@songsid/agend 2.3.0-beta.11 → 2.3.0-beta.13

package/dist/fleet-manager.d.ts

@@ -245,6 +245,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     fleetConfig: FleetConfig | null;
     private rawFleetConfig;
     private rawFleetDocument;
+    /** #2208: the paths a saveFleetConfig() wrote, for its check that nothing else changed. */
+    private fleetDocumentWrites;
     private savedFleetConfigSnapshot;
     adapter: ChannelAdapter | null;
     readonly worlds: Map<string, AdapterWorld>;
@@ -411,6 +413,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** #2175: this boot's progress message, whose completion may still be owed by its background retry. */
     private startupProgress;
     private adapterState;
+    private adapterRetryInFlight;
     /** Web Settings secret rotation is deliberately separate from reconnect
      * recovery: a rotation must build a fresh provider client with the new token,
      * and stale callbacks from the old client must not win. */
@@ -623,6 +626,30 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private classicSettingsOwners;
     private queueSettingsOperation;
     private settingsGate;
+    /**
+     * #2170: a held change confirmed by the request itself — only when ALL hold, else the chat card or the host CLI, as
+     * before:
+     *   - the session is web-verified (#1939: its account confirmed this browser on Discord or Telegram), asked now;
+     *   - the change's effect owners are known and on one platform (settingsChatAuthority — the chat card's own rule), the
+     *     verified account is on that platform and an admin of every one of them;
+     *   - a chat card could have been asked: a connected General on that platform the change does not affect (else the
+     *     change goes to the host CLI, as before) — the General that then hears of it;
+     *   - and, at execution (store.decide asks `current()` again): still web-verified under the same session and account
+     *     (not expired, revoked, signed out or the switch turned off), still those owners' admin, still a General a card
+     *     could go to, the fleet unchanged.
+     * What it rests on: the account's one confirmation of this browser (#1939), kept for the session until it is revoked,
+     * expires or signs out — not a fresh confirmation per Apply. Whoever uses that verified session (a browser left signed
+     * in, its cookie) confirms the same way. A public link never qualifies (evaluateWebAuthority refuses it). General
+     * still hears it: a notice, not a step.
+     */
+    private settingsSelfConfirmation;
+    /** #2170: the Generals a chat card could be posted in (promptSettingsChange's rule): connected, on the platform, unaffected. */
+    private settingsNoticeGenerals;
+    /**
+     * #2170: General's notice of a change confirmed from the web — the first General a chat card could have been posted
+     * in, plain text, no mentions. Information only: nothing waits on it.
+     */
+    private settingsWebConfirmedNotice;
     /** Exact configured effect owners; this does not depend on prompt location. */
     private settingsChatAuthority;
     private promptSettingsChange;
@@ -1357,7 +1384,10 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * snapshot use the fleet startup/retry state. */
     private readyProgressAdapter;
     /** Last-resort completion after RestartProgress could not deliver to its
-     * adopted target. It stays bounded and never wakes a not-ready gateway. */
+     * adopted target (or had no message: a small fleet, a failed first post). It
+     * never wakes a not-ready gateway. #2213: an outage at fleet start no longer
+     * loses it — bounded at startup, then retried in the background once the
+     * adapter is ready again, never posted twice after an uncertain attempt. */
     private sendFleetStartCompletionFallback;
     stopInstance(name: string, transition?: TransitionHandle): Promise<{
         backgroundWorkEnded: boolean;
@@ -1683,8 +1713,14 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private sweepOrphanedWebUploads;
     /** Start the shared channel adapter(s) for topic mode */
     private startSharedAdapter;
-    /** Exponential backoff retry for a single failed adapter (background, non-blocking). */
+    /** Keep trying while the fleet runs, with a five-minute cap even after a long outage. */
     private scheduleAdapterRetry;
+    /** One login per connection, shared by the background timer and the operator's Retry now. */
+    private attemptAdapterRetry;
+    retryAdapterNow(adapterId: string): {
+        queued: boolean;
+        already_running?: boolean;
+    };
     /** Notify admin about adapter failure (uses any available adapter). */
     private notifyAdapterFailure;
     /** Notify admin that a retried adapter reconnected. */
@@ -2126,6 +2162,12 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private slimFleetConfigAtStartup;
     private writeFleetConfigBackup;
     private patchFleetDocument;
+    /**
+     * #2208: before every write to the raw document — the place is unshared first (an alias on the way becomes its own
+     * copy; an anchor's other aliases get theirs), so the write changes that place only; and it is recorded for the
+     * save's check that nothing else changed.
