@songsid/agend 2.2.0-alpha.1 → 2.2.0-alpha.3

package/dist/fleet-manager.js

@@ -6,6 +6,7 @@ import { SettingsExecution, settingsRevision, noteSettingsWrite, settingsFileRes
 import { performance } from "node:perf_hooks";
 import { gatewayRequestContext } from "./web-request-context.js";
 import { createPublicWebGateway } from "./public-web-gateway.js";
+import { renderPublicLinkProgress, ThrottledMessageEditor } from "./public-link-progress.js";
 import { PublicWebLink, publicLinkSettings } from "./public-web-link.js";
 import { TunnelPurposeLane } from "./tunnel/purpose-lane.js";
 import { ManagedTunnel } from "./tunnel/manager.js";
@@ -14,6 +15,7 @@ import { measureSyncWork } from "./sync-work-attribution.js";
 import { RuntimeCpuProfiler, ProfileBusyError, profileDuration } from "./runtime-cpu-profile.js";
 import { ProfileControlServer } from "./profile-control.js";
 import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync, accessSync, realpathSync, constants as fsConstants } from "node:fs";
+import { atomicWriteFileSync } from "./atomic-write.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { freemem, totalmem, cpus, homedir } from "node:os";
@@ -39,6 +41,9 @@ import { STATUS_EMOJI_CONFIG_KEYS, STATUS_EMOJI_KEYS, STATUS_EMOJI_SUGGESTIONS,
 import { isProbeableRouteTarget } from "./fleet-context.js";
 import { loadFleetConfig, loadRawFleetConfig, DEFAULT_COST_GUARD, DEFAULT_DAILY_SUMMARY, DEFAULT_INSTANCE_CONFIG } from "./config.js";
 import { EventLog } from "./event-log.js";
+import { binaryProbe } from "./binary-probe.js";
+import { classifySqliteOpenError } from "./sqlite-open-errors.js";
+import { OutboxOpenError } from "./outbox-open-error.js";
 import { AdapterWorld } from "./adapter-world.js";
 import { CostGuard, formatCents } from "./cost-guard.js";
 import { startEventLoopWatch } from "./event-loop-watch.js";
@@ -120,8 +125,13 @@ export function applyTaskListCap(tasks, filterAssignee, filterStatus) {
 }
 import { handleWebRequest, broadcastSseEvent, SSE_HEARTBEAT_MS } from "./web-api.js";
 import { WebChatHistory, WEB_CHAT_TEXT_MAX, isWebMessageId, newWebMessageId } from "./web-chat-history.js";
+import { ReplyButtonStore, parseReplyButtons, replyButtonClickText, replyButtonsFallbackText, REPLY_BUTTON_PREFIX } from "./reply-buttons.js";
+import { ReplyButtonsController } from "./reply-buttons-controller.js";
 import { publicAttachment, sweepOrphanedUploads, WebFileLedger } from "./web-upload.js";
-import { handleViewRequest, isViewPath } from "./view-api.js";
+import { handleViewRequest, isViewPath, profileIdentities, resolveInstanceIdentity } from "./view-api.js";
+import { envFileKeys } from "./token-env-name.js";
+import { parseEnvText } from "./env-file.js";
+import { isDisallowedIntentsError, isRejectedTokenError } from "./discord-permissions.js";
 import { filterUsageProviders, formatDiscordUsageActivity, getUsageSnapshot, handleUsageRequest, isUsagePath, usageProviderIdForBackend } from "./usage/usage-api.js";
 import { LOGIN_FLOWS, LOGIN_BACKEND_ALIASES } from "./login-flows.js";
 import { LoginSession } from "./login-manager.js";
@@ -129,7 +139,9 @@ import { tightenInstanceDirs } from "./private-dir.js";
 import { decideSlash } from "./slash-authz.js";
 import { commandSpec, decideCommand, ruleFor } from "./command-table.js";
 import { runVisibilityCommand } from "./cross-instance-notice.js";
-import { UPDATE_COMMAND, installedChannel, isPrereleaseVersion, updateNoticeKey } from "./update-check.js";
+import { installedChannel, isPrereleaseVersion, updateNoticeKey } from "./update-check.js";
+import { resolveInstalledAgend } from "./update-dispatch.js";
+import { resolveUpdateLaunch, watchUpdateLaunch } from "./update-launch.js";
 import { LoginController, LOGIN_TOKEN_RESEND_PREFIX, POST_LOGIN_RECOVERY_DEADLINE_MS } from "./login-controller.js";
 import { runBeforeDeadline } from "./deadline.js";
 import { LoginWindowLock } from "./login-window-lock.js";
@@ -156,6 +168,10 @@ import { NeedsYouHub } from "./needs-you-hub.js";
 import { WEB_CHAT_NOTICE, WEB_REMOTE_DOCS_URL, claimNotice, hasWebChat, releaseNotice, upgradeNoticesPath } from "./upgrade-notices.js";
 import { GENERAL_PAUSE_ERROR, isGeneralInstance } from "./general-instance.js";
 import { buildOrgChart } from "./web-org.js";
+import { CacheService, WINDOWS } from "./cache-service.js";
+import { runWebCommand } from "./web-commands.js";
+import { claudeProjectKey } from "./backend/claude-code.js";
+import { sharedRolloutIndex } from "./rollout-index.js";
 import { mayUseTool, resolveToolSet, scheduleOpRefusal, toolForIpcType, toolRefusedMessage, } from "./tool-permissions.js";
 import { authorizeSession, decideWebGate, loadOrCreateWebToken, readWebToken } from "./web-auth.js";
 import { bypassesWebGate, handleAuthRequest, serveSigninPage } from "./auth-api.js";
@@ -164,7 +180,7 @@ import { tokenEpoch, WebSessionStore } from "./web-session.js";
 import { WebLoginCodes, LOGIN_CODE_TTL_MS } from "./web-login.js";
 import { allowedHostNames, applyWebSecurityHeaders, hostnameOf, isHostAllowed, WEB_HOST_REJECTED_MESSAGE } from "./web-host-guard.js";
 import { createPreviewListener, previewAvailability, previewSettings } from "./web-preview.js";
-import { fleetLevelDifferences, fleetLevelSignature } from "./fleet-level-config.js";
+import { fleetLevelDifferences, fleetLevelSignature, appendedConnections } from "./fleet-level-config.js";
 import { checkSelfRestartAllowance, recordSelfRestartAttempt } from "./self-restart-limit.js";
 import { SecretStore } from "./secret-store.js";
 import { opaqueId, safeSecretError, SECRET_CHALLENGE_TTL_MS, } from "./connection-secrets.js";
@@ -334,6 +350,7 @@ const WEB_MIRRORED_PROMPT_PREFIXES = new Set([
  */
 const WEB_ONLY_REPLY_SINK = {
     type: "web",
+    supportsReplyButtons: true, // #1266: the web chat shows a reply's buttons itself
     sendText: async () => ({ chatId: "web", messageId: newWebMessageId() }),
     sendFile: async () => ({ chatId: "web", messageId: newWebMessageId() }),
 };
@@ -437,6 +454,8 @@ export class FleetManager {
     dataDir;
     static signalTarget = null;
     static sighupHandlerInstalled = false;
+    /** Test seam: inject a spy to verify saveFleetConfig calls fsync. Default: fsyncSync. */
+    fsyncForTest = undefined;
     children = new Map();
     lifecycle;
     stormWindow;
@@ -833,21 +852,66 @@ export class FleetManager {
                     return false;
                 await settlement;
                 const job = this.providerSecretJobs.get(id) ?? this.connectionSecretJobs.get(id) ?? this.connectionBindingJobs.get(id);
-                return !!job && ["applied", "applied_next_use", "reloaded"].includes(job.result);
+                // restart_required: the value is stored and committed (the receipt is checked above), only no adapter was running
+                // to take it — the change is done, and the page says it starts with the next restart (#1519 P1), never "failed".
+                return !!job && ["applied", "applied_next_use", "reloaded", "restart_required"].includes(job.result);
             },
         });
         this.settingsConfirmation = gate;
         return gate;
     }
+    /** Exact configured effect owners; this does not depend on prompt location. */
+    settingsChatAuthority(store, id) {
+        const scope = store.authorityOf(id);
+        if (!scope || scope.unknown)
+            return null;
+        const channels = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+        const targets = new Set(scope.connections);
+        let primaryGeneral;
+        const selectPrimary = () => {
+            const generals = Object.entries(this.fleetConfig?.instances ?? {}).filter(([, cfg]) => cfg.general_topic === true);
+            const selected = generals.find(([name]) => this.getInstanceAdapterId(name) === this.getPrimaryAdapterId()) ?? generals[0];
+            const owner = selected && this.getInstanceAdapterId(selected[0]);
+            return selected && owner ? { name: selected[0], owner } : undefined;
+        };
+        if (scope.primaryGeneral) {
+            primaryGeneral = selectPrimary();
+            if (!primaryGeneral)
+                return null;
+            targets.add(primaryGeneral.owner);
+        }
+        const owners = [...targets].map(id => channels.filter(ch => (ch.id ?? ch.type) === id));
+        if (!owners.length || owners.some(matches => matches.length !== 1))
+            return null;
+        const platform = owners[0][0].type;
+        if ((platform !== "telegram" && platform !== "discord") || owners.some(matches => matches[0].type !== platform))
+            return null;
+        const identities = owners.map(matches => ({ id: matches[0].id ?? matches[0].type, type: matches[0].type }));
+        const generation = this.settingsGeneration;
+        const current = () => !this.shuttingDown && this.settingsGeneration === generation
+            && identities.every(owner => {
+                const configs = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+                const matches = configs.filter(ch => (ch.id ?? ch.type) === owner.id);
+                return matches.length === 1 && matches[0].type === owner.type;
+            })
+            && (!primaryGeneral || selectPrimary()?.name === primaryGeneral.name && selectPrimary()?.owner === primaryGeneral.owner);
+        return { platform, current, admin: userId => current() && !!userId
+                && identities.every(owner => this.isFleetAdmin(userId, owner.id)) };
+    }
     async promptSettingsChange(store, view) {
         const generation = this.settingsGeneration;
+        const authority = this.settingsChatAuthority(store, view.id);
+        if (!authority) {
+            this.logger.info({ id: view.id }, "Settings authority is unknown or spans platforms; host CLI confirmation required");
+            return;
+        }
         const excluded = new Set(store.affectedConnections(view.id));
         for (const [name, config] of Object.entries(this.fleetConfig?.instances ?? {})) {
             if (!config.general_topic)
                 continue;
             const adapterId = this.getInstanceAdapterId(name), adapter = this.getAdapterForInstance(name);
             const general = this.daemons.get(name);
-            if (!adapterId || !adapter || !general || excluded.has(adapterId) || !this.hasFleetAdmins(adapterId))
+            if (!adapterId || !adapter || !general || excluded.has(adapterId) || adapter.type !== authority.platform)
                 continue;
             const chatId = this.getGroupIdForInstance(name), topic = String(config.topic_id ?? "");
             if (!chatId || !topic)
@@ -860,7 +924,7 @@ export class FleetManager {
                 && this.adapterState.get(adapterId)?.status === "connected"
                 && this.getInstanceAdapterId(name) === adapterId && this.getAdapterForInstance(name) === adapter
                 && this.getGroupIdForInstance(name) === chatId && String(this.fleetConfig?.instances[name]?.topic_id ?? "") === topic
-                && this.hasFleetAdmins(adapterId);
+                && authority.current();
             if (!current())
                 continue;
             try {
@@ -869,7 +933,7 @@ export class FleetManager {
                     message: `🔒 Settings change awaiting fleet-admin confirmation\nSource: ${view.source}\nRequester: ${view.requested_by}\n${view.summary.join("\n")}`,
                     choices: [{ action: "confirm", label: "Confirm" }, { action: "reject", label: "Reject" }],
                     expiredText: "Settings confirmation is no longer pending.", timeoutMs: view.remaining_ms,
-                    extra: { pendingChangeId: view.id, confirmationCurrent: current },
+                    extra: { pendingChangeId: view.id, confirmationCurrent: current, confirmationAdmin: userId => current() && authority.admin(userId) },
                 });
                 void posted.then(nonce => {
                     if (!retired)
@@ -907,7 +971,7 @@ export class FleetManager {
         this.logger.info({ id: view.id }, "Settings change requires local `agend settings confirm <id>`");
     }
     async handleSettingsChangeCallback(data, adapterId, adapter) {
-        const result = this.consumeNonceCallback("settings-confirm:", /^settings-confirm:([0-9a-f]{32}):(confirm|reject)$/, data, adapterId, adapter);
+        const result = this.consumeNonceCallback("settings-confirm:", /^settings-confirm:([0-9a-f]{32}):(confirm|reject)$/, data, adapterId, adapter, undefined, (userId, entry) => entry.confirmationAdmin?.(userId) === true);
         if (!result)
             return false;
         if (result === "consumed")
@@ -917,7 +981,7 @@ export class FleetManager {
             const view = await this.settingsGate().store.decide(entry.pendingChangeId, action, {
                 label: `fleet admin ${data.userId}`,
                 current: () => entry.confirmationCurrent?.() === true && this.getAdapterForInstance(entry.instanceName) === entry.adapter
-                    && !!data.userId && this.isFleetAdmin(data.userId, entry.adapterId),
+                    && !!data.userId && entry.confirmationAdmin?.(data.userId) === true,
             });
             await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, view.outcome?.message ?? "Settings change is applying.");
         }
@@ -990,16 +1054,111 @@ export class FleetManager {
         this.topicArchiver = new TopicArchiver(this);
         this.statuslineWatcher = new StatuslineWatcher(this);
     }
+    /** #1266: a reply's buttons — the store (reply-buttons.db) and what a click does. Created on first use. */
+    replyButtonsCtl = null;
+    /** The store could not be opened in this process: buttons are offered as text until the next start. */
+    replyButtonsUnavailable = false;
+    /**
+     * The controller, or null when reply-buttons.db cannot be opened (#1500 review). That file holds only open choices,
+     * so it never stops AgEnD: the failure is logged and posted once, replies offer their choices as text, and a click on
+     * an older button is answered "closed". The file is left where it is — an open error is not proof of corruption.
