@songsid/agend 2.3.0-beta.1 → 2.3.0-beta.11

package/dist/fleet-manager.js

@@ -20,14 +20,14 @@ import { withinBudget } from "./monotonic-budget.js";
 import { measureSyncWork } from "./sync-work-attribution.js";
 import { RuntimeCpuProfiler, ProfileBusyError, profileDuration } from "./runtime-cpu-profile.js";
 import { ProfileControlServer } from "./profile-control.js";
-import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync, accessSync, realpathSync, constants as fsConstants, closeSync } from "node:fs";
+import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync, accessSync, realpathSync, lstatSync, constants as fsConstants, closeSync } from "node:fs";
 import { atomicWriteFileSync } from "./atomic-write.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { freemem, totalmem, cpus, homedir } from "node:os";
 import { createServer } from "node:http";
 import { Worker } from "node:worker_threads";
 import { ProbeWorkerPool } from "./probe-worker-pool.js";
-import { join, dirname, basename, delimiter, isAbsolute, resolve as resolvePath } from "node:path";
+import { join, dirname, basename, delimiter, isAbsolute, relative, resolve as resolvePath } from "node:path";
 import { fileURLToPath } from "node:url";
 import { getAgendHome, ensureWorkspaceGit } from "./paths.js";
 import { fleetLabel } from "./fleet-label.js";
@@ -48,6 +48,7 @@ import { isProbeableRouteTarget } from "./fleet-context.js";
 import { getEffectiveInstanceDefaults, loadFleetConfig, loadRawFleetConfig, DEFAULT_COST_GUARD, DEFAULT_DAILY_SUMMARY, DEFAULT_INSTANCE_CONFIG } from "./config.js";
 import { EventLog } from "./event-log.js";
 import { binaryProbe } from "./binary-probe.js";
+import { AVAILABILITY_STALE_MS, BackendAvailabilityStore, hostAvailabilityProbes } from "./backend-availability.js";
 import { classifySqliteOpenError } from "./sqlite-open-errors.js";
 import { OutboxOpenError } from "./outbox-open-error.js";
 import { AdapterWorld } from "./adapter-world.js";
@@ -65,7 +66,7 @@ import { createBackend } from "./backend/factory.js";
 import { readEffortMetadata } from "./backend/effort-metadata.js";
 import { codexEffort, flagEffort } from "./backend/launch-effort.js";
 import { codexMetadataHomes, readCodexModelEffortLevels, resolveCodexLaunchModel } from "./backend/codex-metadata.js";
-import { CLI_ENV_TTL_MS, isModelCompatible, resolveBinary, SYSINFO_BACKEND_IDS, UnsupportedCliError } from "./backend/types.js";
+import { CLI_ENV_TTL_MS, isModelCompatible, noteResolvedBinary, resolveBinary, SYSINFO_BACKEND_IDS, UnsupportedCliError } from "./backend/types.js";
 import { createLogger, rotateLogIfNeeded } from "./logger.js";
 import { processAttachments } from "./channel/attachment-handler.js";
 import { routeToolCall } from "./channel/tool-router.js";
@@ -134,9 +135,9 @@ export function applyTaskListCap(tasks, filterAssignee, filterStatus) {
     }
     return tasks;
 }
-import { handleWebRequest, broadcastSseEvent, SSE_HEARTBEAT_MS } from "./web-api.js";
+import { handleWebRequest, broadcastSseEvent, broadcastToGuests, SSE_HEARTBEAT_MS } from "./web-api.js";
 import { LogService } from "./log-service.js";
-import { WebChatHistory, WEB_CHAT_TEXT_MAX, isWebMessageId, newWebMessageId } from "./web-chat-history.js";
+import { WebChatHistory, WEB_CHAT_TEXT_MAX, isWebMessageId, newWebMessageId, webChatFrom } from "./web-chat-history.js";
 import { WebChatDiskStore } from "./web-chat-store.js";
 import { SeenUsers, resolveMentions } from "./web-mentions.js";
 import { OPERATOR, WebPrefsStore } from "./web-prefs.js";
@@ -158,7 +159,7 @@ import { ReplyButtonsController } from "./reply-buttons-controller.js";
 import { parsePoll } from "./reply-polls.js";
 import { isUploadRequest, limitRequestReceive, publicAttachment, sweepOrphanedUploads, UPLOAD_REQUEST_TIMEOUT_MS, uploadLimits, WebFileLedger } from "./web-upload.js";
 import { REPLY_FILES_MAX_BYTES, snapshotReplyFile, sweepReplySnapshots, webFilesDir } from "./web-reply-files.js";
-import { cardPicture, handleViewRequest, humanCards, identityColors, isViewPath, profileIdentities, resolveInstanceIdentity } from "./view-api.js";
+import { cardPicture, handleViewRequest, humanCards, identityColors, instanceTeams, isViewPath, personBannerFocus, personIdentityColour, profileIdentities, resolveInstanceIdentity, setPersonBannerFocus, setPersonIdentityColour } from "./view-api.js";
 import { autoIdentityColor } from "./web-identity-color.js";
 import { AppearanceTools } from "./web-appearance-tools.js";
 import { cardVersion, resolveCard } from "./web-card.js";
@@ -178,7 +179,11 @@ import { runOnLoginShell } from "./login-shell.js";
 import { tightenInstanceDirs } from "./private-dir.js";
 import { decideSlash } from "./slash-authz.js";
 import { canonicalCommand, commandSpec, decideCommand, ruleFor } from "./command-table.js";
-import { runVisibilityCommand } from "./cross-instance-notice.js";
+import { crossInstanceVisibility, runVisibilityCommand } from "./cross-instance-notice.js";
+import { WebSettingsTools } from "./web-settings-tools.js";
+import { bindGuestRequest, guestRouteDecision } from "./web-guest-access.js";
+import { GUEST_ROOM_TICK_MS, GuestRoomMembership, guestGroupRooms } from "./web-guest-rooms.js";
+import { Delegations, TrafficLog, trafficItem } from "./fleet-traffic.js";
 import { installedChannel, updateNoticeKey } from "./update-check.js";
 import { resolveInstalledAgend } from "./update-dispatch.js";
 import { resolveUpdateLaunch, openUpdateLog, updateLogPath, watchUpdateLaunch } from "./update-launch.js";
@@ -190,7 +195,7 @@ import { setLocale, detectLocale, getLocale, t } from "./locale.js";
 import { recentChatContext } from "./log-tail.js";
 import { describeSignalSource, recordInternalRequest, withOrigin } from "./fleet-control-audit.js";
 import { handleAgentRequest, ToolNotPermittedError } from "./agent-endpoint.js";
-import { ClassicChannelManager, getClassicBackendChoices, isSelectableClassicBackend, readClassicLastActivityAt } from "./classic-channel-manager.js";
+import { ClassicChannelManager, classicWebEchoOn, getClassicBackendChoices, inferClassicChannelType, isSelectableClassicBackend, readClassicLastActivityAt } from "./classic-channel-manager.js";
 import { assertExplicitInstanceRemoval } from "./instance-removal.js";
 import { KNOWN_BACKENDS, validateFleetConfig } from "./config-validator.js";
 import { isRemovedBackend, removedBackendMessage } from "./backend/removed.js";
@@ -209,8 +214,9 @@ import { NeedsYouHub } from "./needs-you-hub.js";
 import { WEB_CHAT_NOTICE, claimNotice, hasWebChat, releaseNotice, upgradeNoticesPath } from "./upgrade-notices.js";
 import { GENERAL_PAUSE_ERROR, isGeneralInstance } from "./general-instance.js";
 import { buildOrgChart } from "./web-org.js";
+import { topMemoryHogs } from "./memory-hogs.js";
 import { GENERAL_POINTING_REFUSALS, SNOWFLAKE, hasPlaceRefs, placeRef, webRoute, webTextLinks, placeSuffix, renderPlaceRefs, stripPlaceRefs, topicUrl, worldPlaceOf } from "./topic-link.js";
-import { CacheService, WINDOWS } from "./cache-service.js";
+import { CacheService, cacheWindow } from "./cache-service.js";
 import { runWebCommand } from "./web-commands.js";
 import { CompactWatch, launchIdentity } from "./compact-watch.js";
 import { agyLegacyAgentsFile, danglingSymlink, migrateAgyAgentsFile } from "./backend/antigravity.js";
@@ -220,11 +226,17 @@ import { mayUseTool, resolveToolSet, scheduleOpRefusal, toolForIpcType, toolRefu
 import { authorizeSession, decideWebGate, loadOrCreateWebToken, readWebToken } from "./web-auth.js";
 import { bypassesWebGate, handleAuthRequest, serveSigninPage } from "./auth-api.js";
 import { isWebPageNavigation } from "./web-shell-routes.js";
-import { localSessionPolicy, tokenEpoch, WebSessionStore } from "./web-session.js";
-import { WebLoginCodes, LOGIN_CODE_TTL_MS } from "./web-login.js";
+import { guestSessionPolicy, localSessionPolicy, tokenEpoch, WebSessionStore } from "./web-session.js";
+import { authorityNow, evaluateWebAuthority, VERIFIED_SESSION_HOURS, webAuthorityPolicy } from "./authority/web-authority.js";
+import { AuthorityStateStore } from "./authority/authority-state.js";
+import { SessionAuthorizations } from "./authority/session-authorizations.js";
+import { SessionAuthorizationRequests } from "./web-session-authorization.js";
+import { GuestLoginCodes, WebLoginCodes, LOGIN_CODE_TTL_MS } from "./web-login.js";
+import { decisionListAnswer } from "./decision-list.js";
 import { CodeRequestLimiter, ReturningDevices } from "./web-returning-device.js";
-import { allowedHostNames, applyWebSecurityHeaders, hostnameOf, isHostAllowed, WEB_HOST_REJECTED_MESSAGE } from "./web-host-guard.js";
+import { allowedHostNames, applyWebSecurityHeaders, hostnameOf, isHostAllowed, LOOPBACK_HOST_NAMES, WEB_HOST_REJECTED_MESSAGE } from "./web-host-guard.js";
 import { createPreviewListener, normalizeOrigin, previewAvailability, previewSettings } from "./web-preview.js";
+import { createEffectBootstrap } from "./web-effect-bootstrap.js";
 import { fleetLevelDifferences, fleetLevelSignature, appendedConnections } from "./fleet-level-config.js";
 import { checkSelfRestartAllowance, recordSelfRestartAttempt } from "./self-restart-limit.js";
 import { SecretStore } from "./secret-store.js";
@@ -234,7 +246,7 @@ import { PROVIDER_SECRET_SPECS, providerSecretSpec, providerRegistryEnvKeys, isR
 /** A self-restart is a whole service restart; 120s is the apply budget, not this. */
 const SELF_RESTART_DEADLINE_MS = 300_000;
 import { APPLY_FLEET_TARGET, ApplyJobStore, viewOf, } from "./apply-job.js";
-import { CHAT_PROFILE_LOGIN_BACKENDS, credentialHomeSpec, credentialProfileHome, credentialSwitchCarriesConversation, credentialSwitchStartsFresh, instanceCredentialProfile } from "./backend/credential-profile.js";
+import { CHAT_PROFILE_LOGIN_BACKENDS, credentialHomeSpec, credentialProfileHome, credentialProfileLogin, credentialProfileStoreHome, credentialSwitchCarriesConversation, credentialSwitchStartsFresh, instanceCredentialProfile } from "./backend/credential-profile.js";
 import { carryClaudeConversation } from "./backend/claude-carry.js";
 import { mergeBackendOptions, profileKey, profileName, profileOf } from "./classic-bindings.js";
 import { classifyInstanceChange, CLASSIC_HOT_CONFIG_KEYS, HOT_INSTANCE_CONFIG_KEYS, hotConfigUpdate, } from "./instance-config-impact.js";
@@ -283,6 +295,41 @@ export function selectLruEvictions(warm, cap, opts) {
  * fleet.yaml. Keep in sync with `uniqueInstanceName` — every name it emits
  * must match here, or a deleted instance's CLI is left running (#1305 P2-3).
  */
+/**
+ * #2163: where `p` really is — symlinks resolved. A path that does not exist yet is resolved through its deepest
+ * existing ancestor (a missing child of a link elsewhere is elsewhere too).
+ */
+function realPathThroughAncestors(p) {
+    const missing = [];
+    let at = resolvePath(p);
+    for (;;) {
+        try {
+            return join(realpathSync(at), ...missing.reverse());
+        }
+        catch { /* not there yet: try its parent */ }
+        try {
+            lstatSync(at);
+            return null;
+        }
+        catch { /* truly absent — not a broken link whose target is unknown */ }
+        const up = dirname(at);
+        if (up === at)
+            return resolvePath(p);
+        missing.push(basename(at));
+        at = up;
+    }
+}
+/**
+ * #2163: whether `dir` is inside AgEnD's own workspaces (<AGEND_HOME>/workspaces/<name>/…), compared after resolving
+ * symlinks on both sides — including a missing folder's existing ancestors — so a link elsewhere is not inside, nor is a broken link.
+ */
+export function insideManagedWorkspaces(dir, agendHome = getAgendHome()) {
+    const root = realPathThroughAncestors(join(agendHome, "workspaces")), real = realPathThroughAncestors(dir);
+    if (root === null || real === null)
+        return false;
+    const rel = relative(root, real);
+    return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+}
 export function isOrphanInstanceWindowName(name) {
     return /-t\d+$/.test(name) || /^classic-/.test(name);
 }
@@ -504,6 +551,8 @@ function emojiListFilter(opts) {
         withImageUrls: flag(opts.with_image_urls),
     };
 }
+/** #1920: a guest's scope until phase 2 derives one: nothing. */
+const NO_GUEST_SCOPE = new Set();
 export class FleetManager {
     dataDir;
     static signalTarget = null;
@@ -732,6 +781,8 @@ export class FleetManager {
     // Adapter restart: prevents re-entrant restart attempts
     adapterRestarting = new Set();
     // Adapter isolation: track state per adapter for retry + visibility
+    /** #2175: this boot's progress message, whose completion may still be owed by its background retry. */
+    startupProgress = null;
     adapterState = new Map();
     /** Web Settings secret rotation is deliberately separate from reconnect
      * recovery: a rotation must build a fresh provider client with the new token,
@@ -770,10 +821,16 @@ export class FleetManager {
     collabInstances = new Set();
     // Health endpoint
     healthServer = null;
+    /** #2118: independent of HTML preview availability/port; fixed bootstrap only, no effect resources. */
+    effectBootstrap = createEffectBootstrap();
+    /** Fixed trusted document coherence, independent of the HTML preview listener; never a resource grant. */
+    get effectBoot() { return this.effectBootstrap.boot; }
     healthServerDrain = null;
     /** #1306: the preview listener (health_port + 1 by default), and whether it is listening. */
     previewListener = null;
     previewListening = false;
+    /** The preview listener could not open its port: "<port>: <error code>", for the page (#2061 follow-up); null otherwise. */
+    previewListenError = null;
     /** The ports the preview listener was started for, and the inputs it was built from (a reload compares them). */
     previewPorts = null;
     previewInputs = "";
@@ -792,6 +849,9 @@ export class FleetManager {
     /** Injectable only to keep the chat→CLI reload hand-off deterministic in tests. */
     fullRestartLauncher = launchFullRestartHelper;
     eventLogPruneTimer = null;
+    /** #1920 §3.2: the background reads of guests' ClassicBot room membership (a minute's tick; reads only what is due). */
+    guestRoomsTimer = null;
+    guestRoomMembership = null;
     outboxPruneTimer = null;
     logRotateTimer = null;
     discordPresenceTimer = null;
@@ -806,6 +866,17 @@ export class FleetManager {
     startedAt = 0;
     stormOpenNotifyTimer = null;
     memoryLogAt = null;
+    /**
+     * #2015: while host memory is elevated or critical, the processes holding the most in the fleet's service and whose
+     * they are (an instance, the fleet, tmux), for the pressure log, /health and the dashboard — never chat (#1712).
+     * Rescanned at most once a minute (async, one at a time); cleared when pressure ends.
+     */
+    memoryTop = null;
+    memoryTopScan = { at: null, inFlight: false, loggedAt: null };
+    /** The scan (a seam for tests: they give it a fake /proc). */
+    memoryHogScan = topMemoryHogs;
+    /** The fleet's own tmux session exists (only then are its panes read: a fleet that never started has none). */
+    tmuxSessionEnsured = false;
     memoryDebugAt = null;
     memoryLogLevel = null;
     /** #1685: the host_memory value the last status frame carried, so a change re-sends the frame. */
@@ -978,7 +1049,7 @@ export class FleetManager {
                 this.emitSseEvent("status", this.getUiStatus());
             }
             catch { /* later status carries placements */ } },
-            // A nonmutating own/shared offer is not an appearance write. Only an explicit local-admin click may start it.