+     */
+    private writingFleetDocument;
     getSettingsConfigPath(): string;
     removeInstance(name: string, authorization: ExplicitInstanceRemoval, execution?: SettingsExecution): Promise<void>;
     private removeInstanceOwned;

package/dist/fleet-manager.js

@@ -38,6 +38,7 @@ import { readFleetMemory } from "./process-memory.js";
 import { MemoryPressure } from "./memory-pressure.js";
 import { replyDedupText, ReplyDeduper } from "./reply-dedup.js";
 import { isMap, isScalar, parseDocument } from "yaml";
+import { changedOutside, detachForWrite } from "./yaml-shared-nodes.js";
 import { kiroLogGate } from "./kiro-log-gate.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -227,7 +228,7 @@ import { authorizeSession, decideWebGate, loadOrCreateWebToken, readWebToken } f
 import { bypassesWebGate, handleAuthRequest, serveSigninPage } from "./auth-api.js";
 import { isWebPageNavigation } from "./web-shell-routes.js";
 import { guestSessionPolicy, localSessionPolicy, tokenEpoch, WebSessionStore } from "./web-session.js";
-import { authorityNow, evaluateWebAuthority, VERIFIED_SESSION_HOURS, webAuthorityPolicy } from "./authority/web-authority.js";
+import { authorityNow, classifyWebPeer, evaluateWebAuthority, VERIFIED_SESSION_HOURS, webAuthorityPolicy } from "./authority/web-authority.js";
 import { AuthorityStateStore } from "./authority/authority-state.js";
 import { SessionAuthorizations } from "./authority/session-authorizations.js";
 import { SessionAuthorizationRequests } from "./web-session-authorization.js";
@@ -250,7 +251,7 @@ import { CHAT_PROFILE_LOGIN_BACKENDS, credentialHomeSpec, credentialProfileHome,
 import { carryClaudeConversation } from "./backend/claude-carry.js";
 import { mergeBackendOptions, profileKey, profileName, profileOf } from "./classic-bindings.js";
 import { classifyInstanceChange, CLASSIC_HOT_CONFIG_KEYS, HOT_INSTANCE_CONFIG_KEYS, hotConfigUpdate, } from "./instance-config-impact.js";
-import { cleanupWatchVerdict, formatRestartProgressCompletion, RESTART_PROGRESS_TERMINAL_TIMEOUT_MS, RestartProgress, } from "./restart-progress.js";
+import { cleanupWatchVerdict, formatRestartProgressCompletion, RestartProgress, } from "./restart-progress.js";
 import { launchFullRestartHelper } from "./full-restart.js";
 import { SYSTEMD_RESTART_INDETERMINATE_EXIT_CODE } from "./service-restart-selection.js";
 import { collectRedundantInstanceDefaultPaths } from "./fleet-yaml-slim.js";
@@ -589,6 +590,8 @@ export class FleetManager {
     fleetConfig = null;
     rawFleetConfig = {};
     rawFleetDocument = null;
+    /** #2208: the paths a saveFleetConfig() wrote, for its check that nothing else changed. */
+    fleetDocumentWrites = null;
     savedFleetConfigSnapshot = null;
     adapter = null;
     worlds = new Map();
@@ -784,6 +787,7 @@ export class FleetManager {
     /** #2175: this boot's progress message, whose completion may still be owed by its background retry. */
     startupProgress = null;
     adapterState = new Map();
+    adapterRetryInFlight = new Map();
     /** Web Settings secret rotation is deliberately separate from reconnect
      * recovery: a rotation must build a fresh provider client with the new token,
      * and stale callbacks from the old client must not win. */
@@ -1283,6 +1287,7 @@ export class FleetManager {
                     current: () => current() && sessions === this.webSessions && !!this.webToken
                         && sessions.isCurrent(record, tokenEpoch(this.webToken)) && (!exposure || exposure.isCurrent()) };
             }, baseline: () => baselines.read(), snapshot: () => baselines.snapshot(),
+            selfConfirm: (req, id) => this.settingsSelfConfirmation(store, req, id),
             job: async (id) => {
                 const settlement = this.settingsJobSettlements.get(id);
                 if (!settlement)
@@ -1297,6 +1302,86 @@ export class FleetManager {
         this.settingsConfirmation = gate;
         return gate;
     }
+    /**
+     * #2170: a held change confirmed by the request itself — only when ALL hold, else the chat card or the host CLI, as
+     * before:
+     *   - the session is web-verified (#1939: its account confirmed this browser on Discord or Telegram), asked now;
+     *   - the change's effect owners are known and on one platform (settingsChatAuthority — the chat card's own rule), the
+     *     verified account is on that platform and an admin of every one of them;
+     *   - a chat card could have been asked: a connected General on that platform the change does not affect (else the
+     *     change goes to the host CLI, as before) — the General that then hears of it;
+     *   - and, at execution (store.decide asks `current()` again): still web-verified under the same session and account
+     *     (not expired, revoked, signed out or the switch turned off), still those owners' admin, still a General a card
+     *     could go to, the fleet unchanged.