+     */
+    replyButtons() {
+        if (this.replyButtonsCtl)
+            return this.replyButtonsCtl;
+        if (this.replyButtonsUnavailable)
+            return null;
+        const path = join(this.dataDir, "reply-buttons.db");
+        let store;
+        try {
+            store = new ReplyButtonStore(path);
+        }
+        catch (err) {
+            this.replyButtonsUnavailable = true;
+            this.logger.error({ err: err.message, path }, "Reply buttons unavailable: reply-buttons.db could not be opened — replies offer their choices as text");
+            try {
+                this.notifyFleetError(`⚠️ Reply buttons are off until AgEnD restarts: ${path} could not be opened (${err.message}). Replies offer their choices as text.`);
+            }
+            catch { /* the notice is best effort */ }
+            return null;
+        }
+        this.replyButtonsCtl = new ReplyButtonsController({
+            store,
+            now: () => Date.now(),
+            adapterFor: (adapterId) => this.worlds.get(adapterId)?.adapter ?? (adapterId === this.getPrimaryAdapterId() ? this.adapter ?? undefined : undefined),
+            mayClick: (set, userId) => this.mayAnswerReplyButtons(set.instance, set.adapterId, userId),
+            deliver: (set, button, by) => this.deliverReplyButtonChoice(set, button, by),
+            publish: (instance, view) => this.emitSseEvent("reply_buttons", { instance, buttons: view }),
+            logger: this.logger,
+            setTimer: (fn, ms) => { const h = setTimeout(fn, ms); h.unref?.(); return h; },
+            clearTimer: (h) => clearTimeout(h),
+        });
+        this.replyButtonsStore = store;
+        return this.replyButtonsCtl;
+    }
+    replyButtonsStore = null;
+    /**
+     * #1266: who may answer a reply's buttons on a platform — whoever may message that instance there: in a ClassicBot
+     * room anyone there (as a typed message), elsewhere someone the sending connection lets speak (#754/#1148), never a
+     * fleet bot.
+     */
+    mayAnswerReplyButtons(instance, adapterId, userId) {
+        if ([...this.worlds.values()].some(w => w.botUserId && w.botUserId === userId))
+            return false;
+        if (this.classicChannels?.getChannelIdByInstance(instance) !== undefined)
+            return true;
+        const access = this.worlds.get(adapterId)?.accessManager ?? (adapterId === this.getPrimaryAdapterId() ? this.accessManager : null);
+        return this.isFleetAdmin(userId, adapterId) || !!access?.isAllowed(userId);
+    }
+    /** #1266: the choice, delivered as an ordinary inbound message from whoever made it, and shown in the web chat. */
+    async deliverReplyButtonChoice(set, button, by) {
+        const content = replyButtonClickText(button);
+        const web = by.source === "web";
+        const ts = new Date().toISOString();
+        const messageId = web ? newWebMessageId() : (set.messageId ?? "");
+        const sent = await this.deliverToInstance(set.instance, {
+            type: "fleet_inbound",
+            content,
+            targetSession: set.instance,
+            meta: {
+                chat_id: set.chatId, message_id: messageId, user: by.username, user_id: by.userId, ts,
+                thread_id: set.threadId, adapter_id: set.adapterId === "web" ? undefined : set.adapterId,
+                source: web ? "web" : (this.worlds.get(set.adapterId)?.adapter.type ?? "web"),
+            },
+        });
+        if (sent === false)
+            return false;
+        this.lastInboundUser.set(set.instance, by.username);
+        this.emitSseEvent("message", {
+            instance: set.instance, sender: by.username, role: "user", text: content, ts, ...(web ? { messageId } : {}),
+        });
+        return true;
+    }
     ensureDeliveryOutbox() {
         if (this.deliveryOutbox)
             return;
-        const outbox = new DeliveryOutbox(join(this.dataDir, "delivery-outbox.db"), this.managerBootId);
-        this.deliveryOutbox = outbox;
-        if (!this.deliveryOutboxRecovered) {
-            const recovered = outbox.recoverForBoot(this.managerBootId);
-            this.logger.info({ ...recovered }, "Recovered durable delivery outbox for this process boot");
-            this.deliveryOutboxRecovered = true;
+        const dbPath = join(this.dataDir, "delivery-outbox.db");
+        let outbox;
+        try {
+            outbox = new DeliveryOutbox(dbPath, this.managerBootId);
+            if (!this.deliveryOutboxRecovered) {
+                const recovered = outbox.recoverForBoot(this.managerBootId);
+                this.logger.info({ ...recovered }, "Recovered durable delivery outbox for this process boot");
+            }
         }
+        catch (cause) {
+            // Unlike events.db, these rows cannot be discarded: queued messages and uncertain submissions are authoritative.
+            // Publish only a fully recovered store. A partial open/recovery must not authorize admission on a later call.
+            try {
+                outbox?.close();
+            }
+            catch { /* preserve the original failure */ }
+            const error = new OutboxOpenError(dbPath, cause);
+            this.logger.error({ err: cause, dbPath, kind: error.kind }, error.message);
+            throw error;
+        }
+        this.deliveryOutbox = outbox;
+        this.deliveryOutboxRecovered = true;
         outbox.on("admitted", () => { this.scheduleDeliveryOutboxPump(); this.wakeCoordinator?.kick(); });
         outbox.on("state", (event) => {
             this.scheduleDeliveryOutboxPump();
@@ -1514,6 +1673,10 @@ export class FleetManager {
         });
         return caller;
     }
+    /** Pure cached admission for command continuations; no IO or update-progress lookup. */
+    isFleetStopping() {
+        return this.shuttingDown;
+    }
     /**
      * Is the fleet going down (or coming back up) on purpose?
      *
@@ -1575,6 +1738,16 @@ export class FleetManager {
     lastActivityMs(name) {
         return this.lastActivity.get(name) ?? 0;
     }
+    /** Capture the current daemon and delivery owner for a background context read. */
+    getPaneContextSource(name) {
+        const daemon = this.daemons.get(name);
+        const source = daemon?.getPaneContextSource?.();
+        if (!daemon || !source || this.shuttingDown)
+            return null;
+        const epoch = this.getDeliveryEpoch(name);
+        return { ...source, generation: `${source.generation}:${epoch}`, isCurrent: () => !this.shuttingDown
+                && this.daemons.get(name) === daemon && this.getDeliveryEpoch(name) === epoch && source.isCurrent() };
+    }
     /**
      * Is the instance between turns?
      *
@@ -1850,7 +2023,7 @@ export class FleetManager {
                 await data.respond(t(`${action}.usage`));
                 return;
             }
-            if (!this.fleetConfig?.instances[requested]) {
+            if (!Object.hasOwn(this.fleetConfig?.instances ?? {}, requested)) {
                 await data.respond(t("instance.not_found", requested));
                 return;
             }
@@ -1898,14 +2071,27 @@ export class FleetManager {
         const { spawn } = await import("node:child_process");
         // Plain `agend update`: the CLI picks the channel from the version it is about to replace (a beta install
         // stays on beta). Deciding here, from the package.json next to THIS code, read a source checkout's 1.22.0 as
-        // "not a beta" and sent a beta install to @latest.
-        const command = UPDATE_COMMAND;
+        // "not a beta" and sent a beta install to @latest. #1450 C5: the INSTALLED agend, verified, by absolute path.
+        const installed = await resolveInstalledAgend();
+        if (!installed.ok) {
+            this.failUpdateProgress(`/update cannot verify the installed AgEnD (${installed.reason}). Run \`agend update\` from a shell.`);
+            return;
+        }
         const origin = `slash /update by ${adapterId}:${data.userId}`;
         recordInternalRequest(this.dataDir, "update", origin);
-        const child = spawn("sh", ["-c", `sleep 2 && ${command}`], {
+        const launch = await resolveUpdateLaunch(installed.agend);
+        if (!launch.ok) {
+            this.failUpdateProgress(`/update cannot prepare an independent updater (${launch.reason}). Run ` + "`agend update` from a host shell.");
+            return;
+        }
+        if (this.fleetAdminGate(data.userId, adapterId) !== "ok" || this.shuttingDown) {
+            this.failUpdateProgress(t("not_authorized"));
+            return;
+        }
+        const child = spawn(launch.command, launch.args, {
             detached: true, stdio: "ignore", env: withOrigin(origin),
         });
-        child.once("error", err => this.failUpdateProgress(err.message));
+        watchUpdateLaunch(child, message => this.failUpdateProgress(message));
         child.unref();
     }
     async handleProfileSlash(data, adapterId) {
@@ -1927,7 +2113,7 @@ export class FleetManager {
         await this.handleGeneralProfile(general, msg.userId, adapterId, seconds, async (text) => (await adapter.sendText(msg.chatId, text, { threadId: msg.threadId })).messageId);
     }
     async handleGeneralProfile(general, userId, ingressAdapterId, seconds, respond) {
-        if (!general || !this.fleetConfig?.instances[general]?.general_topic) {
+        if (!general || !Object.hasOwn(this.fleetConfig?.instances ?? {}, general) || !this.fleetConfig?.instances[general]?.general_topic) {
             await respond(t("profile.general_only"));
             return;
         }
@@ -3173,7 +3359,9 @@ export class FleetManager {
                     await this.sendLocalDashboard(data, adapterId);
                     return;
                 }
-                await this.showDashboardMenu(owner, data.respondButtons);
+                // Discord shows a deferred reply that is never answered as "the application did not respond".
+                if (!await this.showDashboardMenu(owner, data.respondButtons, data.retireButtons))
+                    await data.respond(t("dashboard.menu_failed"));
             }
         }
         else if (data.command === "restart") {
@@ -3913,18 +4101,17 @@ export class FleetManager {
     /**
      * Probe the same executable set exposed by the web backend catalog.
