@songsid/agend 2.2.0-beta.9 → 2.3.0-beta.1

package/dist/fleet-manager.js

@@ -7,7 +7,7 @@ import { SettingsExecution, settingsRevision, noteSettingsWrite, settingsFileRes
 import { performance } from "node:perf_hooks";
 import { withSpawnHoldReply } from "./spawn-hold-reply.js";
 import { gatewayRequestContext } from "./web-request-context.js";
-import { createPublicWebGateway } from "./public-web-gateway.js";
+import { createPublicWebGateway, PUBLIC_GATEWAY_RECEIVE_MS } from "./public-web-gateway.js";
 import { handleWebIconRequest } from "./web-icons.js";
 import { trackWebServer } from "./web-server-drain.js";
 import { renderPublicLinkProgress, ThrottledMessageEditor } from "./public-link-progress.js";
@@ -20,10 +20,9 @@ import { withinBudget } from "./monotonic-budget.js";
 import { measureSyncWork } from "./sync-work-attribution.js";
 import { RuntimeCpuProfiler, ProfileBusyError, profileDuration } from "./runtime-cpu-profile.js";
 import { ProfileControlServer } from "./profile-control.js";
-import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync, accessSync, realpathSync, constants as fsConstants } from "node:fs";
+import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync, accessSync, realpathSync, constants as fsConstants, closeSync } from "node:fs";
 import { atomicWriteFileSync } from "./atomic-write.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { spawnSync } from "node:child_process";
 import { freemem, totalmem, cpus, homedir } from "node:os";
 import { createServer } from "node:http";
 import { Worker } from "node:worker_threads";
@@ -34,7 +33,7 @@ import { getAgendHome, ensureWorkspaceGit } from "./paths.js";
 import { fleetLabel } from "./fleet-label.js";
 import { beginFullRestartProgress as persistFullRestartProgress, beginUpdateProgress as persistUpdateProgress, clearUpdateMarker, isUpdateInProgress, readUpdateProgress, sameUpdateMarker, setUpdateProgressStage, updateMarkerIdentity, updateProgressOperation, updateReceiptOf, } from "./update-marker.js";
 import { formatUpdateProgress } from "./update-progress.js";
-import { sdNotify, sdNotifyBlocking } from "./sd-notify.js";
+import { sdNotify, sdNotifyBlocking, setSdNotifyWarn } from "./sd-notify.js";
 import { readFleetMemory } from "./process-memory.js";
 import { MemoryPressure } from "./memory-pressure.js";
 import { replyDedupText, ReplyDeduper } from "./reply-dedup.js";
@@ -46,7 +45,7 @@ const __dirname = dirname(__filename);
 const DEFAULT_OPEN_ACCESS = { mode: "open", allowed_users: [], max_pending_codes: 0, code_expiry_minutes: 0 };
 import { STATUS_EMOJI_CONFIG_KEYS, STATUS_EMOJI_KEYS, STATUS_EMOJI_SUGGESTIONS, TELEGRAM_REACTION_EMOJIS, builtinStatusEmojis, customEmojiValue, emojiImageUrl, normalizeEmoji, previewStatusEmojis, reactionForm, reactionMatchKey, resolveStatusEmojis, statusAvoidList, statusEmojiProblem, statusMatchKey, statusMatchKeys, textForm, } from "./status-emojis.js";
 import { isProbeableRouteTarget } from "./fleet-context.js";
-import { loadFleetConfig, loadRawFleetConfig, DEFAULT_COST_GUARD, DEFAULT_DAILY_SUMMARY, DEFAULT_INSTANCE_CONFIG } from "./config.js";
+import { getEffectiveInstanceDefaults, loadFleetConfig, loadRawFleetConfig, DEFAULT_COST_GUARD, DEFAULT_DAILY_SUMMARY, DEFAULT_INSTANCE_CONFIG } from "./config.js";
 import { EventLog } from "./event-log.js";
 import { binaryProbe } from "./binary-probe.js";
 import { classifySqliteOpenError } from "./sqlite-open-errors.js";
@@ -64,7 +63,9 @@ import { isWebChannelEcho, WEB_ECHO_PREFIX } from "./web-channel-echo.js";
 import { TelegramAdapter } from "./channel/adapters/telegram.js";
 import { createBackend } from "./backend/factory.js";
 import { readEffortMetadata } from "./backend/effort-metadata.js";
-import { CLI_ENV_TTL_MS, isModelCompatible, SYSINFO_BACKEND_IDS, UnsupportedCliError } from "./backend/types.js";
+import { codexEffort, flagEffort } from "./backend/launch-effort.js";
+import { codexMetadataHomes, readCodexModelEffortLevels, resolveCodexLaunchModel } from "./backend/codex-metadata.js";
+import { CLI_ENV_TTL_MS, isModelCompatible, resolveBinary, SYSINFO_BACKEND_IDS, UnsupportedCliError } from "./backend/types.js";
 import { createLogger, rotateLogIfNeeded } from "./logger.js";
 import { processAttachments } from "./channel/attachment-handler.js";
 import { routeToolCall } from "./channel/tool-router.js";
@@ -80,7 +81,8 @@ import { RoutingEngine } from "./routing-engine.js";
 import { InstanceLifecycle, SupersededStartError, BACKEND_INSTALLATION_INFO, checkBinaryInstalled, } from "./instance-lifecycle.js";
 import { TopicArchiver } from "./topic-archiver.js";
 import { StatuslineWatcher } from "./statusline-watcher.js";
-import { outboundHandlers } from "./outbound-handlers.js";
+import { applyInstanceConfigPatch, outboundHandlers } from "./outbound-handlers.js";
+import { backendArgs, backendStep, joinBackendArgs, modelNameCarried, planDisplay } from "./backend-command.js";
 import { DeliveryOutbox, DEFAULT_REPLY_OBLIGATION_TTL_MS, isSilentScheduleDelivery } from "./delivery-outbox.js";
 // The target Daemon can legitimately wait 30 minutes for a busy pane before
 // deciding to defer before submission. This is an alert threshold only: the
@@ -137,12 +139,31 @@ import { LogService } from "./log-service.js";
 import { WebChatHistory, WEB_CHAT_TEXT_MAX, isWebMessageId, newWebMessageId } from "./web-chat-history.js";
 import { WebChatDiskStore } from "./web-chat-store.js";
 import { SeenUsers, resolveMentions } from "./web-mentions.js";
-import { WebPrefsStore } from "./web-prefs.js";
+import { OPERATOR, WebPrefsStore } from "./web-prefs.js";
+import { agendVersion } from "./agent-whats-new.js";
+import { OwnerCssStore } from "./web-owner-css-store.js";
+import { ThemeStore } from "./web-theme-store.js";
+import { WebAppearance } from "./web-appearance.js";
+import { WebEffectLibrary } from "./web-effect-library.js";
+import { WebEffectTrials } from "./web-effect-trials.js";
+import { WebEffectService } from "./web-effect-service.js";
+import { WebEffectProfiles } from "./web-effect-profiles.js";
+import { WebEffectTools, WEB_EFFECT_TOOLS } from "./web-effect-tools.js";
+import { resolveEffectParams } from "./web-effect.js";
+import { cw1EffectChecker } from "./web-mod-bundle.js";
+import { effectiveAppearanceLimits } from "./web-appearance-limits.js";
+import { WEB_NAME_FALLBACK, safeWebName, validateWebName, webNameInUse, webPersonKey } from "./web-profile.js";
 import { ReplyButtonStore, parseReplyButtons, replyButtonClickText, replyButtonsFallbackText, REPLY_BUTTON_PREFIX } from "./reply-buttons.js";
 import { ReplyButtonsController } from "./reply-buttons-controller.js";
-import { publicAttachment, sweepOrphanedUploads, WebFileLedger } from "./web-upload.js";
+import { parsePoll } from "./reply-polls.js";
+import { isUploadRequest, limitRequestReceive, publicAttachment, sweepOrphanedUploads, UPLOAD_REQUEST_TIMEOUT_MS, uploadLimits, WebFileLedger } from "./web-upload.js";
 import { REPLY_FILES_MAX_BYTES, snapshotReplyFile, sweepReplySnapshots, webFilesDir } from "./web-reply-files.js";
-import { handleViewRequest, isViewPath, profileIdentities, resolveInstanceIdentity } from "./view-api.js";
+import { cardPicture, handleViewRequest, humanCards, identityColors, isViewPath, profileIdentities, resolveInstanceIdentity } from "./view-api.js";
+import { autoIdentityColor } from "./web-identity-color.js";
+import { AppearanceTools } from "./web-appearance-tools.js";
+import { cardVersion, resolveCard } from "./web-card.js";
+import { ModStore } from "./web-mod-store.js";
+import { AgentMods } from "./web-mod-agent.js";
 import { downloadStickerImage } from "./channel/sticker-download.js";
 import { WebImageCache, imageMimeForFile, WEB_IMAGE_MAX_AGE_MS, WEB_IMAGE_MAX_BYTES, WEB_IMAGE_RETRY_MS } from "./web-images.js";
 import { accentColor, avatarFor, ownBotConnections } from "./instance-avatar.js";
@@ -153,13 +174,14 @@ import { isDisallowedIntentsError, isRejectedTokenError } from "./discord-permis
 import { filterUsageProviders, formatDiscordUsageActivity, getUsageSnapshot, handleUsageRequest, isUsagePath, usageProviderIdForBackend } from "./usage/usage-api.js";
 import { LOGIN_FLOWS, LOGIN_BACKEND_ALIASES } from "./login-flows.js";
 import { LoginSession } from "./login-manager.js";
+import { runOnLoginShell } from "./login-shell.js";
 import { tightenInstanceDirs } from "./private-dir.js";
 import { decideSlash } from "./slash-authz.js";
 import { canonicalCommand, commandSpec, decideCommand, ruleFor } from "./command-table.js";
 import { runVisibilityCommand } from "./cross-instance-notice.js";
-import { installedChannel, isPrereleaseVersion, updateNoticeKey } from "./update-check.js";
+import { installedChannel, updateNoticeKey } from "./update-check.js";
 import { resolveInstalledAgend } from "./update-dispatch.js";
-import { resolveUpdateLaunch, watchUpdateLaunch } from "./update-launch.js";
+import { resolveUpdateLaunch, openUpdateLog, updateLogPath, watchUpdateLaunch } from "./update-launch.js";
 import { admitProfileLogin, LoginController, LOGIN_TOKEN_RESEND_PREFIX, POST_LOGIN_RECOVERY_DEADLINE_MS } from "./login-controller.js";
 import { runBeforeDeadline } from "./deadline.js";
 import { LoginWindowLock } from "./login-window-lock.js";
@@ -170,10 +192,10 @@ import { describeSignalSource, recordInternalRequest, withOrigin } from "./fleet
 import { handleAgentRequest, ToolNotPermittedError } from "./agent-endpoint.js";
 import { ClassicChannelManager, getClassicBackendChoices, isSelectableClassicBackend, readClassicLastActivityAt } from "./classic-channel-manager.js";
 import { assertExplicitInstanceRemoval } from "./instance-removal.js";
-import { validateFleetConfig } from "./config-validator.js";
+import { KNOWN_BACKENDS, validateFleetConfig } from "./config-validator.js";
 import { isRemovedBackend, removedBackendMessage } from "./backend/removed.js";
 import { presentationState, interactionSummary, sameInteractionOwner } from "./interaction-observation.js";
-import { readLastInboundAt } from "./daemon.js";
+import { DEFAULT_STUCK_TIMEOUT_MS, readLastInboundAt } from "./daemon.js";
 import { clearPausedMarker, readPausedAt, readPauseReason, writePausedMarker } from "./pause-marker.js";
 import { readBackgroundWorkEndedMarker } from "./background-work-ended.js";
 import { DEFAULT_WARM_OVERFLOW, WakeCoordinator } from "./wake-coordinator.js";
@@ -184,11 +206,14 @@ import { isSetupComplete, markSetupComplete } from "./setup-marker.js";
 import { manualCleanupMessage, reapStaleTunnel } from "./tunnel/lease.js";
 import { buildToolPermissionsNotice } from "./tool-permissions-notice.js";
 import { NeedsYouHub } from "./needs-you-hub.js";
-import { WEB_CHAT_NOTICE, WEB_REMOTE_DOCS_URL, claimNotice, hasWebChat, releaseNotice, upgradeNoticesPath } from "./upgrade-notices.js";
+import { WEB_CHAT_NOTICE, claimNotice, hasWebChat, releaseNotice, upgradeNoticesPath } from "./upgrade-notices.js";
 import { GENERAL_PAUSE_ERROR, isGeneralInstance } from "./general-instance.js";
 import { buildOrgChart } from "./web-org.js";
+import { GENERAL_POINTING_REFUSALS, SNOWFLAKE, hasPlaceRefs, placeRef, webRoute, webTextLinks, placeSuffix, renderPlaceRefs, stripPlaceRefs, topicUrl, worldPlaceOf } from "./topic-link.js";
 import { CacheService, WINDOWS } from "./cache-service.js";
 import { runWebCommand } from "./web-commands.js";
+import { CompactWatch, launchIdentity } from "./compact-watch.js";
+import { agyLegacyAgentsFile, danglingSymlink, migrateAgyAgentsFile } from "./backend/antigravity.js";
 import { claudeConfigDirFor, claudeProjectKey } from "./backend/claude-code.js";
 import { sharedRolloutIndex } from "./rollout-index.js";
 import { mayUseTool, resolveToolSet, scheduleOpRefusal, toolForIpcType, toolRefusedMessage, } from "./tool-permissions.js";
@@ -353,6 +378,7 @@ const CLASSIC_BACKEND_SELECTION_TIMEOUT_MS = 60_000;
 const CLASSIC_BACKEND_CALLBACK_PREFIX = "classic-backend:";
 const MODEL_SELECT_CALLBACK_PREFIX = "model-select:";
 const EFFORT_SELECT_CALLBACK_PREFIX = "effort-select:";
+const BACKEND_SELECT_CALLBACK_PREFIX = "backend-select:";
 const INTERACTIVE_ASSIST_CALLBACK_PREFIX = "interactive-assist:";
 const EXIT_RESTART_CALLBACK_PREFIX = "exit-restart:";
 /** #1386: how long a paused instance's marker reason is reused before it is read again (transitions drop it at once). */
@@ -376,6 +402,7 @@ const WEB_MIRRORED_PROMPT_PREFIXES = new Set([
 const WEB_ONLY_REPLY_SINK = {
     type: "web",
     supportsReplyButtons: true, // #1266: the web chat shows a reply's buttons itself
+    supportsPolls: true, // #1823: …and a poll (its pages are told; there is nothing to edit)
     sendText: async () => ({ chatId: "web", messageId: newWebMessageId() }),
     sendFile: async () => ({ chatId: "web", messageId: newWebMessageId() }),
 };
@@ -672,6 +699,8 @@ export class FleetManager {
     /** In-flight /effort selections, same coordinator shape as pendingModelSelects. */
     pendingEffortSelects = new Map();
     pendingModelSelects = new Map();
+    /** #1806: in-flight /backend steps, keyed by nonce (see handleBackendSelection). */
+    pendingBackendSelects = new Map();
     /** nonce → pending button prompt (hang restart, interactive assist, clean-exit restart). */
     pendingNonceButtons = new Map();
     /** #1386 "Needs you": the list, its live chat messages and Acknowledge. Started with the fleet (finishStartup). */
@@ -753,7 +782,6 @@ export class FleetManager {
     updateProgressTimer = null;
     updateProgressEditRunning = false;
     lastUpdateProgressText = null;
-    updateCompletionTipText = null;
     /**
      * #1660: an adopted update whose retire outcome is still owed. The
      * completion summary was (or will be) posted; this watch appends the
@@ -792,7 +820,8 @@ export class FleetManager {
     /** #1565: the web chat history's files (set at fleet start, once the home and the instances are known). */
     webChatStore = null;
     /** Uploaded files and the files the dashboard may fetch back (uploads, reply attachments). */
-    webFiles = new WebFileLedger();
+    // #1937: the upload limits are the config's, read on each use (agend reload applies a change to the next upload).