+     * What it rests on: the account's one confirmation of this browser (#1939), kept for the session until it is revoked,
+     * expires or signs out — not a fresh confirmation per Apply. Whoever uses that verified session (a browser left signed
+     * in, its cookie) confirms the same way. A public link never qualifies (evaluateWebAuthority refuses it). General
+     * still hears it: a notice, not a step.
+     */
+    settingsSelfConfirmation(store, req, id) {
+        const auth = authorizeSession(req, this.webToken, this.webSessions, { touch: false });
+        if (auth.kind !== "ok")
+            return null;
+        const record = auth.session, gateway = !!gatewayRequestContext(req), peer = classifyWebPeer(req);
+        const verified = () => {
+            const now = this.webAuthority({ session: record, gateway, peer });
+            // A refusal carries no authority (kind "none"); the handle pins the session, and with it its one account.
+            return now.authority.kind === "web-verified" && now.authority.actor && now.authority.session?.handle === record.handle ? now.authority.actor : null;
+        };
+        const actor = verified();
+        if (!actor)
+            return null;
+        const chat = this.settingsChatAuthority(store, id);
+        if (!chat)
+            return null;
+        const channels = this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []);
+        const own = channels.filter(ch => (ch.id ?? ch.type) === actor.adapter_id);
+        if (own.length !== 1 || own[0].type !== chat.platform || !chat.admin(actor.user_id))
+            return null;
+        const affected = [...store.affectedConnections(id)]; // read now: a finished change no longer has them
+        if (!this.settingsNoticeGenerals(affected, chat.platform).length)
+            return null;
+        const name = this.webPerson({ adapterId: actor.adapter_id, userId: actor.user_id }).name;
+        return {
+            label: `${name} (web-verified)`,
+            // admin() asks chat.current() too; a General a card could go to must still be there (else the host CLI's).
+            current: () => !!verified() && chat.admin(actor.user_id) && this.settingsNoticeGenerals(affected, chat.platform).length > 0,
+            done: view => this.settingsWebConfirmedNotice(view, affected, name, chat.platform),
+        };
+    }
+    /** #2170: the Generals a chat card could be posted in (promptSettingsChange's rule): connected, on the platform, unaffected. */
+    settingsNoticeGenerals(affected, platform) {
+        const excluded = new Set(affected), found = [];
+        for (const [name, config] of Object.entries(this.fleetConfig?.instances ?? {})) {
+            if (!config.general_topic || !this.daemons.get(name))
+                continue;
+            const adapterId = this.getInstanceAdapterId(name), adapter = this.getAdapterForInstance(name);
+            if (!adapterId || !adapter || excluded.has(adapterId) || adapter.type !== platform || this.adapterState.get(adapterId)?.status !== "connected")
+                continue;
+            const chatId = this.getGroupIdForInstance(name), topic = String(config.topic_id ?? "");
+            if (chatId && topic)
+                found.push({ adapterId, adapter, chatId, topic });
+        }
+        return found;
+    }
+    /**
+     * #2170: General's notice of a change confirmed from the web — the first General a chat card could have been posted
+     * in, plain text, no mentions. Information only: nothing waits on it.