      *
-     * This deliberately has no cache: an install `/login` ran can add a
+     * This deliberately skips the cache: an install `/login` ran can add a
      * binary to PATH while the fleet process remains alive, and the next bare
      * `/login` must see it without requiring a restart or an explicit cache
-     * invalidation call.
+     * invalidation call. The fresh answers also refresh the shared cache that
+     * `/ui/backends` reads. #1490: async and bounded, never `which` on the event loop; a probe with no answer in time
+     * counts as not installed, as the old timeout did.
      */
-    probeInstalledBackends() {
-        const installed = new Set();
-        for (const [backend, info] of Object.entries(BACKEND_INSTALLATION_INFO)) {
-            if (checkBinaryInstalled(info.binary))
-                installed.add(backend);
-        }
-        return installed;
+    async probeInstalledBackends() {
+        const entries = Object.entries(BACKEND_INSTALLATION_INFO);
+        const found = await Promise.all(entries.map(([, info]) => binaryProbe.probe(info.binary, { fresh: true })));
+        return new Set(entries.filter((_, i) => { const r = found[i]; return r.known && r.path !== null; }).map(([backend]) => backend));
     }
     /**
      * One fleet-level notice per burst, not one per instance: a post-update herd
@@ -4283,24 +4470,10 @@ export class FleetManager {
         if (!existsSync(envPath))
             return;
         assertSettingsLease(settingsFileResource(envPath), owner);
-        const content = readFileSync(envPath, "utf-8");
-        for (const line of content.split("\n")) {
-            const trimmed = line.trim();
-            if (!trimmed || trimmed.startsWith("#"))
-                continue;
-            const eqIdx = trimmed.indexOf("=");
-            if (eqIdx < 0)
-                continue;
-            // Accept `export KEY=value` — the shell-style form people paste from their
-            // .bashrc. Without this the variable landed in process.env under the key
-            // "export KEY" and silently did nothing.
-            const key = trimmed.slice(0, eqIdx).replace(/^export\s+/, "").trim();
-            const raw = trimmed.slice(eqIdx + 1);
-            const value = raw.replace(/^["'](.*)["']$/, '$1');
-            // .env file always wins over inherited shell env vars, so that
-            // quickstart's newly written token overrides any stale value.
+        // .env file always wins over inherited shell env vars, so that quickstart's newly written token overrides any stale
+        // value. One parser for every reader of .env (env-file.ts): `export KEY=value` included.
+        for (const [key, value] of parseEnvText(readFileSync(envPath, "utf-8")))
             process.env[key] = value;
-        }
     }
     /** Initialize auth before any adapter can answer /dashboard. */
     initializeWebAuthTokens() {
@@ -4429,11 +4602,15 @@ export class FleetManager {
             await adapter?.sendText(msg.chatId, t("dashboard.public_general"), { threadId: msg.threadId });
             return;
         }
-        await this.showDashboardMenu(owner);
+        if (!await this.showDashboardMenu(owner)) {
+            await owner.binding.sendText(owner.chatId, t("dashboard.menu_failed"), { threadId: owner.threadId }).catch(() => undefined);
+        }
     }
     async sendLocalDashboard(data, adapterId) {
-        if (this.shuttingDown || !this.hasFleetAdmins(adapterId) || !this.isFleetAdmin(data.userId, adapterId))
+        if (this.shuttingDown || !this.hasFleetAdmins(adapterId) || !this.isFleetAdmin(data.userId, adapterId)) {
+            await data.respond(t("not_authorized"));
             return;
+        }
         const text = this.topicCommands.getDashboardText();
         const adapter = this.adapters.get(adapterId);
         const token = this.webToken;
@@ -4455,7 +4632,8 @@ export class FleetManager {
                 await withinBudget(adapter.sendDirect(data.userId, privateText, { disablePreview: true }), Math.min(deadline, performance.now() + 5_000));
                 deliveredByDm = true;
             }
-            catch {
+            catch (err) {
+                this.logDashboardDmFailure(err);
                 if (!current())
                     throw new Error("owner changed");
                 const id = await withinBudget(data.respond(privateText), deadline); // native slash response is already ephemeral
@@ -4465,15 +4643,25 @@ export class FleetManager {
             if (!current())
                 throw new Error("owner changed");
             if (deliveredByDm)
-                await withinBudget(data.respond(t("dashboard.private_sent")), deadline);
+                await withinBudget(data.respond(t("dashboard.private_sent_dm")), deadline);
         }
-        catch {
+        catch (err) {
             this.webLoginCodes.revokeIfCurrent(login.issuanceId);
+            this.logger.info({ err: err?.message }, "Dashboard private delivery was not confirmed");
+            await data.respond(t("dashboard.private_failed")).catch(() => undefined);
         }
     }
-    async showDashboardMenu(owner, respondButtons) {
-        if (!this.publicOwnerCurrent(owner))
-            return;
+    /** Why the DM did not go, for the log only (Discord 50007 = the user does not accept DMs from this server's members). */
+    logDashboardDmFailure(err) {
+        const code = err?.code;
+        this.logger.info({ code: typeof code === "string" || typeof code === "number" ? code : undefined, err: err?.message }, "Dashboard DM not delivered; answering privately where the command was used");
+    }
+    /** False when the menu was not shown (the caller still owes the user an answer). */
+    async showDashboardMenu(owner, respondButtons, retireButtons) {
+        if (!this.publicOwnerCurrent(owner)) {
+            this.logger.info("Dashboard menu not shown: the General owner changed");
+            return false;
+        }
         const adapter = owner.binding;
         const status = this.getPublicWebStatus();
         const publicAllowed = publicLinkSettings(this.fleetConfig?.web).allowed;
@@ -4483,7 +4671,7 @@ export class FleetManager {
         const choices = [{ action: "local", label: t("dashboard.local") },
             ...(publicLinkSettings(this.fleetConfig?.web).allowed ? [{ action: "public", label: t("dashboard.public_open") }] : []),
             ...(status.state !== "closed" ? [{ action: "close", label: t("dashboard.public_close") }] : [])];
-        await this.postNonceButtonPromptOrThrow({
+        const posted = await this.postNonceButtonPrompt({
             prefix: "dashboard:", alertType: "login", instanceName: "dashboard", adapter, adapterId: owner.adapterId,
             chatId: owner.chatId, threadId: owner.threadId, timeoutMs: 5 * 60_000,
             message: menuText,
@@ -4492,9 +4680,11 @@ export class FleetManager {
                     const messageId = await respondButtons(menuText, c);
                     if (!messageId)
                         throw new Error("menu refused");
-                    return { chatId: owner.chatId, threadId: owner.threadId, messageId };
+                    // The menu is the command's ephemeral reply: only that interaction can collapse it.
+                    return { chatId: owner.chatId, threadId: owner.threadId, messageId, ...(retireButtons ? { retire: retireButtons } : {}) };
                 } } : {}),
         });
+        return posted !== null;
     }
     async handleDashboardCallback(data, adapterId, adapter) {
         const claimed = this.consumeNonceCallback("dashboard:", /^dashboard:([0-9a-f]{32}):(local|public|close)$/, data, adapterId, adapter);
@@ -4514,9 +4704,26 @@ export class FleetManager {
             const result = await this.publicWebLink?.close("admin close", entry.publicExposureId);
             if (result?.confirmed === false)
                 data.ack?.(t("dashboard.public_cleanup"));
-            await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t("dashboard.public_closed"));
+            await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t("dashboard.public_closed"), data.editClicked);
             return true;
         }
+        // The click is claimed and its buttons are spent: say so on the menu now. A public link follows each of its steps
+        // there (the first one installs cloudflared, which can take a minute): on Discord through the interaction, on
+        // Telegram by editing the menu message itself. Only static words and numbers — the menu may be in General.
+        const progressEdit = data.editClicked ?? entry.retire;
+        const progress = progressEdit && action !== "public"
+            ? progressEdit(t("dashboard.private_sending")).catch(err => this.logger.debug({ err }, "Could not show the dashboard menu's progress"))
+            : Promise.resolve();
+        const stepsEdit = progressEdit ?? (entry.messageId && entry.adapter.editMessageRemoveButtons
+            ? (text) => entry.adapter.editMessageRemoveButtons(entry.chatId, entry.messageId, text, entry.threadId) : undefined);
+        const steps = action === "public" && stepsEdit ? new ThrottledMessageEditor({
+            edit: stepsEdit, now: () => performance.now(), heartbeatMs: 5_000,
+            // Telegram counts edits against a group's ~20 messages a minute.
+            minIntervalMs: owner.binding.type === "telegram" ? 3_000 : 2_000,
+            onError: err => this.logger.debug({ err }, "Could not show the public link's progress"),
+        }) : null;
+        let lastSteps;
+        let deliveredByDm = false;
         const send = async (url, exposureId, expiresAt, current = () => this.publicOwnerCurrent(owner)) => {
             const token = this.webToken;
             if (!token || !current())
@@ -4531,9 +4738,12 @@ export class FleetManager {
                     try {
                         if (!direct.sendDirect)
                             throw new Error("DM unavailable");
-                        return await withinBudget(direct.sendDirect(owner.userId, text, { disablePreview: true, choices: c }), Math.min(deadline, performance.now() + 5_000));
+                        const sent = await withinBudget(direct.sendDirect(owner.userId, text, { disablePreview: true, choices: c }), Math.min(deadline, performance.now() + 5_000));
+                        deliveredByDm = true;
+                        return sent;
                     }
-                    catch {
+                    catch (err) {
+                        this.logDashboardDmFailure(err);
                         if (direct.type !== "discord" || !data.respondPrivate || !current())
                             throw new Error("private delivery unavailable");
                         const sent = await withinBudget(data.respondPrivate(text, c), deadline);
@@ -4552,17 +4762,31 @@ export class FleetManager {
                     throw new Error("owner changed");
                 return true;
             }
-            catch {
+            catch (err) {
                 this.webLoginCodes.revokeIfCurrent(issued.issuanceId);
-                this.logger.info("Dashboard private delivery was not confirmed");
+                this.logger.info({ err: err?.message }, "Dashboard private delivery was not confirmed");
                 return false;
             }
         };
-        const ok = action === "public"
-            ? await this.getPublicWebLink().deliver(owner, link => send(link.url, link.exposureId, link.expiresAt, link.isCurrent))
-            : await send(`http://${this.fleetConfig?.hostname || "localhost"}:${this.fleetConfig?.health_port ?? 19280}/signin`);
+        let ok = false;
+        try {
+            ok = action === "public"
+                ? await this.getPublicWebLink().deliver(owner, link => send(link.url, link.exposureId, link.expiresAt, link.isCurrent), p => {
+                    lastSteps = p;
+                    steps?.update(() => renderPublicLinkProgress(p, performance.now()));
+                })
+                : await send(`http://${this.fleetConfig?.hostname || "localhost"}:${this.fleetConfig?.health_port ?? 19280}/signin`);
+        }
+        catch (err) {
+            // Still closes the step editor below and tells the clicker: a throw must not leave the menu refreshing.
+            this.logger.warn({ err }, "Dashboard sign-in delivery failed");
+        }
         // Only safe, static words enter General; never link, code or platform error text.
-        await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, t(ok ? "dashboard.private_sent" : "dashboard.private_failed"));
+        const outcome = t(!ok ? "dashboard.private_failed"
+            : owner.binding.type !== "discord" ? "dashboard.private_sent" : deliveredByDm ? "dashboard.private_sent_dm" : "dashboard.private_sent_here");
+        await progress;
+        await steps?.close(); // the last step edit has landed: the outcome cannot be overwritten by it
+        await this.retireNonceButtons(entry, entry.messageId ?? data.messageId, lastSteps ? renderPublicLinkProgress(lastSteps, performance.now(), outcome) : outcome, data.editClicked);
         return true;
     }
     /** `/dashboard revoke`: sign out every browser and withdraw any unused code. */
@@ -5274,6 +5498,8 @@ export class FleetManager {
         }
         // Health HTTP endpoint
         this.startHealthServer(fleet.health_port ?? 19280);
+        // #1266: buttons that ended while AgEnD was down (expired, or chosen before a restart) are shown as ended now.