+    webFiles = new WebFileLedger({ limits: () => uploadLimits(this.fleetConfig?.web) });
     /** #1770: per instance, its last web reply still copying its files — the next one is shown after it, in order. */
     webReplyOrder = new Map();
     /** #1770: an instance's web-files byte cap (a field, so a test can make it small). */
@@ -801,6 +830,255 @@ export class FleetManager {
     seenUsers = new SeenUsers();
     webPrefsStore;
     /** #1665: the web preferences kept on the host (<home>/web-prefs.json), read on first use. */
+    /**
+     * #1827: a web person as agents and chats see them. Signed in as an account (a sign-in code DMed to it): that
+     * account's user id — still `via web`, and only for recognition — and the name they chose, else their account's name
+     * at sign-in (made safe). Otherwise (an `agend web` session): "web-user", as before, under a name the operator may set.
+     * Names are checked again now: one an instance or bot has taken since reads as the next choice down.
+     */
+    webPerson(owner) {
+        const key = webPersonKey(owner);
+        let profile = null;
+        try {
+            profile = this.webPrefs.profile(key);
+        }
+        catch (err) {
+            this.logger.warn({ err: err.message }, "Web profile unavailable");
+        }
+        const reserved = (n) => this.webNameReserved(n);
+        const own = profile?.name !== undefined ? webNameInUse(profile.name, reserved) : WEB_NAME_FALLBACK;
+        const chosen = own !== WEB_NAME_FALLBACK;
+        const platformName = owner ? safeWebName(profile?.platformName, reserved) : undefined;
+        return {
+            key, bound: !!owner,
+            userId: owner ? owner.userId : WEB_NAME_FALLBACK,
+            // A poll ballot is the account's — the same key its votes on the platform have — or the operator's.
+            voterKey: owner ? `${owner.adapterId}:${owner.userId}` : "web:operator",
+            name: chosen ? own : platformName ?? WEB_NAME_FALLBACK,
+            set: chosen,
+            ...(platformName !== undefined ? { platformName } : {}),
+        };
+    }
+    /** #1827: set (null: clear — back to their account's name) a web person's own name; validated in full. */
+    setWebPersonName(owner, raw) {
+        let name = null;
+        if (raw !== null) {
+            const v = validateWebName(raw, (n) => this.webNameReserved(n));
+            if (!v.ok)
+                return { ok: false, status: 400, error: v.error };
+            name = v.name;
+        }
+        const w = this.webPrefs.setProfileName(webPersonKey(owner), name);
+        return w.ok ? { ok: true, person: this.webPerson(owner) } : { ok: false, status: w.status, error: w.error };
+    }
+    /** #1827 (auth-api): a sign-in as this account — its display name then is the web name it starts with. */
+    noteWebSignIn(account) {
+        if (account.username)
+            this.webPrefs.setPlatformName(webPersonKey(account), account.username);
+    }
+    /**
+     * #1827: a name that belongs to something here — an instance (or ClassicBot room), its display name, a bot. On the web
+     * send path: it never throws (a lookup that fails reserves nothing; the name was checked in full when it was set).
+     */
+    webNameReserved(lowered) {
+        try {
+            return this.webNameTaken(lowered);
+        }
+        catch {
+            return false;
+        }
+    }
+    webNameTaken(lowered) {
+        const low = (s) => (typeof s === "string" ? s.normalize("NFC").toLocaleLowerCase("en-US") : "");
+        for (const [name, cfg] of Object.entries(this.fleetConfig?.instances ?? {})) {
+            if (low(name) === lowered || low(cfg.display_name) === lowered)
+                return true;
+        }
+        for (const ch of this.classicChannels?.getAll() ?? [])
+            if (low(ch.instanceName) === lowered || low(ch.displayName) === lowered)
+                return true;
+        for (const w of this.worlds.values())
+            if (w.botUsername && low(w.botUsername) === lowered)
+                return true;
+        return false;
+    }
+    themeStoreInstance;
+    webAppearanceService;
+    /** #1629: every instance's theme, placements, assets and lock (web-themes.json). */
+    get themeStore() {
+        // r4.1 Q3 (b): the card's limits are read from fleet.yaml at each upload (a change applies without a restart).
+        return (this.themeStoreInstance ??= new ThemeStore(this.dataDir, { limits: () => effectiveAppearanceLimits(this.fleetConfig?.web?.appearance).limits, effectsDropped: ids => this.effectLibrary.collectUnreferenced(ids) }));
+    }
+    /** #1629: the theme tools, a person's reset and lock, and the one appearance rate limiter (shared with effects). */
+    get webAppearance() {
+        return (this.webAppearanceService ??= new WebAppearance(this.themeStore, () => this.fleetConfig?.web ?? null, () => { try {
+            this.emitSseEvent("status", this.getUiStatus());
+        }
+        catch { /* the next frame carries the rev */ } }));
+    }
+    effectLibraryInstance;
+    effectTrialsInstance;
+    /** Lazy, single-owner storage. Register every host reference source before any operation can collect. */
+    get effectLibrary() {
+        if (!this.effectLibraryInstance) {
+            const library = new WebEffectLibrary(this.dataDir);
+            // Providers are lazy; publish only after every registration succeeds.
+            library.registerReferenceSource("themes", () => {
+                if (!this.themeStore.readable())
+                    throw new Error("themes_unreadable");
+                return this.themeStore.placedEffects().flatMap(row => row.ids.map(id => ({ id, holder: `instance:${row.name}` })));
+            });
+            library.registerReferenceSource("prefs", () => this.webPrefs.ownerEffectReferences());
+            library.registerReferenceSource("mods", () => {
+                const mods = this.mods.list();
+                if (mods.unreadable)
+                    throw new Error("mods_unreadable");
+                return mods.mods.flatMap(mod => mod.effects.map(effect => ({ id: effect.id, holder: `mod:${mod.id}` })));
+            });
+            this.effectTrialsInstance = new WebEffectTrials({ library, known: name => this.isKnownInstance(name) });
+            this.effectLibraryInstance = library;
+        }
+        return this.effectLibraryInstance;
+    }
+    /** Volatile Try offers and session-bound runs share this library. */
+    get effectTrials() { if (!this.effectTrialsInstance)
+        void this.effectLibrary; return this.effectTrialsInstance; }
+    effectProfilesInstance;
+    get effectProfiles() { return (this.effectProfilesInstance ??= new WebEffectProfiles(this.dataDir)); }
+    effectServiceInstance;
+    get effectService() {
+        return (this.effectServiceInstance ??= new WebEffectService({ library: this.effectLibrary, themes: this.themeStore, profiles: this.effectProfiles, prefs: this.webPrefs, trials: this.effectTrials,
+            known: name => this.isKnownInstance(name), changed: () => { try {
+                this.emitSseEvent("status", this.getUiStatus());
+            }
+            catch { /* next status carries revision */ } } }));
+    }
+    effectToolsService;
+    /** Caller identity is supplied only by the owned IPC connection / verified agent endpoint token. */
+    get effectTools() {
+        return (this.effectToolsService ??= new WebEffectTools({
+            library: this.effectLibrary, limiter: this.webAppearance.limiter,
+            authorize: (name, buckets) => !this.isKnownInstance(name) ? { error: "unknown_instance" } : this.webAppearance.authorizeEffect(name, buckets),
+            placed: name => this.themeStore.get(name).placements.effects,
+            place: (name, effects) => {
+                const before = this.themeStore.get(name).placements.effects;
+                const explicit = new Set(effects.filter(e => typeof e !== "string").map(e => e.id));
+                const w = this.themeStore.setPlacements(name, { effects }, "agent", what => {
+                    // An unchanged human/private placement may be retained, never exposed or newly acquired by an agent.
+                    const r = explicit.has(what.id) ? this.effectLibrary.read(what.id, { kind: "agent", id: name })
+                        : this.effectLibrary.readReferenced(what.id, `instance:${name}`);
+                    if (!r.ok)
+                        return r.error;
+                    const params = explicit.has(what.id) ? what.params : before.find(e => e.id === what.id)?.params;
+                    return resolveEffectParams(r.entry.manifest, params ?? {}).ok ? null : "effect_params";
+                });
+                return w.ok ? { ok: true, rev: w.rev } : { ok: false, error: w.error };
+            },
+            changed: () => { try {
+                this.emitSseEvent("status", this.getUiStatus());
+            }
+            catch { /* later status carries placements */ } },
+            // A nonmutating own/shared offer is not an appearance write. Only an explicit local-admin click may start it.
+            preview: async (instance, id) => {
+                const result = this.effectTrials.offer(instance, id);
+                if (!result.ok)
+                    return { error: "not_found" };
+                const present = this.webChatHistory.list(instance).some(row => row.effectTrial?.offer === result.offer.offer);
+                if (!present && !this.publishEffectTrial(instance, result.offer))
+                    return { error: "trial_unavailable" };
+                return { id, status: "offered", expiresAt: result.offer.expiresAt, message: "A trial card is in your web chat. A signed-in local admin can start it; nothing was applied." };
+            },
+            profiles: id => this.effectProfiles.read(id),
+            profileSummary: id => this.effectService.profileSummary(id),
+            profileSummaries: ids => this.effectService.profileSummaries(ids),
+        }));
+    }
+    appearanceToolsService;
+    /** #1629 r4 §1: get_web_appearance / preview_web_appearance — the caller's own look, resolved as the page resolves it. */
+    get appearanceTools() {
+        return (this.appearanceToolsService ??= new AppearanceTools({
+            frame: (name) => (this.getUiStatus().instances.find(i => i.name === name) ?? { name }),
+            theme: (name) => { const r = this.themeStore.get(name); return { theme: r.theme, locked: r.locked, widgets: r.placements.widgets }; },
+            card: (name) => resolveCard(name, humanCards(this.dataDir).get(name), this.themeStore.get(name).theme.card),
+            // #1958: the host's identity-colour settings, as the page reads them (an unreadable prefs file: the defaults).
+            colorPrefs: () => { try {
+                const v = this.webPrefs.read(OPERATOR).values;
+                return { show: v["color.show"], off: v["color.off"] === true };
+            }
+            catch {
+                return {};
+            } },
+            cardPicture: (name, slot) => cardPicture(this, name, slot),
+            themeAsset: (name, id) => this.themeStore.asset(name, id),
+            profileAvatar: (name) => this.webImage("avatar", name),
+            botAvatar: (_name, key) => this.webImage("bot", key),
+            themeAnswer: (name) => this.webAppearance.getTheme(name),
+        }));
+    }
+    /** #1958: a profile, card or colour write (view-api.ts) landed: every open page gets a fresh status frame. */
+    identityChanged() {
+        try {
+            this.emitSseEvent("status", this.getUiStatus());
+        }
+        catch { /* the next frame carries it */ }
+    }
+    /** A fleet.yaml instance (own key) or a ClassicBot room, now (#1629: a person's reset/lock names one). */
+    isKnownInstance(name) {
+        return Object.hasOwn(this.fleetConfig?.instances ?? {}, name) || (this.classicChannels?.getAll() ?? []).some((ch) => ch.instanceName === name);
+    }
+    modStore;
+    /**
+     * #1629 r4-5 / B2: installed mods use the same validated library and scoped holder claims as direct uploads.
+     */
+    get mods() {
+        return (this.modStore ??= new ModStore(this.dataDir, {
+            themes: this.themeStore,
+            prefs: this.webPrefs,
+            ownerCss: this.ownerCss,
+            effects: this.effectLibrary,
+            context: () => ({ agendVersion: agendVersion(), limits: this.themeStore.limits(), effects: cw1EffectChecker() }),
+            isKnownInstance: (name) => this.isKnownInstance(name),
+            prefsIdentity: OPERATOR,
+        }));
+    }
+    agentModsService;
+    /** #1629 r4-5b: export_web_mod / propose_web_mod — the caller's own look as a file, and a proposal for a person. */
+    get agentMods() {
+        return (this.agentModsService ??= new AgentMods({
+            themes: this.themeStore, mods: this.mods, limiter: this.webAppearance.limiter,
+            webConfig: () => this.fleetConfig?.web ?? null,
+            // The mod store's own: a proposal is checked exactly as the person's import of it will be.
+            context: () => this.mods.checkContext(),
+            readOwnEffect: (instance, id) => { const r = this.effectLibrary.read(id, { kind: "agent", id: instance }); return r.ok ? { name: r.entry.manifest.name, files: r.entry.files } : null; },
+            notice: (instance, text) => { try {
+                this.emitSseEvent("message", { instance, sender: instance, role: "status", text, ts: new Date().toISOString() });
+            }
+            catch { /* the page reads it from Settings too */ } },
+            changed: () => { try {
+                this.emitSseEvent("status", this.getUiStatus());
+            }
+            catch { /* the next frame */ } },
+        }));
+    }
+    /**
+     * #1629 r4-5c: an effect as this person may carry it away in an export — their own claim, or one a person shared —
+     * read with their principal (Sol's ACL). Being able to view or run a placed effect never grants packaging someone
+     * else's private claim: the library's reference read is runtime access, not an export path. Null: not theirs.
+     */
+    modPlacedEffect(person, id) {
+        const r = this.effectLibrary.read(id, { kind: "human", id: person });
+        return r.ok ? { name: r.entry.manifest.name, files: r.entry.files } : null;
+    }
+    /** #1629 r4-5: an instance's card text as every viewer sees it (a person's fields over the agent's). */
+    modCardText(name) {
+        const card = resolveCard(name, humanCards(this.dataDir).get(name), this.themeStore.get(name).theme.card);
+        return { ...(card.tagline ? { tagline: card.tagline.text } : {}), ...(card.bio ? { bio: card.bio.text } : {}) };
+    }
+    ownerCssStore;
+    /** #1629 r4 §3: each person's own CSS; which version is in force is their `css.active` in the web preferences. */
+    get ownerCss() {
+        return (this.ownerCssStore ??= new OwnerCssStore(this.dataDir, this.webPrefs));
+    }
     get webPrefs() {
         // #1664: a favorite must be an instance of this fleet now — fleet.yaml's (own keys) or a ClassicBot room's.
         return (this.webPrefsStore ??= new WebPrefsStore(this.dataDir, {
@@ -1149,6 +1427,8 @@ export class FleetManager {
             mayClick: (set, userId) => this.mayAnswerReplyButtons(set.instance, set.adapterId, userId),
             deliver: (set, button, by) => this.deliverReplyButtonChoice(set, button, by),
             publish: (instance, view) => this.emitSseEvent("reply_buttons", { instance, buttons: view }),
+            admitResults: (set, key, text) => this.admitPollResults(set, key, text),
+            monotonic: () => performance.now(),
             logger: this.logger,
             setTimer: (fn, ms) => { const h = setTimeout(fn, ms); h.unref?.(); return h; },
             clearTimer: (h) => clearTimeout(h),
@@ -1157,6 +1437,21 @@ export class FleetManager {
         return this.replyButtonsCtl;
     }
     replyButtonsStore = null;
+    /**
+     * #1823: a closed poll's results go to its instance through the delivery outbox, as a system notice keyed by the
+     * poll: durable (held until the instance can take it) and admitted once, however often this is asked. Addressed to
+     * the poll's chat, so the instance's answer (the right option, the scores) goes there.