+            // A nonmutating own/shared offer is not an appearance write. Only an explicit non-public admin-session click may start it.
             preview: async (instance, id) => {
                 const result = this.effectTrials.offer(instance, id);
                 if (!result.ok)
@@ -986,11 +1057,12 @@ export class FleetManager {
                 const present = this.webChatHistory.list(instance).some(row => row.effectTrial?.offer === result.offer.offer);
                 if (!present && !this.publishEffectTrial(instance, result.offer))
                     return { error: "trial_unavailable" };
-                return { id, status: "offered", expiresAt: result.offer.expiresAt, message: "A trial card is in your web chat. A signed-in local admin can start it; nothing was applied." };
+                return { id, status: "offered", expiresAt: result.offer.expiresAt, message: "A trial card is in your web chat. A signed-in admin outside the public link can start it; nothing was applied." };
             },
             profiles: id => this.effectProfiles.read(id),
             profileSummary: id => this.effectService.profileSummary(id),
             profileSummaries: ids => this.effectService.profileSummaries(ids),
+            playbackSummary: (name, id) => this.effectService.playbackSummary(name, id),
         }));
     }
     appearanceToolsService;
@@ -998,7 +1070,12 @@ export class FleetManager {
     get appearanceTools() {
         return (this.appearanceToolsService ??= new AppearanceTools({
             frame: (name) => (this.getUiStatus().instances.find(i => i.name === name) ?? { name }),
-            theme: (name) => { const r = this.themeStore.get(name); return { theme: r.theme, locked: r.locked, widgets: r.placements.widgets }; },
+            theme: (name) => {
+                const r = this.themeStore.get(name);
+                return { theme: r.theme, locked: r.locked, widgets: r.placements.widgets, ambient: r.placements.ambient,
+                    glyphAsset: (id) => this.themeStore.asset(name, id) };
+            },
+            effects: name => this.themeStore.readable() ? this.themeStore.get(name).placements.effects.map(p => ({ id: p.id, by: p.by, ...(p.params ? { params: p.params } : {}), playback: this.effectService.playbackSummary(name, p.id) })) : [],
             card: (name) => resolveCard(name, humanCards(this.dataDir).get(name), this.themeStore.get(name).theme.card),
             // #1958: the host's identity-colour settings, as the page reads them (an unreadable prefs file: the defaults).
             colorPrefs: () => { try {
@@ -1079,6 +1156,31 @@ export class FleetManager {
     get ownerCss() {
         return (this.ownerCssStore ??= new OwnerCssStore(this.dataDir, this.webPrefs));
     }
+    webSettingsToolsService;
+    /**
+     * #2056: Settings → Web appearance for a tool (General, a coordinator, full) — the page's own stores and checks, and the
+     * page's announcement after a change (web-settings-tools.ts).
+     */
+    get webSettings() {
+        return (this.webSettingsToolsService ??= new WebSettingsTools({
+            prefs: this.webPrefs, ownerCss: this.ownerCss, mods: this.mods, effects: this.effectService,
+            instances: () => [...Object.keys(this.fleetConfig?.instances ?? {}),
+                ...(this.classicChannels?.getAll() ?? []).map((ch) => ch.instanceName).filter((n) => !Object.hasOwn(this.fleetConfig?.instances ?? {}, n))],
+            colour: (name) => personIdentityColour(this.dataDir, name),
+            setColour: (name, patch) => { const w = setPersonIdentityColour(this.dataDir, name, patch); if (w.ok)
+                this.identityChanged(); return w; },
+            bannerFocus: (name) => personBannerFocus(this.dataDir, name),
+            setBannerFocus: (name, focus) => { const w = setPersonBannerFocus(this.dataDir, name, focus); if (w.ok)
+                this.identityChanged(); return w; },
+            placements: (name) => this.themeStore.get(name).placements.effects.map((e) => (typeof e === "string" ? { id: e } : e)),
+            ambient: (name) => Object.fromEntries(Object.entries(this.themeStore.get(name).placements.ambient).flatMap(([k, a]) => a ? [[k, { spec: a.spec, by: a.by }]] : [])),
+            setAmbient: (name, spec, which) => this.webAppearance.humanSetAmbient(name, spec, which),
+            announce: () => { try {
+                this.emitSseEvent("status", this.getUiStatus());
+            }
+            catch { /* the next status frame carries it */ } },
+        }));
+    }
     get webPrefs() {
         // #1664: a favorite must be an instance of this fleet now — fleet.yaml's (own keys) or a ClassicBot room's.
         return (this.webPrefsStore ??= new WebPrefsStore(this.dataDir, {
@@ -1349,9 +1451,26 @@ export class FleetManager {
     sseHeartbeatMs = SSE_HEARTBEAT_MS;
     /** The dashboard's login codes. Memory only: a code that outlives the process is a code nobody can prove was not copied. */
     webLoginCodes = null;
+    /**
+     * #1920 step 4: guests' codes, apart from the admins' — one per account, so no guest's `/web` withdraws another's or
+     * an admin's code (#2093 review), at most 32 at once. Local sign-in only for now (audience "local").
+     */
+    webGuestLoginCodes = null;
+    /** #1920 step 4: when each account last got a guest code (monotonic) — one a minute, so `/web` is no DM flood. */
+    guestCodeAskedAt = new Map();
+    /** #2093 review: an account's guest /web in progress — one at a time, so two at once cannot both pass the minute. */
+    guestCodeInFlight = new Set();
+    /**
+     * #2093 review: revokes a guest /web in progress must see — every web session's (`/web revoke` from an admin) bumps
+     * the global count, an account's own bumps its entry — checked before the code is issued and while it is delivered.
+     */
+    guestRevokes = 0;
+    guestAccountRevokes = new Map();
     /** #1570: browsers that may ask the sign-in page for a fresh code, and how often they may. */
     returningDevices = null;
     codeRequestLimiter = new CodeRequestLimiter();
+    /** #1920 step 4b: guests' device code requests, limited apart — guests never use up the admins' fleet-wide budget. */
+    guestCodeRequestLimiter = new CodeRequestLimiter();
     /**
      * Set while a Settings apply job is driving the reconcile. The reconcile
      * stays the single doer; it just says out loud what it is doing to whom, so
@@ -1499,6 +1618,7 @@ export class FleetManager {
                 meta: {
                     chat_id: set.chatId, message_id: messageId, user: by.username, user_id: by.userId, ts,
                     thread_id: set.threadId, adapter_id: inbound.adapterId, source: inbound.source,
+                    ...(web && by.guest ? { web_guest: "1" } : {}), // #1920: "[user:… via web (guest), id:…]", as /ui/send
                     ...reactions.meta,
                 },
             }, by.humanOrigin, button.label)) !== false;
@@ -1519,6 +1639,9 @@ export class FleetManager {
         this.emitSseEvent("message", {
             instance: set.instance, sender: by.username, role: "user", text: content, ts, ...(web ? { messageId } : {}),
             click: { label: button.label, of: set.id },
+            // #1920: a platform click is its clicker's; it is the instance's channel's only when its buttons are there (the
+            // same rule as a reply's: a set sent to another topic or a DM is not). A web click is the web's.
+            ...(web ? {} : { from: webChatFrom(set.adapterId, by.userId), ...(this.clickInOwnChannel(set) ? { channel: true } : {}) }),
         });
         return true;
     }
@@ -1573,6 +1696,18 @@ export class FleetManager {
                 }
             }
         });
+        // #1918: the org canvas's traffic — from the row this listener's events already name, never a probe of its own.
+        // The row as it is now (it has already changed when the event comes): its state, not the event's, is the truth.
+        outbox.on("state", (event) => {
+            const row = event.deliveryId ? outbox.get(event.deliveryId) : undefined;
+            if (row)
+                this.publishTraffic(row);
+        });
+        outbox.on("consumed", (event) => {
+            const row = event.deliveryId ? outbox.get(event.deliveryId) : undefined;
+            if (row)
+                this.publishTraffic(row, "consumed");
+        });
         outbox.on("generation_recovered", () => this.scheduleDeliveryOutboxPump());
         this.replyObligationTimer = setInterval(() => measureSyncWork("fleet.replyObligationSweep", () => this.sweepReplyObligations()), REPLY_OBLIGATION_SWEEP_MS);
         this.replyObligationTimer.unref?.();
@@ -1594,6 +1729,52 @@ export class FleetManager {
         });
         this.scheduleDeliveryOutboxPump();
     }
+    /** #1918: cross-instance traffic, as the org canvas draws it (fleet-traffic.ts). */
+    trafficLog = new TrafficLog();
+    delegations = new Delegations();
+    trafficMemo = null;
+    /**
+     * One delivery row's traffic item, kept for the snapshot and sent to the open pages when it is news; and the
+     * delegation it opens or closes (a task and its report), sent as "delegation".
+     */
+    publishTraffic(row, state) {
+        try {
+            const item = trafficItem(row, this.fleetConfig, new Date().toISOString(), state);
+            const news = item ? this.trafficLog.note(item) : null;
+            const work = news ? this.delegations.note(row, news) : [];
+            if (news || work.length)
+                this.trafficMemo = null;
+            if (news)
+                this.emitSseEvent("traffic", news);
+            // Each delegation as its two instances are seen now: one that expires or is pushed out may be older than a change
+            // to their visibility (the incoming row's own item was checked; these can be anyone's).
+            const visible = (name) => crossInstanceVisibility(this.fleetConfig, name) !== "hidden";
+            for (const d of work)
+                if (visible(d.from) && visible(d.to))
+                    this.emitSseEvent("delegation", d);
+        }
+        catch (err) {
+            this.logger.debug({ err }, "traffic: an item was not published");
+        }
+    }
+    /**
+     * GET /ui/traffic: what is in flight now (the outbox's pending rows) and what finished in the last two minutes, at
+     * most TRAFFIC_SNAPSHOT_MAX items. Worked out at most once every two seconds, so the public link's polling (or any
+     * number of pages) costs one indexed read per two seconds. Visibility is applied as of now.
+     */
+    trafficSnapshot() {
+        const nowMs = performance.now();
+        if (this.trafficMemo && nowMs - this.trafficMemo.atMs < 2_000)
+            return this.trafficMemo.value;
+        const now = new Date().toISOString();
+        const pending = (this.deliveryOutbox?.listPending() ?? [])
+            .map((r) => trafficItem(r, this.fleetConfig, r.createdAt ?? now)).filter((i) => i !== null);
+        const visible = (name) => crossInstanceVisibility(this.fleetConfig, name) !== "hidden";
+        const items = this.trafficLog.snapshot(pending).filter((i) => visible(i.from) && visible(i.to));
+        const delegations = this.delegations.snapshot().filter((d) => visible(d.from) && visible(d.to));
+        this.trafficMemo = { atMs: nowMs, value: { now, items, delegations } };
+        return this.trafficMemo.value;
+    }
     /** Synchronous SQLite admission; the caller may acknowledge only after this returns. */
     admitDurableDelivery(input) {
         const outbox = this.deliveryOutbox;
@@ -1606,6 +1787,8 @@ export class FleetManager {
         }
         const sourceKey = `mcp:${input.sourceInstance}:${input.operationId}:${input.targetInstance}:${input.targetSession ?? ""}:${input.kind}`;
         const admitted = outbox.admit({ ...input, sourceDaemonBootId, sourceKey });
+        if (admitted.inserted)
+            this.publishTraffic(admitted.delivery);
         if (admitted.inserted)
             this.logger.info({
                 deliveryId: admitted.delivery.deliveryId,
@@ -1628,10 +1811,18 @@ export class FleetManager {
     queryDurableDeliveryStatus(callerInstance, selector) {
         this.ensureDeliveryOutbox();
         const page = this.deliveryOutbox.queryStatusForInstance(callerInstance, selector);
+        // #1939 §10: a human receipt's authority as it reads now (switch, epoch, loopback_only).
+        const state = page.items.some(item => item.authority) ? this.webAuthorityState() : null;
+        const human = (item) => {
+            if (!item.authority || !state)
+                return item;
+            const authority = authorityNow(item.authority, state);
+            return { ...item, authority, ...(authority.downgraded ? { source_instance: "human:web:unknown" } : {}) };
+        };
         // #1641: a sender that sees only `queued` cannot tell "next in line" from "the target is stuck": say which.
         return {
             ...page,
-            items: page.items.map(item => (item.state === "queued" || item.state === "retry_wait")
+            items: page.items.map(human).map(item => (item.state === "queued" || item.state === "retry_wait")
                 ? { ...item, waiting_reason: this.deliveryWaitingReason(item.target_instance) }
                 : item),
         };
@@ -1979,17 +2170,58 @@ export class FleetManager {
                 this.logger.info({ hostMemory: snapshot }, "Host memory recovered");
             }
             this.memoryLogLevel = snapshot.level;
+            if (this.memoryTop) {
+                this.memoryTop = null;
+                this.memoryTopScan.loggedAt = null;
+                this.emitSseEvent("status", this.getUiStatus());
+            }
             return;
         }
+        if (snapshot.level === "elevated" || snapshot.level === "critical")
+            this.refreshMemoryTop(snapshot);
         if (changed || this.memoryLogAt === null || now - this.memoryLogAt >= 10 * 60_000) {
             this.memoryLogAt = now;
-            this.logger.warn({ hostMemory: snapshot }, snapshot.level === "critical"
+            this.logger.warn({ hostMemory: snapshot, ...(this.memoryTop ? { topProcesses: this.memoryTop.processes } : {}) }, snapshot.level === "critical"
                 ? "Host memory critical — deferring new CLI spawns"
                 : snapshot.level === "elevated" ? "Host memory pressure — slowing new CLI spawns"
                     : "Host memory sample unavailable — slowing new CLI spawns");
         }
         this.memoryLogLevel = snapshot.level;
     }
+    /**
+     * #2015: rescan the largest processes (at most once a minute, one at a time). The first result of an episode, and
+     * then at most every 10 minutes, is logged with the pressure; /health and the dashboard read the latest. Never chat.
+     */
+    refreshMemoryTop(snapshot) {
+        const scan = this.memoryTopScan;
+        const now = performance.now();
+        if (scan.inFlight || (scan.at !== null && now - scan.at < 60_000))
+            return;
+        scan.inFlight = true;
+        scan.at = now;
+        void (async () => {
+            const session = getTmuxSession();
+            const [tmuxServerPid, panes] = this.tmuxSessionEnsured
+                ? await Promise.all([TmuxManager.getServerPid(session), TmuxManager.listPanePids(session)])
+                : [null, []];
+            const processes = await this.memoryHogScan({
+                fleetPid: process.pid, tmuxServerPid, panes,
+                isInstance: name => this.daemons.has(name) || Object.hasOwn(this.fleetConfig?.instances ?? {}, name),
+            }, 3);
+            // Pressure may have ended while the scan ran: nothing is kept then.
+            if (this.shuttingDown || processes.length === 0 || this.hostMemoryIndicator() === null)
+                return;
+            const before = JSON.stringify(this.memoryTop?.processes ?? null);
+            this.memoryTop = { at: new Date().toISOString(), processes };
+            if (scan.loggedAt === null || performance.now() - scan.loggedAt >= 10 * 60_000) {
+                scan.loggedAt = performance.now();
+                this.logger.warn({ hostMemory: snapshot, topProcesses: processes }, "Host memory pressure — largest processes in the fleet");
+            }
+            if (JSON.stringify(processes) !== before)
+                this.emitSseEvent("status", this.getUiStatus());
+        })().catch(err => this.logger.debug({ err }, "Largest-process scan failed"))
+            .finally(() => { scan.inFlight = false; });
+    }
     /** Wire the one fleet-wide storm into notification and recovery surfaces. */
     bindStormWindowEvents() {
         this.stormWindow.on("opened", (snapshot) => {
@@ -2311,6 +2543,7 @@ export class FleetManager {
         this.fleetConfig = loaded;
         this.savedFleetConfigSnapshot = structuredClone(this.fleetConfig);
         this.warnAboutRemovedLoginMode(loaded);
+        this.enforceGuestSwitch();
         return this.fleetConfig;
     }
     relayLoginModeWarned = false;
@@ -3436,7 +3669,8 @@ export class FleetManager {
      * for `instance` (#1320 part B). Per entry: the channel's own adapter, no
      * thread, mention suppression on. Returns the number of channels posted
      * to. Failures are per-entry warn-and-continue — a failed echo never fails
-     * the web send. Entries without `web_echo: true` are never touched.
+     * the web send. Only entries classicWebEchoOn admits are touched (#2054: unset follows web.echo_to_channel; an explicit
+     * `web_echo: false` never echoes).
      *
      * Every copy is fenced at start time: an entry whose explicit world is
      * gone is skipped (only legacy adapterId-less entries fall back to the
@@ -3447,6 +3681,15 @@ export class FleetManager {
      * already in flight may still land late — the contract permits that.
      */
     /** `sender` (#1827): the web person's name, as the room log records them ("web-user" when none). */
+    /**
+     * #1920 §5.2: a web message's channel copy was sent — it is now what the channel saw. Kept so (and on disk), and sent
+     * to the guests' streams only: an admin's page already has it, and nothing about it changed for them.
+     */
+    webMessageInChannel(instance, messageId) {
+        const m = this.webChatHistory.markChannel(instance, messageId);
+        if (m)
+            broadcastToGuests(this.sseClients, "message", m, (err) => this.logger.debug({ err }, "SSE client write failed; evicting"));
+    }
     async sendClassicWebEcho(instance, text, sender = WEB_NAME_FALLBACK) {
         const guard = this.webChannelEchoGuards.get(instance);
         const handled = new Set();
@@ -3463,7 +3706,7 @@ export class FleetManager {
                 }
             }
             const entry = (this.classicChannels?.getAll() ?? [])
-                .find(candidate => candidate.instanceName === instance && candidate.webEcho === true
+                .find(candidate => candidate.instanceName === instance && classicWebEchoOn(candidate.webEcho, this.fleetConfig?.web?.echo_to_channel)
                 && !handled.has(`${candidate.channelId}#${candidate.adapterId ?? ""}`));
             if (!entry)
                 break;
@@ -3663,12 +3906,31 @@ export class FleetManager {
     }
     /** Evidence-only admission. Bots/system/agent payloads have no trusted origin. */
     humanReceiptPayload(instanceName, payload, origin, originalBody) {
+        // #1939 S3: "via web (verified)" comes only from the receipt written here — never from a caller's meta.