+        void this.replyButtons()?.sweep().catch(err => this.logger.warn({ err }, "Reply-button sweep failed"));
         // Daily update check — first check after 1 hour, then every 24 hours
         this.updateCheckTimer = setTimeout(() => {
             this.checkForUpdates();
@@ -6427,26 +6653,64 @@ export class FleetManager {
         return undefined;
     }
     /**
-     * #1085, defense in depth: a routed Telegram target must belong to the group
-     * the message came from — its own world's group_id. Two Telegram fleet
-     * worlds can number topics alike; a coincidence is dropped, never delivered.
+     * A forum-root command has one configured General before any adapter claims
+     * dedup. Bare commands prefer the primary adapter's General in this group;
+     * explicit suffixes select their own bot. Runtime availability must not pick
+     * another administrator, so stopped owners remain selected and every copy
+     * silently refuses instead of falling back.
+     * undefined = another ingress scope; null = root command with no proven target.
      */
+    telegramRootCommandTarget(msg, threadId) {
+        if (msg.source !== "telegram" || threadId !== undefined || !/^\/\w/.test(msg.text?.trim() ?? ""))
+            return undefined;
+        const channels = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+        const receiving = channels.find(ch => (ch.id ?? ch.type) === msg.adapterId);
+        if (receiving?.type !== "telegram" || receiving.group_id == null || String(receiving.group_id) !== msg.chatId)
+            return undefined;
+        const generals = Object.entries(this.fleetConfig?.instances ?? {}).filter(([, cfg]) => cfg.general_topic === true)
+            .map(([name]) => {
+            const owner = this.getInstanceAdapterId(name);
+            return { name, owner, channel: channels.find(ch => (ch.id ?? ch.type) === owner) };
+        });
+        const candidates = generals.filter(entry => entry.owner && entry.channel?.type === "telegram"
+            && entry.channel.group_id != null && String(entry.channel.group_id) === msg.chatId);
+        const suffix = msg.text?.trim().match(/^\/[\w-]+@(\S+)/)?.[1];
+        let selected;
+        if (suffix) {
+            const matches = candidates.filter(entry => this.worlds.get(entry.owner)?.botUsername?.toLowerCase() === suffix.toLowerCase());
+            const owners = new Set(matches.map(entry => entry.owner));
+            if (owners.size !== 1)
+                return null;
+            selected = matches[0];
+        }
+        else {
+            // An unresolvable General may be the intended primary; do not silently
+            // widen authority to the next readable binding.
+            if (generals.some(entry => !entry.channel || (entry.channel.type === "telegram" && entry.channel.group_id == null)))
+                return null;
+            selected = candidates.find(entry => entry.owner === this.getPrimaryAdapterId()) ?? candidates[0];
+        }
+        return selected?.owner ? { name: selected.name, owner: selected.owner } : null;
+    }
     /**
      * #1346: whether this copy may claim the shared dedup key for
      * command-like text. Fleet topics resolve an owning adapter and only its
      * copy proceeds. Classic targets and unknown routing keep their existing
-     * handling. At the receiving Telegram world's own forum root, an explicit
-     * suffix requires a known matching username before dedup; present-thread
+     * handling. Telegram forum-root commands select a configured General before
+     * dedup. An explicit suffix requires a known matching username; present-thread
      * copies retain their permissive handling when that identity is unknown.
      */
-    isOwnerCommandCopy(msg, threadId) {
+    isOwnerCommandCopy(msg, threadId, rootCommand = this.telegramRootCommandTarget(msg, threadId)) {
+        if (rootCommand !== undefined) {
+            return rootCommand !== null && msg.adapterId === rootCommand.owner && this.daemons.has(rootCommand.name);
+        }
         if (!msg.adapterId)
             return true;
         const suffix = msg.text?.trim().match(/^\/[\w-]+@(\S+)/)?.[1];
         if (threadId === undefined) {
-            // General at the forum root belongs to the receiving world. Prove an
-            // explicit suffix before shared dedup, even when there is no message id.
-            // Classic/private/foreign-forum copies retain their own dispatch rules.
+            // Compatibility for a runtime world without configuration: preserve
+            // explicit receiver proof; Classic/private/foreign-forum copies retain
+            // their own dispatch rules.
             const channels = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
             const channel = channels.find(ch => (ch.id ?? ch.type) === msg.adapterId)
                 ?? this.worlds.get(msg.adapterId)?.channelConfig;
@@ -6476,6 +6740,9 @@ export class FleetManager {
         }
         return true;
     }
+    /**
+     * #1085: coincident topic numbers must not route across Telegram groups.
+     */
     resolveInboundTarget(msg, threadId) {
         if (msg.source !== "telegram")
             return this.routing.resolve(threadId);
@@ -6512,6 +6779,7 @@ export class FleetManager {
             return;
         }
         const threadId = this.inboundRouteThreadId(msg);
+        const rootCommand = this.telegramRootCommandTarget(msg, threadId);
         this.logger.debug({ source: msg.source, chatId: msg.chatId, threadId, userId: msg.userId, isBotMessage: msg.isBotMessage, textLen: (msg.text ?? "").length, text: (msg.text ?? "").slice(0, 80) }, "handleInboundMessage entry");
         // Ownership and per-adapter filtering both run before the dedup claim below.
         // When several bots share a guild they all receive the same message; a copy
@@ -6572,7 +6840,7 @@ export class FleetManager {
         // to flow — so only fleet targets are judged here; the in-handler gates
         // (owner entry check, Discord ignore) cover classic instead.
         if ((msg.messageId || (msg.source === "telegram" && threadId === undefined))
-            && /^\/\w/.test(msg.text?.trim() ?? "") && !this.isOwnerCommandCopy(msg, threadId)) {
+            && /^\/\w/.test(msg.text?.trim() ?? "") && !this.isOwnerCommandCopy(msg, threadId, rootCommand)) {
             this.logger.debug({ adapterId: msg.adapterId, threadId }, "Non-owner command copy — skipping before dedup claim");
             return;
         }
@@ -6879,7 +7147,7 @@ export class FleetManager {
             }
             // General topic: Discord /xxx gets the system note first (never a
             // command); other sources fall through to the handlers below.
-            const generalInstance = this.findGeneralInstance(msg.adapterId);
+            const generalInstance = rootCommand?.name ?? this.findGeneralInstance(msg.adapterId);
             if (generalInstance && await this.replyDiscordNotACommand(msg, generalInstance))
                 return;
             if (generalInstance && await this.topicCommands.handleInstanceCommand(msg, generalInstance))
@@ -7268,6 +7536,12 @@ export class FleetManager {
                     return;
                 }
             }
+            // #1266: buttons are checked before anything is sent, like stickers.
+            const parsedButtons = parseReplyButtons(args.buttons, args);
+            if (parsedButtons && "error" in parsedButtons) {
+                respond(null, `reply: ${parsedButtons.error}`);
+                return;
+            }
             // Stickers (#1226) are checked before anything is sent: a refused one is the reply's error, not a gap.
             const stickerProblem = await this.replyStickerProblem(outAdapter, args, threadId, contextAdapterId ?? this.getInstanceAdapterId(senderInstanceName ?? instanceName));
             if (stickerProblem) {
@@ -7280,8 +7554,33 @@ export class FleetManager {
                 ticket.subscribe(respond);
                 return;
             }
+            // #1266: the buttons' set, before the send (a click cannot match it until the message is known). Where buttons
+            // cannot be shown, the choices go into the text instead.
+            let replySet = null;
+            if (parsedButtons && "buttons" in parsedButtons) {
+                const buttons = outAdapter.supportsReplyButtons ? this.replyButtons() : null;
+                if (buttons) {
+                    const outId = outAdapter === WEB_ONLY_REPLY_SINK ? "web" : outAdapter.id ?? contextAdapterId ?? "";
+                    replySet = buttons.prepare({ instance: instanceName, adapterId: outId, chatId: String(args.chat_id ?? ""), threadId }, parsedButtons.buttons);
+                }
+                else {
+                    args.text = `${String(args.text)}\n\n${replyButtonsFallbackText(parsedButtons.buttons)}`;
+                }
+            }
             const original = respond;
             const respondAndRecord = (result, error) => {
+                let buttonsView = null;
+                if (replySet) {
+                    const sent = result;
+                    const carrying = sent?.buttonsMessageId ?? sent?.messageId;
+                    if (!error && carrying) {
+                        this.replyButtonsCtl?.bind(replySet.id, carrying);
+                        buttonsView = this.replyButtonsCtl?.viewOf(replySet.id) ?? null;
+                    }
+                    else {
+                        this.replyButtonsCtl?.discard(replySet.id);
+                    }
+                }
                 ticket.complete(result, error);
                 // Return the platform outcome first. Bookkeeping below must never turn
                 // a confirmed Discord/Telegram POST into a tool error if a secondary
@@ -7294,7 +7593,7 @@ export class FleetManager {
                 // an agent cannot invent it to suppress the normal completion marker.
                 if (!error && result != null && msg.statusOnly !== true) {
                     try {
-                        this.afterReplyRouted(instanceName, args, senderSessionName);
+                        this.afterReplyRouted(instanceName, args, senderSessionName, buttonsView);
                     }
                     catch (err) {
                         this.logger.warn({ err, instanceName }, "Reply delivered but post-delivery bookkeeping failed");
@@ -7309,9 +7608,11 @@ export class FleetManager {
                     });
                 }
             };
-            if (routeToolCall(outAdapter, tool, args, threadId, respondAndRecord)) {
+            if (routeToolCall(outAdapter, tool, args, threadId, respondAndRecord, replySet ? { replyButtons: replySet.callbacks } : {})) {
                 return;
             }
+            if (replySet)
+                this.replyButtonsCtl?.discard(replySet.id);
             // routeToolCall knows "reply"; not handling it means the world changed.
             ticket.complete(null, "reply not handled");
             original(null, "reply not handled");
@@ -7345,7 +7646,7 @@ export class FleetManager {
     webOnlyPromptPlace() {
         return this.worlds.size === 0 && this.isWebOnlyFleet() ? { adapter: WEB_ONLY_PROMPT_SINK, adapterId: "web", chatId: "web" } : null;
     }
-    afterReplyRouted(instanceName, args, senderSessionName) {
+    afterReplyRouted(instanceName, args, senderSessionName, buttons = null) {
         // A reply is NOT proof the turn is over (#410) — but it is not proof of
         // more work either. Split the difference: an instance that is clearly
         // idle loses the button now; one that looks busy keeps it (re-posted
@@ -7376,6 +7677,7 @@ export class FleetManager {
             text: (args.text ?? "").slice(0, WEB_CHAT_TEXT_MAX),
             ts: new Date().toISOString(),
             ...(attachments.length ? { attachments } : {}),
+            ...(buttons ? { buttons } : {}), // #1266
         });
         // Log bot reply to classic instance chat-log
         const isClassic = this.classicChannels?.getChannelIdByInstance(instanceName) !== undefined;
@@ -8579,15 +8881,48 @@ export class FleetManager {
         const output = String(this.rawFleetDocument);
         if (redundantPaths.length > 0)
             this.writeFleetConfigBackup(source);
-        const tempPath = `${this.configPath}.tmp-${process.pid}`;
-        writeFileSync(tempPath, output, "utf-8");
-        if (existsSync(this.configPath))
-            chmodSync(tempPath, statSync(this.configPath).mode);
-        renameSync(tempPath, this.configPath);
+        // Atomic write with fsync. The beforeRename hook runs after fsync and
+        // before rename so validation failures are reported before the file is
+        // replaced (#1056), and the temp file is cleaned up on any throw.
+        atomicWriteFileSync(this.configPath, output, {
+            mode: existsSync(this.configPath) ? statSync(this.configPath).mode : 0o644,
+            fsync: this.fsyncForTest,
+            beforeRename: (tempPath) => {
+                // #1056 (Fable's 2.2 audit): the patcher writes leaves, not configs, so
+                // a wrong patch can produce a file the validator — or the next start —
+                // refuses. Load and validate what is about to replace fleet.yaml.