+     */
+    admitPollResults(set, key, text) {
+        this.ensureDeliveryOutbox();
+        const outbox = this.deliveryOutbox;
+        if (!outbox)
+            return false;
+        outbox.admitSystemNotice(set.instance, key, text, new Date(), {
+            chatId: set.chatId, threadId: set.threadId || undefined, adapterId: set.adapterId === "web" ? undefined : set.adapterId,
+        });
+        return true;
+    }
     /**
      * #1266: who may answer a reply's buttons on a platform — whoever may message that instance there: in a ClassicBot
      * room anyone there (as a typed message), elsewhere someone the sending connection lets speak (#754/#1148), never a
@@ -1220,8 +1515,10 @@ export class FleetManager {
             return false;
         reactions.consume();
         this.afterUserInboundDelivered(set.instance, inbound, deliveryEpoch);
+        // The web chat shows the click as its button's label (a chip); `text` stays what the agent was given.
         this.emitSseEvent("message", {
             instance: set.instance, sender: by.username, role: "user", text: content, ts, ...(web ? { messageId } : {}),
+            click: { label: button.label, of: set.id },
         });
         return true;
     }
@@ -1564,6 +1861,7 @@ export class FleetManager {
                     content: payload.content,
                     delivery_id: claimed.deliveryId,
                     delivery_attempt: String(claimed.attemptNo),
+                    ...(isSilentScheduleDelivery(claimed) ? { silent_schedule: true } : {}),
                 }, { waitForIdle: false, noInlineWake: this.deliveryWorkerMode(target) !== "off" });
             }
             else {
@@ -2203,7 +2501,7 @@ export class FleetManager {
     async handleUpdateSlash(data, adapterId) {
         const gate = this.fleetAdminGate(data.userId, adapterId);
         if (gate !== "ok") {
-            await data.respond(t(gate === "disabled" ? "update.disabled" : "not_authorized"));
+            await data.respond(gate === "disabled" ? t("update.disabled", this.adminListKey(adapterId)) : t("not_authorized"));
             return;
         }
         const messageId = await data.respond(t("update.progress.preparing", 0));
@@ -2218,24 +2516,29 @@ export class FleetManager {
         // "not a beta" and sent a beta install to @latest. #1450 C5: the INSTALLED agend, verified, by absolute path.
         const installed = await resolveInstalledAgend();
         if (!installed.ok) {
-            this.failUpdateProgress(`/update cannot verify the installed AgEnD (${installed.reason}). Run \`agend update\` from a shell.`);
+            this.failUpdateProgress(`${t("update.failure.shell")} ${t("update.failure.installed", installed.reason)}`);
             return;
         }
         const origin = `slash /update by ${adapterId}:${data.userId}`;
         recordInternalRequest(this.dataDir, "update", origin);
         const launch = await resolveUpdateLaunch(installed.agend);
         if (!launch.ok) {
-            this.failUpdateProgress(`/update cannot prepare an independent updater (${launch.reason}). Run ` + "`agend update` from a host shell.");
+            this.failUpdateProgress(`${t("update.failure.shell")} ${t("update.failure.independent", launch.reason)}`);
             return;
         }
         if (this.fleetAdminGate(data.userId, adapterId) !== "ok" || this.shuttingDown) {
             this.failUpdateProgress(t("not_authorized"));
             return;
         }
+        const logPath = updateLogPath(this.dataDir);
+        const ts = new Date().toISOString();
+        const logFd = openUpdateLog(logPath, `--- /update ${ts} ---`);
         const child = spawn(launch.command, launch.args, {
-            detached: true, stdio: "ignore", env: withOrigin(origin),
+            detached: true, stdio: ["ignore", logFd ? logFd.fd : "ignore", logFd ? logFd.fd : "ignore"], env: withOrigin(origin),
         });
-        watchUpdateLaunch(child, message => this.failUpdateProgress(message));
+        if (logFd)
+            closeSync(logFd.fd); // parent closes its copy; the child's fd stays open
+        watchUpdateLaunch(child, message => this.failUpdateProgress(message), logFd ? logPath : undefined, logFd?.offset, installed.agend);
         child.unref();
     }
     async handleProfileSlash(data, adapterId) {
@@ -2708,6 +3011,32 @@ export class FleetManager {
             emit: (event, data) => this.emitSseEvent(event, data),
         });
     }
+    /** Board 003648ac: a web /compact followed to its end, from the transcript the Log reads (none: nothing to follow). */
+    compactWatchService = null;
+    get compactWatch() {
+        return this.compactWatchService ??= new CompactWatch({
+            source: (name) => { const src = this.logSource(name); return { path: src.path, format: src.format }; },
+            // The launch that runs it now (the same value the daemon sends with raw_paste_written).
+            owner: (name) => {
+                const daemon = this.lifecycle.daemons.get(name);
+                try {
+                    return daemon ? launchIdentity(daemon.getInteractionSnapshot().owner) : null;
+                }
+                catch {
+                    return null;
+                }
+            },
+            paneFollow: (name) => {
+                try {
+                    return this.lifecycle.daemons.get(name)?.compactPaneUi() != null;
+                }
+                catch {
+                    return false;
+                }
+            },
+            changed: () => this.emitSseEvent("status", this.getUiStatus()),
+        });
+    }
     /** #1218: GET /ui/steps — an instance's steps, read on demand (null: no such instance). */
     logSteps(name, q) { return this.log.steps(name, q); }
     /**
@@ -3117,7 +3446,8 @@ export class FleetManager {
      * or a rebound adapter is never posted through a stale route. A copy
      * already in flight may still land late — the contract permits that.
      */
-    async sendClassicWebEcho(instance, text) {
+    /** `sender` (#1827): the web person's name, as the room log records them ("web-user" when none). */
+    async sendClassicWebEcho(instance, text, sender = WEB_NAME_FALLBACK) {
         const guard = this.webChannelEchoGuards.get(instance);
         const handled = new Set();
         let posted = 0;
@@ -3148,7 +3478,7 @@ export class FleetManager {
                 if (!adapter?.sendText)
                     continue;
                 await adapter.sendText(entry.channelId, text, { format: "text", allowedMentions: { parse: [] } });
-                ClassicChannelManager.logMessage(instance, "web-user", text, new Date());
+                ClassicChannelManager.logMessage(instance, sender, text, new Date());
                 posted++;
             }
             catch (err) {
@@ -3475,6 +3805,20 @@ export class FleetManager {
     hasFleetAdmins(adapterId) {
         return (this.adminListOf(adapterId)?.length ?? 0) > 0;
     }
+    /**
+     * Where this adapter's fleet-admin list is in fleet.yaml, as the operator wrote it, for the "disabled" replies:
+     * `channel.access.allowed_users` (the single-channel form), else the `channels:` entry — by its `id:`, or its
+     * `type:` when it has none. Read from the raw file: loading turns `channel:` into `channels` and fills in ids.
+     */
+    adminListKey(adapterId) {
+        const raw = this.rawFleetConfig;
+        if (!Array.isArray(raw.channels) && raw.channel)
+            return "channel.access.allowed_users";
+        const channels = Array.isArray(raw.channels) ? raw.channels : this.fleetConfig?.channels ?? [];
+        const id = adapterId ?? this.getPrimaryAdapterId();
+        const entry = channels.find(ch => (ch.id ?? ch.type) === id);
+        return `channels[${entry?.id ? `id: ${entry.id}` : `type: ${entry?.type ?? id}`}].access.allowed_users`;
+    }
     /**
      * The one question the privileged commands (/update, /doctor, /dashboard, /collab) ask: may THIS caller,
      * through THIS adapter, run it. `disabled` is "nobody can" — an empty list — and is told apart from
@@ -3552,7 +3896,14 @@ export class FleetManager {
         if (!decision.allow) {
             this.logger.info({ command: data.command, adapterId, scope, reply: decision.reply[0] }, "Slash command refused by the command table");
             const [key, ...args] = decision.reply;
-            await data.respond(t(key, ...args)).catch(() => { });
+            // A command off for want of fleet admins names where they go (`{0}` in its disabled reply).
+            if (decision.reply === spec.disabled)
+                args.push(this.adminListKey(adapterId));
+            // #1990: a refusal that sends the person to General links to it — not in a ClassicBot room, whose readers need
+            // not be in the fleet's guild.
+            const toGeneral = GENERAL_POINTING_REFUSALS.has(key) && scope !== "classic" && scope !== "none";
+            const reply = toGeneral ? this.renderPlaces(adapterId, t(key, ...args) + placeSuffix({ kind: "general" }, "General")).text : t(key, ...args);
+            await data.respond(reply).catch(() => { });
             return;
         }
         if (data.command === "start") {
@@ -3611,6 +3962,9 @@ export class FleetManager {
         else if (data.command === "model") {
             await this.handleModelSlash(data, adapterId);
         }
+        else if (data.command === "backend") {
+            await this.handleBackendSlash(data, adapterId);
+        }
         else if (data.command === "clear") {
             await this.handleClearSlash(data, adapterId);
         }
@@ -3704,7 +4058,7 @@ export class FleetManager {
                 await data.respond(result.durable ? t("dashboard.revoked", result.count) : t("dashboard.revoked_not_durable", result.count));
             }
             else {
-                const owner = this.dashboardOwner(data.userId, adapterId, data.channelId);
+                const owner = this.dashboardOwner(data.userId, adapterId, data.channelId, undefined, data.username);
                 if (!owner) {
                     await this.sendLocalDashboard(data, adapterId);
                     return;
@@ -5026,7 +5380,7 @@ export class FleetManager {
             && cfg.topic_id?.toString() === owner.threadId);
     }
     /** Exact owning General. No primary-adapter or name fallback participates in authorization. */
-    dashboardOwner(userId, adapterId, address, threadId) {
+    dashboardOwner(userId, adapterId, address, threadId, username) {
         const world = this.worlds.get(adapterId);
         if (!world || !this.hasFleetAdmins(adapterId) || !this.isFleetAdmin(userId, adapterId))
             return null;
@@ -5041,7 +5395,7 @@ export class FleetManager {
             const matched = dc ? topic === address || (group === address && topic === threadId)
                 : group === address && ((topic === "1" && (threadId === undefined || threadId === "1")) || topic === threadId);
             if (group && matched)
-                return { userId, adapterId, chatId: group, threadId: topic, binding: world.adapter };
+                return { userId, adapterId, chatId: group, threadId: topic, binding: world.adapter, ...(username ? { username } : {}) };
         }
         return null;
     }
@@ -5050,7 +5404,7 @@ export class FleetManager {
      * — this bot's configured group and its one General topic. No address to match in a DM, so it must be unambiguous:
      * no General, or more than one on this bot and group, and there is no owner (nothing is guessed).
      */
-    dmDashboardOwner(userId, adapterId) {
+    dmDashboardOwner(userId, adapterId, username) {
         const world = this.worlds.get(adapterId);
         if (!world || !this.hasFleetAdmins(adapterId) || !this.isFleetAdmin(userId, adapterId))
             return null;
@@ -5064,7 +5418,7 @@ export class FleetManager {
             .map(([, cfg]) => cfg.topic_id.toString());
         if (topics.length !== 1)
             return null;
-        const owner = { userId, adapterId, chatId: group, threadId: topics[0], binding: world.adapter };
+        const owner = { userId, adapterId, chatId: group, threadId: topics[0], binding: world.adapter, ...(username ? { username } : {}) };
         return this.publicOwnerCurrent(owner) ? owner : null;
     }
     /**
@@ -5091,7 +5445,7 @@ export class FleetManager {
     async startWebInDm(msg, adapter) {
         if (!adapter)
             return;
-        const owner = msg.chatId === msg.userId ? this.dmDashboardOwner(msg.userId, msg.adapterId ?? "") : null;
+        const owner = msg.chatId === msg.userId ? this.dmDashboardOwner(msg.userId, msg.adapterId ?? "", msg.username) : null;
         if (!owner) {
             await adapter.sendText(msg.chatId, t("dashboard.start_web_ack"));
             return;
@@ -5144,10 +5498,11 @@ export class FleetManager {
     /** Telegram's typed command enters through the same strict owner and nonce path as Discord. */
     async dashboardMenu(msg) {
         const id = msg.adapterId;
-        const owner = id ? this.dashboardOwner(msg.userId, id, msg.chatId, msg.threadId) : null;
+        const owner = id ? this.dashboardOwner(msg.userId, id, msg.chatId, msg.threadId, msg.username) : null;
         if (!owner) {
             const adapter = id ? this.adapters.get(id) : undefined;
-            await adapter?.sendText(msg.chatId, t("dashboard.public_general"), { threadId: msg.threadId });
+            const out = this.renderPlaces(id, t("dashboard.public_general") + placeSuffix({ kind: "general" }, "General"), { threadId: msg.threadId });
+            await adapter?.sendText(msg.chatId, out.text, out.opts);
             return;
         }
         if (!await this.showDashboardMenu(owner)) {
@@ -5177,7 +5532,9 @@ export class FleetManager {
             return;
         }
         this.initializeWebSessions();
-        const login = this.webLoginCodes.issue({ epoch: tokenEpoch(token) });
+        // #1827: the code goes privately to this account (a DM, or else this slash command's ephemeral answer): whoever
+        // redeems it is recognised as that account. Recognition only — no owner (this is not an owning General's code).
+        const login = this.webLoginCodes.issue({ epoch: tokenEpoch(token), recipient: { adapterId, userId: data.userId, ...(data.username ? { username: data.username } : {}) } });
         const current = () => !this.shuttingDown && this.adapters.get(adapterId) === adapter
             && this.webToken === token && this.hasFleetAdmins(adapterId) && this.isFleetAdmin(data.userId, adapterId);
         const privateText = `${text}\n${t("dashboard.code", login.display, Math.round(LOGIN_CODE_TTL_MS / 60_000))}`;
@@ -5289,13 +5646,12 @@ export class FleetManager {
         const adapter = owner.binding;
         const status = this.getPublicWebStatus();
         const publicAllowed = publicLinkSettings(this.fleetConfig?.web).allowed;
-        const tgHint = adapter.type === "telegram" && dmChatId === undefined ? this.tgStartWebUrl(owner.adapterId) : null;
-        const menuText = this.topicCommands.getDashboardText(false, !publicAllowed)
-            + (publicAllowed ? "\n\n" + t("dashboard.public_risk") : "")
-            + "\n" + t("dashboard.public_status", status.state, status.remainingSeconds ?? 0)
-            + (status.expiresAt ? t("dashboard.public_until", formatFleetTime(status.expiresAt)) : "")
-            + (tgHint ? "\n" + t("dashboard.menu_tg_hint", tgHint) : "");
-        const choices = [{ action: "local", label: t("dashboard.local") },
+        // Show the action before any link exists. TG's Start instructions belong to confirmed DM refusal below.
+        const menuText = this.topicCommands.getDashboardMenuText()
+            + (publicAllowed ? "\n" + t("dashboard.public_risk") : "")
+            + (status.state !== "closed" ? "\n" + t("dashboard.public_status", status.state, status.remainingSeconds ?? 0)
+                + (status.expiresAt ? t("dashboard.public_until", formatFleetTime(status.expiresAt)) : "") : "");
+        const choices = [{ action: "local", label: t("dashboard.local_signin") },
             ...(publicLinkSettings(this.fleetConfig?.web).allowed ? [{ action: "public", label: t("dashboard.public_open") }] : []),
             ...(status.state !== "closed" ? [{ action: "close", label: t("dashboard.public_close") }] : [])];
         const posted = await this.postNonceButtonPrompt({
@@ -5371,9 +5727,11 @@ export class FleetManager {
                 return false;
             this.initializeWebSessions();
             const issued = this.webLoginCodes.issue({ epoch: tokenEpoch(token), audience: exposureId, owner });
-            // #1586: the expiry in the fleet's zone with its offset, never a bare UTC ISO string.
-            const text = t("dashboard.private_link", url, issued.display, Math.round(LOGIN_CODE_TTL_MS / 60_000), expiresAt ? formatFleetTime(expiresAt) : t("dashboard.local"))
-                + "\n" + t("dashboard.code_next");
+            // Only a public link has a link expiry; the code's five-minute lifetime applies to either packet.
+            const minutes = Math.round(LOGIN_CODE_TTL_MS / 60_000);
+            const text = expiresAt !== undefined
+                ? t("dashboard.private_public", url, issued.display, minutes, formatFleetTime(expiresAt))
+                : t("dashboard.private_local", url, issued.display, minutes);
             const deadline = performance.now() + 10_000;
             const direct = owner.binding;
             // The route the sign-in message took: the code-only follow-up takes the same one (#1586).
@@ -5562,7 +5920,6 @@ export class FleetManager {
             messageId,
         });
         this.lastUpdateProgressText = null;
-        this.updateCompletionTipText = null;
         this.startUpdateProgressMonitor(adapter);
     }
     /** Persist the public response, wait for idle, then start the canonical service restart. */
@@ -5593,7 +5950,6 @@ export class FleetManager {
             return false;
         }
         this.lastUpdateProgressText = null;
-        this.updateCompletionTipText = null;
         this.startUpdateProgressMonitor(adapter);
         await this.waitForFullRestartIdleGrace();
         // An update can begin while the idle wait yields. Never launch a second
@@ -5833,17 +6189,8 @@ export class FleetManager {
             const adapter = this.adapters.get(target.adapterId) ?? (initialAdapter?.id === target.adapterId ? initialAdapter : undefined);
             if (!adapter)
                 return;
-            let text = formatUpdateProgress(marker);
-            // No-restart updates complete in the old fleet process, so they never
-            // reach RestartProgress.finish(). Append the same optional tip here.
-            if (marker.progress.stage === "complete" && this.tipsEnabled()) {
-                if (this.updateCompletionTipText === null) {
-                    const tip = this.pickAvailableTip();
-                    this.updateCompletionTipText = tip ? this.formatTip(tip) : "";
-                }
-                if (this.updateCompletionTipText)
-                    text += `\n\n${this.updateCompletionTipText}`;
-            }
+            // #1854: no tip on an update's completion (either path); tips come on their own schedule and from /tips.