+        const given = payload.meta;
+        if (given && "web_verified" in given) {
+            const { web_verified: _claimed, ...rest } = given;
+            payload = { ...payload, meta: rest };
+        }
         if (!origin || !this.deliveryOutbox)
             return payload;
         const row = this.deliveryOutbox.createHumanReceipt({ targetInstance: instanceName, originalBody,
             origin: { ...origin }, inputKind: String(payload.type), managerBootId: this.managerBootId });
+        // #1939 §7: each ordinary verified web message, for the S1 beta to watch. No text, cookie or session id: the handle.
+        const authority = origin.authority;
+        if (authority?.kind === "web-verified" && authority.actor && authority.session) {
+            try {
+                this.eventLog?.insert(instanceName, "web_authority", { receipt_id: row.receipt_id, session: authority.session.handle,
+                    peer: authority.session.peer, surface: "local", actor: `${authority.actor.adapter_id}:${authority.actor.user_id}`,
+                    input_kind: String(payload.type), outcome: "web-verified", authority_epoch: authority.authority_epoch });
+            }
+            catch (err) {
+                this.logger.warn({ err, instanceName }, "Could not record web authority");
+            }
+        }
+        const verified = origin.platform === "web" && authority?.kind === "web-verified";
         return { ...payload, meta: { ...(payload.meta ?? {}),
-                human_receipt_id: row.receipt_id, verification_id: row.message_id } };
+                human_receipt_id: row.receipt_id, verification_id: row.message_id, ...(verified ? { web_verified: "1" } : {}) } };
     }
     /** Bind at the actual IPC send, after all wake/reconnect waits. No human retry lane. */
     bindHumanReceiptPayload(instanceName, payload) {
@@ -3882,6 +4144,14 @@ export class FleetManager {
             return;
         }
         const scope = door.scope;
+        // #1920 step 4: a non-admin's /web while guest sign-in is on is theirs to sign in as a guest (or revoke their own)
+        // — before the table, which keeps /web for fleet admins. Per account: it touches no instance binding.
+        // Decided synchronously, so an admin's /web still reaches the table with no await after the door (#1399).
+        if (data.command === "dashboard" && this.isGuestWebAsk(adapterId, data.userId)) {
+            await this.guestWebCommand({ adapterId, userId: data.userId, username: data.username,
+                arg: String(data.options?.action ?? "").trim().toLowerCase(), replyHere: text => data.respond(text), replyPrivately: text => data.respond(text) });
+            return;
+        }
         const spec = commandSpec(data.command);
         if (!spec) {
             this.logger.info({ command: data.command, adapterId }, "Slash command is not in the command table");
@@ -4516,6 +4786,22 @@ export class FleetManager {
                 this.logger.warn({ err, name, backend }, "Failed to sync worker skills — continuing startup");
             }
         }
+        else if (kind === "classic") {
+            // #2163: a Classic bot gets only the skills marked `classic` (its own look, the dashboard) — never the fleet's
+            // coordination playbooks (#557 kept those out of end-user bots) — and only into a workspace AgEnD manages: the
+            // room's own folder under <AGEND_HOME>/workspaces/. Anywhere else, nothing is written; `agend-agent skill <name>`
+            // reads any bundled skill on demand.
+            try {
+                const skillsWorkDir = this.resolveKnowledgeWorkDir(config.working_directory, backend, name);
+                if (insideManagedWorkspaces(skillsWorkDir))
+                    measureSyncWork("fleet.classicSkills", () => this.syncRoleSkills(skillsWorkDir, backend, "classic"));
+                else
+                    this.logger.debug({ name, skillsWorkDir }, "Classic workspace is not AgEnD-managed — no skills published");
+            }
+            catch (err) {
+                this.logger.warn({ err, name, backend }, "Failed to sync classic skills — continuing startup");
+            }
+        }
         const receipt = execution ? this.classicSettingsOwners.get(execution) : undefined;
         const identity = { kind, backend, model: this.resolveInstanceModel(name).display };
         if (receipt) {
@@ -5326,10 +5612,14 @@ export class FleetManager {
                 // #1620: fleet.yaml's web.session.local, read at every check — a Settings save or a reload applies at once
                 // (shortening ends the sessions it now outlives). The public link's policy stays fixed.
                 localPolicy: () => localSessionPolicy(this.fleetConfig?.web?.session?.local),
+                // #1920 §5.4: a guest's, from web.guests.session (never longer than the surface's own).
+                guestPolicy: () => guestSessionPolicy(this.fleetConfig?.web?.guests?.session),
             });
+            this.enforceGuestSwitch(); // #1920: guests off while the fleet was down
         }
         if (!this.returningDevices) {
             this.returningDevices = new ReturningDevices({ dataDir: this.dataDir, onWarn: message => this.logger.warn(message) });
+            this.enforceGuestSwitch(); // #1920: guests' devices too, if guests went off while down
         }
         if (!this.webLoginCodes) {
             this.webLoginCodes = new WebLoginCodes({
@@ -5341,6 +5631,16 @@ export class FleetManager {
                 },
             });
         }
+        if (!this.webGuestLoginCodes) {
+            this.webGuestLoginCodes = new GuestLoginCodes({
+                onEvent: event => {
+                    if (event === "burned")
+                        this.logger.warn("A guest web login code was used up by wrong attempts");
+                    else if (event === "breaker-open")
+                        this.logger.warn("Guest web sign-in paused: too many wrong login codes");
+                },
+            });
+        }
     }
     /**
      * A single-use login code for the dashboard, for a channel only the operator
@@ -5464,6 +5764,7 @@ export class FleetManager {
                 dispatch: (req, res) => this.dispatchWebHttp(req, res, this.fleetConfig?.health_port ?? 19280) }),
             revoke: id => {
                 this.webLoginCodes?.revokeAudience(id);
+                this.webGuestLoginCodes?.revokeAudience(id);
                 const result = this.webSessions?.revokeExposure(id);
                 if (result && !result.durable)
                     this.logger.warn("Public session revocation could not be saved; exposure remains closed");
@@ -5495,6 +5796,24 @@ export class FleetManager {
         if (!current() || !this.publicOwnerCurrent(info.owner))
             throw new Error("public owner changed");
     }
+    /**
+     * #1920 §5.5 (step 4b): a guest signing in through the public link — said in the General of the admin who opened it
+     * (who, how many agents), awaited as an admin's public sign-in is, while that link is the open one, its opener still
+     * current, and the account still an admitted guest. A failure refuses the sign-in.
+     */
+    async confirmGuestPublicWebLogin(info, current) {
+        const admitted = () => {
+            const open = this.publicWebLink?.openSignin();
+            return current() && open && open.exposureId === info.exposureId && this.publicOwnerCurrent(open.owner) && this.guestSignInAllowed(info.account) ? open : null;
+        };
+        const open = admitted();
+        if (!open)
+            throw new Error("guest public sign-in unavailable");
+        const adapter = open.owner.binding;
+        await adapter.sendText(open.owner.chatId, t("web.guest_public_login_notice", this.webPerson(info.account).name, info.label, this.guestScope(info.account).size, info.handle.slice(0, 8)), { threadId: open.owner.threadId, allowedMentions: { parse: [] } });
+        if (!admitted())
+            throw new Error("guest public sign-in changed");
+    }
     /** Telegram's typed command enters through the same strict owner and nonce path as Discord. */
     async dashboardMenu(msg) {
         const id = msg.adapterId;
@@ -5818,16 +6137,197 @@ export class FleetManager {
         this.initializeWebSessions();
         void this.publicWebLink?.close("dashboard revoke");
         this.webLoginCodes.revoke();
+        this.webGuestLoginCodes.revokeAll();
+        this.guestRevokes++; // and every guest /web still on its way
         // #1570: no browser may ask the sign-in page for a code any more.
         const devices = this.returningDevices.revokeAll();
         const sessions = this.webSessions.revokeAll();
-        const result = { count: sessions.count, durable: sessions.durable && devices.durable };
+        // #1939 §10: and every web authority given so far (its receipts read as none).
+        const authority = this.revokeWebAuthority();
+        const result = { count: sessions.count, durable: sessions.durable && devices.durable && authority.durable };
         if (result.durable)
             this.logger.info({ count: result.count, devices: devices.count }, "Web sessions revoked (all)");
         else
             this.logger.warn({ count: result.count }, "Web sessions revoked in memory only — the session file could not be updated or removed");
         return result;
     }
+    /**
+     * #1920 phase 3: Settings → Web sign-ins → Guests — the switches, each connection's access mode and the agents named for
+     * an open one, and every guest account (signed in, with a returning device, or narrowed): who, its platform, what it
+     * reaches now, its sessions and devices, and its narrowing. Ids are the accounts' own (an admin's page).
+     */
+    guestOverview() {
+        this.initializeWebSessions();
+        const cfg = this.fleetConfig?.web?.guests;
+        const own = (map, key) => (map && Object.hasOwn(map, key) ? map[key] : undefined);
+        const connections = [...this.worlds.entries()].map(([id, w]) => ({ id, type: w.adapter.type, mode: (w.accessManager.getMode() === "open" ? "open" : "allowlist"),
+            named: [...(own(cfg?.open_instances, id) ?? [])] }));
+        const accounts = new Map();
+        for (const a of this.webSessions.guestActivity())
+            accounts.set(`${a.adapterId}\u0000${a.userId}`, a);
+        const devices = this.returningDevices.guestCounts();
+        for (const k of devices.keys())
+            if (!accounts.has(k)) {
+                const [adapterId, userId] = k.split("\u0000");
+                accounts.set(k, { adapterId, userId, sessions: 0, lastSeen: null });
+            }
+        for (const key of Object.keys(cfg?.narrow ?? {})) {
+            const at = key.indexOf(":"), adapterId = key.slice(0, at), userId = key.slice(at + 1), k = `${adapterId}\u0000${userId}`;
+            if (at > 0 && !accounts.has(k))
+                accounts.set(k, { adapterId, userId, sessions: 0, lastSeen: null });
+        }
+        const guests = [...accounts.entries()].map(([k, a]) => {
+            const owner = { adapterId: a.adapterId, userId: a.userId };
+            const badge = this.guestBadge(owner);
+            // `reach`: before narrowing — what Settings offers to narrow to (#2104 review: never an agent it cannot reach).
+            return { ...a, name: badge.name, platform: badge.platform, scope: [...this.guestScope(owner)].sort(), reach: [...this.guestReach(owner)].sort(),
+                devices: devices.get(k) ?? 0, narrow: own(cfg?.narrow, `${a.adapterId}:${a.userId}`) ?? null };
+        }).sort((x, y) => (y.lastSeen ?? -1) - (x.lastSeen ?? -1));
+        return { enabled: cfg?.enabled === true, chat: cfg?.chat !== false, instances: Object.keys(this.fleetConfig?.instances ?? {}).sort(), connections, guests };
+    }
+    /** #1920 phase 3 (the app shell): a guest's chip — its web name, and its connection's platform (discord, telegram). */
+    guestBadge(owner) {
+        return { name: this.webPerson(owner).name, platform: this.worlds.get(owner.adapterId)?.adapter.type ?? owner.adapterId };
+    }
+    /** #1920 step 4: whether a `/web` is a guest's — guest sign-in on, and not from a fleet admin (theirs runs as before). */
+    isGuestWebAsk(adapterId, userId) {
+        return !!adapterId && this.fleetConfig?.web?.guests?.enabled === true && !this.isFleetAdmin(userId, adapterId);
+    }
+    /** #1920 step 4 (auth-api): a guest code's account may still sign in — guests on, and something in its scope now. */
+    guestSignInAllowed(account) {
+        return this.fleetConfig?.web?.guests?.enabled === true && !this.isFleetAdmin(account.userId, account.adapterId) && this.guestScope(account).size > 0;
+    }
+    /**
+     * #1920 §5.4: a guest's own `/web revoke` — its sessions and its outstanding code; nobody else's (an admin's revokes
+     * everyone's, as before).
+     */
+    revokeGuestWebSessions(owner) {
+        this.initializeWebSessions();
+        const key = `${owner.adapterId}\u0000${owner.userId}`;
+        this.guestAccountRevokes.set(key, (this.guestAccountRevokes.get(key) ?? 0) + 1); // its /web on its way, too
+        while (this.guestAccountRevokes.size > 4096)
+            this.guestAccountRevokes.delete(this.guestAccountRevokes.keys().next().value);
+        this.webGuestLoginCodes.revokeRecipient(owner);
+        // §5.4: its sessions and its returning devices (no browser of theirs may ask for a code any more).
+        const devices = this.returningDevices.revokeGuest(owner);
+        const ended = this.webSessions.revokeAll(r => r.tier === "guest" && r.owner?.adapterId === owner.adapterId && r.owner.userId === owner.userId);
+        this.logger.info({ adapterId: owner.adapterId, count: ended.count, devices: devices.count, durable: ended.durable && devices.durable }, "Guest web sessions revoked by their account");
+        return { count: ended.count, durable: ended.durable && devices.durable };
+    }
+    /**
+     * #1920 §2.3 (step 4): `/web` from someone who is not a fleet admin, while guest sign-in is on. `revoke` ends their
+     * own guest sessions. Otherwise a guest code (tier guest, bound to this account) goes privately — a DM, else the
+     * slash command's ephemeral answer (`replyPrivately`) — once a minute at most, and only when their scope (from what
+     * they may already use in chat, rooms read at sign-in) holds something. The code itself is never posted where asked.
+     * Callers ask isGuestWebAsk first (synchronously); false here too when it is not a guest's.
+     */
+    async guestWebCommand(ask) {
+        if (!this.isGuestWebAsk(ask.adapterId, ask.userId))
+            return false;
+        const owner = { adapterId: ask.adapterId, userId: ask.userId };
+        const say = (text) => ask.replyHere(text).catch(() => undefined);
+        if (ask.arg === "revoke") {
+            const ended = this.revokeGuestWebSessions(owner);
+            await say(t(ended.durable ? "web.guest_revoked" : "web.guest_revoked_not_durable", ended.count));
+            return true;
+        }
+        const token = this.webToken;
+        const adapter = this.adapters.get(ask.adapterId);
+        if (this.shuttingDown || !token || !adapter) {
+            await say(t("dashboard.starting"));
+            return true;
+        }
+        const key = `${owner.adapterId}\u0000${owner.userId}`, asked = this.guestCodeAskedAt.get(key);
+        if (this.guestCodeInFlight.has(key) || (asked !== undefined && performance.now() - asked < 60_000)) {
+            await say(t("web.guest_wait"));
+            return true;
+        }
+        this.guestCodeInFlight.add(key);
+        try {
+            await this.issueGuestCode(ask, owner, key, adapter, token);
+        }
+        finally {
+            this.guestCodeInFlight.delete(key);
+        }
+        return true;
+    }
+    /** guestWebCommand's issuance, one per account at a time; a revoke made meanwhile (either kind) ends it unissued. */
+    async issueGuestCode(ask, owner, key, adapter, token) {
+        const say = (text) => ask.replyHere(text).catch(() => undefined);
+        const revokes = this.guestRevokes, accountRevokes = this.guestAccountRevokes.get(key) ?? 0;
+        const unrevoked = () => this.guestRevokes === revokes && (this.guestAccountRevokes.get(key) ?? 0) === accountRevokes;
+        // §3.2: its rooms are read at sign-in (bounded; never longer than the reads' own deadline).
+        await withinBudget(this.refreshGuestRooms(owner, { mode: "force" }), performance.now() + 6_000).catch(() => undefined);
+        if (!unrevoked())
+            return; // revoked while its rooms were read: no code
+        const scope = this.guestScope(owner);
+        if (!scope.size) {
+            const open = this.worlds.get(owner.adapterId)?.accessManager.getMode() === "open";
+            await say(t(open ? "web.guest_not_set_up" : "web.guest_nothing"));
+            return;
+        }
+        this.initializeWebSessions();
+        const codes = this.webGuestLoginCodes;
+        if (codes.pausedForMs() > 0) {
+            await say(t("web.guest_paused"));
+            return;
+        }
+        // §5.5 (step 4b): with the public link open, the code works through it too (an admin opened it; a guest is still a
+        // guest there) — most guests are not on the host's network. Its closing withdraws that audience (revokeAudience).
+        const open = this.publicWebLink?.openSignin() ?? null;
+        // One code per account (a new one replaces only its own); at the cap, refused — never another guest's evicted.