+     */
+    async settingsWebConfirmedNotice(view, affected, who, platform) {
+        const outcome = view.outcome ? view.outcome.message : view.state;
+        const text = `✅ Settings change confirmed from the web by ${who} (web-verified)\nSource: ${view.source}\nRequester: ${view.requested_by}\n${view.summary.join("\n")}\nOutcome: ${outcome}`;
+        for (const { adapterId, adapter, chatId, topic } of this.settingsNoticeGenerals(affected, platform)) {
+            try {
+                await adapter.sendText(chatId, text, { threadId: topic, allowedMentions: { parse: [] } });
+                return;
+            }
+            catch {
+                this.logger.info({ id: view.id, adapterId }, "Settings web-confirmation notice unavailable; trying another General");
+            }
+        }
+        this.logger.info({ id: view.id }, "Settings change confirmed from the web: no General reachable for the notice");
+    }
     /** Exact configured effect owners; this does not depend on prompt location. */
     settingsChatAuthority(store, id) {
         const scope = store.authorityOf(id);
@@ -5297,34 +5382,18 @@ export class FleetManager {
         return this.adapterState.get(adapterId)?.status === "connected" ? adapter : undefined;
     }
     /** Last-resort completion after RestartProgress could not deliver to its
-     * adopted target. It stays bounded and never wakes a not-ready gateway. */
+     * adopted target (or had no message: a small fleet, a failed first post). It
+     * never wakes a not-ready gateway. #2213: an outage at fleet start no longer
+     * loses it — bounded at startup, then retried in the background once the
+     * adapter is ready again, never posted twice after an uncertain attempt. */
     async sendFleetStartCompletionFallback(chatId, text, threadId) {
         const adapterId = this.getPrimaryAdapterId();
-        const adapter = adapterId ? this.readyProgressAdapter(adapterId) : undefined;
-        if (!adapter) {
-            this.logger.error({ adapterId }, "Fleet start completion fallback skipped because the primary adapter is not ready");
+        if (!adapterId) {
+            this.logger.error({ adapterId }, "Fleet start completion fallback skipped because there is no primary adapter");
             return false;
         }
-        let timer;
-        const timeout = new Promise(resolve => {
-            timer = setTimeout(() => resolve({ status: "timeout" }), RESTART_PROGRESS_TERMINAL_TIMEOUT_MS);
-            timer.unref?.();
-        });
-        const delivery = Promise.resolve()
-            .then(() => adapter.sendText(chatId, text, { threadId }))
-            .then(() => ({ status: "sent" }), err => ({ status: "failed", err }));
-        const result = await Promise.race([delivery, timeout]);
-        if (timer)
-            clearTimeout(timer);
-        if (result.status === "sent")
-            return true;
-        if (result.status === "failed") {
-            this.logger.error({ err: result.err }, "Failed to send fleet start completion fallback");
-        }
-        else {
-            this.logger.error({ timeout_ms: RESTART_PROGRESS_TERMINAL_TIMEOUT_MS }, "Timed out sending fleet start completion fallback");
-        }
-        return false;
+        const poster = new RestartProgress(0, Date.now(), this.logger);
+        return poster.postCompletion({ resolveAdapter: () => this.readyProgressAdapter(adapterId), chatId, threadId }, text);
     }
     async stopInstance(name, transition) {
         this.explicitStopGeneration.set(name, (this.explicitStopGeneration.get(name) ?? 0) + 1);
@@ -7537,48 +7606,109 @@ export class FleetManager {
                 const err = results[i].reason;
                 this.logger.error({ adapterId, err: err?.message ?? err }, "Adapter startup failed — scheduling background retry");
                 this.adapterState.set(adapterId, { status: "retrying", retryCount: 0, lastError: err?.message ?? String(err) });
-                this.scheduleAdapterRetry(adapterId, channelConfigs[i], i === 0 ? fleet : undefined);
+                this.scheduleAdapterRetry(adapterId);
                 // Notify admin via whichever adapter is already up
                 this.notifyAdapterFailure(adapterId, err?.message ?? String(err));
             }
         }
     }
-    /** Exponential backoff retry for a single failed adapter (background, non-blocking). */
-    scheduleAdapterRetry(adapterId, channelConfig, fleet) {
-        const MAX_RETRIES = 10;
+    /** Keep trying while the fleet runs, with a five-minute cap even after a long outage. */
+    scheduleAdapterRetry(adapterId) {
         const INITIAL_DELAY_MS = 5_000;
         const MAX_DELAY_MS = 5 * 60_000;
         const state = this.adapterState.get(adapterId);
-        if (!state || state.retryCount >= MAX_RETRIES) {
-            if (state) {
-                state.status = "failed";
-                this.logger.error({ adapterId, retries: state.retryCount }, "Adapter retry exhausted — giving up");
-                this.notifyAdapterFailure(adapterId, `Retry exhausted after ${state.retryCount} attempts. Check token/network and restart fleet.`);