+            const text = formatUpdateProgress(marker);
             if (text === this.lastUpdateProgressText)
                 return;
             this.updateProgressEditRunning = true;
@@ -5894,6 +6241,7 @@ export class FleetManager {
         this.rotateFleetLogs();
         const fleet = this.loadConfig(configPath);
         this.slimFleetConfigAtStartup();
+        this.logConfigWarningsAtStartup();
         setLocale(detectLocale(fleet)); // user-facing text language (fleet.yaml defaults.locale / timezone)
         // #1737 review: the marker this boot adopts — the startup clear may only ever clear this one.
         const bootUpdateMarker = updateMarkerIdentity(this.dataDir);
@@ -6125,7 +6473,7 @@ export class FleetManager {
                 ...DEFAULT_SCHEDULER_CONFIG,
                 ...this.fleetConfig?.defaults.scheduler,
             };
-            this.scheduler = new Scheduler(join(this.dataDir, "scheduler.db"), (schedule, runId, retry) => this.handleScheduleTrigger(schedule, runId, retry), schedulerConfig, (name) => this.fleetConfig?.instances?.[name] != null || !!this.classicChannels?.getAll().some(ch => ch.instanceName === name), (schedule, retry, reason) => this.scheduleRetryDropped(schedule, retry, reason));
+            this.scheduler = new Scheduler(join(this.dataDir, "scheduler.db"), (schedule, runId, retry) => this.handleScheduleTrigger(schedule, runId, retry), schedulerConfig, (name) => this.fleetConfig?.instances?.[name] != null || !!this.classicChannels?.getAll().some(ch => ch.instanceName === name), (schedule, retry, reason) => this.scheduleRetryDropped(schedule, retry, reason), this.logger);
             this.scheduler.init();
             this.logger.info("Scheduler initialized");
             // Tips share the daily-report clock but remain an independent internal
@@ -6229,6 +6577,7 @@ export class FleetManager {
         // into the same broken state, and a user who has legitimately stopped every
         // instance would get a restart loop. Those conditions surface through /health
         // (which now returns 503) and through the General-topic notifications instead.
+        setSdNotifyWarn((fields, message) => this.logger.warn(fields, message));
         this.watchdogTimer = setInterval(() => sdNotify("WATCHDOG=1"), 30_000);
         // #1231: a stalled loop is what turns a slash command into "did not respond";
         // put each long stall in the log instead of leaving it to be guessed at.
@@ -6347,12 +6696,6 @@ export class FleetManager {
                 pausedNames,
                 failedNames,
                 backgroundWorkEndedNames,
-                tipText: pendingProgressOperation === "update" && this.tipsEnabled()
-                    ? (() => {
-                        const tip = this.pickAvailableTip();
-                        return tip ? this.formatTip(tip) : undefined;
-                    })()
-                    : undefined,
                 ...(cleanupOutcome && "render" in cleanupOutcome
                     ? { warningText: cleanupOutcome.render.warning, warningCommand: cleanupOutcome.render.cleanupCommand }
                     : {}),
@@ -6403,6 +6746,7 @@ export class FleetManager {
         // Health HTTP endpoint
         this.startHealthServer(fleet.health_port ?? 19280);
         // #1266: buttons that ended while AgEnD was down (expired, or chosen before a restart) are shown as ended now.
+        // #1823: and polls: a deadline that passed meanwhile closes now (results once); an open one's countdown is redrawn.
         void this.replyButtons()?.sweep().catch(err => this.logger.warn({ err }, "Reply-button sweep failed"));
         // Daily update check — first check after 1 hour, then every 24 hours
         this.updateCheckTimer = setTimeout(() => {
@@ -7144,6 +7488,16 @@ export class FleetManager {
                         });
                     }
                 }
+                else if (msg.type === "raw_paste_written") {
+                    // Board 003648ac: a web /compact's paste reached the pane (or never will): its watch starts, or ends as lost.
+                    if (typeof msg.id === "string")
+                        this.compactWatchService?.pasted(name, msg.id, msg.outcome === "written", { owner: msg.owner, checkpoint: msg.checkpoint, pane: msg.pane });
+                }
+                else if (msg.type === "compact_pane_result") {
+                    // Board 907c7899: kiro's pane said how that /compact ended.
+                    if (typeof msg.id === "string")
+                        this.compactWatchService?.paneResult(name, msg.id, msg.owner, msg.outcome);
+                }
                 else if (msg.type === "runtime_switch_result") {
                     // #1690: what our own runtime /model came to (the daemon answered claude's "Switch model?" or saw the result).
                     const waiter = typeof msg.id === "string" ? this.runtimeSwitchWaiters.get(msg.id) : undefined;
@@ -7351,6 +7705,48 @@ export class FleetManager {
             this.adapterRestarting.delete(id);
         }
     }
+    /**
+     * #1990: how a reader in world `worldId`'s group reaches a place token's target — undefined (plain text) for another
+     * world's instance, an instance without a fleet topic (a ClassicBot room may be anywhere), or an id no link is built
+     * from. Discord: the channel mention; Telegram: the topic URL (General's topic included).
+     */
+    placeLink(worldId, target) {
+        const world = this.worlds.get(worldId ?? "");
+        if (!world)
+            return undefined;
+        let topic;
+        if (target.kind === "general") {
+            const notice = this.fleetNoticeTarget(world.id);
+            if (!notice || notice.chatId !== world.groupId || notice.opts.threadId === undefined)
+                return undefined;
+            topic = String(notice.opts.threadId);
+        }
+        else {
+            if (this.getInstanceAdapterId(target.name) !== world.id)
+                return undefined;
+            const topicId = this.fleetConfig?.instances[target.name]?.topic_id;
+            if (topicId == null)
+                return undefined;
+            topic = String(topicId);
+        }
+        if (world.type === "discord")
+            return SNOWFLAKE.test(topic) && SNOWFLAKE.test(world.groupId) ? { mention: `<#${topic}>` } : undefined;
+        const url = topicUrl(worldPlaceOf(world), topic, { general: target.kind === "general" });
+        return url ? { url } : undefined;
+    }
+    /** #1990: a message for world `worldId`'s group with its place tokens rendered (links as text or Telegram entities). */
+    renderPlaces(worldId, text, opts) {
+        if (!hasPlaceRefs(text))
+            return { text, opts };
+        const type = this.worlds.get(worldId ?? "")?.type;
+        const surface = type === "discord" ? "discord" : type === "telegram" ? "telegram" : "plain";
+        const out = renderPlaceRefs(text, surface, target => this.placeLink(worldId, target));
+        return { text: out.text, opts: out.textLinks.length ? { ...opts, textLinks: out.textLinks } : opts };
+    }
+    /** #1990: renderPlaces for the world that owns `instanceName`'s topic. */
+    renderPlacesFor(instanceName, text, opts) {
+        return this.renderPlaces(this.getInstanceAdapterId(instanceName), text, opts);
+    }
     /** Handle inbound message — transcribe voice if present, then route */
     findGeneralInstance(adapterId) {
         if (!this.fleetConfig)
@@ -7938,6 +8334,21 @@ export class FleetManager {
                     }
                     return;
                 }
+                // #1806: /backend — channel admin, as /model. A ClassicBot agent is not switched by it (it says so).
+                if (text === "/backend" || text.startsWith("/backend ") || text.startsWith("/backend@")) {
+                    if (!this.isModelAdmin(msg.userId, chatId, msg.adapterId)) {
+                        await msgAdapter?.sendText(chatId, t("permission.denied"));
+                        return;
+                    }
+                    const backendInstance = this.classicChannels.getInstanceByChannel(chatId, msg.adapterId);
+                    if (!backendInstance) {
+                        await msgAdapter?.sendText(chatId, t("classic.no_agent_start"));
+                        return;
+                    }
+                    if (msgAdapter)
+                        await this.runBackendCommand(backendInstance, text, msg.userId, chatId, msgAdapter, chatId, undefined, msg.adapterId);
+                    return;
+                }
                 // Handle /compact command (admin only)
                 const classicCompact = parseCompactCommand(text);
                 if (classicCompact) {
@@ -8337,7 +8748,7 @@ export class FleetManager {
             if (!claimNotice(path, WEB_CHAT_NOTICE, adapterId))
                 continue;
             try {
-                await world.adapter.sendText(target.chatId, t("upgrade.web_chat", WEB_REMOTE_DOCS_URL), target.opts);
+                await world.adapter.sendText(target.chatId, t("upgrade.web_chat"), target.opts);
                 this.logger.info({ adapterId, notice: WEB_CHAT_NOTICE }, "Announced web chat in General");
             }
             catch (err) {
@@ -8500,6 +8911,17 @@ export class FleetManager {
                 respond(null, `reply: ${parsedButtons.error}`);
                 return;
             }
+            // #1823: a poll is checked with its buttons. Where it cannot be shown it is refused, never sent as text: text
+            // options would never come back as results.
+            const parsedPoll = parsePoll(args.poll, parsedButtons && "buttons" in parsedButtons ? parsedButtons.buttons : null, args.text);
+            if (parsedPoll && "error" in parsedPoll) {
+                respond(null, `reply: ${parsedPoll.error}`);
+                return;
+            }
+            if (parsedPoll && (!outAdapter.supportsPolls || !this.replyButtons())) {
+                respond(null, `reply: a poll cannot be shown here${outAdapter.supportsPolls ? " (reply buttons are unavailable until AgEnD restarts)" : " — polls work in Discord and Telegram chats and the web chat"}; send the question without poll`);
+                return;
+            }
             // Stickers (#1226) are checked before anything is sent: a refused one is the reply's error, not a gap.
             const stickerProblem = await this.replyStickerProblem(outAdapter, args, threadId, contextAdapterId ?? this.getInstanceAdapterId(senderInstanceName ?? instanceName));
             if (stickerProblem) {
@@ -8519,7 +8941,7 @@ export class FleetManager {
                 const buttons = outAdapter.supportsReplyButtons ? this.replyButtons() : null;
                 if (buttons) {
                     const outId = outAdapter === WEB_ONLY_REPLY_SINK ? "web" : outAdapter.id ?? contextAdapterId ?? "";
-                    replySet = buttons.prepare({ instance: instanceName, adapterId: outId, chatId: String(args.chat_id ?? ""), threadId }, parsedButtons.buttons);
+                    replySet = buttons.prepare({ instance: instanceName, adapterId: outId, chatId: String(args.chat_id ?? ""), threadId }, parsedButtons.buttons, parsedPoll && "poll" in parsedPoll ? parsedPoll.poll : null);
                 }
                 else {
                     args.text = `${String(args.text)}\n\n${replyButtonsFallbackText(parsedButtons.buttons)}`;
@@ -8539,6 +8961,9 @@ export class FleetManager {
                         this.replyButtonsCtl?.discard(replySet.id);
                     }
                 }
+                // #1823: the agent learns its poll's id (the results name it).
+                if (replySet?.poll && !error && result && typeof result === "object")
+                    result = { ...result, poll_id: replySet.id };
                 ticket.complete(result, error);
                 // Return the platform outcome first. Bookkeeping below must never turn
                 // a confirmed Discord/Telegram POST into a tool error if a secondary
@@ -8566,7 +8991,7 @@ export class FleetManager {
                     });
                 }
             };
-            if (routeToolCall(outAdapter, tool, args, threadId, respondAndRecord, replySet ? { replyButtons: replySet.callbacks } : {})) {
+            if (routeToolCall(outAdapter, tool, args, threadId, respondAndRecord, replySet ? { replyButtons: replySet.callbacks, ...(replySet.poll ? { replyPoll: replySet.poll } : {}) } : {})) {
                 return;
             }
             if (replySet)
@@ -8994,6 +9419,19 @@ export class FleetManager {
     }
     dispatchTypedIpc(name, msg) {
         const type = String(msg.type);
+        if (type.startsWith("fleet_") && WEB_EFFECT_TOOLS.has(type.slice(6))) {
+            const ipc = this.instanceIpcClients.get(name), fleetRequestId = msg.fleetRequestId;
+            if (!ipc || typeof fleetRequestId !== "string")
+                return;
+            void this.handleWebThemeHttp(name, type.slice(6), (msg.payload ?? {})).then(result => {
+                if (this.instanceIpcClients.get(name) === ipc)
+                    ipc.send({ type: "fleet_web_theme_response", fleetRequestId, result });
+            }, err => {
+                if (this.instanceIpcClients.get(name) === ipc)
+                    ipc.send({ type: "fleet_web_theme_response", fleetRequestId, error: err instanceof Error ? err.message : "Effect operation failed" });
+            }).catch(err => this.logger.debug({ err }, "Effect tool response could not be written"));
+            return;
+        }
         if (type.startsWith("fleet_schedule_")) {
             this.handleScheduleCrud(name, msg);
             return;
@@ -9019,6 +9457,36 @@ export class FleetManager {
             this.handlePersonaEmoji(name, msg);
             return;
         }
+        if (type === "fleet_get_web_theme" || type === "fleet_set_web_theme" || type === "fleet_set_web_theme_asset" || type === "fleet_reset_web_theme"
+            || type === "fleet_get_web_appearance" || type === "fleet_preview_web_appearance"
+            || type === "fleet_set_web_widget" || type === "fleet_remove_web_widget"
+            || type === "fleet_export_web_mod" || type === "fleet_propose_web_mod") {
+            this.handleWebTheme(name, msg);
+            return;
+        }
+    }
+    /**
+     * #1629: the caller's own web theme over IPC (the agent endpoint calls the same service). `name` is the instance this
+     * IPC connection belongs to — never anything the message says. A refusal is a result the agent reads (its `error`
+     * and what to do), not a transport error.
+     */
+    handleWebTheme(instanceName, msg) {
+        const fleetRequestId = msg.fleetRequestId;
+        const ipc = this.instanceIpcClients.get(instanceName);
+        if (!ipc)
+            return;
+        const tool = String(msg.type).replace(/^fleet_/, "");
+        try {
+            const args = (msg.payload ?? {});
+            const result = tool === "get_web_appearance" || tool === "preview_web_appearance"
+                ? this.appearanceTools.handle(instanceName, tool, args)
+                : tool === "export_web_mod" || tool === "propose_web_mod" ? this.agentMods.handle(instanceName, tool, args)
+                    : this.webAppearance.handleTool(instanceName, tool, args);
+            ipc.send({ type: "fleet_web_theme_response", fleetRequestId, result });
+        }
+        catch (err) {
+            ipc.send({ type: "fleet_web_theme_response", fleetRequestId, error: err.message });
+        }
     }
     /** `list_emojis` / `set_persona_emoji` / `preview_emojis` / `list_stickers` / `preview_stickers` over IPC; the agent endpoint calls the same methods. */
     handlePersonaEmoji(instanceName, msg) {
@@ -9423,6 +9891,19 @@ export class FleetManager {
     async handleSetPersonaEmojiHttp(instance, args) {
         return this.setPersonaEmoji(instance, args);
     }
+    /** #1629: `agend-agent theme …` — the same service as the tools; `instance` is the token's. */
+    async handleWebThemeHttp(instance, tool, args) {
+        if (WEB_EFFECT_TOOLS.has(tool)) {
+            if (!this.isKnownInstance(instance))
+                return { error: "unknown_instance" };
+            return this.effectTools.handle(instance, tool, args);
+        }
+        if (tool === "get_web_appearance" || tool === "preview_web_appearance")
+            return this.appearanceTools.handle(instance, tool, args);
+        if (tool === "export_web_mod" || tool === "propose_web_mod")
+            return this.agentMods.handle(instance, tool, args);
+        return this.webAppearance.handleTool(instance, tool, args);
+    }
     async handlePreviewEmojisHttp(instance, args) {
         return this.previewEmojis(instance, args);
     }
@@ -9929,6 +10410,21 @@ export class FleetManager {
             ? `Refusing to save fleet.yaml: it would be invalid (${introduced.map(e => `${e.path}: ${e.message}`).join("; ")})`
             : null;
     }
+    /**
+     * #1874 follow-up: the validator's warnings, once per start, in daemon.log — a setting fleet.yaml has that AgEnD
+     * ignores (e.g. `web.access`) is otherwise silent unless someone runs `agend validate`.