+        const login = codes.issue({ epoch: tokenEpoch(token), audiences: ["local", ...(open ? [open.exposureId] : [])],
+            recipient: { adapterId: owner.adapterId, userId: owner.userId, ...(ask.username ? { username: ask.username } : {}) } });
+        if (!login) {
+            await say(t("web.guest_busy"));
+            return;
+        }
+        this.guestCodeAskedAt.delete(key);
+        this.guestCodeAskedAt.set(key, performance.now());
+        while (this.guestCodeAskedAt.size > 256)
+            this.guestCodeAskedAt.delete(this.guestCodeAskedAt.keys().next().value);
+        const current = () => !this.shuttingDown && this.webToken === token && this.adapters.get(owner.adapterId) === adapter
+            && unrevoked() && this.guestSignInAllowed(owner);
+        const privateText = `${t("web.guest_intro", scope.size)}\n${this.topicCommands.getDashboardText()}${open ? `\n${t("web.guest_public", open.url)}` : ""}\n${t("dashboard.code", login.display, Math.round(LOGIN_CODE_TTL_MS / 60_000))}`;
+        const deadline = performance.now() + 10_000;
+        try {
+            let byDm = false;
+            try {
+                if (!adapter.sendDirect)
+                    throw new Error("DM unavailable");
+                await withinBudget(adapter.sendDirect(owner.userId, `${privateText}\n${t("dashboard.code_next")}`, { disablePreview: true }), Math.min(deadline, performance.now() + 5_000));
+                byDm = true;
+            }
+            catch (err) {
+                this.logDashboardDmFailure(err);
+                if (!ask.replyPrivately || !current())
+                    throw err;
+                const id = await withinBudget(ask.replyPrivately(privateText), deadline); // a slash command's answer: ephemeral
+                if (!id)
+                    throw new Error("private delivery unconfirmed");
+            }
+            if (!current())
+                throw new Error("guest no longer admitted");
+            if (byDm) {
+                await this.sendCodeAlone((body, opts) => adapter.sendDirect(owner.userId, body, opts), adapter.type, login.display);
+                if (!current())
+                    throw new Error("guest no longer admitted");
+                await say(t("web.guest_sent"));
+            }
+        }
+        catch (err) {
+            codes.revokeIfCurrent(login.issuanceId); // this flow's code only, never a later one's
+            this.logger.info({ err: err?.message, adapterId: owner.adapterId }, "Guest sign-in code was not delivered privately");
+            if (!unrevoked())
+                return; // revoked meanwhile: the revoke's own answer said so
+            const start = adapter.type === "telegram" ? this.tgStartWebUrl(owner.adapterId) : null;
+            // #1742 for guests (step 4b-3): its START button (a bare /start, or the link's /start web) then asks again, from
+            // the DM — once, within the window.
+            if (adapter.type === "telegram")
+                this.openTgWebStartWindow(owner.adapterId, owner.userId);
+            await say(start ? t("web.guest_dm_failed_link", start) : t("web.guest_dm_failed"));
+        }
+    }
     /** #1570 (auth-api): this browser becomes a returning device of the code's owner. The cookie value, or null. */
     rememberReturningDevice(owner, input) {
         const token = this.webToken;
@@ -5855,6 +6355,12 @@ export class FleetManager {
         if (!token || this.shuttingDown)
             return { kind: "refused" };
         this.initializeWebSessions();
+        // #2095 review: verified before the request's body was read — a revoke (its own, or an admin's) made meanwhile
+        // removed it, and nothing it asks for may then go out.
+        if (!this.returningDevices.current(device, tokenEpoch(token)))
+            return { kind: "refused" };
+        if (device.tier === "guest")
+            return this.requestGuestDeviceCode(device, input, token);
         const paused = this.webLoginCodes.pausedForMs();
         if (paused > 0)
             return { kind: "limited", retryAfterMs: paused };
@@ -5886,7 +6392,7 @@ export class FleetManager {
             this.logger.info({ err: err?.message, adapterId }, "Sign-in code request: the private message could not be sent");
             return { kind: "refused" };
         }
-        if (this.webToken !== token || !this.publicOwnerCurrent(owner)) {
+        if (this.webToken !== token || !this.publicOwnerCurrent(owner) || !this.returningDevices.current(device, tokenEpoch(token))) {
             this.webLoginCodes.revokeIfCurrent(issued.issuanceId);
             return { kind: "refused" };
         }
@@ -5894,15 +6400,94 @@ export class FleetManager {
         // Asked again after the follow-up's wait: the owner, the token, shutdown, and a public request's exposure.
         const exposureGone = input.surface === "gateway"
             && (this.publicWebLink?.exposureId !== input.exposureId || this.publicWebLink?.status().state !== "open");
-        if (this.shuttingDown || this.webToken !== token || !this.publicOwnerCurrent(owner) || exposureGone) {
+        if (this.shuttingDown || this.webToken !== token || !this.publicOwnerCurrent(owner) || exposureGone || !this.returningDevices.current(device, tokenEpoch(token))) {
             this.webLoginCodes.revokeIfCurrent(issued.issuanceId);
             return { kind: "refused" };
         }
         this.logger.info({ adapterId, surface: input.surface }, "Web sign-in code sent privately to a returning device's owner");
         return { kind: "sent" };
     }
+    /**
+     * #1920 step 4b: a guest's returning device asks for a code — a guest code for that account, by DM only, under the
+     * same rules as its /web (guests on, not an admin, something in scope now; one per account and the cap; one flow per
+     * account at a time; a revoke meanwhile ends it), its own limiter, and the guests' breaker. Asked through the public
+     * link: only while that exposure is the open one (its code then works through it alone), as an admin's device.
+     */
+    async requestGuestDeviceCode(device, input, token) {
+        const codes = this.webGuestLoginCodes;
+        const account = { adapterId: device.owner.adapterId, userId: device.owner.userId };
+        const key = `${account.adapterId}\u0000${account.userId}`;
+        const adapter = this.adapters.get(account.adapterId);
+        const viaLink = input.surface === "gateway";
+        const linkOpen = () => !!input.exposureId && this.publicWebLink?.openSignin()?.exposureId === input.exposureId;
+        if ((viaLink ? !linkOpen() : input.exposureId !== undefined) || !adapter?.sendDirect || !this.guestSignInAllowed(account)) {
+            this.logger.info({ adapterId: account.adapterId, surface: input.surface }, "Guest sign-in code request refused");
+            return { kind: "refused" };
+        }
+        const paused = codes.pausedForMs();
+        if (paused > 0)
+            return { kind: "limited", retryAfterMs: paused };
+        const asked = this.guestCodeAskedAt.get(key);
+        if (this.guestCodeInFlight.has(key))
+            return { kind: "limited", retryAfterMs: 5_000 };
+        if (asked !== undefined && performance.now() - asked < 60_000)
+            return { kind: "limited", retryAfterMs: 60_000 - (performance.now() - asked) };
+        const admitted = this.guestCodeRequestLimiter.admit(device.idHash);
+        if (!admitted.ok)
+            return { kind: "limited", retryAfterMs: admitted.retryAfterMs };
+        const revokes = this.guestRevokes, accountRevokes = this.guestAccountRevokes.get(key) ?? 0;
+        const current = () => !this.shuttingDown && this.webToken === token && this.adapters.get(account.adapterId) === adapter
+            && this.guestRevokes === revokes && (this.guestAccountRevokes.get(key) ?? 0) === accountRevokes && this.guestSignInAllowed(account)
+            && (!viaLink || linkOpen()) && this.returningDevices.current(device, tokenEpoch(token));
+        const issued = codes.issue({ epoch: tokenEpoch(token), recipient: account, audiences: [viaLink ? input.exposureId : "local"] });
+        if (!issued)
+            return { kind: "limited", retryAfterMs: 60_000 }; // the guests' cap: never someone's evicted
+        this.guestCodeInFlight.add(key);
+        this.guestCodeAskedAt.delete(key);
+        this.guestCodeAskedAt.set(key, performance.now());
+        try {
+            const text = t("web.resend_code", issued.display, Math.round(LOGIN_CODE_TTL_MS / 60_000), input.label || t("web.resend_unknown_browser"), t(viaLink ? "web.resend_public" : "web.resend_local"))
+                + "\n" + t("dashboard.code_next");
+            try {
+                await withinBudget(adapter.sendDirect(account.userId, text, { disablePreview: true }), performance.now() + 5_000);
+            }
+            catch (err) {
+                codes.revokeIfCurrent(issued.issuanceId);
+                this.logger.info({ err: err?.message, adapterId: account.adapterId }, "Guest sign-in code request: the private message could not be sent");
+                return { kind: "refused" };
+            }
+            if (!current()) {
+                codes.revokeIfCurrent(issued.issuanceId);
+                return { kind: "refused" };
+            }
+            await this.sendCodeAlone((body, opts) => adapter.sendDirect(account.userId, body, opts), adapter.type, issued.display);
+            if (!current()) {
+                codes.revokeIfCurrent(issued.issuanceId);
+                return { kind: "refused" };
+            }
+            this.logger.info({ adapterId: account.adapterId }, "Guest sign-in code sent privately to a returning device's account");
+            return { kind: "sent" };
+        }
+        finally {
+            this.guestCodeInFlight.delete(key);
+        }
+    }
+    /** #1920 step 4b (auth-api): this browser becomes a guest's returning device. The cookie value, or null. */
+    rememberGuestDevice(account, input) {
+        const token = this.webToken;
+        if (!token)
+            return null;
+        this.initializeWebSessions();
+        return this.returningDevices.rememberGuest(account, { ...input, tokenEpoch: tokenEpoch(token), webToken: token });
+    }
     /** Called by the sign-in endpoint: a login the operator did not make should be visible to them. */
     onWebLogin(info) {
+        // #1920 §2.3: a guest's sign-in is always said in General (web.notify_login is the operator's own sign-ins): who,
+        // and how many agents they now reach — admins stay aware of everyone who is not one of them.
+        if (info.tier === "guest" && info.owner) {
+            this.notifyFleetError(t("web.guest_login_notice", this.webPerson(info.owner).name, info.label, this.guestScope(info.owner).size, info.handle.slice(0, 8)));
+            return;
+        }
         if (this.fleetConfig?.web?.notify_login === false)
             return;
         // The session handle makes each notice distinct: notifyFleetError throttles by text, and a second
@@ -6101,11 +6686,17 @@ export class FleetManager {
      * landed mid-edit) must not be cleared or disturbed (Prism b).
      */
     async appendCleanupWarning(target, watch, warning, cleanupCommand) {
-        const text = formatRestartProgressCompletion("update", {
-            ...watch.summary,
-            warningText: warning,
-            warningCommand: cleanupCommand,
-        }, watch.receipt.startedAt);
+        // #2175: one text per outcome, frozen at its first tick. The completion carries elapsed seconds, so a text made
+        // anew each tick would never equal the one already handed over and landed (terminalLanded compares exactly).
+        const key = JSON.stringify([warning, cleanupCommand ?? null]);
+        if (watch.frozen?.key !== key) {
+            watch.frozen = { key, text: formatRestartProgressCompletion("update", {
+                    ...watch.summary,
+                    warningText: warning,
+                    warningCommand: cleanupCommand,
+                }, watch.receipt.startedAt) };
+        }
+        const text = watch.frozen.text;
         const stopWatching = () => {
             this.updateCleanupWatch = null;
             if (this.updateProgressTimer)
@@ -6113,10 +6704,22 @@ export class FleetManager {
             this.updateProgressTimer = null;
         };
         if (text !== this.lastUpdateProgressText) {
-            const adapter = this.adapters.get(target.adapterId);
-            if (!adapter)
-                return; // retry on a later tick
-            await adapter.editMessage(target.chatId, target.messageId, text, target.threadId);
+            // #2175: while the completion is still owed by the background retry, that retry is the message's only
+            // writer — this text (the completion plus the warning) goes to it rather than racing it. Handing it over is not
+            // delivery: the receipt and this watch stay until the retry reports this exact text landed (a later tick).
+            const progress = this.startupProgress;
+            if (progress?.terminalLanded(text)) {
+                // landed through the retry
+            }
+            else if (progress?.replaceTerminalText(text)) {
+                return;
+            }
+            else {
+                const adapter = this.adapters.get(target.adapterId);
+                if (!adapter)
+                    return; // retry on a later tick
+                await adapter.editMessage(target.chatId, target.messageId, text, target.threadId);
+            }
             this.lastUpdateProgressText = text;
         }
         const verdict = cleanupWatchVerdict(readUpdateProgress(this.dataDir), watch.receipt);
@@ -6266,6 +6869,9 @@ export class FleetManager {
         const { getTmuxSocketName: getSocket } = await import("./paths.js");
         TmuxManager.setSocketName(getSocket());
         await TmuxManager.ensureSession(getTmuxSession());
+        this.tmuxSessionEnsured = true;
+        // #2072: what this host can run — probed in the background, published for every picker.
+        this.startAvailabilityRefresh();
         // Pre-flight (advisory, fire-and-forget): warm the per-backend auth cache
         // before instances spawn, so a CLI that comes up on its sign-in screen gets
         // an instant 🔑 verdict instead of decaying into crash/MCP-died noise.
@@ -6503,6 +7109,7 @@ export class FleetManager {
         const generals = allEntries.filter(([_, cfg]) => cfg.general_topic);
         const others = allEntries.filter(([_, cfg]) => !cfg.general_topic);
         const startupProgress = new RestartProgress(this.runnableStartupCount(fleet, topicMode), pendingUpdateProgress?.startedAt ?? startupStartedAt, this.logger, { mode: pendingProgressOperation === "full-restart" ? "reload" : pendingUpdateProgress ? "update" : "restart" });
+        this.startupProgress = startupProgress;
         if (generals.length > 0) {
             for (const [name, cfg] of generals) {
                 try {
@@ -6589,6 +7196,18 @@ export class FleetManager {
         this.pruneEventLog();
         this.eventLogPruneTimer = setInterval(() => this.pruneEventLog(), 24 * 60 * 60_000);
         this.eventLogPruneTimer.unref?.();
+        // #2122 §5.5: usage is collected from the start, not from the first time someone opens a report — the same bounded
+        // background passes the cache report uses (16 MB a pass, then every 10 minutes).
+        {
+            const cache = this.cacheServiceFor();
+            cache.start();
+            void cache.kick();
+        }
+        // #1920 §3.2: guests' ClassicBot room membership, read in the background — now, then each key ten minutes after
+        // its answer (a minute after a failed read; the tick only finds what is due). A request only reads the answers.
+        void this.refreshAllGuestRooms();
+        this.guestRoomsTimer = setInterval(() => { void this.refreshAllGuestRooms(); }, GUEST_ROOM_TICK_MS);
+        this.guestRoomsTimer.unref?.();
         // #1335: delivery-outbox.db and Task Board retention. Same once-at-startup
         // + daily-timer pattern; chunked DELETEs so one run cannot hold the loop.
         void this.pruneOutboxAndTasks();
@@ -7089,7 +7708,8 @@ export class FleetManager {
             adapters: { total: this.adapterState.size, connected, states, details },
             startupComplete: this.startupComplete,
             memory: readFleetMemory(),
-            hostMemory,
+            hostMemory: this.memoryTop && (hostMemory.level === "elevated" || hostMemory.level === "critical")
+                ? { ...hostMemory, topProcesses: this.memoryTop.processes, topProcessesAt: this.memoryTop.at } : hostMemory,
             problems,
         };
     }
@@ -8240,6 +8860,13 @@ export class FleetManager {
                 if (!isPrivateChat && !cmdMatch && rawText.startsWith("/")) {
                     return; // bare slash in group — ignore silently
                 }
+                // #1920 step 4b-3: /web typed in a ClassicBot room (a group: `/web@ThisBot`) by someone who is not a fleet admin,
+                // while guest sign-in is on: their guest code, privately — as anywhere else. An admin's goes on as before.
+                if (/^\/(?:web|dashboard)(?:\s|$)/i.test(text) && msgAdapter && this.isGuestWebAsk(msg.adapterId, msg.userId)) {
+                    await this.guestWebCommand({ adapterId: msg.adapterId, userId: msg.userId, username: msg.username,
+                        arg: text.replace(/^\/(?:web|dashboard)/i, "").trim().toLowerCase(), replyHere: body => msgAdapter.sendText(chatId, body) });
+                    return;
+                }
                 // Handle /start command
                 if (text === "/start" || text.startsWith("/start ")) {
                     // #1686: intercept /start web before the ClassicBot admission flow runs.
@@ -8248,15 +8875,21 @@ export class FleetManager {
                     // #1742: a bare /start from a fleet admin whose /web just failed to reach them privately is that /start web
                     // (Telegram's START button sends it bare) — once, within the window; any other bare /start is ClassicBot's.
                     const admin = isPrivateChat && this.isFleetAdmin(msg.userId, msg.adapterId ?? "");
+                    // #1920 step 4b-3: a guest's too (guest sign-in on, not an admin) — its /web reached it no other way.
+                    const guest = isPrivateChat && !admin && this.isGuestWebAsk(msg.adapterId, msg.userId);
                     const webStart = isPrivateChat && (requestedBackend === "web"
-                        || (text === "/start" && admin && this.takeTgWebStartWindow(msg.adapterId ?? "", msg.userId)));
+                        || (text === "/start" && (admin || guest) && this.takeTgWebStartWindow(msg.adapterId ?? "", msg.userId)));
                     if (webStart) {
                         if (requestedBackend === "web")
                             this.takeTgWebStartWindow(msg.adapterId ?? "", msg.userId);
                         // #1742: the /web menu right here; the code comes to this DM.
                         if (admin)
                             await this.startWebInDm(msg, msgAdapter ?? undefined);
-                        // Non-fleet-admins: /start alone is enough to open the DM channel; no further action.
+                        // A guest: its guest code, here (this DM is where it goes).
+                        else if (guest && msgAdapter)
+                            await this.guestWebCommand({ adapterId: msg.adapterId, userId: msg.userId, username: msg.username, arg: "",
+                                replyHere: body => msgAdapter.sendText(chatId, body) });
+                        // Anyone else: /start alone is enough to open the DM channel; no further action.