-            }
+        if (this.shuttingDown || !state || state.retryTimer || this.adapterRetryInFlight.has(adapterId))
             return;
-        }
-        const delay = Math.min(INITIAL_DELAY_MS * Math.pow(2, state.retryCount), MAX_DELAY_MS);
+        const delay = Math.min(INITIAL_DELAY_MS * Math.pow(2, Math.min(state.retryCount, 6)), MAX_DELAY_MS);
         this.logger.info({ adapterId, attempt: state.retryCount + 1, delay_ms: delay }, "Scheduling adapter retry");
-        state.retryTimer = setTimeout(async () => {
+        const timer = setTimeout(() => {
+            const current = this.adapterState.get(adapterId);
+            if (this.shuttingDown || current?.retryTimer !== timer)
+                return;
+            current.retryTimer = undefined;
+            void this.attemptAdapterRetry(adapterId);
+        }, delay);
+        state.retryTimer = timer;
+        timer.unref?.();
+    }
+    /** One login per connection, shared by the background timer and the operator's Retry now. */
+    attemptAdapterRetry(adapterId) {
+        const pending = this.adapterRetryInFlight.get(adapterId);
+        if (pending)
+            return pending;
+        if (this.shuttingDown || !this.secureConnectionChannel(adapterId))
+            return Promise.resolve();
+        const attempt = Promise.resolve().then(async () => {
+            const channel = this.secureConnectionChannel(adapterId);
+            if (this.shuttingDown || !channel)
+                return;
+            const generation = this.settingsGeneration;
+            const binding = JSON.stringify([channel, this.getPrimaryAdapterId()]);
+            const token = process.env[channel.bot_token_env];
+            const operation = { owner: Symbol("adapter-retry"), assert: () => {
+                    if (this.shuttingDown || generation !== this.settingsGeneration
+                        || JSON.stringify([this.secureConnectionChannel(adapterId), this.getPrimaryAdapterId()]) !== binding
+                        || process.env[channel.bot_token_env] !== token)
+                        throw new Error("adapter retry superseded");
+                } };
+            const state = this.adapterState.get(adapterId) ?? { status: "retrying", retryCount: 0 };
+            state.status = "retrying";
             state.retryCount++;
+            this.adapterState.set(adapterId, state);
             try {
-                if (fleet) {
-                    await this.startSingleAdapter(fleet, channelConfig);
-                }
-                else {
-                    await this.startAdditionalAdapter(channelConfig);
-                }
-                state.status = "connected";
-                state.lastError = undefined;
+                if (this.getPrimaryAdapterId() === adapterId)
+                    await this.startSingleAdapter(this.fleetConfig, channel, undefined, operation);
+                else
+                    await this.startAdditionalAdapter(channel, true, undefined, operation);
+                if (this.shuttingDown || generation !== this.settingsGeneration)
+                    return;
+                if (!this.adapters.has(adapterId))
+                    throw new Error("Adapter token is not configured");
+                // Health events can replace the state object during login. Update its current owner.
+                const current = this.adapterState.get(adapterId);
+                current.status = "connected";
+                current.lastError = undefined;
                 this.logger.info({ adapterId, attempts: state.retryCount }, "Adapter reconnected on retry");
                 this.notifyAdapterRecovery(adapterId, state.retryCount);
             }
             catch (err) {
-                state.lastError = err?.message ?? String(err);
-                this.logger.warn({ adapterId, attempt: state.retryCount, err: state.lastError }, "Adapter retry failed");
-                this.scheduleAdapterRetry(adapterId, channelConfig, fleet);
+                if (this.shuttingDown || generation !== this.settingsGeneration)
+                    return;
+                const current = this.adapterState.get(adapterId);
+                current.status = "retrying";
+                current.lastError = err?.message ?? String(err);
+                this.logger.warn({ adapterId, attempt: state.retryCount, err: current.lastError }, "Adapter retry failed");
             }
-        }, delay);
+        }).finally(() => {
+            if (this.adapterRetryInFlight.get(adapterId) !== attempt)
+                return;
+            this.adapterRetryInFlight.delete(adapterId);
+            const channel = this.secureConnectionChannel(adapterId);
+            if (!this.shuttingDown && channel && this.adapterState.get(adapterId)?.status !== "connected") {
+                this.scheduleAdapterRetry(adapterId);
+            }
+        });
+        this.adapterRetryInFlight.set(adapterId, attempt);
+        return attempt;
+    }
+    retryAdapterNow(adapterId) {
+        if (this.shuttingDown)