+     */
+    logConfigWarningsAtStartup() {
+        let warnings = [];
+        try {
+            warnings = validateFleetConfig(this.rawFleetConfig).warnings;
+        }
+        catch (err) {
+            this.logger.debug({ err }, "fleet.yaml validation failed (startup warnings)");
+        }
+        for (const w of warnings)
+            this.logger.warn({ path: w.path }, `fleet.yaml: ${w.path ? `${w.path}: ` : ""}${w.message}`);
+    }
     /** One-time upgrade migration; invalid YAML is never rewritten. */
     slimFleetConfigAtStartup() {
         const redundantPaths = collectRedundantInstanceDefaultPaths(this.rawFleetConfig);
@@ -10102,6 +10598,7 @@ export class FleetManager {
         // must not be shown the old one's conversation, and deleted names must not pile up.
         this.webChatHistory.forget(name);
         this.webFiles.forget(name);
+        this.compactWatchService?.forget(name);
         // #1664: and it is nobody's favorite any more (every device sees that at its next status frame).
         try {
             this.webPrefs.forgetInstance(name);
@@ -10109,6 +10606,17 @@ export class FleetManager {
         catch (err) {
             this.logger.warn({ err: err.message, name }, "Dropping a removed instance from web favorites failed");
         }
+        try {
+            this.themeStore.forget(name);
+            this.webAppearance.forget(name);
+            this.appearanceTools.forget(name);
+            this.effectToolsService?.forget(name);
+            this.mods.forgetInstance(name);
+            this.agentMods.forget(name);
+        }
+        catch (err) {
+            this.logger.warn({ err: err.message, name }, "Dropping a removed instance's web theme failed");
+        }
         // Clean up statusline watcher + instance directory
         this.statuslineWatcher.unwatch(name);
         // instanceDirToClean and effectiveBackend are captured before lifecycle.remove
@@ -10309,10 +10817,12 @@ export class FleetManager {
         return this.webImageCaches[kind];
     }
     /**
-     * instance → the connection that is its own bot: configured now (a connection removed from fleet.yaml is nobody's,
-     * whatever an instance still names — #1635 review), not the primary, and answering for it alone.
+     * The bots instances and ClassicBot rooms speak through, by connections configured now (a connection removed from
+     * fleet.yaml is nobody's, whatever an instance still names — #1635 review). `own`: instance → its own bot (answering
+     * for it alone; the primary too, when it serves one instance only). `speaking` (#1867): instance → the bot it speaks through — its own, a shared one,
+     * or, with none configured for it, the primary.
      */
-    ownBots() {
+    webBots() {
         const instances = this.fleetConfig?.instances ?? {};
         const channels = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
         const configured = new Set(channels.map(ch => ch.id ?? ch.type).filter((id) => typeof id === "string"));
@@ -10322,8 +10832,17 @@ export class FleetManager {
             if (!Object.hasOwn(instances, room.instanceName))
                 assignments.push([room.instanceName, assigned(room.instanceName)]);
         }
-        return ownBotConnections(this.getPrimaryAdapterId(), assignments);
+        const primary = this.getPrimaryAdapterId(), fallback = primary && configured.has(primary) ? primary : undefined;
+        const speaking = new Map();
+        for (const [instance, connection] of assignments) {
+            const c = connection ?? fallback;
+            if (c)
+                speaking.set(instance, c);
+        }
+        return { own: ownBotConnections(assignments), speaking };
     }
+    /** instance → the connection that is its own bot (see webBots). */
+    ownBots() { return this.webBots().own; }
     /**
      * The bot a connection is now: its running adapter and that bot's own user id. Everything cached for an own bot is
      * keyed by both, so a bot put in its place (a token replaced under the same connection id) never shows the old one's
@@ -10366,8 +10885,11 @@ export class FleetManager {
             },
         };
     }
-    /** One instance's avatar and ring for the status frame. Synchronous: what is cached now; fetches run behind. */
-    webIdentityImage(name, displayName, profileAvatar, own) {
+    /**
+     * One instance's avatar and ring for the status frame. Synchronous: what is cached now; fetches run behind. The bot
+     * is its own, else the one it speaks through (#1867) — one cache entry per bot, so a shared bot is fetched once.
+     */
+    webIdentityImage(name, displayName, profileAvatar, bots) {
         let profileVersion = null;
         if (profileAvatar && imageMimeForFile(profileAvatar)) {
             try {
@@ -10375,22 +10897,41 @@ export class FleetManager {
             }
             catch { /* removed */ }
         }
-        const connection = own.get(name), owner = connection ? this.botOwner(connection) : null;
+        const ownConnection = bots.own.get(name), connection = ownConnection ?? bots.speaking.get(name);
+        const owner = connection ? this.botOwner(connection) : null;
         const source = connection && owner?.adapter.fetchBotAvatar ? this.botAvatarSource(connection, owner) : null;
         const bot = source ? this.webImageCache("avatars").peek(source.key, source.load) : null;
         const cfg = this.ownInstanceConfig(name);
         const avatar = avatarFor({ name, displayName, profileVersion, bot: bot && connection ? { connection, version: bot.version } : null,
             personaEmoji: cfg?.status_emojis?.delivered });
-        // The ring belongs to the bot's own face: only when that is what is shown.
-        const accent = !profileVersion && bot && connection && owner
-            ? this.webAccent(connection, owner, cfg ? (cfg.topic_id == null ? undefined : String(cfg.topic_id)) : this.classicChannels?.getChannelIdByInstance(name))
+        // The ring belongs to an own bot's face: only when that is what is shown (a shared bot's would ring everyone alike).
+        // #1958: the own bot's colour is also the identity colour's role tier — whatever face is shown (never a shared bot's).
+        const roleColor = ownConnection && owner
+            ? this.webAccent(ownConnection, owner, cfg ? (cfg.topic_id == null ? undefined : String(cfg.topic_id)) : this.classicChannels?.getChannelIdByInstance(name))
             : null;
-        return accent ? { avatar, accent } : { avatar };
+        const accent = !profileVersion && bot && ownConnection && owner ? roleColor : null;
+        // #1629 (first design §5, r2 (d)): the agent's theme may name its own picture and ring colour. Both come below a
+        // person's upload (never when there is one) and ride beside the theme-free face: a viewer who turned agents'
+        // themes off (fx.show), or a safe-mode load, shows `avatar` and `accent` as before.
+        let theme = { v: 1 };
+        try {
+            theme = this.themeStore.get(name).theme;
+        }
+        catch { /* unreadable themes: none */ }
+        const themeAvatar = !profileVersion && theme.avatar ? { kind: "image", src: `/ui/img/theme/${encodeURIComponent(name)}/${theme.avatar}` } : undefined;
+        const themeAccent = !profileVersion && theme.accent ? theme.accent : undefined;
+        return { avatar, ...(accent ? { accent } : {}), ...(themeAvatar ? { themeAvatar } : {}), ...(themeAccent ? { themeAccent } : {}),
+            // #1958: the agent's own identity colour (theme.identity.color, else its accent) and where it would show it.
+            ...(roleColor ? { roleColor } : {}), ...(theme.identity?.color ?? theme.accent ? { agentColor: theme.identity?.color ?? theme.accent } : {}),
+            ...(theme.identity?.show ? { agentShow: theme.identity.show } : {}) };
     }
-    /** GET /ui/img/bot|avatar/<key>: what is cached, never a fetch. Only an own-bot connection, or a known instance's upload. */
+    /**
+     * GET /ui/img/bot|avatar/<key>: what is cached, never a fetch. Only a connection some instance or room speaks
+     * through (#1867), or a known instance's upload.
+     */
     webImage(kind, key) {
         if (kind === "bot") {
-            if (![...this.ownBots().values()].includes(key))
+            if (![...this.webBots().speaking.values()].includes(key))
                 return null;
             const owner = this.botOwner(key);
             return owner ? this.webImageCache("avatars").read(this.botAvatarSource(key, owner).key) : null;
@@ -11469,7 +12010,8 @@ export class FleetManager {
             // Discord, so every such fallback failed inside the catch handler.
             const target = this.fleetNoticeTarget();
             if (this.adapter && target) {
-                this.adapter.sendText(target.chatId, body, target.opts)
+                const out = this.renderPlaces(this.getPrimaryAdapterId(), body, target.opts);
+                this.adapter.sendText(target.chatId, out.text, out.opts)
                     .catch(err => this.logger.warn({ err }, "Failed to send fleet error notification"));
                 dispatched = true;
             }
@@ -11481,7 +12023,7 @@ export class FleetManager {
             // also suppressed the next ten minutes of identical ones. Leaving the key
             // unspent lets the next caller, once an adapter is up, actually get
             // through. The counter is not reset either: nothing was shown.
-            this.logger.warn({ text: body }, "Fleet error could not be delivered (no adapter or no target yet) — not consuming the throttle window");
+            this.logger.warn({ text: stripPlaceRefs(body) }, "Fleet error could not be delivered (no adapter or no target yet) — not consuming the throttle window");
             return false;
         }
         if (!throttled)
@@ -11519,24 +12061,28 @@ export class FleetManager {
         const groupId = channelCfg?.group_id;
         // Fleet topic instance
         const threadId = this.fleetConfig?.instances[instanceName]?.topic_id;
+        const worldId = this.getInstanceAdapterId(instanceName);
         if (threadId != null && groupId) {
-            adapter.sendText(String(groupId), text, { threadId: String(threadId), ...extraOpts })
+            const out = this.renderPlaces(worldId, text, { threadId: String(threadId), ...extraOpts });
+            adapter.sendText(String(groupId), out.text, out.opts)
                 .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send instance topic notification"));
             return true;
         }
         // Classic instance: find its channelId from the classic manager
         const classicChatId = this.classicChannels?.getChannelIdByInstance(instanceName);
         if (classicChatId) {
-            adapter.sendText(classicChatId, text, extraOpts)
+            // #1990: a ClassicBot room's readers need not be in the fleet's group, so its notices name places as plain text.
+            adapter.sendText(classicChatId, stripPlaceRefs(text), extraOpts)
                 .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send classic notification"));
             return true;
         }
         // Fallback: the instance has neither a topic nor a classic channel, so post
         // where fleet-wide notices go. Not the bare group id: on Discord that is a
         // guild, and the send fails inside the catch handler.
-        const target = this.fleetNoticeTarget(this.getInstanceAdapterId(instanceName));
+        const target = this.fleetNoticeTarget(worldId);
         if (target) {
-            adapter.sendText(target.chatId, text, { ...target.opts, ...extraOpts })
+            const out = this.renderPlaces(worldId, text, { ...target.opts, ...extraOpts });
+            adapter.sendText(target.chatId, out.text, out.opts)
                 .catch(e => this.logger.warn({ err: e, instanceName }, "Failed to send notification (no topic)"));
             return true;
         }
@@ -11607,12 +12153,14 @@ export class FleetManager {
         this.pendingNonceButtons.set(nonce, entry);
         try {
             const choices = opts.choices.map(c => ({ id: `${opts.prefix}${nonce}:${c.action}`, label: c.label }));
+            // #1990: place names link for the group the prompt is posted in; the dashboard's copy is plain (for now).
+            const posted = this.renderPlaces(opts.adapterId, opts.message, opts.threadId ? { threadId: opts.threadId } : undefined);
             const sent = opts.deliver ? await opts.deliver(choices) : await opts.adapter.notifyAlert(opts.chatId, {
                 type: opts.alertType,
                 instanceName: opts.instanceName,
-                message: opts.message,
+                message: posted.text,
                 choices,
-            }, opts.threadId ? { threadId: opts.threadId } : undefined);
+            }, posted.opts);
             // Bind the nonce to the provider's canonical delivery address, not the
             // logical routing input. Telegram, for example, represents General as
             // AgEnD topic "1" on input but omits message_thread_id on the wire and in
@@ -11630,8 +12178,15 @@ export class FleetManager {
             // Offered on the dashboard only once it is live on the platform (a failed post is disarmed above),
             // and only if nothing claimed or expired it meanwhile.
             if (WEB_MIRRORED_PROMPT_PREFIXES.has(opts.prefix) && this.pendingNonceButtons.get(nonce) === entry) {
+                // #1990: on the dashboard an instance's name opens its terminal View (where the prompt is answered by hand).
+                const web = renderPlaceRefs(opts.message, "web", target => {
+                    const route = target.kind === "instance" && Object.hasOwn(this.fleetConfig?.instances ?? {}, target.name) ? webRoute("view", target.name) : undefined;
+                    return route ? { url: route } : undefined;
+                });
+                const links = webTextLinks(web.textLinks, web.text);
                 entry.web = {
-                    text: opts.message,
+                    text: web.text,
+                    ...(links ? { links } : {}),
                     actions: opts.choices.map(c => ({ id: c.action, label: c.label })),
                     expiresAt: Date.now() + (opts.timeoutMs ?? NONCE_BUTTON_TIMEOUT_MS),
                 };
@@ -11827,6 +12382,8 @@ export class FleetManager {
             return true;
         if (await this.handleEffortSelection(data, adapterId))
             return true;
+        if (await this.handleBackendSelection(data, adapterId))
+            return true;
         if (await this.handleHangPrompt(data, adapterId, adapter))
             return true;
         if (data.callbackData.startsWith("cancel:")) {
@@ -11881,7 +12438,7 @@ export class FleetManager {
             isClassic: name => classic.has(name),
             place: name => {
                 const world = this.worlds.get(this.getInstanceAdapterId(name) ?? "");
-                return world ? { type: world.type, ...(world.groupId ? { groupId: world.groupId } : {}) } : undefined;
+                return world ? worldPlaceOf(world) : undefined;
             },
             // fleet.yaml's topic only. A ClassicBot room has none here, so no link: its channel may sit in any allowed
             // guild, not necessarily its world's group.
@@ -12046,9 +12603,7 @@ export class FleetManager {
                 finishedAt: Date.parse(d.finishedAt) || 0,
             })),
             ownerOf,
-            worlds: () => [...this.worlds.values()].map((w) => ({
-                id: w.id, adapter: w.adapter, place: { type: w.type, ...(w.groupId ? { groupId: w.groupId } : {}) },
-            })),
+            worlds: () => [...this.worlds.values()].map((w) => ({ id: w.id, adapter: w.adapter, place: worldPlaceOf(w) })),
             noticeTarget: world => {
                 const target = this.fleetNoticeTarget(world);
                 return target ? { chatId: target.chatId, ...(target.opts.threadId !== undefined ? { threadId: String(target.opts.threadId) } : {}) } : null;
@@ -12094,10 +12649,18 @@ export class FleetManager {
      * The caller has passed the /ui gate (session, same origin, CSRF). Here: the prompt must be one offered
      * on the dashboard, about the instance the page named, and the action one of its own buttons.
      */
-    /** #1266: a click on a reply's button in the web chat (the /ui gate is passed: a session, or the public link). */
-    clickWebReplyButton(instance, id, index) {
+    /** #1823: close_poll — `instance` closes one of its own polls before the deadline. */
+    closePollEarly(instance, id) {
+        const buttons = this.replyButtons();
+        return buttons ? buttons.closeEarly(instance, id) : Promise.resolve({ ok: false, error: "polls are unavailable until AgEnD restarts" });
+    }
+    /**
+     * #1266: a click on a reply's button in the web chat (the /ui gate is passed: a session, or the public link). On a
+     * poll (#1823) it is `voter`'s vote: the page's session.
+     */
+    clickWebReplyButton(instance, id, index, voter) {
         const buttons = this.replyButtons();
-        return buttons ? buttons.clickWeb(instance, id, index) : Promise.resolve({ status: 409, error: t("reply_buttons.closed") });
+        return buttons ? buttons.clickWeb(instance, id, index, voter) : Promise.resolve({ status: 409, error: t("reply_buttons.closed") });
     }
     async clickWebPrompt(instance, nonce, action) {
         if (!/^[0-9a-f]{32}$/.test(nonce) || !/^[a-z][a-z-]{0,23}$/.test(action))
@@ -12450,6 +13013,8 @@ export class FleetManager {
             }
         };
     }
+    /** #1806: the web's /backend confirmations — one per question, used once, for the arguments and backend asked about. */
+    webBackendTokens = new Map();
     /** #1269: the web's /clear confirmations — one token per question, used once, for the instance as it was asked about. */
     webClearTokens = new Map();
     /** #1269: an instance's chat command from the web chat (web-commands.ts); `publicLink`: a gateway request. */
@@ -12457,7 +13022,9 @@ export class FleetManager {
         const webMeta = (instance) => {
             const topicId = this.fleetConfig?.instances[instance]?.topic_id;
             return {
-                chatId: this.getGroupIdForInstance(instance) || "", messageId: newWebMessageId(), username: "web-user", userId: "web-user",
+                // #1827: a /steer or /btw reaches the agent as the web person who wrote it.