                         return;
                     }
                     // All new starts, including explicit backend and later chooser callbacks,
@@ -8560,10 +9193,7 @@ export class FleetManager {
                     this.afterUserInboundDelivered(generalInstance, msg);
                     this.logger.info(`${msg.username} → ${generalInstance}: ${(text ?? "").slice(0, 100)}`);
                     this.eventLog?.logActivity("message", msg.username, (text ?? "").slice(0, 200), generalInstance);
-                    this.emitSseEvent("message", {
-                        instance: generalInstance, sender: msg.username, role: "user",
-                        text: (text ?? "").slice(0, WEB_CHAT_TEXT_MAX), ts: new Date().toISOString(),
-                    });
+                    this.emitPlatformInbound(generalInstance, msg, text ?? "");
                 }
                 catch (err) {
                     this.logger.warn({ err: err.message, instanceName: generalInstance }, "General wake/delivery failed");
@@ -8672,9 +9302,16 @@ export class FleetManager {
         this.afterUserInboundDelivered(instanceName, msg);
         this.logger.info(`${msg.username} → ${instanceName}: ${(text ?? "").slice(0, 100)}`);
         this.eventLog?.logActivity("message", msg.username, (text ?? "").slice(0, 200), instanceName);
+        this.emitPlatformInbound(instanceName, msg, text ?? "");
+    }
+    /**
+     * A person's platform message as the web chat shows it — the user's own words, as a user (#1306), in the instance's
+     * history (#1565). #1920 §5.2: said in the instance's topic, General or room, so it is that channel's, by that account.
+     */
+    emitPlatformInbound(instance, msg, text) {
         this.emitSseEvent("message", {
-            instance: instanceName, sender: msg.username, role: "user",
-            text: (text ?? "").slice(0, WEB_CHAT_TEXT_MAX), ts: new Date().toISOString(),
+            instance, sender: msg.username, role: "user", text: text.slice(0, WEB_CHAT_TEXT_MAX), ts: new Date().toISOString(),
+            channel: true, from: webChatFrom(msg.adapterId, msg.userId),
         });
     }
     /** Handle outbound tool calls from a daemon instance */
@@ -8976,7 +9613,14 @@ export class FleetManager {
                 // an agent cannot invent it to suppress the normal completion marker.
                 if (!error && result != null && msg.statusOnly !== true) {
                     try {
-                        void this.afterReplyRouted(instanceName, args, senderSessionName, buttonsView);
+                        // #1920 §5.2: shown to the instance's guests only when it landed in the instance's own topic or room.
+                        let inChannel = false;
+                        try {
+                            inChannel = outAdapter !== WEB_ONLY_REPLY_SINK
+                                && this.landedInOwnChannel(instanceName, contextAdapterId ?? this.getInstanceAdapterId(instanceName), result);
+                        }
+                        catch { /* not known: not the channel's (fail closed), and the bookkeeping below still runs */ }
+                        void this.afterReplyRouted(instanceName, args, senderSessionName, buttonsView, inChannel);
                     }
                     catch (err) {
                         this.logger.warn({ err, instanceName }, "Reply delivered but post-delivery bookkeeping failed");
@@ -9030,7 +9674,35 @@ export class FleetManager {
         return this.worlds.size === 0 && this.isWebOnlyFleet() ? { adapter: WEB_ONLY_PROMPT_SINK, adapterId: "web", chatId: "web" } : null;
     }
     /** Resolves when the reply is in the web chat (#1770: after its files are copied); the caller need not wait. */
-    afterReplyRouted(instanceName, args, senderSessionName, buttons = null) {
+    /**
+     * #1920 §5.2: whether a platform send landed in the instance's own place — its ClassicBot room, or its topic in its
+     * connection's group — so its channel's members saw it. Anything else (another chat, a DM, a context left from General,
+     * an answer without the chat it went to) is not the channel's.
+     */
+    landedInOwnChannel(instance, adapterId, sent) {
+        const s = sent && typeof sent === "object" ? sent : {};
+        if (!adapterId || typeof s.chatId !== "string" || !s.chatId)
+            return false;
+        const roomId = this.classicChannels?.getChannelIdByInstance(instance);
+        if (roomId !== undefined)
+            return (this.classicChannels?.getAdapterIdByInstance(instance) ?? this.getPrimaryAdapterId()) === adapterId && roomId === s.chatId;
+        const cfg = this.fleetConfig?.instances && Object.hasOwn(this.fleetConfig.instances, instance) ? this.fleetConfig.instances[instance] : undefined;
+        const world = this.worlds.get(adapterId);
+        if (!cfg || this.getInstanceAdapterId(instance) !== adapterId || !world?.groupId || s.chatId !== world.groupId)
+            return false;
+        const thread = typeof s.threadId === "string" && s.threadId ? s.threadId : null;
+        return cfg.topic_id == null ? thread === null : thread === String(cfg.topic_id);
+    }
+    /** #1920 §5.2 (#2085 review): a platform click's buttons are in the instance's own place — else not its channel's. */
+    clickInOwnChannel(set) {
+        try {
+            return this.landedInOwnChannel(set.instance, set.adapterId, { chatId: set.chatId, threadId: set.threadId || undefined });
+        }
+        catch {
+            return false;
+        }
+    }
+    afterReplyRouted(instanceName, args, senderSessionName, buttons = null, inChannel = false) {
         // A reply is NOT proof the turn is over (#410) — but it is not proof of
         // more work either. Split the difference: an instance that is clearly
         // idle loses the button now; one that looks busy keeps it (re-posted
@@ -9066,6 +9738,7 @@ export class FleetManager {
                 ts,
                 ...(attachments.length ? { attachments } : {}),
                 ...(buttons ? { buttons } : {}), // #1266
+                ...(inChannel ? { channel: true } : {}), // #1920 §5.2
             });
         };
         const before = this.webReplyOrder.get(instanceName);
@@ -9460,6 +10133,7 @@ export class FleetManager {
         if (type === "fleet_get_web_theme" || type === "fleet_set_web_theme" || type === "fleet_set_web_theme_asset" || type === "fleet_reset_web_theme"
             || type === "fleet_get_web_appearance" || type === "fleet_preview_web_appearance"
             || type === "fleet_set_web_widget" || type === "fleet_remove_web_widget"
+            || type === "fleet_set_web_ambient" || type === "fleet_clear_web_ambient"
             || type === "fleet_export_web_mod" || type === "fleet_propose_web_mod") {
             this.handleWebTheme(name, msg);
             return;
@@ -9574,10 +10248,11 @@ export class FleetManager {
                 }
                 case "fleet_decision_list":
                     db.pruneExpiredDecisions();
-                    result = db.listDecisions(projectRoot, {
+                    // #2152: titles by default; the full text by id, or all of it with full: true.
+                    result = decisionListAnswer(db.listDecisions(projectRoot, {
                         includeArchived: payload.include_archived,
                         tags: payload.tags,
-                    });
+                    }), { id: payload.id, full: payload.full });
                     break;
                 case "fleet_decision_update": {
                     const id = payload.id;
@@ -9770,10 +10445,16 @@ export class FleetManager {
                     created_by: instance,
                 });
             }
-            case "list": return db.listDecisions(projectRoot, {
-                includeArchived: args.includeArchived === true,
-                tags: asStrArr(args.tags),
-            });
+            // #2152: titles by default (agend-agent decision-list); one decision's full text by id (decision-get <id>).
+            // The CLI sends include_archived (snake case, as the MCP tool): both spellings are read.
+            case "list":
+            case "get":
+                if (op === "get" && !asStr(args.id)?.trim())
+                    return { error: "id is required" };
+                return decisionListAnswer(db.listDecisions(projectRoot, {
+                    includeArchived: args.includeArchived === true || args.include_archived === true,
+                    tags: asStrArr(args.tags),
+                }), { id: op === "get" ? asStr(args.id) ?? "" : args.id, full: args.full });
             case "update": {
                 const id = asStr(args.id);
                 if (!id)
@@ -10319,6 +11000,7 @@ export class FleetManager {
      */
     saveFleetConfig(explicitPatches = []) {
         this.publicWebLink?.refresh();
+        this.enforceGuestSwitch(); // #1920: a Settings save turning guests off ends their sessions
         if (!this.fleetConfig || !this.configPath)
             return;
         if (!this.savedFleetConfigSnapshot)
@@ -10808,11 +11490,23 @@ export class FleetManager {
     guildEmojiFetches = new Map();
     // ── #1630: what stands for an instance in the web app, and Discord server emoji in web chat ──
     webImageCaches = null;
+    /** Server emoji whose picture fetch failure was already logged at warn (once each; bounded). */
+    webEmojiFailures = new Set();
     webImageCache(kind) {
         const onError = (key, err) => this.logger.debug({ err: err?.message, key }, "web image fetch failed (kept what was cached)");
+        // A server emoji's picture that cannot be fetched reads `:name:` in web chat (it used to be an empty box, the user's
+        // "tofu"): say why once per emoji, where it can be seen, not on every render (its key is quiet for an hour anyway).
+        const emojiError = (key, err) => {
+            if (this.webEmojiFailures.has(key))
+                return onError(key, err);
+            this.webEmojiFailures.add(key);
+            while (this.webEmojiFailures.size > 512)
+                this.webEmojiFailures.delete(this.webEmojiFailures.values().next().value);
+            this.logger.warn({ err: err?.message, key }, "Discord server emoji picture could not be fetched (web chat shows its :name:)");
+        };
         this.webImageCaches ??= {
             avatars: new WebImageCache({ dir: join(this.dataDir, "cache", "avatars"), onError }),
-            emoji: new WebImageCache({ dir: join(this.dataDir, "cache", "emoji"), onError }),
+            emoji: new WebImageCache({ dir: join(this.dataDir, "cache", "emoji"), onError: emojiError }),
         };
         return this.webImageCaches[kind];
     }
@@ -12342,6 +13036,8 @@ export class FleetManager {
     }
     /** Routes a click to the handler that owns its prefix; false when none does. */
     async dispatchAdapterCallback(data, adapterId, adapter) {
+        if (await this.sessionAuthorizationRequests().handleCallback(data, adapterId))
+            return true; // #1939 S2b
         if (data.callbackData.startsWith(REPLY_BUTTON_PREFIX)) { // #1266
             const buttons = this.replyButtons();
             if (!buttons) {
@@ -12479,7 +13175,7 @@ export class FleetManager {
     cacheInstances() {
         const fleet = Object.entries(this.fleetConfig?.instances ?? {}).map(([name, cfg]) => ({
             name, backend: this.backendNameOf(name), workingDirectory: cfg.working_directory, ledgerPath: join(this.getInstanceDir(name), "cache-ledger.json"),
-            claudeConfigDir: this.claudeConfigDirOf(name),
+            claudeConfigDir: this.claudeConfigDirOf(name), profile: this.usageProfileOf(name, this.backendNameOf(name)),
         }));
         const taken = new Set(fleet.map(i => i.name));
         const classic = (this.classicChannels?.getAll() ?? []).filter(ch => !taken.has(ch.instanceName)).map(ch => ({
@@ -12488,6 +13184,7 @@ export class FleetManager {
             workingDirectory: join(getAgendHome(), "workspaces", ch.instanceName),
             ledgerPath: join(this.getInstanceDir(ch.instanceName), "cache-ledger.json"),
             claudeConfigDir: this.claudeConfigDirOf(ch.instanceName),
+            profile: this.usageProfileOf(ch.instanceName, this.classicChannels?.getBackendByInstance(ch.instanceName, this.fleetConfig?.defaults?.backend) ?? this.fleetConfig?.defaults?.backend ?? "claude-code"),
         }));
         return [...fleet, ...new Map(classic.map(c => [c.name, c])).values()];
     }
@@ -12497,17 +13194,63 @@ export class FleetManager {
      * (cache-service.ts) — never a vendor call, never a synchronous transcript read.
      */
     cacheReport(window) {
-        const w = Object.prototype.hasOwnProperty.call(WINDOWS, window) ? window : "7d";
-        this.cacheService ??= new CacheService({
+        return this.cacheServiceFor().report(cacheWindow(window));
+    }
+    /**
+     * #2122 §5.1: the profile the usage read now is tagged with — the claude profile whose config dir is read ("default"
+     * without one); codex "unrecorded" (its rollouts don't say which login wrote them).
+     */
+    usageProfileOf(name, backend) {
+        if (backend === "claude-code")
+            return this.credentialProfileOf(name, "claude-code") ?? "default";
+        if (backend === "codex")
+            return "unrecorded";
+        return undefined;
+    }
+    /** #2122: the fleet's day boundary zone — defaults.scheduler.default_timezone, else this host's. */
+    usageZone() {
+        return this.fleetConfig?.defaults?.scheduler?.default_timezone?.trim() || Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
+    }
+    /**
+     * #2122: the usage report (usage-report.ts) — from the ledgers and rollups as they are now and the delivered-message
+     * counts; never a transcript read. `only`: just that instance (an ordinary agent's own row).
+     */
+    async usageReport(params) {
+        const { buildUsageReport } = await import("./usage-report.js");
+        const data = await this.cacheServiceFor().usageData();
+        const team = new Map();
+        for (const [t, cfg] of Object.entries(this.fleetConfig?.teams ?? {}))
+            for (const m of cfg?.members ?? [])
+                if (!team.has(m))
+                    team.set(m, t);
+        const now = Date.now();
+        this.ensureDeliveryOutbox?.();
+        // Every hour of the kept history: the report places each on a local date and keeps the range's own.
+        const messages = this.deliveryOutbox?.deliveredMessageHours(now - 401 * 86_400_000, now + 3_600_000) ?? [];
+        const keep = (name) => params.only === undefined || name === params.only;
+        return buildUsageReport({
+            now, zone: this.usageZone(), range: params.range, group: params.group, scanning: data.scanning,
+            instances: data.instances.filter(i => keep(i.inst.name)).map(i => ({ name: i.inst.name, backend: i.inst.backend, team: team.get(i.inst.name) ?? null,
+                status: i.status, ...(i.with ? { with: i.with } : {}), ledger: i.ledger, days: i.days })),
+            messages: messages.filter(m => keep(m.instance)),
+        });
+    }
+    /** #2001: get_cache_report's — the same report, as last worked out (reused for a minute, until the next pass). */
+    cacheReportPublished(window) {
+        return this.cacheServiceFor().published(cacheWindow(window));
+    }
+    cacheServiceFor() {
+        return this.cacheService ??= new CacheService({
             instances: () => this.cacheInstances(),
             claudeProjectsDir: () => join(process.env.CLAUDE_CONFIG_DIR?.trim() || join(homedir(), ".claude"), "projects"),
             claudeKey: claudeProjectKey,
             codexSessionsDir: () => join(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"), "sessions"),
             listRollouts: root => sharedRolloutIndex(root).list(),
+            rolloutsUnreadable: root => sharedRolloutIndex(root).unreadable,
             metaPath: join(this.dataDir, "cache-codex-rollouts.json"),
+            zone: () => this.usageZone(),
             log: (level, msg, extra) => this.logger[level](extra ?? {}, msg),
         });
-        return this.cacheService.report(w);
     }
     /** The web's Acknowledge (any item; a signed-in session is fleet-admin level). */
     acknowledgeNeedsItem(id, principal) {
@@ -13017,6 +13760,198 @@ export class FleetManager {
     webBackendTokens = new Map();
     /** #1269: the web's /clear confirmations — one token per question, used once, for the instance as it was asked about. */
     webClearTokens = new Map();
+    /**
+     * #1939 S1: the design's §3 for one web request (authority/web-authority.ts), with this fleet's admins, policy and
+     * token; `instance` once the body has named it. Observe only: receipts record it, no agent acts on it yet.
+     */
+    webAuthority(input) {
+        const state = this.webAuthorityState();
+        return evaluateWebAuthority({
+            session: input.session, gateway: input.gateway, peer: input.peer,
+            tokenEpoch: this.webToken ? tokenEpoch(this.webToken) : null,
+            ...(input.instance !== undefined ? { target: { adapterId: this.getInstanceAdapterId(input.instance) } } : {}),
+            isAdmin: (userId, adapterId) => this.adminGate(userId, adapterId) === "ok",
+            authorization: input.session ? this.sessionAuthorizationStore()?.get(input.session.handle) ?? null : null,
+            policy: { ...webAuthorityPolicy(this.fleetConfig?.web), enabled: state.enabled, loopbackOnly: state.loopbackOnly }, epoch: state.epoch, now: Date.now(),
+        });
+    }
+    sessionAuthorizations = null;
+    sessionAuthorizationStore() {
+        if (!this.dataDir)
+            return null;
+        this.sessionAuthorizations ??= new SessionAuthorizations(join(this.dataDir, "web-authorizations.json"), this.logger);
+        return this.sessionAuthorizations;
+    }
+    /**
+     * #1939 §0: record that a session's account has authorized it — called only once that account has confirmed on Discord
+     * or Telegram (S2b). The session must qualify now (§3, as a message from it would be judged); then every message,
+     * click, /steer and /btw from it is web-verified until max_session_hours after now, the session ends, or a revocation.
+     * Ones no longer worth keeping (their session gone, an old epoch, run out) are dropped on the way.
