125,11 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             clearInterval(this.discordPresenceTimer);
             this.discordPresenceTimer = null;
         }
+        if (this.discordPresenceEagerTimer) {
+            clearTimeout(this.discordPresenceEagerTimer);
+            this.discordPresenceEagerTimer = null;
+        }
+        this.discordPresenceEagerPending = false;
         // Cancel-button timers were never cleared here. The idle-check interval is not
         // unref'd, so it held the event loop open past shutdown and kept retrying
         // deletes against an adapter that was already gone.