+                chatId: this.getGroupIdForInstance(instance) || "", messageId: newWebMessageId(),
+                username: opts.person?.name ?? WEB_NAME_FALLBACK, userId: opts.person?.userId ?? WEB_NAME_FALLBACK,
                 threadId: topicId != null ? String(topicId) : undefined, adapterId: this.getAdapterForInstance(instance)?.id ?? "", source: "web", humanOrigin: webHumanOrigin(true),
             };
         };
@@ -12477,7 +13044,22 @@ export class FleetManager {
                 return this.classicChannels?.getChannelIdByInstance(instance) !== undefined ? "classic" : null;
             },
             ctx: (instance) => this.topicCommands.getCtxText(instance),
-            compact: (instance, instructions) => this.topicCommands.sendCompact(instance, instructions),
+            // Board 003648ac: a watch for the paste, armed when the daemon says it was written (raw_paste_written); one
+            // for a command that was not handed over is dropped.
+            compact: async (instance, instructions) => {
+                let watch = null;
+                try {
+                    const r = this.topicCommands.compactInstance(instance, instructions, () => (watch = this.compactWatch.begin(instance)));
+                    if (!r.sent && watch)
+                        this.compactWatch.cancel(instance, watch);
+                    return { ...r, watch: r.sent ? watch : null };
+                }
+                catch (err) {
+                    if (watch)
+                        this.compactWatch.cancel(instance, watch);
+                    throw err;
+                }
+            },
             applyModel: (instance, name) => this.applyModel(instance, name),
             modelChoices: choicesFromCache,
             applyEffort: (instance, level) => this.applyEffort(instance, level),
@@ -12488,6 +13070,41 @@ export class FleetManager {
                 const current = this.resolveInstanceEffort(instance).effort;
                 return { current, options: levels.map(l => ({ id: l, label: this.effortChoiceLabel(l, current) })) };
             },
+            backendStep: async (instance, args) => {
+                const refusal = this.backendCommandRefusal(instance);
+                if (refusal)
+                    return { error: refusal };
+                // The cached model lists only, as the web's /model: never a live probe on this path.
+                const step = await backendStep(this.backendCommandDeps(instance, { live: false }), instance, backendArgs(args));
+                if (step.kind === "refuse")
+                    return step.noop ? { text: step.text } : { error: step.text };
+                if (step.kind === "choose") {
+                    const id = (token) => joinBackendArgs([...step.args, token]);
+                    return { choices: { prompt: step.text, current: step.current === null ? null : id(step.current), options: step.choices.map(c => ({ id: id(c.token), label: c.label })) } };
+                }
+                const now = performance.now();
+                for (const [k, v] of this.webBackendTokens)
+                    if (v.deadline < now)
+                        this.webBackendTokens.delete(k);
+                const token = randomBytes(16).toString("hex");
+                this.webBackendTokens.set(token, {
+                    instance, asked: joinBackendArgs(backendArgs(args)), args: step.args, from: step.from,
+                    target: this.fleetConfig.instances[instance], deadline: now + CLASSIC_BACKEND_SELECTION_TIMEOUT_MS,
+                });
+                return { confirm: { token, message: step.text } };
+            },
+            backendConfirm: async (instance, args, token) => {
+                const entry = this.webBackendTokens.get(token);
+                this.webBackendTokens.delete(token); // used once, whatever happens next
+                if (!entry || entry.instance !== instance || entry.asked !== joinBackendArgs(backendArgs(args)) || performance.now() > entry.deadline) {
+                    return { status: 409, text: t("backend.selection_expired") };
+                }
+                // The instance it was asked about: one deleted and created again under the name, stopped or not, is another.
+                const stillCurrent = () => this.backendTargetIs(instance, entry.target);
+                if (!stillCurrent())
+                    return { status: 409, text: t("menu.click_stale") };
+                return { status: 200, text: await this.applyBackendSwitch(instance, entry.args, entry.from, stillCurrent) };
+            },
             cancel: (instance) => this.cancelInstance(instance),
             steer: (instance, text, originalBody) => this.topicCommands.sendSteer(instance, text, { ...webMeta(instance), humanOriginalBody: originalBody }),
             btw: (instance, text, originalBody) => this.topicCommands.sendBtw(instance, text, { ...webMeta(instance), humanOriginalBody: originalBody }),
@@ -12516,7 +13133,8 @@ export class FleetManager {
                 // sendClear sends its first IPC synchronously: no await separates this check from the effect.
                 if (this.shuttingDown || !entry.fence())
                     return { status: 409, text: t("menu.click_stale") };
-                return { status: 200, text: await this.topicCommands.sendClear(instance) };
+                const r = this.topicCommands.clearInstance(instance);
+                return r.sent ? { status: 200, text: r.text, sent: true } : { status: 409, text: r.text };
             },
             t: (key, ...args) => t(key, ...args),
         }, input, opts);
@@ -12637,12 +13255,12 @@ export class FleetManager {
      * the operator's. Keep the instance notice passive and put the action in the
      * same-world General topic where an administrator can make the choice. */
     async notifyNormalExit(instanceName) {
-        this.notifyInstanceTopic(instanceName, t("exit.instance_notice", instanceName));
+        this.notifyInstanceTopic(instanceName, t("exit.instance_notice", instanceName) + placeSuffix({ kind: "general" }, "General"));
         const web = this.webOnlyPromptPlace();
         if (web) {
             await this.postNonceButtonPrompt({
                 prefix: EXIT_RESTART_CALLBACK_PREFIX, alertType: "exit_restart", instanceName, ...web,
-                message: t("exit.general_notice", instanceName),
+                message: t("exit.general_notice", placeRef({ kind: "instance", name: instanceName }, instanceName)),
                 choices: [{ action: "restart", label: t("exit.restart") }, { action: "ignore", label: t("exit.ignore") }],
                 expiredText: t("exit.expired", instanceName),
             });
@@ -12671,7 +13289,7 @@ export class FleetManager {
             adapterId,
             chatId,
             threadId,
-            message: t("exit.general_notice", instanceName),
+            message: t("exit.general_notice", placeRef({ kind: "instance", name: instanceName }, instanceName)),
             choices: [
                 { action: "restart", label: t("exit.restart") },
                 { action: "ignore", label: t("exit.ignore") },
@@ -12718,7 +13336,7 @@ export class FleetManager {
      * contain usernames or secret-adjacent text and stays in daemon.log.
      */
     async notifyInteractivePrompt(instanceName, kind) {
-        this.notifyInstanceTopic(instanceName, t("interactive.instance_notice", instanceName));
+        this.notifyInstanceTopic(instanceName, t("interactive.instance_notice", instanceName) + placeSuffix({ kind: "general" }, "General"));
         // Multi-world fleets can have one General per bot/platform. Route the assist
         // request to the General bound to the same adapter as the blocked instance.
         const generalName = this.findGeneralInstance(this.getInstanceAdapterId(instanceName));
@@ -12729,7 +13347,7 @@ export class FleetManager {
         const label = this.interactivePromptLabel(kind);
         const prompt = {
             prefix: INTERACTIVE_ASSIST_CALLBACK_PREFIX, alertType: "interactive_prompt", instanceName,
-            message: t("interactive.general_notice", instanceName, label),
+            message: t("interactive.general_notice", placeRef({ kind: "instance", name: instanceName }, instanceName), label),
             choices: [{ action: "confirm", label: t("interactive.confirm") }, { action: "cancel", label: t("interactive.cancel") }],
             expiredText: t("interactive.expired", instanceName),
             extra: { generalName, promptKind: kind, assistFor: this.interactionWaitKey(instanceName) },
@@ -14099,10 +14717,18 @@ export class FleetManager {
                     }
                     return;
                 }
+                // Between the install ending and the sign-in starting there is no
+                // session to cancel; this hand-off is what `/login cancel` stops — from
+                // here on, as the login-shell lookup below is an await.
+                const handoff = { backend, cancelled: false };
+                this.installHandoff = handoff;
                 // The installer may only have added the binary to a profile PATH; a
                 // fresh login shell sees that, the fleet process's PATH may not.
-                const installedAt = this.locateBinaryOnLoginShell(info.binary) ?? this.locateInInstallerBinDirs(info);
+                const installedAt = (await this.locateBinaryOnLoginShell(info.binary)) ?? this.locateInInstallerBinDirs(info);
+                if (handoff.cancelled || this.installHandoff !== handoff)
+                    return;
                 if (!installedAt) {
+                    this.installHandoff = null;
                     await chat.adapter.sendText(chat.chatId, t("install.verify_failed", backend, info.binary), { threadId: chat.threadId }).catch(() => { });
                     return;
                 }
@@ -14112,6 +14738,7 @@ export class FleetManager {
                 // installed, reported as verified, and then offered nowhere.
                 this.adoptBinaryDirectory(installedAt, backend);
                 if (!LOGIN_FLOWS[backend]) {
+                    this.installHandoff = null;
                     await chat.adapter.sendText(chat.chatId, t("install.success_no_login", backend), { threadId: chat.threadId }).catch(() => { });
                     return;
                 }
@@ -14120,10 +14747,6 @@ export class FleetManager {
                 // publish a durable completion line first so a successful install can
                 // never look like it silently disappeared.  Include the binary that
                 // passed the fresh-login-shell verification and the exact next step.
-                // Between the install ending and the sign-in starting there is no
-                // session to cancel; this hand-off is what `/login cancel` stops.
-                const handoff = { backend, cancelled: false };
-                this.installHandoff = handoff;
                 await chat.adapter.sendText(chat.chatId, t("install.success", backend, info.binary), { threadId: chat.threadId }).catch(err => this.logger.warn({ err, backend }, "Failed to send durable install success notification"));
                 if (handoff.cancelled || this.installHandoff !== handoff)
                     return;
@@ -14182,16 +14805,14 @@ export class FleetManager {
      * The absolute path a fresh login shell resolves `binary` to, or null. Only
      * a real executable file counts: `command -v` also answers with an alias
      * definition or a function name, neither of which a spawn could run.
+     * Async (runOnLoginShell): a login file that backgrounds a process holding the shell's output once froze the fleet loop here.
      */
-    locateBinaryOnLoginShell(binary) {
-        return measureSyncWork("fleet.installLookup", () => this.locateBinaryOnLoginShellSync(binary));
-    }
-    locateBinaryOnLoginShellSync(binary) {
+    async locateBinaryOnLoginShell(binary) {
         try {
-            const result = measureSyncWork("fleet.installLoginShell", () => spawnSync("bash", ["-lc", `command -v ${binary}`], { timeout: 10_000, stdio: "pipe", encoding: "utf8" }));
+            const result = await runOnLoginShell(`command -v ${binary}`);
             if (result.status !== 0)
                 return null;
-            const path = String(result.stdout ?? "").trim().split("\n").pop()?.trim() ?? "";
+            const path = result.stdout.trim().split("\n").pop()?.trim() ?? "";
             if (!isAbsolute(path))
                 return null;
             accessSync(path, fsConstants.X_OK);
@@ -14325,6 +14946,14 @@ export class FleetManager {
         const room = this.classicChannels?.getAll().find(c => c.instanceName === name);
         return room ? `room:${room.channelId}:${room.adapterId ?? ""}` : null;
     }
+    /** The only Try-card publisher: no arbitrary SSE sender/role can manufacture this metadata. */
+    publishEffectTrial(instance, offer) {
+        const row = this.webChatHistory.recordEffectTrial(instance, offer, new Date().toISOString());
+        if (!row)
+            return false;
+        broadcastSseEvent(this.sseClients, "message", row, err => this.logger.debug({ err }, "SSE client write failed; evicting"), this.webChatHistory.cursorOf(row));
+        return true;
+    }
     /** Push an SSE event to all connected Web UI clients. */
     emitSseEvent(event, data) {
         // #1386: a prompt opened or closed, or an instance's state moved — "Needs you" may have changed.
@@ -14340,8 +14969,13 @@ export class FleetManager {
                 messageId: typeof m.messageId === "string" ? m.messageId : undefined,
                 role: typeof m.role === "string" ? m.role : undefined,
                 buttons: m.buttons,
+                click: m.click,
+                links: m.links,
             });
             broadcastSseEvent(this.sseClients, event, recorded, onError, this.webChatHistory.cursorOf(recorded));
+            // #1629: live-only receipt after the recorded agent reply. Never persist/replay it or give it an SSE cursor.
+            if (recorded.role === "agent")
+                broadcastSseEvent(this.sseClients, "agent_reply_live", { v: 1, boot: recorded.boot, id: recorded.id, instance: recorded.instance }, onError);
             return;
         }
         // #1266: a reply's buttons ended — the history shows it too (a later load, the public link's poll).
@@ -14391,7 +15025,7 @@ export class FleetManager {
         const instanceHangConfig = this.fleetConfig?.instances[instanceName]?.hang_detector;
         const configuredMinutes = instanceHangConfig?.timeout_minutes
             ?? this.fleetConfig?.defaults?.hang_detector?.timeout_minutes
-            ?? 15;
+            ?? DEFAULT_STUCK_TIMEOUT_MS / 60_000; // #1854: the detector's own default (10 min), not a stale 15
         const unchangedMinutes = unchangedForMs == null
             ? configuredMinutes
             : Math.max(1, Math.floor(unchangedForMs / 60_000));
@@ -14449,12 +15083,12 @@ export class FleetManager {
         "codex": "AGENTS.md",
         "opencode": "AGENTS.md",
         "kiro-cli": ".kiro/steering/project.md",
-        // Grok reads AGENTS.md project docs; agy reads .agents/agents.md — the
+        // Grok reads AGENTS.md project docs; agy reads .agents/AGENTS.md (board 0340ec89: not the lowercase name) — the
         // same files their writeConfig() appends fleet instructions to.
         "grok": "AGENTS.md",
         // muse init scaffolds AGENTS.md and the binary reads it as project rules.
         "muse": "AGENTS.md",
-        "antigravity": ".agents/agents.md",
+        "antigravity": ".agents/AGENTS.md",
         "mock": "CLAUDE.md",
     };
     static GENERAL_INSTRUCTIONS = `# Fleet Coordinator
@@ -14494,10 +15128,17 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     ensureGeneralInstructionsSync(workDir, backendName, instanceName) {
         const backend = backendName ?? "claude-code";
         workDir = this.resolveKnowledgeWorkDir(workDir, backend, instanceName);
+        // Board 0340ec89: General's file from before, under the lowercase name agy never read, becomes the one it reads.
+        if (backend === "antigravity")
+            migrateAgyAgentsFile(workDir);
         const filename = FleetManager.INSTRUCTIONS_FILENAME[backend] ?? "CLAUDE.md";
         const filePath = join(workDir, filename);
         mkdirSync(dirname(filePath), { recursive: true });
-        if (!existsSync(filePath)) {
+        if (backend === "antigravity" && danglingSymlink(filePath)) {
+            // #1914 review: a person's dangling symlink there is kept and not followed (nothing created where it points).
+            this.logger.warn({ filePath }, "General's agy instructions file is a dangling symlink; left as it is, not written");
+        }
+        else if (!existsSync(filePath)) {
             writeFileSync(filePath, FleetManager.GENERAL_INSTRUCTIONS, "utf-8");
             this.logger.info({ filePath }, "Created general instance instructions file");
         }
@@ -14594,6 +15235,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
         const filename = FleetManager.INSTRUCTIONS_FILENAME[backend] ?? "CLAUDE.md";
         const instructionsPath = join(workDir, filename);
+        if (backend === "antigravity" && danglingSymlink(instructionsPath))
+            return; // kept, not followed (#1914 review; logged above)
         const body = files.map(f => readFileSync(join(srcSteering, f), "utf-8").trim()).join("\n\n");
         const block = `${FleetManager.STEERING_BLOCK_BEGIN}\n${body}\n${FleetManager.STEERING_BLOCK_END}`;
         let existing = "";
@@ -14614,6 +15257,22 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             mkdirSync(dirname(instructionsPath), { recursive: true });
             writeFileSync(instructionsPath, next);
         }
+        // Board 0340ec89: a legacy agy file that stays beside the new one (a person's own) loses only AgEnD's block.