+     */
+    authorizeWebSession(session, peer, gateway) {
+        const store = this.sessionAuthorizationStore();
+        const state = this.webAuthorityState(), now = Date.now(), policy = webAuthorityPolicy(this.fleetConfig?.web);
+        if (!store || !session.owner)
+            return { ok: false, refusal: !store ? "disabled" : "no_account" };
+        const check = evaluateWebAuthority({
+            session, gateway, peer, tokenEpoch: this.webToken ? tokenEpoch(this.webToken) : null,
+            isAdmin: (userId, adapterId) => this.adminGate(userId, adapterId) === "ok",
+            authorization: { handle: session.handle, owner: session.owner, authorizedAt: now, until: now + policy.maxSessionMs, epoch: state.epoch },
+            policy: { ...policy, enabled: state.enabled, loopbackOnly: state.loopbackOnly }, epoch: state.epoch, now,
+        });
+        if (check.refusal)
+            return { ok: false, refusal: check.refusal };
+        const live = new Set(this.webSessions?.list(undefined, () => true).map(r => r.handle) ?? []);
+        store.prune(a => a.epoch === state.epoch && now <= Math.min(a.until, a.authorizedAt + policy.maxSessionMs) && live.has(a.handle));
+        return { ok: true, ...store.authorize(session.handle, session.owner, now, state.epoch, now + policy.maxSessionMs) };
+    }
+    authorityStateStore = null;
+    /**
+     * #1939 §10: the switch, "Only this computer can authorize" and the revocation epoch in force for the configuration as
+     * it is now (a change since last seen moves the epoch first; authority-state.ts). No data directory: off.
+     */
+    webAuthorityState() {
+        if (!this.dataDir)
+            return { enabled: false, loopbackOnly: true, epoch: 0 };
+        this.authorityStateStore ??= new AuthorityStateStore(join(this.dataDir, "web-authority.json"), this.logger, undefined, undefined, () => { this.ensureDeliveryOutbox?.(); return this.deliveryOutbox?.maxWebAuthorityEpoch() ?? 0; });
+        return this.authorityStateStore.current(this.fleetConfig?.web?.verified_authority);
+    }
+    /**
+     * #1939 S2a: Settings → Web → Web authority — the state in force (the switch counts as off while its state cannot be
+     * written), what fleet.yaml says, the hosts that make the dashboard reachable from elsewhere (the warning while
+     * loopback_only is off), and the sessions authorized now (§0): each one's device, account, and when it runs out.
+     */
+    webAuthorityOverview() {
+        const configured = this.fleetConfig?.web?.verified_authority ?? {};
+        const lanHosts = (this.fleetConfig?.web?.allowed_hosts ?? []).filter(h => { const name = hostnameOf(String(h)); return name !== null && !LOOPBACK_HOST_NAMES.includes(name); });
+        const state = this.webAuthorityState(), maxMs = webAuthorityPolicy(this.fleetConfig?.web).maxSessionMs, now = Date.now();
+        const sessions = new Map((this.webSessions?.list(undefined, () => true) ?? []).map(r => [r.handle, r]));
+        const authorized = state.enabled ? (this.sessionAuthorizationStore()?.list() ?? [])
+            .filter(a => a.epoch === state.epoch && sessions.has(a.handle) && now <= Math.min(a.until, a.authorizedAt + maxMs))
+            .map(a => ({ handle: a.handle, label: sessions.get(a.handle).label, account: `${a.owner.adapterId}:${a.owner.userId}`, authorizedAt: a.authorizedAt,
+            until: Math.min(a.until, a.authorizedAt + maxMs, sessions.get(a.handle).absoluteExpiry) })) : [];
+        return { state, configured, hours: VERIFIED_SESSION_HOURS, lanHosts, authorized };
+    }
+    authorizationRequests = null;
+    /**
+     * #1939 S2b (§0.1): "Authorize this browser" — the Confirm card in the account's DM. Confirm runs §3 again at the tap
+     * (authorizeWebSession on the session read again by its handle); Not me signs the session out.
+     */
+    sessionAuthorizationRequests() {
+        if (this.authorizationRequests)
+            return this.authorizationRequests;
+        const adapterOf = (adapterId) => this.adapters.get(adapterId) ?? this.worlds.get(adapterId)?.adapter;
+        // The host's clock, with its zone: the person may read the DM on a phone in another one.
+        const when = (ms) => new Date(ms).toLocaleString(undefined, { timeZoneName: "short" });
+        const where = (peer) => t(peer === "loopback" ? "web_auth.peer_loopback" : "web_auth.peer_lan");
+        return this.authorizationRequests = new SessionAuthorizationRequests({
+            now: () => performance.now(), wallNow: () => Date.now(),
+            maxSessionMs: () => webAuthorityPolicy(this.fleetConfig?.web).maxSessionMs,
+            sendDirect: async (owner, text, choices) => {
+                const adapter = adapterOf(owner.adapterId);
+                if (!adapter?.sendDirect)
+                    return null;
+                const sent = await adapter.sendDirect(owner.userId, text, { choices, allowedMentions: { parse: [] } });
+                return sent?.messageId ? { chatId: sent.chatId, messageId: sent.messageId } : null;
+            },
+            sendGeneralHint: async (owner, text) => {
+                const adapter = adapterOf(owner.adapterId), general = this.findGeneralInstance(owner.adapterId);
+                const topic = general ? this.fleetConfig?.instances[general]?.topic_id : undefined;
+                const group = general ? this.getGroupIdForInstance(general) : undefined;
+                if (adapter && group)
+                    await adapter.sendText(String(group), text, { ...(topic != null ? { threadId: String(topic) } : {}), allowedMentions: { parse: [] } });
+            },
+            editCard: async (owner, at, text, choices) => {
+                const adapter = adapterOf(owner.adapterId);
+                if (!adapter)
+                    return;
+                if (!choices.length && adapter.editMessageRemoveButtons) {
+                    await adapter.editMessageRemoveButtons(at.chatId, at.messageId, text);
+                    return;
+                }
+                await adapter.editMessage(at.chatId, at.messageId, text);
+                if (adapter.replaceMessageButtons)
+                    await adapter.replaceMessageButtons(at.chatId, at.messageId, choices);
+            },
+            authorize: (handle, peer) => {
+                const record = this.webSessions?.findByHandle(handle);
+                if (!record)
+                    return { ok: false, refusal: "session_gone" };
+                const r = this.authorizeWebSession(record, peer, false);
+                // What the card says: the end of the authorization, or the session's own end when that comes first.
+                return r.ok ? { ok: true, until: Math.min(r.authorization.until, record.absoluteExpiry) } : { ok: false, refusal: r.refusal };
+            },
+            signOut: (handle) => {
+                this.webSessions?.revokeByHandle(handle);
+                this.sessionAuthorizationStore()?.prune(a => a.handle !== handle);
+            },
+            event: (type, payload) => { try {
+                this.eventLog?.insert("web", type, payload);
+            }
+            catch { /* the event log is best effort */ } },
+            text: {
+                ask: (c) => t("web_auth.card_ask", c.label, where(c.peer), when(c.askedAt), when(c.until)),
+                confirmed: (c) => t("web_auth.card_confirmed", c.label, where(c.peer), when(c.until)),
+                denied: (c) => t("web_auth.card_denied", c.label),
+                expired: (c) => t("web_auth.card_expired", c.label),
+                refused: (c) => t("web_auth.card_refused", c.label, t(`web_auth.refusal_${c.refusal}`)),
+                revoked: (c) => t("web_auth.card_revoked", c.label),
+                ended: (c) => t("web_auth.card_ended", c.label),
+                generalHint: () => t("web_auth.general_hint"),
+                confirmLabel: () => t("web_auth.confirm"),
+                notMeLabel: () => t("web_auth.not_me"),
+                notYours: () => t("web_auth.not_yours"),
+            },
+            log: this.logger,
+        });
+    }
+    /** #1939 S2b: the web session asks to be authorized (the request judged by §3 first — as it will be again at the tap). */
+    async requestSessionAuthorization(input) {
+        const s = input.session;
+        const gate = this.webAuthorityQualifies(input);
+        if (gate)
+            return { ok: false, refusal: gate };
+        return this.sessionAuthorizationRequests().ask({ handle: s.handle, owner: s.owner, label: s.label, peer: input.peer, sessionEnd: s.absoluteExpiry });
+    }
+    /**
+     * #1939 §3 without the authorization: would this request's session qualify to be authorized? null: yes; otherwise the
+     * first check it fails (for the app to say why it can't be authorized here).
+     */
+    webAuthorityQualifies(input) {
+        const s = input.session, state = this.webAuthorityState(), now = Date.now(), policy = webAuthorityPolicy(this.fleetConfig?.web);
+        const r = evaluateWebAuthority({
+            session: s, gateway: input.gateway, peer: input.peer, tokenEpoch: this.webToken ? tokenEpoch(this.webToken) : null,
+            isAdmin: (userId, adapterId) => this.adminGate(userId, adapterId) === "ok",
+            authorization: s?.owner ? { handle: s.handle, owner: s.owner, authorizedAt: now, until: now + policy.maxSessionMs, epoch: state.epoch } : null,
+            policy: { ...policy, enabled: state.enabled, loopbackOnly: state.loopbackOnly }, epoch: state.epoch, now,
+        });
+        return r.refusal;
+    }
+    /** #1939 S2b: what the app shows for this browser — verified (until when), a card pending, or why not. */
+    webSessionAuthorization(input) {
+        const s = input.session;
+        const verdict = this.webAuthority(input);
+        if (!verdict.refusal && verdict.authority.session) {
+            const a = this.sessionAuthorizationStore()?.get(s.handle);
+            const max = webAuthorityPolicy(this.fleetConfig?.web).maxSessionMs;
+            if (a)
+                return { state: "verified", until: Math.min(a.until, a.authorizedAt + max, s.absoluteExpiry) };
+        }
+        const pending = s ? this.sessionAuthorizationRequests().pending(s.handle) : null;
+        if (pending)
+            return { state: "pending", expiresInMs: pending.expiresInMs };
+        return { state: "none", reason: this.webAuthorityQualifies(input) ?? (verdict.refusal ?? "not_authorized") };
+    }
+    /** #1939 §10: revoke every web authority given so far (receipts read as none), without signing anyone out. */
+    revokeWebAuthority() {
+        this.webAuthorityState(); // any switch change first, then this revocation
+        const result = this.authorityStateStore?.revoke() ?? { epoch: 0, durable: false };
+        if (result.durable)
+            this.logger.info({ epoch: result.epoch }, "Web authority revoked");
+        else
+            this.logger.warn({ epoch: result.epoch }, "Web authority revoked in memory only — web authority stays off until its state can be written; a restart before then undoes this revocation");
+        return result;
+    }
     /** #1269: an instance's chat command from the web chat (web-commands.ts); `publicLink`: a gateway request. */
     webCommand(input, opts) {
         const webMeta = (instance) => {
@@ -13025,15 +13960,16 @@ export class FleetManager {
                 // #1827: a /steer or /btw reaches the agent as the web person who wrote it.
                 chatId: this.getGroupIdForInstance(instance) || "", messageId: newWebMessageId(),
                 username: opts.person?.name ?? WEB_NAME_FALLBACK, userId: opts.person?.userId ?? WEB_NAME_FALLBACK,
-                threadId: topicId != null ? String(topicId) : undefined, adapterId: this.getAdapterForInstance(instance)?.id ?? "", source: "web", humanOrigin: webHumanOrigin(true),
+                threadId: topicId != null ? String(topicId) : undefined, adapterId: this.getAdapterForInstance(instance)?.id ?? "", source: "web", humanOrigin: webHumanOrigin(true, opts.authority),
             };
         };
         const choicesFromCache = (instance) => {
-            const cached = this.readCliEnv(this.backendNameForInstance(instance)); // the cached catalog only: never a probe here
+            const backend = this.backendNameForInstance(instance);
+            const cached = this.readCliEnv(backend, this.catalogProfile(backend, instance)); // the cached catalog only: never a probe here
             if (!cached?.models.length)
                 return null;
             const current = this.resolveInstanceModel(instance).model;
-            return { current, options: cached.models.map(o => ({ id: o.id, label: this.modelChoiceLabel(o, current) })) };
+            return { current, options: this.withCurrentModel(cached.models, current).map(o => ({ id: o.id, label: this.modelChoiceLabel(o, current) })) };
         };
         return runWebCommand({
             // Own entries only: a name like "__proto__" or "constructor" must not be found on the prototype (#1476 review).
@@ -13080,7 +14016,7 @@ export class FleetManager {
                     return step.noop ? { text: step.text } : { error: step.text };
                 if (step.kind === "choose") {
                     const id = (token) => joinBackendArgs([...step.args, token]);
-                    return { choices: { prompt: step.text, current: step.current === null ? null : id(step.current), options: step.choices.map(c => ({ id: id(c.token), label: c.label })) } };
+                    return { choices: { prompt: step.text, current: step.current === null ? null : id(step.current), options: step.choices.map(c => ({ id: id(c.token), label: c.label, ...(c.disabled ? { disabled: c.disabled } : {}) })) } };
                 }
                 const now = performance.now();
                 for (const [k, v] of this.webBackendTokens)
@@ -14218,7 +15154,12 @@ export class FleetManager {
                 fleetConfig: () => this.fleetConfig,
                 isFleetAdmin: (userId, adapterId) => this.isFleetAdmin(userId, adapterId),
                 eventLog: () => this.eventLog,
-                recoverBackendInstances: (backend, profile) => this.recoverBackendInstances(backend, undefined, profile ?? null),
+                recoverBackendInstances: (backend, profile) => {
+                    // #2072: a sign-in just finished — the pickers learn it now, not at the next pass.
+                    if (!profile)
+                        void this.backendAvailability.refresh([backend], { force: true });
+                    return this.recoverBackendInstances(backend, undefined, profile ?? null);
+                },
                 claimWindow: backend => this.loginWindow.tryClaim("web", backend),
                 releaseWindow: claim => { this.loginWindow.release(claim); },
                 isClaimCurrent: claim => this.loginWindow.isCurrent(claim),
@@ -14737,6 +15678,8 @@ export class FleetManager {
                 // binary the same way, so a binary only a login shell could see was
                 // installed, reported as verified, and then offered nowhere.
                 this.adoptBinaryDirectory(installedAt, backend);
+                // #2072: an install just finished — the pickers learn it now, not at the next pass.
+                void this.backendAvailability.refresh([backend], { force: true });
                 if (!LOGIN_FLOWS[backend]) {
                     this.installHandoff = null;
                     await chat.adapter.sendText(chat.chatId, t("install.success_no_login", backend), { threadId: chat.threadId }).catch(() => { });
@@ -14971,6 +15914,8 @@ export class FleetManager {
                 buttons: m.buttons,
                 click: m.click,
                 links: m.links,
+                channel: m.channel,
+                from: m.from,
             });
             broadcastSseEvent(this.sseClients, event, recorded, onError, this.webChatHistory.cursorOf(recorded));
             // #1629: live-only receipt after the recorded agent reply. Never persist/replay it or give it an SSE cursor.
@@ -15200,7 +16145,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // can keep those copies current; other backends never had unmanaged
         // AgEnD-published skills and must retain the normal user-ownership guard.
         const adoptLegacyUnmanaged = backend === "kiro-cli" && role === "general";
-        this.syncManagedSkills(join(workDir, ...skillSegments), join(root, "skills"), role, adoptLegacyUnmanaged);
+        this.syncManagedSkills(join(workDir, ...skillSegments), join(root, "skills"), role, adoptLegacyUnmanaged, 
+        // #2163: a Classic bot's skills folder (or a skill in it) may be a link out of its workspace; every path is
+        // checked where it really lands, just before it is written.
+        role === "classic" ? (path) => insideManagedWorkspaces(path) : undefined);
         this.logger.debug({ workDir, backend, role }, "Synced role-based bundled skills");
     }
     /**
@@ -15286,11 +16234,22 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      * migration exception is the pre-manifest Kiro General layout explicitly
      * selected by adoptLegacyUnmanaged.
      */
-    syncManagedSkills(destSkills, srcSkills, role, adoptLegacyUnmanaged = false) {
+    syncManagedSkills(destSkills, srcSkills, role, adoptLegacyUnmanaged = false, confined) {
         if (!existsSync(srcSkills))
             return;
+        const refuse = (path) => {
+            if (!confined || confined(path))
+                return false;
+            this.logger.warn({ path, destSkills }, "Not publishing skills — the path leads out of the managed workspace");
+            return true;
+        };
+        if (refuse(destSkills))
+            return;
         mkdirSync(destSkills, { recursive: true });
         const manifestPath = join(destSkills, ".agend-managed-skills.json");
+        // Its ownership claims decide what is replaced or removed below: one that lives elsewhere is never believed.
+        if (refuse(manifestPath))
+            return;
         const hadManifest = existsSync(manifestPath);
         let previouslyManaged = [];
         try {
@@ -15319,9 +16278,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
         const eligible = bundled.filter(name => {
             const roles = this.readManagedSkillRoles(join(srcSkills, name, "SKILL.md"));
-            // General is the coordinator and receives both coordinator and worker
-            // playbooks. Workers receive only skills explicitly marked for workers.
-            return role === "general" || roles.includes("worker");
+            // General is the coordinator and receives every playbook. Workers and Classic bots receive only skills
+            // explicitly marked for their role (#2163).