+                const refusal = this.savedFleetConfigProblem(tempPath);
+                if (refusal)
+                    throw new Error(refusal);
+                if (existsSync(this.configPath))
+                    chmodSync(tempPath, statSync(this.configPath).mode);
+            },
+        });
         this.rawFleetConfig = loadRawFleetConfig(this.configPath);
         this.savedFleetConfigSnapshot = structuredClone(this.fleetConfig);
         this.logger.info({ path: this.configPath, strippedDefaults: redundantPaths.length }, "Saved fleet config (lossless patch)");
     }
+    /** Why the config written to `candidate` must not replace fleet.yaml, or null: it does not load, or it adds errors. */
+    savedFleetConfigProblem(candidate) {
+        let after;
+        try {
+            after = validateFleetConfig(loadFleetConfig(candidate));
+        }
+        catch (err) {
+            return `Refusing to save fleet.yaml: the result would not load (${err.message})`;
+        }
+        let had = new Set();
+        try {
+            if (this.configPath && existsSync(this.configPath)) {
+                had = new Set(validateFleetConfig(loadFleetConfig(this.configPath)).errors.map(e => `${e.path}\u0000${e.message}`));
+            }
+        }
+        catch { /* the current file does not load: every error of the result counts as new */ }
+        const introduced = after.errors.filter(e => !had.has(`${e.path}\u0000${e.message}`));
+        return introduced.length
+            ? `Refusing to save fleet.yaml: it would be invalid (${introduced.map(e => `${e.path}: ${e.message}`).join("; ")})`
+            : null;
+    }
     /** One-time upgrade migration; invalid YAML is never rewritten. */
     slimFleetConfigAtStartup() {
         const redundantPaths = collectRedundantInstanceDefaultPaths(this.rawFleetConfig);
@@ -8646,6 +8981,20 @@ export class FleetManager {
         }
         const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
         if (isRecord(before) && isRecord(after)) {
+            // #1056: a legacy `channel` is being migrated (the caller removed it and kept `channels`). The file has no
+            // `channels` for the leaf patch below to land on — the snapshot's list is only the normalized alias — so a bare
+            // channels[0] holding just the changed field would be written while `channel` is deleted. Move the connection
+            // as it is in the file NOW (a concurrent or manual edit, an option AgEnD does not know) into channels[0]
+            // first; the patch then applies only this save's own changes on top, with the usual identity/order check.
+            if (path.length === 0 && this.rawFleetConfig.channel && !this.rawFleetConfig.channels
+                && after.channel === undefined && Array.isArray(after.channels) && !document.hasIn(["channels"])) {
+                const fresh = document.getIn(["channel"], true);
+                if (isMap(fresh)) {
+                    const list = document.createNode([]);
+                    list.items.push(fresh.clone());
+                    document.setIn(["channels"], list);
+                }
+            }
             const keys = new Set([...Object.keys(before), ...Object.keys(after)]);
             for (const key of keys) {
                 // `channel` is a derived alias when the raw file uses `channels`.
@@ -8790,6 +9139,21 @@ export class FleetManager {
      * to a plain add (never worse than the old behaviour).
      */
     lastStatusEmoji = new Map();
+    /**
+     * #1056: every status emoji each bot really stamped, per `${adapterId}:${messageId}` (match keys). A connection's
+     * status set can change while AgEnD runs, so "is this a stamp?" cannot be answered from the current set alone: a
+     * bot's earlier stamp in the old emoji must still be plumbing, not an agent's reaction. Unbounded for the same
+     * reason as lastStatusEmoji (a few short strings per stamped message).
+     */
+    stampedStatus = new Map();
+    noteStamped(adapter, messageId, emoji) {
+        const adapterId = typeof adapter.id === "string" ? adapter.id : "?";
+        const k = `${adapterId}:${messageId}`;
+        let set = this.stampedStatus.get(k);
+        if (!set)
+            this.stampedStatus.set(k, set = new Set());
+        set.add(statusMatchKey(emoji));
+    }
     /**
      * One in-flight status update per bot+message: updates run strictly in call
      * order, so a delayed ❌ add can never land after a newer ✅'s removal —
@@ -8812,7 +9176,7 @@ export class FleetManager {
      */
     resolveStatusEmojisFor(instanceName, adapterId, adapter) {
         const worldId = adapterId ?? this.getInstanceAdapterId(instanceName);
-        const channel = (worldId ? this.worlds.get(worldId)?.channelConfig : undefined) ?? this.getChannelConfig(worldId ?? undefined);
+        const channel = this.statusEmojiChannel(worldId);
         // The adapter that will react decides the vocabulary: a Telegram bot gets
         // Telegram's reaction set even if the channel lookup fell back elsewhere.
         const reacting = adapter ?? (worldId ? this.worlds.get(worldId)?.adapter : undefined) ?? this.adapter;
@@ -8833,6 +9197,22 @@ export class FleetManager {
         return { ...resolved, platform };
     }
     warnedStatusEmojis = new Set();
+    /**
+     * The connection whose `options.status_emojis` an instance on `worldId` stamps with. #1056: read from the live config
+     * first — a Settings save replaces `fleetConfig.channels`, and the running world keeps the object it started with —
+     * so a change to the connection's emojis applies at the next stamp, as an instance's own override does. Only the
+     * emoji options are taken from it: the platform is still the running adapter's (resolveStatusEmojisFor).
+     */
+    statusEmojiChannel(worldId) {
+        const started = (worldId ? this.worlds.get(worldId)?.channelConfig : undefined) ?? this.getChannelConfig(worldId ?? undefined);
+        if (!worldId)
+            return started;
+        const list = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+        const live = list.find(ch => (ch.id ?? ch.type) === worldId);
+        if (!live || !started)
+            return live ?? started;
+        return { ...started, options: { ...(started.options ?? {}), status_emojis: live.options?.status_emojis } };
+    }
     /**
      * A Discord connection's server emojis for the Settings picker (#1005), from
      * every server its bot can draw on (#1021): the primary `group_id` server,
@@ -8922,11 +9302,18 @@ export class FleetManager {
             return { error: this.personaEmojiMissing(instanceName) };
         const worldId = this.getInstanceAdapterId(instanceName);
         const { platform } = this.resolveStatusEmojisFor(instanceName);
-        const channel = (worldId ? this.worlds.get(worldId)?.channelConfig : undefined) ?? this.getChannelConfig(worldId ?? undefined);
+        const channel = this.statusEmojiChannel(worldId);
         const current = previewStatusEmojis({ platform, platformConfig: channel?.options?.status_emojis, instanceConfig: self?.status_emojis });
         const out = {
             platform: platform ?? null,
-            statuses: current.entries.map(e => ({ status: e.key, value: e.value, source: e.source })),
+            // #1056: progress_prefix is the emoji at the start of the progress message, not a reaction stamp.
+            statuses: current.entries.map(e => ({ status: e.key, value: e.value, source: e.source, kind: e.key === "progress_prefix" ? "text_prefix" : "reaction" })),
+            // #1056: say inline why the lists differ by platform, so an agent need not know it already.
+            platform_note: platform === "telegram"
+                ? "Telegram has no server custom emoji, so there is no server_emojis list: standard.reactions is the complete set a status reaction can use. progress_prefix is message text, not a reaction, so any single emoji works there."
+                : platform === "discord"
+                    ? "A status reaction can be any single emoji, or a server emoji from server_emojis as <:name:id> (one of the servers this bot is in). progress_prefix is message text, not a reaction."
+                    : "This instance has no chat connection, so no platform rules apply yet.",
             standard: platform === "telegram"
                 ? { reactions: [...TELEGRAM_REACTION_EMOJIS], note: "Telegram reacts only with these; progress_prefix may be any single emoji" }
                 : { suggestions: STATUS_EMOJI_SUGGESTIONS, note: "any single emoji works" },
@@ -9365,6 +9752,9 @@ export class FleetManager {
             const reactorWorlds = new Set(worlds.filter(w => w.botUserId === r.userId).map(w => w.id));
             if (reactorWorlds.size === 0)
                 return false; // a human, or a bot outside this fleet
+            // #1056: what this bot really stamped on this message, whatever its status set says now.
+            if ([...reactorWorlds].some(id => this.stampedStatus.get(`${id}:${r.messageId}`)?.has(key)))
+                return true;
             return [...names]
                 .filter(n => reactorWorlds.has(this.getInstanceAdapterId(n) ?? ""))
                 .some(n => statusMatchKeys(this.resolveStatusEmojisFor(n)).includes(key));
@@ -9372,6 +9762,8 @@ export class FleetManager {
         // Fallback: the built-in ladder (as before #1005) plus every value an
         // operator configured. Not the Telegram built-ins — 👎 is AgEnD's failed
         // stamp there, but also far too common a human reaction to swallow blind.
+        if (worlds.some(w => this.stampedStatus.get(`${w.id}:${r.messageId}`)?.has(key)))
+            return true; // #1056, as above
         const keys = new Set(statusMatchKeys(builtinStatusEmojis(undefined)));
         for (const name of names) {
             const resolved = this.resolveStatusEmojisFor(name);
@@ -9394,9 +9786,15 @@ export class FleetManager {
         const emoji = this.receivedReactionFor(instanceName, adapter, msg.adapterId);
         // Classic's system receipt is status-owned too. An ordinary react call
         // would label it as an agent/other reaction and suppress later statuses.
+        // #1056: recorded as this bot's stamp like the delivery statuses (provenance survives a status-set change) —
+        // on Telegram once the adapter took the slot, on Discord before the add (its gateway can echo it first).
         if (adapter instanceof TelegramAdapter) {
-            return adapter.reactDeliveryStatus(msg.chatId, msg.messageId, emoji, msg.timestamp.getTime()).then(() => { });
+            return adapter.reactDeliveryStatus(msg.chatId, msg.messageId, emoji, msg.timestamp.getTime()).then((took) => {
+                if (took)
+                    this.noteStamped(adapter, msg.messageId, emoji);
+            });
         }
+        this.noteStamped(adapter, msg.messageId, emoji);
         return adapter.react(msg.threadId ?? msg.chatId, msg.messageId, emoji);
     }
     reactClassicForwardedAttachment(instanceName, adapter, msg, kind) {
@@ -9482,8 +9880,10 @@ export class FleetManager {
                 if (await adapter.reactDeliveryStatus(chatId, messageId, emoji, receivedAt)) {
                     if (emoji == null)
                         this.lastStatusEmoji.delete(key);
-                    else
+                    else {
                         this.lastStatusEmoji.set(key, { emoji, status });
+                        this.noteStamped(adapter, messageId, emoji);
+                    }
                 }
                 return;
             }
@@ -9507,6 +9907,8 @@ export class FleetManager {
                 // Best effort: a failed removal must not block the new status.
                 await adapter.unreact(target, messageId, last.emoji, threadId).catch(e => this.logger.debug({ err: e.message }, "Delivery status reaction removal failed"));
             }
+            // Recorded before the add: Discord can report the reaction back before react() resolves.
+            this.noteStamped(adapter, messageId, emoji);
             await adapter.react(target, messageId, emoji, threadId);
             this.lastStatusEmoji.set(key, { emoji, status });
         }
@@ -9694,13 +10096,28 @@ export class FleetManager {
     wasDeliveryIdPrunedForCaller(deliveryId, callerInstance) {
         return this.deliveryOutbox?.wasDeliveryIdPrunedForCaller(deliveryId, callerInstance) ?? false;
     }
+    /** How long opening events.db waits for another process's lock (a field so tests need not wait 5 s). */
+    eventLogBusyTimeoutMs = 5000;
     openEventLog() {
         const dbPath = join(this.dataDir, "events.db");
         try {
-            return new EventLog(dbPath);
+            return new EventLog(dbPath, { busyTimeoutMs: this.eventLogBusyTimeoutMs });
         }
         catch (err) {
-            this.logger.error({ err, dbPath }, "events.db unusable — moving it aside and starting a fresh one");
+            // #1490: only a file SQLite proved corrupt is moved aside. A lock (it outlasted the busy timeout), a driver that
+            // cannot load (ABI), or a permission/I/O problem says nothing against the file: it stays where it is, history
+            // intact, and the fleet runs without event logging until it restarts.