+        const legacy = backend === "antigravity" ? agyLegacyAgentsFile(workDir) : null;
+        if (legacy) {
+            try {
+                const old = readFileSync(legacy, "utf-8");
+                const b = old.indexOf(FleetManager.STEERING_BLOCK_BEGIN), e = old.indexOf(FleetManager.STEERING_BLOCK_END);
+                if (b !== -1 && e > b) {
+                    const rest = (old.slice(0, b).trimEnd() + "\n" + old.slice(e + FleetManager.STEERING_BLOCK_END.length).trimStart()).trim();
+                    if (rest)
+                        writeFileSync(legacy, rest + "\n");
+                    else
+                        rmSync(legacy, { force: true });
+                }
+            }
+            catch { /* best effort: the new file already has the block */ }
+        }
     }
     static STEERING_BLOCK_BEGIN = "<!-- >>> agend:core-rules — managed by AgEnD; edits inside this block are overwritten -->";
     static STEERING_BLOCK_END = "<!-- <<< agend:core-rules -->";
@@ -15149,10 +15808,11 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      * accepts any string ("Set model to opsu"), and its "Switch model?" then names the typo. Static aliases (with [1m]),
      * the cached account catalog, the configured model; without a cached catalog, any `claude-…` id too (cannot check).
      */
-    claudeModelKnown(instanceName, model) {
+    claudeModelKnown(instanceName, model, 
+    /** #1806: null on a switch INTO claude-code — the configured model then belongs to the backend being left. */
+    configured = this.fleetConfig?.instances[instanceName]?.model ?? this.fleetConfig?.defaults?.model) {
         const aliases = ["default", "sonnet", "opus", "haiku", "opusplan", "Fable"];
         const api = (this.readCliEnv("claude-code")?.apiModels ?? []).map(m => m.id);
-        const configured = this.fleetConfig?.instances[instanceName]?.model ?? this.fleetConfig?.defaults?.model;
         const lower = model.trim().toLowerCase();
         const bare = lower.replace(/\[1m\]$/, "");
         const known = aliases.some(a => a.toLowerCase() === bare)
@@ -16131,7 +16791,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     /** How this instance's backend applies an effort change. */
     effortStrategyFor(instanceName) {
         try {
-            const { strategy, levels } = readEffortMetadata(this.backendNameForInstance(instanceName), this.getInstanceDir(instanceName));
+            const { strategy, levels } = this.instanceEffortMetadata(instanceName);
             return strategy !== "unsupported" && levels.length > 0 ? strategy : "unsupported";
         }
         catch {
@@ -16141,13 +16801,23 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     /** Effort levels this instance's backend actually accepts (empty = unsupported). */
     effortLevelsFor(instanceName) {
         try {
-            const { strategy, levels } = readEffortMetadata(this.backendNameForInstance(instanceName), this.getInstanceDir(instanceName));
+            const { strategy, levels } = this.instanceEffortMetadata(instanceName);
             return strategy === "unsupported" ? [] : levels;
         }
         catch {
             return [];
         }
     }
+    /** The instance's backend's effort metadata; agy's levels are its model's (#1825), the one the instance runs. */
+    instanceEffortMetadata(instanceName) {
+        const backend = this.backendNameForInstance(instanceName);
+        let model = null;
+        if (backend === "antigravity") {
+            const resolved = this.resolveInstanceModel(instanceName);
+            model = resolved.source === "unresolved" ? null : resolved.model;
+        }
+        return readEffortMetadata(backend, this.getInstanceDir(instanceName), model);
+    }
     /** Configured effort for an instance: per-instance, else fleet default, else none. */
     resolveInstanceEffort(instanceName) {
         const own = this.fleetConfig?.instances[instanceName]?.effort;
@@ -16299,6 +16969,377 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             ? `\n${t("effort.current_fleet", effort)}`
             : `\n${t("effort.current", effort)}`;
     }
+    // ── #1806: /backend — another CLI backend, with its model and effort, in one write and one relaunch ──
+    /** The steps' view of this fleet (backend-command.ts). `live`: a missing or stale model list may be probed (not on the web). */
+    backendCommandDeps(instanceName, opts) {
+        return {
+            currentBackend: (name) => this.backendNameForInstance(name),
+            currentDisplay: (name) => `${this.backendNameForInstance(name)} · ${this.resolveInstanceModel(name).display}`,
+            installedBackends: () => KNOWN_BACKENDS.filter(b => b !== "mock" && this.backendInstalledHere(b)),
+            models: (backend) => this.backendModelOptions(backend, opts),
+            // #1808: the same rule update_instance_config's switch applies (backendModelVerdict).
+            modelKnown: (backend, model) => this.backendModelVerdict(instanceName, backend, model).ok,
+            effortLevels: (backend, model) => this.backendEffortLevels(instanceName, backend, model),
+            inherited: (key) => {
+                const value = getEffectiveInstanceDefaults(this.fleetConfig?.defaults)[key];
+                return typeof value === "string" && value ? value : undefined;
+            },
+            modelCompatible: (backend, model) => isModelCompatible(backend, model),
+            state: (name) => {
+                const status = this.getInstanceStatus(name);
+                return { running: status === "running", busy: status === "running" && !this.getInstanceIdle(name), status };
+            },
+            t: (key, ...args) => t(key, ...args),
+        };
+    }
+    /**
+     * `/effort`'s levels for a backend this instance may move to, for the model that will run there (codex's levels are
+     * per model; null: its configured default). Empty: it has no effort setting. A file read, never a CLI.
+     */
+    backendEffortLevels(instanceName, backend, model = null) {
+        // codex: the model the NEXT launch runs, for the levels and the gate alike (#1807 review r2).
+        let runs = model;
+        if (backend === "codex") {
+            const next = this.prospectiveCodexModel(instanceName, model);
+            if (!next.proven)
+                return [];
+            runs = next.model;
+        }
+        let levels;
+        try {
+            const metadata = readEffortMetadata(backend, this.getInstanceDir(instanceName), runs);
+            levels = metadata.strategy === "unsupported" ? [] : metadata.levels;
+        }
+        catch {
+            return [];
+        }
+        // #1811: only the levels this host's launch of that backend will pass (launch-effort.ts, the gate the launch
+        // itself applies) — an effort chosen here reaches the new CLI with the one relaunch, or is not offered.
+        const takes = this.launchEffortGate(instanceName, backend, runs);
+        return levels.filter(takes);
+    }
+    /**
+     * #1808: whether a backend takes this model name — the one rule for /backend and update_instance_config's switch.
+     * The name must be one its launch line can carry (modelNameCarried); then its offered list (the cached CLI env), and
+     * claude-code's known names (without this instance's configured model, which belongs to the backend being left).
+     * With no list known, the backend's usual name pattern decides.
+     */
+    backendModelVerdict(instanceName, backend, model, 
+    /** The provider the backend will run on (default: this instance's own, else the fleet's). */
+    opts = { provider: this.customProviderFor(instanceName, backend) }) {
+        // A custom provider has its own catalog, which the CLI reads at launch and AgEnD cannot see before one (#1815
+        // review): only the launch-line rule applies — never the account's list or the default provider's naming pattern.
+        if (opts.provider)
+            return modelNameCarried(backend, model) ? { ok: true } : { ok: false, choices: [] };
+        const listed = this.readCliEnv(backend)?.models ?? [];
+        const choices = listed.slice(0, 24).map(o => o.id);
+        if (!modelNameCarried(backend, model))
+            return { ok: false, choices };
+        if (listed.some(o => o.id === model))
+            return { ok: true };
+        if (backend === "claude-code") {
+            const check = this.claudeModelKnown(instanceName, model, null);
+            return check.known ? { ok: true } : { ok: false, choices: check.names };
+        }
+        return listed.length === 0 && isModelCompatible(backend, model) ? { ok: true } : { ok: false, choices };
+    }
+    /**
+     * #1807 review r2: the model codex's next launch of this instance runs. Every launch's writeConfig copies the SHARED
+     * config.toml into the instance's codex home first, so that source decides — not the home's copy from an earlier
+     * launch. Read-only; a model chosen here (`-c model=…`) outranks it; a project file that could change it, unproven.
+     */
+    prospectiveCodexModel(instanceName, model) {
+        const { sharedHome } = codexMetadataHomes(this.getInstanceDir(instanceName));
+        return resolveCodexLaunchModel({
+            isolatedHome: sharedHome, sharedHome, model,
+            workingDirectory: this.fleetConfig?.instances[instanceName]?.working_directory,
+        });
+    }
+    /** #1811: whether a launch of `backend` here would pass a level: the same gate its builder applies. */
+    launchEffortGate(instanceName, backend, model) {
+        if (backend === "claude-code" || backend === "grok" || backend === "antigravity") {
+            const binary = BACKEND_INSTALLATION_INFO[backend]?.binary;
+            if (!binary)
+                return () => false;
+            const path = resolveBinary(binary);
+            return level => flagEffort(backend, level, path).arg !== null;
+        }
+        if (backend === "codex") {
+            // `model` is the next launch's, proven by the caller (prospectiveCodexModel); the catalog is codex's own cache.
+            if (!model)
+                return () => false;
+            const catalog = readCodexModelEffortLevels({ ...codexMetadataHomes(this.getInstanceDir(instanceName)), model });
+            return level => codexEffort(level, catalog).arg !== null;
+        }
+        // kiro-cli gates its own --effort by version at launch (a quiet console note otherwise); muse always passes it.
+        return () => true;
+    }
+    /** Installed the way the launch finds a CLI (resolveBinary): on PATH or in a known install directory. */
+    backendInstalledHere(backend) {
+        const binary = BACKEND_INSTALLATION_INFO[backend]?.binary;
+        return !!binary && resolveBinary(binary) !== binary;
+    }
+    /** The models `/model` would offer on a backend: the cached CLI env, else (live) a bounded probe. Never throws. */
+    async backendModelOptions(backend, opts) {
+        const cached = this.readCliEnv(backend);
+        if (!opts.live || (cached?.models.length && !this.cliEnvNeedsRefresh(cached)))
+            return cached?.models ?? [];
+        opts.onLiveProbe?.();
+        const env = await this.probeBackendBounded(backend).catch(() => null);
+        return env?.models.length ? env.models : cached?.models ?? [];
+    }
+    /**
+     * #1806 review: the instance a `/backend` was asked about is still this config entry — not one deleted and created
+     * again under the same name, or replaced by a Settings edit (both put a new object there), stopped or not.
+     */
+    backendTargetIs(instanceName, target) {
+        const instances = this.fleetConfig?.instances;
+        return !!target && !!instances && Object.prototype.hasOwnProperty.call(instances, instanceName) && instances[instanceName] === target;
+    }
+    /** `/backend` is for fleet.yaml instances: update_instance_config does not manage a ClassicBot agent. */
+    backendCommandRefusal(instanceName) {
+        return this.fleetConfig?.instances && Object.prototype.hasOwnProperty.call(this.fleetConfig.instances, instanceName)
+            ? null : t("backend.classic_unsupported", instanceName);
+    }
+    /**
+     * Apply a confirmed `/backend`: judged again first (a menu lives a minute — the backend may have moved, a CLI been
+     * removed), then update_instance_config's write: backend, model and effort at once, refused and rolled back whole
+     * (its credential-profile login gate included), then one fresh relaunch of a running instance.
+     */
+    async applyBackendSwitch(instanceName, args, from, stillCurrent) {
+        if (this.backendNameForInstance(instanceName) !== from)
+            return t("backend.changed", instanceName, from);
+        if (!stillCurrent())
+            return t("menu.click_stale");
+        const deps = this.backendCommandDeps(instanceName, { live: false });
+        const step = await backendStep(deps, instanceName, args);
+        if (step.kind !== "confirm")
+            return step.kind === "refuse" ? step.text : t("backend.usage");
+        // Asked again after the await, with nothing awaited between here and the write (applyInstanceConfigPatch writes
+        // synchronously): two switches confirmed together, or an instance changed meanwhile, never both succeed.
+        if (this.backendNameForInstance(instanceName) !== from)
+            return t("backend.changed", instanceName, from);
+        if (!stillCurrent())
+            return t("menu.click_stale");
+        const { plan } = step;
+        const shown = planDisplay(deps, plan);
+        const { value, error } = await new Promise(resolve => {
+            applyInstanceConfigPatch(this, instanceName, { backend: plan.backend, model: plan.model, effort: plan.effort }, (value, error) => resolve({ value, error }));
+        });
+        if (error)
+            return t("backend.refused", instanceName, error);
+        const result = (value ?? {});
+        if (result.warning)
+            return t("backend.restart_failed", instanceName, plan.backend, result.warning);
+        if (result.restarted)
+            return t("backend.switched", instanceName, plan.backend, shown.model, shown.effort);
+        return t("backend.switched_not_running", instanceName, plan.backend, shown.model, shown.effort, this.getInstanceStatus(instanceName));
+    }
+    /** A step's buttons: index callbacks (a model id can be longer than Telegram's 64-byte callback data allows). */
+    backendStepButtons(instanceName, nonce, step) {
+        if (step.kind === "choose")
+            return step.choices.map((c, i) => ({ id: `${BACKEND_SELECT_CALLBACK_PREFIX}${nonce}:${i}`, label: c.label }));
+        if (step.kind !== "confirm")
+            return [];
+        const running = this.getInstanceStatus(instanceName) === "running";
+        return [
+            { id: `${BACKEND_SELECT_CALLBACK_PREFIX}${nonce}:0`, label: t(running ? "backend.confirm_button" : "backend.confirm_button_stopped") },
+            { id: `${BACKEND_SELECT_CALLBACK_PREFIX}${nonce}:1`, label: t("backend.cancel_button") },
+        ];
+    }
+    /**
+     * Show a `/backend` step (a choice, or the confirmation) where the command was given: Discord edits its interaction
+     * reply; Telegram retires the previous step's keyboard and posts the next. One pending entry per step, under a fresh
+     * nonce: a click on an older step finds nothing.
+     */
+    async presentBackendStep(place, step) {
+        const nonce = randomBytes(6).toString("hex");
+        const buttons = this.backendStepButtons(place.instanceName, nonce, step);
+        const timer = setTimeout(() => {
+            const p = this.pendingBackendSelects.get(nonce);
+            if (!p)
+                return;
+            this.pendingBackendSelects.delete(nonce);
+            void this.endBackendMenu(p, t("backend.selection_expired")).catch(() => { });
+        }, CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
+        timer.unref?.();
+        const pending = { ...place, step, timer };
+        this.pendingBackendSelects.set(nonce, pending);
+        try {
+            if (step.kind === "confirm" && place.respondButtons) {
+                await place.respondButtons(step.text, buttons);
+                return;
+            }
+            if (place.respondChoices) {
+                await place.respondChoices(step.text, buttons);
+                return;
+            }
+            if (!place.adapter || !place.adapterChatId)
+                throw new Error("no place to show the menu");
+            if (place.menuMessageId && place.adapter.editMessageRemoveButtons) {
+                const chosen = t("backend.chosen", joinBackendArgs(step.args));
+                await place.adapter.editMessageRemoveButtons(place.adapterChatId, place.menuMessageId, chosen, place.adapterThreadId).catch(() => { });
+            }
+            const menuMessageId = await place.adapter.promptUser(place.adapterChatId, step.text, buttons, { threadId: place.adapterThreadId });
+            const fresh = this.pendingBackendSelects.get(nonce);
+            if (fresh)
+                fresh.menuMessageId = menuMessageId;
+        }
+        catch (err) {
+            this.pendingBackendSelects.delete(nonce);
+            clearTimeout(timer);
+            this.logger.warn({ err, instanceName: place.instanceName }, "backend menu failed");
+            await place.respond(t("backend.usage")).catch(() => { });
+        }
+    }
+    /** Close a `/backend` menu with a last word: its buttons go (Telegram edits them away), the text stays. Returns where it was said. */
+    async endBackendMenu(pending, text) {
+        if (pending.adapter && pending.adapterChatId) {
+            if (pending.menuMessageId && pending.adapter.editMessageRemoveButtons) {
+                try {
+                    await pending.adapter.editMessageRemoveButtons(pending.adapterChatId, pending.menuMessageId, text, pending.adapterThreadId);
+                    return pending.menuMessageId;
+                }
+                catch { /* say it in a new message */ }
+            }
+            return (await pending.adapter.sendText(pending.adapterChatId, text, { threadId: pending.adapterThreadId })).messageId;
+        }
+        if (pending.retireButtons)
+            await pending.retireButtons(text);
+        else
+            await pending.respond(text);
+        return undefined;
+    }
+    /** Start `/backend` for a fleet instance from Discord or Telegram; the caller has checked the channel admin. */
+    async beginBackendCommand(place, args) {
+        const refusal = this.backendCommandRefusal(place.instanceName);
+        if (refusal) {
+            await place.respond(refusal);
+            return;
+        }
+        if (!place.respondChoices && !(place.adapter && place.adapterChatId)) {
+            await place.respond(t("backend.usage"));
+            return;
+        }
+        place = { ...place, target: this.fleetConfig.instances[place.instanceName] };
+        const deps = this.backendCommandDeps(place.instanceName, {
+            live: true,
+            onLiveProbe: () => { void place.respond(t("model.refreshing")).catch(() => { }); },
+        });
+        const step = await backendStep(deps, place.instanceName, args);
+        if (step.kind === "refuse") {
+            await place.respond(step.text);
+            return;
+        }
+        await this.presentBackendStep(place, step);
+    }
+    /** `/backend` slash handler: channel admin, as `/model`. Options or typed text give the direct form. */
+    async handleBackendSlash(data, adapterId) {
+        if (!this.isModelAdmin(data.userId, data.channelId, adapterId)) {
+            await data.respond(t("permission.denied"));
+            return;
+        }
+        const name = this.resolveSlashTarget(data.channelId, adapterId);
+        if (!name) {
+            await data.respond(t("classic.no_agent"));
+            return;
+        }
+        const option = (key) => typeof data.options?.[key] === "string" ? data.options[key].trim() : "";
+        const given = [option("backend"), option("model"), option("effort")];
+        // A later option without the one before it says nothing that can be judged in order.