+            return role === "general" || roles.includes(role);
         });
         const managed = [];
         for (const name of eligible) {
@@ -15338,6 +16297,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             }
             managed.push(name);
             const newContent = readFileSync(join(srcSkills, name, "SKILL.md"), "utf-8");
+            if (refuse(dest))
+                continue;
             try {
                 if (existsSync(dest) && readFileSync(dest, "utf-8") === newContent)
                     continue;
@@ -15384,9 +16345,9 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             if (!Array.isArray(frontmatter.roles))
                 throw new Error("roles must be an array");
             const roles = [...new Set(frontmatter.roles)]
-                .filter((value) => value === "general" || value === "worker");
+                .filter((value) => value === "general" || value === "worker" || value === "classic");
             if (roles.length !== frontmatter.roles.length || roles.length === 0) {
-                throw new Error("roles must contain only general and/or worker");
+                throw new Error("roles must contain only general, worker and/or classic");
             }
             return roles;
         }
@@ -15771,10 +16732,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.logger.info(`${msg.username} → ${instanceName} (classic): ${text.slice(0, 100)}`);
         // #1592: the web chat shows what was asked, as for every other inbound — the user's own words (no chat-log
         // context), as a user (#1306: never a role read from text), in the room's history (#1565).
-        this.emitSseEvent("message", {
-            instance: instanceName, sender: msg.username, role: "user",
-            text: text.slice(0, WEB_CHAT_TEXT_MAX), ts: new Date().toISOString(),
-        });
+        this.emitPlatformInbound(instanceName, msg, text);
     }
     /** Paste raw text directly to a classic instance's CLI (no [user:] wrapping) */
     /** #1690: our own runtime switches awaiting the daemon's outcome, by id. */
@@ -15812,7 +16770,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     /** #1806: null on a switch INTO claude-code — the configured model then belongs to the backend being left. */
     configured = this.fleetConfig?.instances[instanceName]?.model ?? this.fleetConfig?.defaults?.model) {
         const aliases = ["default", "sonnet", "opus", "haiku", "opusplan", "Fable"];
-        const api = (this.readCliEnv("claude-code")?.apiModels ?? []).map(m => m.id);
+        const api = (this.readCliEnv("claude-code", this.catalogProfile("claude-code", instanceName))?.apiModels ?? []).map(m => m.id);
         const lower = model.trim().toLowerCase();
         const bare = lower.replace(/\[1m\]$/, "");
         const known = aliases.some(a => a.toLowerCase() === bare)
@@ -15840,13 +16798,22 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             : undefined;
         return classic ?? this.fleetConfig?.defaults?.backend ?? "claude-code";
     }
-    cliEnvPath(backend) {
-        return join(getAgendHome(), "cli-env", `${backend.replace(/[^A-Za-z0-9._-]/g, "_")}.json`);
+    /**
+     * #2072: a catalog is the account's, so a credential profile has its own. Only claude-code's probe reads an account
+     * catalog through a profile's login (its `GET /v1/models` with the profile's token); other backends' probes read the
+     * process environment, so their catalog stays the backend's own.
+     */
+    catalogProfile(backend, instanceName) {
+        return backend === "claude-code" && instanceName ? this.credentialProfileOf(instanceName, backend) : null;
     }
-    /** Read the cached CLI env for a backend, or null if missing/stale/unparseable. */
-    readCliEnv(backend) {
+    cliEnvPath(backend, profile = null) {
+        const safe = (s) => s.replace(/[^A-Za-z0-9._-]/g, "_");
+        return join(getAgendHome(), "cli-env", profile ? `${safe(backend)}@${safe(profile)}.json` : `${safe(backend)}.json`);
+    }
+    /** Read the cached CLI env for a backend (a credential profile's own, when given), or null if missing/stale/unparseable. */
+    readCliEnv(backend, profile = null) {
         try {
-            const env = JSON.parse(readFileSync(this.cliEnvPath(backend), "utf-8"));
+            const env = JSON.parse(readFileSync(this.cliEnvPath(backend, profile), "utf-8"));
             if (typeof env?.probedAt === "number" && Date.now() - env.probedAt < CLI_ENV_TTL_MS)
                 return env;
         }
@@ -15889,10 +16856,12 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      * previous list, never stall the command that asked for it.
      */
     async probeBackendBounded(backend, opts = {}) {
-        // #725: single-flight per backend. Explicit vendor refreshes remain a
+        // #725: single-flight per backend (#2072: per backend and credential profile). Explicit vendor refreshes remain a
         // separate flight from an ordinary probe, while sysinfo can join either.
-        const regularFlight = this.pendingCliEnvProbes.get(backend);
-        const vendorFlight = this.pendingVendorCliEnvProbes.get(backend);
+        const profile = opts.profile ?? null;
+        const key = profile ? `${backend}@${profile}` : backend;
+        const regularFlight = this.pendingCliEnvProbes.get(key);
+        const vendorFlight = this.pendingVendorCliEnvProbes.get(key);
         if (opts.refreshVendorCatalog && vendorFlight)
             return vendorFlight;
         if (!opts.refreshVendorCatalog && (vendorFlight || regularFlight))
@@ -15903,25 +16872,26 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const epoch = this.cliEnvProbeEpoch;
         const input = {
             mode: "env", backend, instanceDir,
-            config: { workingDirectory: "", instanceDir, instanceName: `probe-${backend}`, mcpServers: {} },
+            config: { workingDirectory: "", instanceDir, instanceName: `probe-${backend}`, mcpServers: {},
+                ...(profile ? { credentialStoreHome: credentialProfileStoreHome(getAgendHome(), backend, profile) } : {}) },
             refreshVendorCatalog: opts.refreshVendorCatalog === true,
         };
-        const bounded = this.runBackendProbeWorker(`global:${backend}`, input).then(probed => {
+        const bounded = this.runBackendProbeWorker(`global:${key}`, input).then(probed => {
             if (!probed || Array.isArray(probed) || this.shuttingDown || epoch !== this.cliEnvProbeEpoch)
                 return null;
             try {
-                return this.persistCliEnvProbeResult(backend, probed);
+                return this.persistCliEnvProbeResult(backend, probed, profile);
             }
             catch (err) {
-                this.logger.warn({ backend, err }, "CLI env cache write failed");
+                this.logger.warn({ backend, profile, err }, "CLI env cache write failed");
                 return null;
             }
         }).finally(() => {
             const flights = opts.refreshVendorCatalog ? this.pendingVendorCliEnvProbes : this.pendingCliEnvProbes;
-            if (flights.get(backend) === bounded)
-                flights.delete(backend);
+            if (flights.get(key) === bounded)
+                flights.delete(key);
         });
-        (opts.refreshVendorCatalog ? this.pendingVendorCliEnvProbes : this.pendingCliEnvProbes).set(backend, bounded);
+        (opts.refreshVendorCatalog ? this.pendingVendorCliEnvProbes : this.pendingCliEnvProbes).set(key, bounded);
         return bounded;
     }
     stopCliEnvProbes() {
@@ -16036,12 +17006,21 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     modelDisplayForInstance(instanceName) {
         return this.resolveInstanceModel(instanceName).display;
     }
+    /**
+     * #2072: the model an instance runs is always among its choices — one its CLI's catalog does not list (an older
+     * name, a custom provider's, a typed one) is shown first, marked, so the menu never hides what is running.
+     */
+    withCurrentModel(options, currentModel) {
+        if (!currentModel || currentModel === "default" || options.some(o => o.id === currentModel))
+            return options;
+        return [{ id: currentModel, label: currentModel, description: t("model.not_listed") }, ...options];
+    }
     modelChoiceLabel(option, currentModel) {
         const label = option.description ? `${option.label} — ${option.description}` : option.label;
         return option.id === currentModel ? `✓ ${label}` : label;
     }
     /** Preserve the existing cache merge rules for worker probes. */
-    persistCliEnvProbeResult(backend, probed) {
+    persistCliEnvProbeResult(backend, probed, profile = null) {
         const env = { backend, probedAt: Date.now(), ...probed };
         // An empty result must never overwrite a catalog we already have. Some
         // probes hit the network (`agy models` fetches, 5s cap), so a slow moment
@@ -16050,14 +17029,14 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // antigravity cache replaced by an empty one. Keep the known models and
         // let the fresher currentModel/version through.
         if (!env.models?.length) {
-            const previous = this.readCliEnv(backend);
+            const previous = this.readCliEnv(backend, profile);
             if (previous?.models?.length)
                 env.models = previous.models;
         }
         // Same protection for the extended catalog: one offline moment must not
         // blank a good account list for the whole cache TTL.
         if (!env.apiModels?.length) {
-            const previous = this.readCliEnv(backend);
+            const previous = this.readCliEnv(backend, profile);
             if (previous?.apiModels?.length)
                 env.apiModels = previous.apiModels;
         }
@@ -16065,12 +17044,12 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // keeps the cached levels only for that same binary: both versions known and equal, cache still valid. A help
         // that was read and lists none ([]) is an answer and is written as is, so the fallback applies.
         if (env.effortLevels === undefined) {
-            const previous = this.readCliEnv(backend);
+            const previous = this.readCliEnv(backend, profile);
             if (previous?.effortLevels && previous.version && env.version && previous.version === env.version) {
                 env.effortLevels = previous.effortLevels;
             }
         }
-        const path = this.cliEnvPath(backend);
+        const path = this.cliEnvPath(backend, profile);
         mkdirSync(dirname(path), { recursive: true });
         writeFileSync(path, JSON.stringify(env, null, 2));
         return env;
@@ -16092,6 +17071,18 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // indefinitely — each is wrapped by CLI_ENV_PROBE_DEADLINE_MS.
         for (const b of backends)
             void this.probeBackendBounded(b);
+        // #2072: each Claude credential profile in use has its own account catalog. Only fleet.yaml's agents are walked
+        // here; a ClassicBot room on a profile is probed on its first /model (catalogProfile knows rooms too).
+        const profiles = new Set();
+        for (const name of Object.keys(this.fleetConfig?.instances ?? {})) {
+            if (this.backendNameForInstance(name) !== "claude-code")
+                continue;
+            const profile = this.catalogProfile("claude-code", name);
+            if (profile)
+                profiles.add(profile);
+        }
+        for (const profile of profiles)
+            void this.probeBackendBounded("claude-code", { profile });
     }
     /** Best-effort model list for `/model`: cached CLI env first, else live probe. Never throws. */
     async getModelOptions(instanceName, refresh = false, onLiveProbe) {
@@ -16105,7 +17096,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      */
     async getModelOptionsWithSource(instanceName, opts = {}) {
         const backendName = this.backendNameForInstance(instanceName);
-        const cached = this.readCliEnv(backendName);
+        const profile = this.catalogProfile(backendName, instanceName);
+        const cached = this.readCliEnv(backendName, profile);
         if (!opts.refresh && cached?.models.length && !this.cliEnvNeedsRefresh(cached)) {
             return { models: cached.models, source: "cache" };
         }
@@ -16116,7 +17108,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // Stale, missing, or a forced refresh → probe live (also refreshes the cache).
         // A newly released model is invisible until this runs, which is why staleness
         // triggers it rather than waiting for the 24h hard expiry or a cold start.
-        const env = await this.probeBackendBounded(backendName, { refreshVendorCatalog: opts.refreshVendorCatalog });
+        const env = await this.probeBackendBounded(backendName, { refreshVendorCatalog: opts.refreshVendorCatalog, profile });
         if (env?.models.length)
             return { models: env.models, source: "live" };
         // Probe failed or timed out: the previous list is still the best answer.
@@ -16131,7 +17123,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     modelMenuChoices(instanceName, nonce, options, currentModel) {
         const isClaude = this.backendNameForInstance(instanceName) === "claude-code";
         const choices = [{ id: `${MODEL_SELECT_CALLBACK_PREFIX}${nonce}:__refresh__`, label: t("model.refresh") }];
-        for (const o of options.slice(0, isClaude ? 23 : 24)) {
+        for (const o of this.withCurrentModel(options, currentModel).slice(0, isClaude ? 23 : 24)) {
             choices.push({ id: `${MODEL_SELECT_CALLBACK_PREFIX}${nonce}:${o.id}`, label: this.modelChoiceLabel(o, currentModel) });
         }
         if (isClaude)
@@ -16538,16 +17530,18 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
     }
     /** Cached-or-live account catalog behind "/model → more models" (claude). */
-    async claudeApiModelOptions() {
-        const cached = this.readCliEnv("claude-code");
+    async claudeApiModelOptions(instanceName) {
+        // #2072: the account behind THIS instance — its credential profile's catalog, else the default login's.
+        const profile = this.catalogProfile("claude-code", instanceName);
+        const cached = this.readCliEnv("claude-code", profile);
         if (cached?.apiModels?.length)
             return cached.apiModels;
-        const env = await this.probeBackendBounded("claude-code");
+        const env = await this.probeBackendBounded("claude-code", { profile });
         return env?.apiModels ?? [];
     }
     /** Replace a consumed "/model" menu with the full account catalog tier. */
     async expandClaudeModelMenu(pending) {
-        const expanded = await this.claudeApiModelOptions();
+        const expanded = await this.claudeApiModelOptions(pending.instanceName);
         if (!expanded.length) {
             await pending.respond(t("model.more_unavailable")).catch(() => { });
             return;
@@ -16975,7 +17969,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         return {
             currentBackend: (name) => this.backendNameForInstance(name),
             currentDisplay: (name) => `${this.backendNameForInstance(name)} · ${this.resolveInstanceModel(name).display}`,
-            installedBackends: () => KNOWN_BACKENDS.filter(b => b !== "mock" && this.backendInstalledHere(b)),
+            availability: () => this.backendAvailabilityFor(instanceName),
             models: (backend) => this.backendModelOptions(backend, opts),
             // #1808: the same rule update_instance_config's switch applies (backendModelVerdict).
             modelKnown: (backend, model) => this.backendModelVerdict(instanceName, backend, model).ok,
@@ -17074,10 +18068,76 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // kiro-cli gates its own --effort by version at launch (a quiet console note otherwise); muse always passes it.
         return () => true;
     }
-    /** Installed the way the launch finds a CLI (resolveBinary): on PATH or in a known install directory. */
-    backendInstalledHere(backend) {
-        const binary = BACKEND_INSTALLATION_INFO[backend]?.binary;
-        return !!binary && resolveBinary(binary) !== binary;
+    /**
+     * #2072: what this host can run, from the published availability snapshot (backend-availability.ts). Read only: a
+     * handler never starts a probe, not even in the background — launch, the timer, and /login install or sign-in do.
+     */
+    backendAvailabilityRows() {
+        return this.backendAvailability.snapshot();
+    }
+    /**
+     * #2072 part 3: the models a Settings field offers for `backend` — the cached catalog (an instance's own credential
+     * profile's, when it is named and has one), claude's account catalog included. Read only: never a probe.
+     */
+    modelCatalogFor(backend, instance) {
+        if (!KNOWN_BACKENDS.includes(backend) || backend === "mock")
+            return [];
+        const own = instance && Object.prototype.hasOwnProperty.call(this.fleetConfig?.instances ?? {}, instance) ? instance
+            : instance && this.classicChannels?.getChannelIdByInstance(instance) !== undefined ? instance : null;
+        const env = this.readCliEnv(backend, this.catalogProfile(backend, own));
+        const seen = new Set(), out = [];
+        for (const m of [...(env?.models ?? []), ...(env?.apiModels ?? [])])
+            if (!seen.has(m.id)) {
+                seen.add(m.id);
+                out.push(m);
+            }
+        return out;
+    }
+    /**
+     * #2072 (#2078 review): the snapshot as THIS instance would see it. Its sign-in on a backend is its own credential
+     * profile's when it has one there — the host's default login says nothing about it. A profile's login is a file check
+     * (credentialProfileLogin), no process.
+     */
+    backendAvailabilityFor(instanceName) {
+        return this.backendAvailabilityRows().map(row => {
+            const profile = this.credentialProfileOf(instanceName, row.backend);
+            if (!profile || (row.state !== "usable" && row.state !== "not_signed_in" && row.state !== "unknown") || !row.path)
+                return row;
+            let login = "unknown";
+            try {
+                login = credentialProfileLogin(this.dataDir, row.backend, profile).state;
+            }
+            catch { /* unknown */ }
+            // Signed in there: usable for this instance. Signed out (or unknown): the host's default login says nothing about
+            // it, so no "not signed in" claim from it — update_instance_config's profile gate refuses a signed-out profile
+            // when applied, naming the profile and the command that signs it in.