+            const kind = classifySqliteOpenError(err);
+            if (kind !== "corrupt") {
+                const key = kind === "busy" ? "eventlog.locked" : kind === "abi" ? "eventlog.abi" : "eventlog.unopenable";
+                this.logger.error({ err, dbPath, kind }, `events.db not opened (${kind}) — left in place; continuing without event logging`);
+                try {
+                    this.notifyFleetError(t(key));
+                }
+                catch { /* best effort: adapters may not be up yet; the log line stands */ }
+                return null;
+            }
+            this.logger.error({ err, dbPath }, "events.db is corrupt — moving it aside and starting a fresh one");
             const stamp = new Date().toISOString().replace(/[:.]/g, "-");
             for (const suffix of ["", "-wal", "-shm"]) {
                 try {
@@ -9709,7 +10126,7 @@ export class FleetManager {
                 catch { /* may not exist */ }
             }
             try {
-                return new EventLog(dbPath);
+                return new EventLog(dbPath, { busyTimeoutMs: this.eventLogBusyTimeoutMs });
             }
             catch (retryErr) {
                 // History is worth losing; a fleet that won't start is not.
@@ -9985,9 +10402,7 @@ export class FleetManager {
                 return;
             this.pendingNonceButtons.delete(nonce);
             this.webPromptGone(entry, entry.expiredText);
-            if (entry.messageId && entry.adapter.editMessageRemoveButtons) {
-                entry.adapter.editMessageRemoveButtons(entry.chatId, entry.messageId, entry.expiredText, entry.threadId).catch(err => this.logger.debug({ err, instanceName: entry.instanceName, prefix: entry.prefix }, "Failed to expire button prompt"));
-            }
+            this.collapseNoncePrompt(entry)?.catch(err => this.logger.debug({ err, instanceName: entry.instanceName, prefix: entry.prefix }, "Failed to expire button prompt"));
         }, opts.timeoutMs ?? NONCE_BUTTON_TIMEOUT_MS);
         entry.timer.unref?.();
         this.pendingNonceButtons.set(nonce, entry);
@@ -10011,6 +10426,8 @@ export class FleetManager {
                 entry.threadId = sent.threadId;
             }
             entry.messageId = sent.messageId;
+            if (sent.retire)
+                entry.retire = sent.retire;
             // Offered on the dashboard only once it is live on the platform (a failed post is disarmed above),
             // and only if nothing claimed or expired it meanwhile.
             if (WEB_MIRRORED_PROMPT_PREFIXES.has(opts.prefix) && this.pendingNonceButtons.get(nonce) === entry) {
@@ -10042,7 +10459,7 @@ export class FleetManager {
      * longer parses) collapses the clicked message so the dead button stops
      * inviting clicks — the same courtesy the cancel button extends.
      */
-    consumeNonceCallback(prefix, actionRe, data, callbackAdapterId, receivingAdapter, staleHandling) {
+    consumeNonceCallback(prefix, actionRe, data, callbackAdapterId, receivingAdapter, staleHandling, authorize) {
         if (!data.callbackData.startsWith(prefix))
             return null;
         const match = data.callbackData.match(actionRe);
@@ -10061,6 +10478,9 @@ export class FleetManager {
             if (staleHandling?.keepText && adapter?.removeMessageButtons) {
                 adapter.removeMessageButtons(data.chatId, data.messageId, data.threadId).catch(collapseFailed);
             }
+            else if (data.editClicked) {
+                data.editClicked(t("buttons.stale")).catch(collapseFailed);
+            }
             else {
                 adapter?.editMessageRemoveButtons?.(data.chatId, data.messageId, t("buttons.stale"), data.threadId).catch(collapseFailed);
             }
@@ -10079,11 +10499,13 @@ export class FleetManager {
         const isAuthorized = fromWeb
             ? pending.web !== undefined
             : data.userId
-                ? pending.allowAnyUser
-                    ? true
-                    : pending.authChannelId
-                        ? this.isModelAdmin(data.userId, pending.authChannelId, callbackAdapterId)
-                        : this.isFleetAdmin(data.userId, callbackAdapterId)
+                ? authorize
+                    ? authorize(data.userId, pending)
+                    : pending.allowAnyUser
+                        ? true
+                        : pending.authChannelId
+                            ? this.isModelAdmin(data.userId, pending.authChannelId, callbackAdapterId)
+                            : this.isFleetAdmin(data.userId, callbackAdapterId)
                 : false;
         const mismatchedFields = [];
         if (pending.adapterId !== callbackAdapterId)
@@ -10157,6 +10579,14 @@ export class FleetManager {
     }
     /** Routes a click to the handler that owns its prefix; false when none does. */
     async dispatchAdapterCallback(data, adapterId, adapter) {
+        if (data.callbackData.startsWith(REPLY_BUTTON_PREFIX)) { // #1266
+            const buttons = this.replyButtons();
+            if (!buttons) {
+                data.ack?.(t("reply_buttons.closed"));
+                return true;
+            }
+            return buttons.handleCallback(data, adapterId);
+        }
         if (this.needsYou?.handleCallback(data, adapterId))
             return true;
         if (await this.handleTipDismiss(data, adapterId, adapter))
@@ -10253,6 +10683,38 @@ export class FleetManager {
             },
         });
     }
+    cacheService = null;
+    /**
+     * #1468: the prompt-cache expiry analysis for the web, per instance, over `window`. Read from each instance's
+     * ledger as it is now; the first request starts the bounded, persisted catch-up over the transcripts
+     * (cache-service.ts) — never a vendor call, never a synchronous transcript read.
+     */
+    cacheReport(window) {
+        const w = Object.prototype.hasOwnProperty.call(WINDOWS, window) ? window : "7d";
+        this.cacheService ??= new CacheService({
+            // fleet.yaml's instances, then the ClassicBot rooms (their workspace under the AgEnD home, their own backend).
+            instances: () => {
+                const fleet = Object.entries(this.fleetConfig?.instances ?? {}).map(([name, cfg]) => ({
+                    name, backend: this.backendNameOf(name), workingDirectory: cfg.working_directory, ledgerPath: join(this.getInstanceDir(name), "cache-ledger.json"),
+                }));
+                const taken = new Set(fleet.map(i => i.name));
+                const classic = (this.classicChannels?.getAll() ?? []).filter(ch => !taken.has(ch.instanceName)).map(ch => ({
+                    name: ch.instanceName,
+                    backend: this.classicChannels?.getBackendByInstance(ch.instanceName, this.fleetConfig?.defaults?.backend) ?? this.fleetConfig?.defaults?.backend ?? "claude-code",
+                    workingDirectory: join(getAgendHome(), "workspaces", ch.instanceName),
+                    ledgerPath: join(this.getInstanceDir(ch.instanceName), "cache-ledger.json"),
+                }));
+                return [...fleet, ...new Map(classic.map(c => [c.name, c])).values()];
+            },
+            claudeProjectsDir: () => join(process.env.CLAUDE_CONFIG_DIR?.trim() || join(homedir(), ".claude"), "projects"),
+            claudeKey: claudeProjectKey,
+            codexSessionsDir: () => join(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"), "sessions"),
+            listRollouts: root => sharedRolloutIndex(root).list(),
+            metaPath: join(this.dataDir, "cache-codex-rollouts.json"),
+            log: (level, msg, extra) => this.logger[level](extra ?? {}, msg),
+        });
+        return this.cacheService.report(w);
+    }
     /** The web's Acknowledge (any item; a signed-in session is fleet-admin level). */
     acknowledgeNeedsItem(id, principal) {
         if (!this.needsYou)
@@ -10395,6 +10857,11 @@ export class FleetManager {
      * The caller has passed the /ui gate (session, same origin, CSRF). Here: the prompt must be one offered
      * on the dashboard, about the instance the page named, and the action one of its own buttons.
      */
+    /** #1266: a click on a reply's button in the web chat (the /ui gate is passed: a session, or the public link). */
+    clickWebReplyButton(instance, id, index) {
+        const buttons = this.replyButtons();
+        return buttons ? buttons.clickWeb(instance, id, index) : Promise.resolve({ status: 409, error: t("reply_buttons.closed") });
+    }
     async clickWebPrompt(instance, nonce, action) {
         if (!/^[0-9a-f]{32}$/.test(nonce) || !/^[a-z][a-z-]{0,23}$/.test(action))
             return { status: 400, error: "Malformed prompt answer" };
@@ -10423,9 +10890,16 @@ export class FleetManager {
             return { status: 200 };
         return { status: 409, error: notice ?? "This prompt is no longer open" };
     }
-    async retireNonceButtons(pending, messageId, text) {
+    async retireNonceButtons(pending, messageId, text, 
+    /** The click's own edit of a private prompt (AdapterCallbackData.editClicked); preferred over the prompt's. */
+    editClicked) {
         this.webPromptGone(pending, text);
         try {
+            const retire = editClicked ?? pending.retire;
+            if (retire) {
+                await retire(text);
+                return;
+            }
             if (!pending.adapter.editMessageRemoveButtons)
                 throw new Error("adapter cannot remove prompt buttons");
             await pending.adapter.editMessageRemoveButtons(pending.chatId, messageId, text, pending.threadId);
@@ -10680,29 +11154,18 @@ export class FleetManager {
         });
         return nonce ? null : t("clear.prompt_unavailable");
     }
-    /** Consume `/clear` Confirm/Cancel exactly once; only Confirm reaches IPC. */
-    async handleClearConfirmation(data, callbackAdapterId, receivingAdapter) {
-        const claimed = this.consumeNonceCallback(CLEAR_CONFIRM_CALLBACK_PREFIX, /^clear-confirm:([0-9a-f]+):(confirm|cancel)$/, data, callbackAdapterId, receivingAdapter);
-        if (claimed === null)
-            return false;
-        if (claimed === "consumed")
-            return true;
-        const { entry: pending, action } = claimed;
-        this.eventLog?.insert(pending.instanceName, "clear_action", { action, userId: data.userId });
-        if (action === "cancel") {
-            await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("clear.cancelled", pending.instanceName));
-            return true;
-        }
-        // The nonce was claimed synchronously. Keep the exact owner across platform
-        // retirement awaits; a replacement with the same name is not this clear's
-        // target, and a role granted at claim time may be revoked while editing.
-        const ipc = this.instanceIpcClients.get(pending.instanceName);
-        const daemon = this.daemons.get(pending.instanceName);
-        const epoch = this.getDeliveryEpoch(pending.instanceName);
-        const groupId = this.getChannelConfig(callbackAdapterId)?.group_id;
+    /**
+     * What a confirmed /clear must still find when it acts — shared by the platform's Confirm button and the web
+     * (#1269): the same daemon and IPC client, the same interaction owner, lifecycle epoch and delivery epoch as when the
+     * fence was taken. Null when there is no owner to pin (then nothing may be cleared). The reads are cached and
+     * synchronous; they never probe the pane.
+     */
+    clearTargetFence(instanceName) {
+        const ipc = this.instanceIpcClients.get(instanceName);
+        const daemon = this.daemons.get(instanceName);
+        const epoch = this.getDeliveryEpoch(instanceName);
         // Object identity survives a resident daemon's respawn/freeze, and stop
         // invalidates its lifecycle epoch before the queued work replaces objects.