+        if (given.some((value, i) => value && given.slice(0, i).some(before => !before))) {
+            await data.respond(t("backend.usage"));
+            return;
+        }
+        const args = given[0] ? given.filter(Boolean) : backendArgs(data.text ?? "");
+        await this.beginBackendCommand({ instanceName: name, userId: data.userId, channelId: data.channelId, adapterId, respond: data.respond, respondChoices: data.respondChoices,
+            respondButtons: data.respondButtons, retireButtons: data.retireButtons }, args);
+    }
+    /** Telegram `/backend` in a fleet topic (topic-commands) or a ClassicBot chat; the caller has checked the admin. */
+    async runBackendCommand(instanceName, text, userId, channelId, adapter, chatId, threadId, adapterId) {
+        const respond = async (reply) => (await adapter.sendText(chatId, reply, { threadId })).messageId;
+        await this.beginBackendCommand({ instanceName, userId, channelId, adapterId, respond, adapter, adapterChatId: chatId, adapterThreadId: threadId }, backendArgs(text.replace(/^\/backend(@\S+)?/, "")));
+    }
+    /** Consume a `/backend` click: the next step, or on the confirmation the switch itself. True for every backend-select id. */
+    async handleBackendSelection(data, adapterId) {
+        if (!data.callbackData.startsWith(BACKEND_SELECT_CALLBACK_PREFIX))
+            return false;
+        const match = data.callbackData.match(/^backend-select:([0-9a-f]+):(\d{1,2})$/);
+        if (!match)
+            return true;
+        const pending = this.pendingBackendSelects.get(match[1]);
+        if (!pending)
+            return true;
+        // As a /model click (#754 audit): the admin who opened it, through the same bot, in the same channel, still admin.
+        const cbChannel = data.threadId ?? data.chatId;
+        if (!data.userId || data.userId !== pending.userId
+            || (pending.adapterId !== undefined && pending.adapterId !== adapterId)
+            || (cbChannel !== pending.channelId && data.chatId !== pending.channelId)
+            || !this.menuClickStillCurrent(pending.instanceName, data.userId, pending.channelId, adapterId, pending.adapterChatId)) {
+            data.ack?.(t("buttons.admin_only"));
+            return true;
+        }
+        this.pendingBackendSelects.delete(match[1]);
+        clearTimeout(pending.timer);
+        if (!pending.menuMessageId && data.messageId)
+            pending.menuMessageId = data.messageId;
+        const index = Number(match[2]);
+        const { step } = pending;
+        if (step.kind === "choose") {
+            const choice = step.choices[index];
+            if (!choice)
+                return true;
+            if (!this.backendTargetIs(pending.instanceName, pending.target)) {
+                await this.endBackendMenu(pending, t("menu.click_stale")).catch(() => { });
+                return true;
+            }
+            const next = await backendStep(this.backendCommandDeps(pending.instanceName, { live: true }), pending.instanceName, [...step.args, choice.token]);
+            if (next.kind === "refuse") {
+                await this.endBackendMenu(pending, next.text).catch(() => { });
+                return true;
+            }
+            await this.presentBackendStep(pending, next);
+            return true;
+        }
+        if (index === 1) {
+            await this.endBackendMenu(pending, t("backend.cancelled")).catch(() => { });
+            return true;
+        }
+        if (index !== 0)
+            return true;
+        // Confirmed: say so at once, then switch in the background (the relaunch takes a while) and say how it went.
+        const progressId = await this.endBackendMenu(pending, t("backend.switching", pending.instanceName, step.plan.backend)).catch(() => undefined);
+        const say = async (text) => {
+            if (pending.adapter && pending.adapterChatId) {
+                if (progressId)
+                    await pending.adapter.editMessage(pending.adapterChatId, progressId, text, pending.adapterThreadId);
+                else
+                    await pending.adapter.sendText(pending.adapterChatId, text, { threadId: pending.adapterThreadId });
+            }
+            else
+                await pending.respond(text);
+        };
+        void (async () => {
+            let result;
+            try {
+                // Asked again after the awaits above: the instance may have moved, or the admin lost admin.
+                const stillCurrent = () => this.backendTargetIs(pending.instanceName, pending.target)
+                    && this.menuClickStillCurrent(pending.instanceName, data.userId, pending.channelId, adapterId, pending.adapterChatId);
+                result = stillCurrent()
+                    ? await withSpawnHoldReply(say, () => this.applyBackendSwitch(pending.instanceName, step.args, step.from, stillCurrent))
+                    : t("menu.click_stale");
+            }
+            catch (err) {
+                this.logger.error({ err, instance: pending.instanceName, backend: step.plan.backend }, "Backend switch failed");
+                result = t("backend.failed", pending.instanceName, step.plan.backend, err instanceof Error ? err.message : String(err));
+            }
+            await say(result).catch(() => {
+                if (pending.adapter && pending.adapterChatId)
+                    pending.adapter.sendText(pending.adapterChatId, result, { threadId: pending.adapterThreadId }).catch(() => { });
+            });
+        })();
+        return true;
+    }
     /** Read recent chat log for agent context */
     getRecentChatLog(instanceName, maxLines = 10) {
         const logDir = ClassicChannelManager.chatLogDir(instanceName);
@@ -16602,6 +17643,14 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             catch (err) {
                 this.logger.warn({ err: err.message, instanceName: ch.instanceName }, "Dropping a removed room from web favorites failed");
             }
+            try {
+                this.themeStore.forget(ch.instanceName);
+                this.webAppearance.limiter.forget(ch.instanceName);
+                this.effectToolsService?.forget(ch.instanceName);
+            }
+            catch (err) {
+                this.logger.warn({ err: err.message, instanceName: ch.instanceName }, "Dropping a removed room's web theme failed");
+            }
         }
         this.instanceWorldBinding.delete(ch.instanceName);
         // #1716: say so in the reply when background work was ended with the stop.
@@ -16711,6 +17760,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.eventLogPruneTimer = null;
         }
         this.logService?.unwatchAll(); // #1218: a Log's watch timers end with the fleet
+        this.compactWatchService?.stopAll();
         if (this.outboxPruneTimer) {
             clearInterval(this.outboxPruneTimer);
             this.outboxPruneTimer = null;
@@ -18694,37 +19744,41 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             const currentVersion = JSON.parse(readFileSync(pkgPath, "utf-8")).version ?? "0.0.0";
             const latest = await npmVersion("@songsid/agend");
             let target = latest;
+            let fromChannel = false;
             // The same channel rule as `agend update` (#1259): an alpha follows @alpha, any other prerelease @beta.
             const channel = installedChannel(currentVersion);
             if (channel !== "latest") {
-                // Prerelease users track their own channel (never fall back to @latest,
-                // which is older, and an alpha is never offered @beta), but should also
-                // hear when a newer STABLE ships — pick whichever is the newest.
                 let pre = "";
                 try {
                     pre = await npmVersion(`@songsid/agend@${channel}`);
                 }
                 catch { /* no such tag */ }
-                target = pre || latest;
-                if (latest && this.semverGt(latest, target))
+                // #1926: a beta install hears about @beta only: beta users stay on the beta line after a stable ships, so
+                // @latest is not their target. Taking the higher of the two made a same-core stable (2.2.0 over beta.16) the
+                // target, which the same-core guard then dropped, so the newer beta.17 was never announced.
+                target = pre;
+                fromChannel = true;
+                // An alpha is still told about a stable that passed its own minor (with --stable, #1259): only a stable of
+                // another core that is newer than its channel's release. A same-core @latest (2.2.0 for 2.2.0-alpha.3) is not
+                // taken from @latest and no longer hides a newer alpha; once the release points @alpha at it, it comes from
+                // @alpha like any channel release.
+                const core = (v) => v.replace(/^v/, "").split("-")[0];
+                if (channel === "alpha" && latest && core(latest) !== core(currentVersion) && (!pre || this.semverGt(latest, pre))) {
                     target = latest;
+                    fromChannel = false;
+                }
             }
-            // A beta already at/ahead of its matching stable must NOT be told to
-            // "update" to that stable — e.g. 2.0.11-beta.41 already contains everything
-            // in stable 2.0.11, so semverGt(2.0.11, 2.0.11-beta.41) being true (a stable
-            // outranks a prerelease of the same core) is a false positive here. Suppress
-            // only that same-core stable-vs-my-beta case; a higher stable core (2.0.12)
-            // or a newer beta (2.0.11-beta.50) still notifies via semverGt below.
-            const core = (v) => v.replace(/^v/, "").split("-")[0];
-            const betaSupersedesStable = isPrereleaseVersion(currentVersion) && !isPrereleaseVersion(target) && core(target) === core(currentVersion);
             // Only notify when target is genuinely newer (semver), so a beta user on
             // 2.0.8-beta.16 is never told that stable 2.0.7 is "available".
-            if (target && !betaSupersedesStable && this.semverGt(target, currentVersion)) {
+            if (target && this.semverGt(target, currentVersion)) {
                 const generalId = this.findGeneralInstance();
                 if (generalId) {
                     // No release URL — Discord's SuppressEmbeds proved unreliable and the
                     // link preview looked bad. Version + /update instruction is enough.
-                    this.notifyInstanceTopic(generalId, t(updateNoticeKey(currentVersion, target), `v${target}`, `v${currentVersion}`));
+                    // From the install's own channel tag, this is what /update installs — even a stable the release pointed the
+                    // tag at (2.2.0 on @alpha / @beta): the plain /update text, never "/update stays on … use --stable" (#1928).
+                    const key = fromChannel ? "update.available_current" : updateNoticeKey(currentVersion, target);
+                    this.notifyInstanceTopic(generalId, t(key, `v${target}`, `v${currentVersion}`));
                 }
             }
         }
@@ -18791,6 +19845,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     /** Shared handler dispatcher; gateway admission is enforced by its separate listener. */
     dispatchWebHttp(req, res, port, closing = false) {
         try {
+            // #1937: the listeners allow an upload long enough for a slow link; every other request keeps its old bound on
+            // arriving whole — 10 s through the public link's gateway, Node's 300 s here.
+            if (!isUploadRequest(req))
+                limitRequestReceive(req, gatewayRequestContext(req) ? PUBLIC_GATEWAY_RECEIVE_MS : 300_000);
             res.setHeader("Content-Type", "application/json");
             // No Referer to a tunnel host, an upstream proxy, or any page linked from
             // the panel — the dashboard URL is itself a credential-bearing address.
@@ -19132,6 +20190,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         if (!this.webToken || !this.webSessions)
             this.initializeWebAuthTokens();
         const server = createServer((req, res) => this.dispatchWebHttp(req, res, port, drain.closing));
+        // #1937: Node's default (300 s to receive a request) would cut a large upload on a slow link. The listener allows
+        // more; the upload route keeps its own clocks (no byte for a minute, or 30 minutes in all), and every other request
+        // keeps the old 300 s (limitRequestReceive in dispatchWebHttp).
+        server.requestTimeout = UPLOAD_REQUEST_TIMEOUT_MS;
         const drain = trackWebServer(server);
         this.healthServer = server;
         this.healthServerDrain = drain;
@@ -19318,13 +20380,16 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // /api/profiles (resolveInstanceIdentity) — the sidebar groups, searches and labels with it on every page.
         const classicRooms = new Map((this.classicChannels?.getAll() ?? []).map(ch => [ch.instanceName, ch]));
         const profiles = profileIdentities(this.dataDir);
+        // #1629 r4 §1: the identity card's version per instance (the page reads the card when it moves).
+        const cards = humanCards(this.dataDir);
+        const colors = identityColors(this.dataDir);
         // #1630: decorative — whatever goes wrong deciding an avatar never costs the frame (every instance gets its first character).
-        let ownBots = new Map();
+        let bots = { own: new Map(), speaking: new Map() };
         try {
-            ownBots = this.ownBots();
+            bots = this.webBots();
         }
         catch (err) {
-            this.logger.debug({ err }, "own bots unreadable (getUiStatus)");
+            this.logger.debug({ err }, "bots unreadable (getUiStatus)");
         }
         const instances = names.map(name => {
             const statusFile = join(this.getInstanceDir(name), "statusline.json");
@@ -19363,9 +20428,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             const effort = (effortStrategy === "unsupported" || isAgy) ? null : effortResolved.effort;
             const effort_source = (effortStrategy === "unsupported" || isAgy) ? null : effortResolved.source;
             const identity = resolveInstanceIdentity({ cfg: this.fleetConfig?.instances[name], classic: classicRooms.get(name), profile: profiles.get(name) });
+            const compact = this.compactWatchService?.view(name) ?? null;
             let image;
             try {
-                image = this.webIdentityImage(name, identity.display_name, profiles.get(name)?.avatar_path, ownBots);
+                image = this.webIdentityImage(name, identity.display_name, profiles.get(name)?.avatar_path, bots);
             }
             catch (err) {
                 this.logger.debug({ err, name }, "avatar unreadable (getUiStatus)");
@@ -19376,6 +20442,21 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 display_name: identity.display_name || undefined,
                 avatar: image.avatar,
                 ...(image.accent ? { accent: image.accent } : {}),
+                // #1629: the agent's theme's picture and ring colour, for viewers who show agents' themes.
+                ...(image.themeAvatar ? { theme_avatar: image.themeAvatar } : {}),
+                ...(image.themeAccent ? { theme_accent: image.themeAccent } : {}),
+                ...(() => { try {
+                    const v = cardVersion(resolveCard(name, cards.get(name), this.themeStore.get(name).theme.card));
+                    return v ? { card_v: v } : {};
+                }
+                catch {
+                    return {};
+                } })(),
+                // #1958: the identity colour's tiers (the page resolves them: the agent's only while it shows agents' themes).
+                color: { ...(colors.get(name)?.color ? { person: colors.get(name).color } : {}), ...(image.agentColor ? { agent: image.agentColor } : {}),
+                    ...(image.roleColor ? { role: image.roleColor } : {}), auto: autoIdentityColor(name) },
+                // #1958 decision 2: where it shows — a person's choice for this instance, the agent's; else the viewer's host default.
+                color_show: { ...(colors.get(name)?.show ? { person: colors.get(name).show } : {}), ...(image.agentShow ? { agent: image.agentShow } : {}) },
                 description: identity.description || undefined,
                 role: identity.role || undefined,
                 tags: identity.tags,
@@ -19390,6 +20471,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 effort,
                 effort_source,
                 ...this.instancePresentation(name),
+                // Board 003648ac: the last web /compact, while it runs and briefly after (the chat's card follows it).
+                ...(compact ? { compact } : {}),
             };
         });
         return {
@@ -19400,6 +20483,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             connections: (this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : [])).length,
             // #1665: the host preferences' revision — a page that has another re-reads /ui/prefs (no values in this frame).
             prefs_rev: this.webPrefs.rev(),
+            // #1629: the themes' revision — the page re-reads GET /ui/themes when it moves.
+            themes_rev: this.themeStore.rev(),
             // #1685: host memory pressure while it slows or holds new agents (the dashboard's indicator; macOS elevated is
             // shown here rather than in chat). null when normal, unknown or advisory.
             host_memory: this.hostMemoryIndicator(),