+            if (login === "logged-in")
+                return { ...row, auth: "valid", state: "usable" };
+            return row.state === "not_signed_in" ? { ...row, auth: "unknown", state: "unknown" } : row;
+        });
+    }
+    /** The probes the snapshot runs (tests replace them: no CLI, no account, no network). */
+    availabilityProbes = hostAvailabilityProbes;
+    availabilityStore = null;
+    availabilityTimer = null;
+    get backendAvailability() {
+        return this.availabilityStore ??= new BackendAvailabilityStore(KNOWN_BACKENDS.filter(b => b !== "mock" && !!BACKEND_INSTALLATION_INFO[b]), this.availabilityProbes, { onChange: () => this.noteAvailabilityPaths() });
+    }
+    /** A launch need not look the binary up again (a synchronous `which` on the loop) when the snapshot found it. */
+    noteAvailabilityPaths() {
+        for (const row of this.availabilityStore?.snapshot() ?? []) {
+            const binary = BACKEND_INSTALLATION_INFO[row.backend]?.binary;
+            if (binary)
+                noteResolvedBinary(binary, row.state === "not_installed" ? null : row.path);
+        }
+    }
+    /** Probe now and then every AVAILABILITY_STALE_MS; a pass that finds nothing changed starts no CLI. */
+    startAvailabilityRefresh() {
+        void this.backendAvailability.refresh();
+        if (this.availabilityTimer)
+            clearInterval(this.availabilityTimer);
+        this.availabilityTimer = setInterval(() => { void this.backendAvailability.refresh(); }, AVAILABILITY_STALE_MS);
+        this.availabilityTimer.unref?.();
     }
     /** The models `/model` would offer on a backend: the cached CLI env, else (live) a bounded probe. Never throws. */
     async backendModelOptions(backend, opts) {
@@ -17419,9 +18479,11 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
         return undefined;
     }
+    /** #2072: from the published snapshot (no `which` on the loop); not checked yet counts as installed (no false alarm). */
     isBackendInstalled(backend) {
-        const installation = BACKEND_INSTALLATION_INFO[backend];
-        return !!installation && checkBinaryInstalled(installation.binary);
+        if (!BACKEND_INSTALLATION_INFO[backend])
+            return false;
+        return this.backendAvailability.get(backend)?.state !== "not_installed";
     }
     getMissingBackendWarning(backend) {
         if (!backend)
@@ -17759,6 +18821,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             clearInterval(this.eventLogPruneTimer);
             this.eventLogPruneTimer = null;
         }
+        if (this.guestRoomsTimer) {
+            clearInterval(this.guestRoomsTimer);
+            this.guestRoomsTimer = null;
+        }
         this.logService?.unwatchAll(); // #1218: a Log's watch timers end with the fleet
         this.compactWatchService?.stopAll();
         if (this.outboxPruneTimer) {
@@ -17858,6 +18924,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.adapters.clear();
         this.controlClient?.stop();
         this.controlClient = null;
+        if (this.availabilityTimer) {
+            clearInterval(this.availabilityTimer);
+            this.availabilityTimer = null;
+        }
         if (this.healthServer) {
             this.healthServerListening = false;
             const server = this.healthServer;
@@ -19842,6 +20912,159 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         this.rejectedHostsLogged.add(name);
         this.logger.warn({ host: name }, "Web request refused: Host is not allowed (add it to web.allowed_hosts if this is a proxy you run)");
     }
+    /**
+     * #1920 §3: the instances a guest session may see — derived on every request from the account's chat access, never
+     * stored; nothing while `web.guests.enabled` is not true.
+     * - Its connection's fleet topics and General (what it may talk to in chat): when that connection's access lets the
+     *   account in (AccessManager.isAllowed — allowed_users or paired). An `open` connection lets everyone in, so it gives
+     *   only the instances an admin named for its guests (`web.guests.open_instances`; the user's decision: least
+     *   privilege, as an open group has no list of people).
+     * - A Telegram private ClassicBot room that is the account's own (its chat id is the user id).
+     * - A ClassicBot group or guild room on its connection: only while its membership is verified (§3.2 — a "member"
+     *   answer read in the background, at most 15 minutes old; unknown, failed or stale hides it).
+     * - Then an admin's narrowing (`web.guests.narrow`), which only takes away.
+     * A fleet admin is not a guest: an admin outside the connection's access gets nothing here (admins sign in as admins).
+     */
+    guestScope(owner) {
+        const guests = this.fleetConfig?.web?.guests;
+        if (!owner || guests?.enabled !== true)
+            return NO_GUEST_SCOPE;
+        const scope = new Set(this.guestReach(owner));
+        const narrow = guests.narrow && Object.hasOwn(guests.narrow, `${owner.adapterId}:${owner.userId}`) ? guests.narrow[`${owner.adapterId}:${owner.userId}`] : undefined;
+        if (narrow) {
+            const keep = new Set(narrow);
+            for (const name of [...scope])
+                if (!keep.has(name))
+                    scope.delete(name);
+        }
+        return scope.size ? scope : NO_GUEST_SCOPE;
+    }
+    /**
+     * #1920 (#2104 review): what an account reaches before an admin's narrowing — its connection's topics (an open one's
+     * named agents), its own Telegram private room, its verified group rooms. Narrowing can only take from this set, so it
+     * is what Settings offers to narrow to. Empty while guest sign-in is off.
+     */
+    guestReach(owner) {
+        const guests = this.fleetConfig?.web?.guests;
+        const scope = new Set();
+        if (guests?.enabled !== true)
+            return scope;
+        const own = (map, key) => (map && Object.hasOwn(map, key) ? map[key] : undefined);
+        const world = this.worlds.get(owner.adapterId);
+        if (world && world.accessManager.isAllowed(owner.userId)) {
+            const named = world.accessManager.getMode() === "open" ? new Set(own(guests.open_instances, owner.adapterId) ?? []) : null;
+            for (const name of Object.keys(this.fleetConfig?.instances ?? {})) {
+                if (this.getInstanceAdapterId(name) !== owner.adapterId || this.isClassicInstance(name))
+                    continue;
+                if (!named || named.has(name))
+                    scope.add(name);
+            }
+        }
+        const rooms = this.classicChannels?.getAll() ?? [];
+        for (const room of rooms) {
+            if (this.isOwnPrivateRoom(owner, room))
+                scope.add(room.instanceName);
+        }
+        const members = this.guestRooms();
+        for (const room of guestGroupRooms(rooms, owner)) {
+            if (members.verified(room, owner.userId))
+                scope.add(room.instance);
+        }
+        return scope;
+    }
+    /**
+     * #1920 §3.5: a guest session still admitted — current, with something in scope. A scope that became empty (guest
+     * sign-in off, the account removed from the connection's access, everything narrowed away) ends the session here,
+     * so the next request and the open stream find it gone.
+     */
+    guestStillAdmitted(record) {
+        return this.guestAdmission(record) === "ok";
+    }
+    /**
+     * The same, with a third answer (§3.2): "pending" — nothing in scope now, but a room's membership is not read yet
+     * (a restart, a room just created). The request is refused and the session kept; its read starts in the background.
+     */
+    guestAdmission(record) {
+        if (!this.webSessions || !this.webToken || !this.webSessions.isCurrent(record, tokenEpoch(this.webToken)))
+            return "gone";
+        const owner = record.owner;
+        if (this.guestScope(owner).size)
+            return "ok";
+        if (owner && this.fleetConfig?.web?.guests?.enabled === true) {
+            const members = this.guestRooms(), rooms = guestGroupRooms(this.classicChannels?.getAll() ?? [], owner);
+            if (rooms.some((room) => members.pending(room, owner.userId))) {
+                void this.refreshGuestRooms(owner, { mode: "triggered" }); // rate-limited per room (30 s), single-flight
+                return "pending";
+            }
+        }
+        this.enforceGuestSwitch();
+        const ended = this.webSessions.revokeByHandle(record.handle);
+        if (ended.found)
+            this.logger.info({ adapterId: record.owner?.adapterId, durable: ended.durable }, "Guest web session ended: nothing left in its scope");
+        return "gone";
+    }
+    /** #1920 §3.2: the membership answers; the read goes to the room's own connection, never waits past its deadline. */
+    guestRooms() {
+        this.guestRoomMembership ??= new GuestRoomMembership({
+            now: () => performance.now(),
+            read: (room, userId) => {
+                const adapter = this.worlds.get(room.adapterId)?.adapter;
+                return room.kind === "telegram" ? adapter?.isGroupMember?.(room.channelId, userId) : adapter?.canViewChannel?.(room.channelId, userId);
+            },
+            // Said once per key while its reads keep failing (no user id: the room and connection are what an admin fixes).
+            onPersistentFailure: (room, failures) => this.logger.warn({ adapterId: room.adapterId, instance: room.instance, failures }, "Guest room membership keeps failing to read (the bot may lack the permission, or was removed); retrying with backoff up to 10 minutes"),
+            onRecovered: (room) => this.logger.info({ adapterId: room.adapterId, instance: room.instance }, "Guest room membership reads again"),
+        });
+        return this.guestRoomMembership;
+    }
+    /** #1920 §3.2: read this guest's rooms that are due (GuestRoomMembership.refresh says when each mode reads). */
+    async refreshGuestRooms(owner, opts = {}) {
+        if (this.fleetConfig?.web?.guests?.enabled !== true)
+            return;
+        try {
+            await this.guestRooms().refresh(owner, guestGroupRooms(this.classicChannels?.getAll() ?? [], owner), opts);
+        }
+        catch (err) {
+            this.logger.warn({ err: err.message }, "Guest room membership could not be read");
+        }
+    }
+    /** Every account with a live guest session, one after another (the guest caps bound them); one pass at a time. */
+    async refreshAllGuestRooms() {
+        if (this.guestRoomsPass || this.fleetConfig?.web?.guests?.enabled !== true || !this.webSessions)
+            return;
+        this.guestRoomsPass = true;
+        try {
+            for (const owner of this.webSessions.guestOwners())
+                await this.refreshGuestRooms(owner);
+        }
+        finally {
+            this.guestRoomsPass = false;
+        }
+    }
+    guestRoomsPass = false;
+    /**
+     * #1920 §3.5: guest sign-in turned off ends every guest session — checked when the configuration is read or saved
+     * and when the sessions are opened, so turning it back on never revives one.
+     */
+    enforceGuestSwitch() {
+        if (this.fleetConfig?.web?.guests?.enabled === true || !this.webSessions)
+            return;
+        const ended = this.webSessions.revokeAll((r) => r.tier === "guest");
+        if (ended.count)
+            this.logger.info({ count: ended.count, durable: ended.durable }, "Guest web sign-in is off: every guest session ended");
+        // #1920 step 4b: and every guest's returning device — turning it back on lets no old browser ask for a code.
+        const devices = this.returningDevices?.revokeGuest();
+        if (devices?.count)
+            this.logger.info({ count: devices.count, durable: devices.durable }, "Guest web sign-in is off: every guest's returning device forgotten");
+    }
+    /** #1920 §5.2: whether this instance is the account's own Telegram private ClassicBot room (its chat id is the user id). */
+    guestOwnRoom(owner, instance) {
+        return (this.classicChannels?.getAll() ?? []).some((room) => room.instanceName === instance && this.isOwnPrivateRoom(owner, room));
+    }
+    /** A private room's chat id is its one user's id (a group's is negative, so never equal); Telegram only. */
+    isOwnPrivateRoom(owner, room) {
+        return room.adapterId === owner.adapterId && room.channelId === owner.userId && inferClassicChannelType(room.channelId) === "telegram";
+    }
     /** Shared handler dispatcher; gateway admission is enforced by its separate listener. */
     dispatchWebHttp(req, res, port, closing = false) {
         try {
@@ -19872,6 +21095,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 return;
             }
             const requestPath = new URL(req.url ?? "/", `http://localhost:${port}`).pathname;
+            if (this.effectBootstrap.handle(req, res))
+                return;
             // Branding is public, after Host admission: automatic favicon requests
             // must not become noisy web-token 401s in the browser console.
             if (handleWebIconRequest(req, res, requestPath))
@@ -19902,6 +21127,40 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                     res.end(JSON.stringify({ error: decision.message }));
                     return;
                 }
+                // #1920: a guest reaches only GUEST_ROUTES, within the scope derived for it now — default deny, before any
+                // handler, on this listener and the public link's gateway alike (both come through here).
+                if (decision.via === "session" && decision.session.tier === "guest") {
+                    const owner = decision.session.owner;
+                    const admitted = decision.session;
+                    const admission = this.guestAdmission(admitted);
+                    if (admission === "pending") {
+                        // §3.2: a room's membership is being read — try again shortly; the session stays.
+                        res.writeHead(503, { "Retry-After": "5" });
+                        res.end(JSON.stringify({ error: "guest_scope_pending" }));
+                        return;
+                    }
+                    if (admission === "gone") {
+                        res.writeHead(401);
+                        res.end(JSON.stringify({ error: "guest_scope_empty" }));
+                        return;
+                    }
+                    const verdict = guestRouteDecision(req.method ?? "GET", parsedUrl, this.guestScope(owner));
+                    if (verdict.kind === "deny") {
+                        res.writeHead(verdict.status);
+                        res.end(JSON.stringify({ error: verdict.error }));
+                        return;
+                    }
+                    // Phase 1b: the handlers that answer per recipient (the stream, the poll, a file) know it is a guest's, and
+                    // ask its scope anew each time; an emptied scope ends the session (and closes its stream).
+                    bindGuestRequest(req, { owner, scope: () => this.guestScope(owner), current: () => this.guestStillAdmitted(admitted),
+                        // #1920 §5.2: its own Telegram private room shows it everything; the kept messages place ticks and buttons.
+                        ownRoom: (instance) => this.guestOwnRoom(owner, instance),
+                        // §3.2: a stream that connects reads its rooms again (in the background; at most once a minute).
+                        streamOpened: () => { void this.refreshGuestRooms(owner, { mode: "force" }); },
+                        history: () => this.webChatHistory,
+                        // #1920 §5.1: guests chat unless the host made them read-only (web.guests.chat: false).
+                        chat: () => this.fleetConfig?.web?.guests?.chat !== false });
+                }
             }
             if (req.method === "GET" && req.url === "/health") {
                 const health = this.getFleetHealth();
@@ -20292,6 +21551,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.logger.warn({ code: err.code, port: settings.port }, "Preview listener unavailable; HTML previews are off");
             this.previewListening = false;
             this.previewListener = null;
+            this.previewListenError = `${settings.port}: ${err.code ?? err.message}`;
         });
         // An optional listener never takes the fleet down: a port Node refuses outright throws here, synchronously.
         try {
@@ -20302,6 +21562,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.logger.warn({ err: err.message, port: settings.port }, "Preview listener cannot listen; HTML previews are off");
             this.previewListening = false;
             this.previewListener = null;
+            this.previewListenError = `${settings.port}: ${err.code ?? err.message}`;
         }
     }
     /** What a reload may change hot: web.preview, and the dashboard names (the shim's allow-list and frame-ancestors). */
@@ -20322,6 +21583,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     }
     stopPreviewListener() {
         this.previewListening = false;
+        this.previewListenError = null;
         this.previewListener?.close();
         this.previewListener = null;
     }
@@ -20329,10 +21591,18 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     previewForUi(hostHeader, secure) {
         const listener = this.previewListening ? this.previewListener : null;
         const decided = previewAvailability(listener ? listener.settings : null, hostHeader, secure, listener ? listener.origins : undefined);
+        // Previews are on, but no listener answers: say why — its port could not be opened (the error, never "turned off"),
+        // or it is not listening yet.
         if (!listener && this.fleetConfig?.web?.preview !== false)
-            decided.reason = "Previews are not available on this fleet right now.";
+            Object.assign(decided, this.previewNotListening());
         return { ...decided, boot: listener ? listener.bootId : null };
     }
+    previewNotListening() {
+        const failed = this.previewListenError;
+        return failed
+            ? { code: "listenFailed", detail: failed, reason: `Previews are unavailable: the fleet could not open its preview port (${failed}). Another program may be using it — set web.preview_port, then restart AgEnD.` }
+            : { code: "notListening", reason: "Previews are not available on this fleet right now." };
+    }
     /**
      * #1723: for one page of the public link (exposure `exposureId`, at `dashboardOrigin`): its own preview tunnel's
      * origin once up, "starting" until then, why it failed if it did — or a configured web.preview_origin, used instead.
@@ -20347,8 +21617,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const configured = typeof web?.preview_origin === "string" ? normalizeOrigin(web.preview_origin) : null;
         if (configured) {
             const listener = this.previewListening ? this.previewListener : null;
-            if (!listener)
-                return off("publicLink", "Previews are not available on this fleet right now.");
+            if (!listener) {
+                const why = this.previewNotListening();
+                return off(why.code, why.reason, why.detail ? { detail: why.detail } : {});
+            }
             if (!configured.startsWith("https:"))
                 return off("needHttps", "Previews need an https web.preview_origin when the dashboard is reached over https.");
             return { dashboardOrigin, previewOrigin: configured, reason: null, code: null, boot: listener.bootId, frameSrc: `${configured}/frame` };
@@ -20452,6 +21724,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 catch {
                     return {};
                 } })(),
+                // #2118: only this Chat's placement content; guest projection drops global revisions.
+                effect_chat_v: createHash("sha256").update(JSON.stringify(this.themeStore.get(name).placements.effects)).digest("hex").slice(0, 32),
                 // #1958: the identity colour's tiers (the page resolves them: the agent's only while it shows agents' themes).
                 color: { ...(colors.get(name)?.color ? { person: colors.get(name).color } : {}), ...(image.agentColor ? { agent: image.agentColor } : {}),
                     ...(image.roleColor ? { role: image.roleColor } : {}), auto: autoIdentityColor(name) },
@@ -20460,6 +21734,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 description: identity.description || undefined,
                 role: identity.role || undefined,
                 tags: identity.tags,
+                teams: instanceTeams(this.fleetConfig?.teams, name), // #2172: the sidebar groups a team's members under it
+                last_reply: this.webChatHistory.lastAgentReply(name) ?? undefined, // #2179: its last reply to a person (ISO)
                 status: this.getInstanceStatus(name),
                 // `state` (presentation: may be awaiting_input) and `execution_state` (working / idle / stuck, or null —
                 // what the dashboard's activity events carry) come from instancePresentation (#1212).
@@ -20488,6 +21764,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             // #1685: host memory pressure while it slows or holds new agents (the dashboard's indicator; macOS elevated is
             // shown here rather than in chat). null when normal, unknown or advisory.
             host_memory: this.hostMemoryIndicator(),
+            // #2015: the largest processes while it lasts (name, pid, RSS, and whose: an instance, the fleet or tmux).
+            ...(this.hostMemoryIndicator() && this.memoryTop ? { host_memory_top: this.memoryTop.processes } : {}),
         };
     }
 }