-        // These reads are cached and synchronous; they never probe the pane.
         const readOwner = () => {
             try {
                 const owner = daemon?.getInteractionSnapshot?.()?.owner;
@@ -10718,7 +11181,7 @@ export class FleetManager {
         };
         const readLifecycleEpoch = () => {
             try {
-                const value = this.lifecycle?.epochOf(pending.instanceName);
+                const value = this.lifecycle?.epochOf(instanceName);
                 return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : null;
             }
             catch {
@@ -10726,8 +11189,112 @@ export class FleetManager {
             }
         };
         const owner = readOwner(), lifecycleEpoch = readLifecycleEpoch();
+        if (owner === null || lifecycleEpoch === null)
+            return null;
+        return () => {
+            try {
+                const currentOwner = readOwner();
+                return this.daemons.get(instanceName) === daemon
+                    && this.instanceIpcClients.get(instanceName) === ipc
+                    && currentOwner !== null && sameInteractionOwner(owner, currentOwner)
+                    && readLifecycleEpoch() === lifecycleEpoch
+                    && this.isDeliveryEpochCurrent(instanceName, epoch);
+            }
+            catch {
+                return false;
+            }
+        };
+    }
+    /** #1269: the web's /clear confirmations — one token per question, used once, for the instance as it was asked about. */
+    webClearTokens = new Map();
+    /** #1269: an instance's chat command from the web chat (web-commands.ts); `publicLink`: a gateway request. */
+    webCommand(input, opts) {
+        const webMeta = (instance) => {
+            const topicId = this.fleetConfig?.instances[instance]?.topic_id;
+            return {
+                chatId: this.getGroupIdForInstance(instance) || "", messageId: newWebMessageId(), username: "web-user", userId: "web-user",
+                threadId: topicId != null ? String(topicId) : undefined, adapterId: this.getAdapterForInstance(instance)?.id ?? "", source: "web",
+            };
+        };
+        const choicesFromCache = (instance) => {
+            const cached = this.readCliEnv(this.backendNameForInstance(instance)); // the cached catalog only: never a probe here
+            if (!cached?.models.length)
+                return null;
+            const current = this.resolveInstanceModel(instance).model;
+            return { current, options: cached.models.map(o => ({ id: o.id, label: this.modelChoiceLabel(o, current) })) };
+        };
+        return runWebCommand({
+            // Own entries only: a name like "__proto__" or "constructor" must not be found on the prototype (#1476 review).
+            scope: (instance) => {
+                const instances = this.fleetConfig?.instances;
+                if (instances && Object.prototype.hasOwnProperty.call(instances, instance))
+                    return isGeneralInstance(this.fleetConfig, instance) ? "general" : "fleet";
+                return this.classicChannels?.getChannelIdByInstance(instance) !== undefined ? "classic" : null;
+            },
+            ctx: (instance) => this.topicCommands.getCtxText(instance),
+            compact: (instance, instructions) => this.topicCommands.sendCompact(instance, instructions),
+            applyModel: (instance, name) => this.applyModel(instance, name),
+            modelChoices: choicesFromCache,
+            applyEffort: (instance, level) => this.applyEffort(instance, level),
+            effortChoices: (instance) => {
+                const levels = this.effortLevelsFor(instance);
+                if (!levels.length)
+                    return null;
+                const current = this.resolveInstanceEffort(instance).effort;
+                return { current, options: levels.map(l => ({ id: l, label: this.effortChoiceLabel(l, current) })) };
+            },
+            cancel: (instance) => this.cancelInstance(instance),
+            steer: (instance, text) => this.topicCommands.sendSteer(instance, text, webMeta(instance)),
+            btw: (instance, text) => this.topicCommands.sendBtw(instance, text, webMeta(instance)),
+            pauseWake: (instance, action) => this.topicCommands.runPauseWake(instance, action),
+            save: (instance, filename) => this.topicCommands.sendSave(instance, filename),
+            clearAsk: (instance) => {
+                if (!this.topicCommands.supportsClear(instance))
+                    return { refused: t("clear.unsupported") };
+                const fence = this.clearTargetFence(instance);
+                if (!fence)
+                    return { refused: t("clear.not_connected") };
+                const now = performance.now();
+                for (const [k, v] of this.webClearTokens)
+                    if (v.deadline < now)
+                        this.webClearTokens.delete(k);
+                const token = randomBytes(16).toString("hex");
+                this.webClearTokens.set(token, { instance, fence, deadline: now + CLEAR_CONFIRM_TIMEOUT_MS });
+                return { token, message: t("clear.confirm_message", instance) };
+            },
+            clearConfirm: async (instance, token) => {
+                const entry = this.webClearTokens.get(token);
+                this.webClearTokens.delete(token); // used once, whatever happens next
+                if (!entry || entry.instance !== instance || performance.now() > entry.deadline)
+                    return { status: 409, text: t("clear.expired", instance) };
+                this.eventLog?.insert(instance, "clear_action", { action: "confirm", userId: "web" });
+                // sendClear sends its first IPC synchronously: no await separates this check from the effect.
+                if (this.shuttingDown || !entry.fence())
+                    return { status: 409, text: t("menu.click_stale") };
+                return { status: 200, text: await this.topicCommands.sendClear(instance) };
+            },
+            t: (key, ...args) => t(key, ...args),
+        }, input, opts);
+    }
+    /** Consume `/clear` Confirm/Cancel exactly once; only Confirm reaches IPC. */
+    async handleClearConfirmation(data, callbackAdapterId, receivingAdapter) {
+        const claimed = this.consumeNonceCallback(CLEAR_CONFIRM_CALLBACK_PREFIX, /^clear-confirm:([0-9a-f]+):(confirm|cancel)$/, data, callbackAdapterId, receivingAdapter);
+        if (claimed === null)
+            return false;
+        if (claimed === "consumed")
+            return true;
+        const { entry: pending, action } = claimed;
+        this.eventLog?.insert(pending.instanceName, "clear_action", { action, userId: data.userId });
+        if (action === "cancel") {
+            await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("clear.cancelled", pending.instanceName));
+            return true;
+        }
+        // The nonce was claimed synchronously. Keep the exact owner across platform
+        // retirement awaits; a replacement with the same name is not this clear's
+        // target, and a role granted at claim time may be revoked while editing.
+        const target = this.clearTargetFence(pending.instanceName);
+        const groupId = this.getChannelConfig(callbackAdapterId)?.group_id;
         const current = () => {
-            const currentOwner = readOwner();
             try {
                 return !this.shuttingDown
                     && !!data.userId && !!pending.authChannelId
@@ -10739,11 +11306,7 @@ export class FleetManager {
                         ? pending.adapter.type !== "telegram" || pending.chatId === pending.authChannelId
                         : String(this.getChannelConfig(callbackAdapterId)?.group_id ?? "") === pending.chatId)
                     && this.getChannelConfig(callbackAdapterId)?.group_id === groupId
-                    && this.daemons.get(pending.instanceName) === daemon
-                    && this.instanceIpcClients.get(pending.instanceName) === ipc
-                    && owner !== null && currentOwner !== null && sameInteractionOwner(owner, currentOwner)
-                    && lifecycleEpoch !== null && readLifecycleEpoch() === lifecycleEpoch
-                    && this.isDeliveryEpochCurrent(pending.instanceName, epoch);
+                    && target !== null && target();
             }
             catch {
                 return false;
@@ -10794,8 +11357,8 @@ export class FleetManager {
             this.webPromptGone(entry, entry.expiredText);
         }
         const collapses = entries
-            .filter(entry => entry.messageId && entry.adapter.editMessageRemoveButtons)
-            .map(entry => entry.adapter.editMessageRemoveButtons(entry.chatId, entry.messageId, entry.expiredText, entry.threadId).catch(err => this.logger.debug({ err, instanceName: entry.instanceName, prefix: entry.prefix }, "Failed to retire button prompt during shutdown")));
+            .map(entry => this.collapseNoncePrompt(entry)?.catch(err => this.logger.debug({ err, instanceName: entry.instanceName, prefix: entry.prefix }, "Failed to retire button prompt during shutdown")))
+            .filter(collapse => collapse !== undefined);
         if (!collapses.length)
             return;
         await Promise.race([
@@ -10814,12 +11377,17 @@ export class FleetManager {
             if (entry.timer)
                 clearTimeout(entry.timer);
             this.webPromptGone(entry, entry.expiredText);
-            if (entry.messageId && entry.adapter.editMessageRemoveButtons) {
-                entry.adapter.editMessageRemoveButtons(entry.chatId, entry.messageId, entry.expiredText, entry.threadId)
-                    .catch(err => this.logger.debug({ err, instanceName, prefix: entry.prefix }, "Failed to collapse prompt during instance stop"));
-            }
+            this.collapseNoncePrompt(entry)?.catch(err => this.logger.debug({ err, instanceName, prefix: entry.prefix }, "Failed to collapse prompt during instance stop"));
         }
     }
+    /** A lapsed prompt's buttons collapsed to its expired text — through its own interaction when it is private. */
+    collapseNoncePrompt(entry) {
+        if (entry.retire)
+            return entry.retire(entry.expiredText);
+        if (!entry.messageId || !entry.adapter.editMessageRemoveButtons)
+            return undefined;
+        return entry.adapter.editMessageRemoveButtons(entry.chatId, entry.messageId, entry.expiredText, entry.threadId);
+    }
     /** A clean exit is intentional from the CLI's perspective, but often not from
      * the operator's. Keep the instance notice passive and put the action in the
      * same-world General topic where an administrator can make the choice. */
@@ -11802,7 +12370,7 @@ export class FleetManager {
         for (const name of this.configuredBackendInstanceNames()) {
             configured.add(this.backendNameOf(name));
         }
-        const installed = this.probeInstalledBackends();
+        const installed = await this.probeInstalledBackends();
         // One entry point for "get this CLI working" (#1131): a backend that is
         // not installed is offered too, and the click installs it first, then
         // signs in (startLoginSession routes it).
@@ -12434,10 +13002,16 @@ export class FleetManager {
                 attachments: Array.isArray(m.attachments) ? m.attachments : undefined,
                 messageId: typeof m.messageId === "string" ? m.messageId : undefined,
                 role: typeof m.role === "string" ? m.role : undefined,
+                buttons: m.buttons,
             });
             broadcastSseEvent(this.sseClients, event, recorded, onError, this.webChatHistory.cursorOf(recorded));
             return;
         }
+        // #1266: a reply's buttons ended — the history shows it too (a later load, the public link's poll).
+        if (event === "reply_buttons" && data && typeof data === "object") {
+            const u = data;
+            this.webChatHistory.updateButtons(String(u.instance ?? ""), u.buttons);
+        }
         broadcastSseEvent(this.sseClients, event, data, onError);
     }
     listClaimedTasks(assignee) {
@@ -14249,6 +14823,11 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         return `${warn}${t("effort.restart_success", instanceName, applied)}`;
     }
     async applyModel(instanceName, model) {
+        // Reject model names with newlines or control characters: they would be
+        // persisted to fleet.yaml and pasted raw into the CLI (P3 from #1490 audit).
+        if (/[\x00-\x1f\x7f]/.test(model)) {
+            return t("model.invalid_chars");
+        }
         const backendName = this.backendNameForInstance(instanceName);
         let strategy = "restart";
         try {
@@ -14623,6 +15202,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // #1386: every live "Needs you" message says the fleet stopped (capabilities revoked first) — while the
         // adapters can still edit. Bounded: a platform that does not answer must not hold the shutdown.
         const needsStopped = this.stopNeedsYou();
+        // #1490 P3: stop() now returns a Promise; await it so the final
+        // ledger flush completes before process.exit(0) in doStopAll's caller.
+        const cacheStopped = this.cacheService?.stop() ?? Promise.resolve();
         const profileStopped = this.runtimeCpuProfiler?.shutdown("fleet shutdown");
         this.ipcStoppingInstances.add("__fleet_stopping__");
         // Release held delivery promises before awaiting daemon shutdown, then
@@ -14656,6 +15238,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         await profileStopped;
         await needsStopped;
         await settingsControlStopped;
+        await cacheStopped;
         await this.cpuProfileControl?.close();
         this.cpuProfileControl = null;
         await this.shutdownLoginWindows();
@@ -14788,6 +15371,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // nor revives a session that was revoked while the disk was refusing writes.
         this.webSessions?.flush();
         this.eventLog?.close();
+        this.replyButtonsCtl?.stop();
+        this.replyButtonsStore?.close();
+        this.replyButtonsCtl = null;
+        this.replyButtonsStore = null;
         const pidPath = join(this.dataDir, "fleet.pid");
         try {
             unlinkSync(pidPath);
@@ -15015,7 +15602,20 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // this process came up on: a Settings edit mutates this.fleetConfig in place
         // before the reload, so comparing the pre-load copy sees nothing at all.
         const newFleetLevel = this.fleetLevelSignature();
-        if (this.appliedFleetLevel !== null && this.appliedFleetLevel !== newFleetLevel) {
+        // #1519 P6: connections appended to a running fleet start now — no restart. Only once every one is running does
+        // this process count the configuration as applied; otherwise the row says a restart is still needed.
+        if (this.appliedFleetLevel !== null && this.appliedFleetLevel !== newFleetLevel && this.canHotAddConnections(this.fleetConfig)) {
+            observe?.(APPLY_FLEET_TARGET, "hot", "running");
+            if (await this.hotAddConnections(appendedConnections(this.startupFleetConfig, this.fleetConfig))) {
+                this.startupFleetConfig = structuredClone(this.fleetConfig);
+                this.appliedFleetLevel = newFleetLevel;
+                observe?.(APPLY_FLEET_TARGET, "hot", "done");
+            }
+            else {
+                observe?.(APPLY_FLEET_TARGET, "restart", "restart-required");
+            }
+        }
+        else if (this.appliedFleetLevel !== null && this.appliedFleetLevel !== newFleetLevel) {
             this.logger.warn({
                 keys: fleetLevelDifferences(this.startupFleetConfig, this.fleetConfig),
             }, "Fleet-level config changed — restart AgEnD for it to take effect");
@@ -15349,6 +15949,15 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     listSecureConnections() {
         const channels = this.fleetConfig?.channels
             ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+        // A token written from Settings is in .env before this process has it (#1519 P1: a new connection's token waits for
+        // the restart that starts it) — stored is "set", not "missing". Names only; no value is read out.
+        let stored;
+        try {
+            stored = envFileKeys(this.dataDir);
+        }
+        catch {
+            stored = new Set();
+        } // unreadable: only what this process has
         return channels.map((channel, index) => {
             const id = channel.id ?? channel.type ?? `channel-${index}`;
             const world = this.worlds.get(id);
@@ -15357,16 +15966,44 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 id,
                 type: channel.type,
                 token_env: channel.bot_token_env,
-                token_present: !!process.env[channel.bot_token_env],
+                token_present: !!process.env[channel.bot_token_env] || stored.has(channel.bot_token_env),
                 group_id: channel.group_id != null ? String(channel.group_id) : null,
                 general_channel_id: channel.options?.general_channel_id != null
                     ? String(channel.options.general_channel_id)
                     : null,
-                status: state?.status ?? (world ? "starting" : "stopped"),
+                ...this.connectionStatus(id, state, world),
                 ...(world ? { identity: { id: world.botUserId ?? null, username: world.botUsername ?? null } } : {}),
             };
         });
     }
+    /**
+     * #1519 P6 (#1537 review): a connection's status from evidence, never from a start call that merely resolved. No
+     * adapter object: not running (or retrying / failed, as recorded) — never "connected". An adapter that has not logged
+     * in yet (no `started`: no bot id; for Telegram, polling not ready) is "starting". Named problems: the Message Content
+     * intent refused (4014, P3), the token refused (an explicit auth error, or Telegram's own 401 flag) — the error text
+     * itself is never passed on.
+     */
+    connectionStatus(id, state, world) {
+        const adapter = this.adapters.get(id);
+        const evidence = adapter?.connectionEvidence?.();
+        const recorded = state?.status;
+        const problem = evidence?.authRejected || (recorded !== "connected" && isRejectedTokenError(state?.lastError)) ? "rejected"
+            : recorded !== "connected" && isDisallowedIntentsError(state?.lastError) ? "missing_intent" : undefined;
+        let status;
+        if (!adapter || evidence?.stopped)
+            status = recorded === "retrying" || recorded === "failed" ? recorded : "stopped"; // gone, or told to stop
+        else if (recorded === "retrying" || recorded === "failed")
+            status = recorded;
+        else if (evidence?.authRejected)
+            status = "failed";
+        else if (!world?.botUserId)
+            status = "starting"; // not logged in yet
+        else if (evidence && !evidence.ready)
+            status = "retrying"; // logged in once; its polling has failed since
+        else
+            status = "connected";
+        return { status, ...(problem ? { problem } : {}) };
+    }
     secureConnectionChannel(connectionId) {
         const channels = this.fleetConfig?.channels
             ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
@@ -16155,8 +16792,15 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             throw new Error("adapter operation superseded"); };
         check();
         const old = this.adapters.get(connectionId);
-        if (!old && !force)
-            return false; // The secret is valid on disk; the next start adopts it.
+        // No adapter: a connection that is not the primary, in a fleet already running connections, starts now (#1519 P6);
+        // otherwise the secret is valid on disk and the next start adopts it.
+        if (!old && !force && (this.getPrimaryAdapterId() === connectionId || this.adapters.size === 0))
+            return false;
+        if (!old) {
+            const pending = this.adapterState.get(connectionId)?.retryTimer;
+            if (pending)
+                clearTimeout(pending);
+        }
         const primary = this.getPrimaryAdapterId() === connectionId;
         const previousState = this.adapterState.get(connectionId);
         this.adapterState.set(connectionId, { status: "retrying", retryCount: previousState?.retryCount ?? 0 });
@@ -16225,6 +16869,74 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      * the reconcile reports as it works. A target the forecast missed (a Classic
      * instance inheriting a changed default) is added when it is first touched.
      */
+    /**
+     * #1519 P6: whether `next` differs from what this process started with only by connections appended to it, while it
+     * runs connections already (a fleet's first connection becomes its primary: a fresh process sets that up).
+     */
+    canHotAddConnections(next) {
+        return this.adapters.size > 0 && appendedConnections(this.startupFleetConfig, next) !== null;
+    }
+    /**
+     * #1519 P6: start connections appended to a running fleet. Each token is read from .env (that key only, under the
+     * file's lease — Settings wrote it there, and this process read .env once at start); a connection already running (a
+     * token Replace started it) is left alone. True only when every one is running; one that failed to start is retried in
+     * the background like any other, and the Apply row says a restart is still needed.
+     */
+    async hotAddConnections(added) {
+        const envPath = join(this.dataDir, ".env");
+        const lease = trySettingsLease([settingsFileResource(envPath)]);
+        if (!lease)
+            return false;
+        try {
+            this.loadEnvKeys(new Set(added.map(c => c.bot_token_env)), lease.owner);
+        }
+        finally {
+            lease.release();
+        }
+        let all = true;
+        for (const channel of added) {
+            const id = channel.id ?? channel.type;
+            if (this.adapters.has(id))
+                continue;
+            if (!process.env[channel.bot_token_env]) {
+                all = false;
+                continue;
+            }
+            const pending = this.adapterState.get(id)?.retryTimer;
+            if (pending)
+                clearTimeout(pending);
+            try {
+                await this.startAdditionalAdapter(channel);
+                if (!this.adapters.has(id)) {
+                    all = false;
+                    continue;
+                }
+                this.adapterState.set(id, { status: "connected", retryCount: 0 });
+                this.logger.info({ adapterId: id }, "Connection started without a restart");
+            }
+            catch (err) {
+                all = false;
+                const message = err?.message ?? String(err);
+                this.adapterState.set(id, { status: "retrying", retryCount: 0, lastError: message });
+                this.scheduleAdapterRetry(id, channel);
+            }
+        }
+        this.classicChannels?.configureAdapters(this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []));
+        this.routing.rebuild(this.fleetConfig);
+        this.reregisterClassicChannels();
+        return all;
+    }
+    /** Set the named keys of the data dir's .env into this process's environment (the file's lease held by `owner`). */
+    loadEnvKeys(keys, owner) {
+        const envPath = join(this.dataDir, ".env");
+        if (!existsSync(envPath))
+            return;
+        assertSettingsLease(settingsFileResource(envPath), owner);
+        // The same parser as the start's (env-file.ts): a token is read the same way at start and when hot-added.
+        for (const [key, value] of parseEnvText(readFileSync(envPath, "utf-8")))
+            if (keys.has(key))
+                process.env[key] = value;
+    }
     planConfigApply() {
         const rows = [];
         const nextConfig = this.nextFleetConfig();
@@ -16248,7 +16960,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 rows.push({ target: name, kind: "restart" });
         }
         if (this.appliedFleetLevel !== null && this.appliedFleetLevel !== this.fleetLevelSignature(nextConfig)) {
-            rows.push({ target: APPLY_FLEET_TARGET, kind: "restart" });
+            // #1519 P6: connections appended to a running fleet start now; anything else at fleet level waits for a restart.
+            rows.push({ target: APPLY_FLEET_TARGET, kind: this.canHotAddConnections(nextConfig) ? "hot" : "restart" });
         }
         return rows;
     }
@@ -16700,7 +17413,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                     const backend = this.fleetConfig?.instances[name]?.backend
                         ?? this.fleetConfig?.defaults?.backend
                         ?? "claude-code";
-                    const { context } = resolveInstanceContext(this.dataDir, name, backend);
+                    const { context } = resolveInstanceContext(this.dataDir, name, backend, { source: this.getPaneContextSource(name) });
                     return {
                         name,
                         status: this.getInstanceStatus(name),
@@ -17089,6 +17802,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             .map(ch => ch.instanceName)
             .filter(name => !fleetNames.includes(name));
         const names = [...fleetNames, ...classicOnly];
+        // The identity every page shows (alpha.2, N1): alias, description, role and tags resolved by the same rule as
+        // /api/profiles (resolveInstanceIdentity) — the sidebar groups, searches and labels with it on every page.
+        const classicRooms = new Map((this.classicChannels?.getAll() ?? []).map(ch => [ch.instanceName, ch]));
+        const profiles = profileIdentities(this.dataDir);
         const instances = names.map(name => {
             const statusFile = join(this.getInstanceDir(name), "statusline.json");
             let cost = 0;
@@ -17106,7 +17823,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 : (this.fleetConfig?.instances[name]?.backend
                     ?? this.fleetConfig?.defaults?.backend
                     ?? "claude-code");
-            const { context } = resolveInstanceContext(this.dataDir, name, backend);
+            const { context } = resolveInstanceContext(this.dataDir, name, backend, { source: this.getPaneContextSource(name) });
             // context_pct: null when unavailable, not 0
             const context_pct = context ?? null;
             // Model: Only Claude Code has live statusline; others use the effective resolver.
@@ -17125,13 +17842,13 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             // Only show effort if backend supports it and it's not antigravity
             const effort = (effortStrategy === "unsupported" || isAgy) ? null : effortResolved.effort;
             const effort_source = (effortStrategy === "unsupported" || isAgy) ? null : effortResolved.source;
-            // Display name: fleet config → classic channel → undefined
-            const display_name = classic
-                ? this.classicChannels?.getAll().find(ch => ch.instanceName === name)?.displayName
-                : this.fleetConfig?.instances[name]?.display_name;
+            const identity = resolveInstanceIdentity({ cfg: this.fleetConfig?.instances[name], classic: classicRooms.get(name), profile: profiles.get(name) });
             return {
                 name,
-                display_name: display_name || undefined,
+                display_name: identity.display_name || undefined,
+                description: identity.description || undefined,
+                role: identity.role || undefined,
+                tags: identity.tags,
                 status: this.getInstanceStatus(name),
                 // `state` (presentation: may be awaiting_input) and `execution_state` (working / idle / stuck, or null —
                 // what the dashboard's activity events carry) come from instancePresentation (#1212).
@@ -17149,6 +17866,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             instances,
             publicLink: this.getPublicWebStatus(),
             uptime: Math.floor((Date.now() - this.startedAt) / 1000),
+            // #1519 P7: how many chat connections are configured — 0 is a web-only fleet, which gets the first-run card.
+            connections: (this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : [])).length,
         };
     }
 }