+            throw new Error("The fleet is stopping");
+        if (!this.secureConnectionChannel(adapterId))
+            throw new Error("Connection not found");
+        if (this.adapterRetryInFlight.has(adapterId) || this.adapterRestarting.has(adapterId))
+            return { queued: true, already_running: true };
+        const state = this.adapterState.get(adapterId);
+        if (state?.retryTimer) {
+            clearTimeout(state.retryTimer);
+            state.retryTimer = undefined;
+        }
+        const adapter = this.adapters.get(adapterId);
+        if (adapter && this.connectionStatus(adapterId, state, this.worlds.get(adapterId)).status === "connected")
+            return { queued: false };
+        const run = adapter ? this.restartAdapter(adapter, adapterId) : this.attemptAdapterRetry(adapterId);
+        void run.catch(err => this.logger.warn({ adapterId, err }, "Requested adapter retry failed"));
+        return { queued: true };
     }
     /** Notify admin about adapter failure (uses any available adapter). */
     notifyAdapterFailure(adapterId, error) {
@@ -7633,6 +7763,7 @@ export class FleetManager {
                 : snapshot.status === "stopped" ? "failed"
                     : "retrying";
             this.adapterState.set(adapterId, {
+                ...previous,
                 status,
                 retryCount: previous?.retryCount ?? 0,
                 lastError: status === "connected" ? undefined : snapshot.lastReconnectReason ?? previous?.lastError,
@@ -9458,6 +9589,16 @@ export class FleetManager {
             respond(null, permitted.message);
             return;
         }
+        // Fleet tools resolve their own targets. A missing chat world must not prevent local
+        // delivery, inspection or receipt lookup; only channel tools need reply routing below.
+        const handler = outboundHandlers.get(tool);
+        if (handler && !usesChannelAddress(tool)) {
+            this.eventLog?.logActivity("tool_call", senderSessionName ?? instanceName, this.summarizeToolCall(tool, args));
+            await handler(this, args, respond, {
+                instanceName, requestId, fleetRequestId, senderSessionName, operationId, sourceDaemonBootId,
+            });
+            return;
+        }
         // A fleet with no chat platform at all is driven from the web dashboard alone: a reply has nowhere
         // else to go, and "retry shortly" would have the agent retry forever. It goes to the web chat.
         const webOnlyReply = tool === "reply" && this.worlds.size === 0 && this.isWebOnlyFleet();
@@ -9649,19 +9790,14 @@ export class FleetManager {
         if (routeToolCall(outAdapter, tool, args, threadId, respond)) {
             return;
         }
-        // Log tool calls for activity visualization
-        const senderLabel = senderSessionName ?? instanceName;
-        this.eventLog?.logActivity("tool_call", senderLabel, this.summarizeToolCall(tool, args));
-        // Dispatch fleet-specific tools via handler map
-        const handler = outboundHandlers.get(tool);
         if (handler) {
+            this.eventLog?.logActivity("tool_call", senderSessionName ?? instanceName, this.summarizeToolCall(tool, args));
             await handler(this, args, respond, {
                 instanceName, requestId, fleetRequestId, senderSessionName, operationId, sourceDaemonBootId,
             });
         }
-        else {
+        else
             respond(null, `Unknown tool: ${tool}`);
-        }
     }
     /** Side effects of a routed reply: cancel-button lifecycle, logs, SSE, chat log. */
     /** No chat platform is configured at all: the web dashboard is the fleet's only surface. */
@@ -11013,6 +11149,10 @@ export class FleetManager {
             throw new Error(`Refusing to overwrite invalid fleet.yaml: ${this.rawFleetDocument.errors[0].message}`);
         }
         this.rawFleetConfig = loadRawFleetConfig(this.configPath);
+        // #2208: what the file says before this save, aliases expanded — every write below is recorded, and anything that
+        // changes outside them (a place sharing a node with one written) refuses the save.
+        const fileBefore = this.rawFleetDocument.toJS({ maxAliasCount: -1 });
+        const writes = this.fleetDocumentWrites = []; // a throw below leaves it to the next save
         this.patchFleetDocument(this.rawFleetDocument, [], this.savedFleetConfigSnapshot, this.fleetConfig);
         // Settings edits are expressed against the raw config, so apply them before
         // canonicalization. A non-identity value equal to its inherited default is
@@ -11023,6 +11163,7 @@ export class FleetManager {
                 // (or a legacy scalar occupies that parent). Removing an override which
                 // is already absent is an idempotent no-op, not a failed Settings save.
                 if (this.rawFleetDocument.hasIn(patch.path)) {
+                    this.writingFleetDocument(this.rawFleetDocument, patch.path);
                     this.rawFleetDocument.deleteIn(patch.path);
                 }
             }
@@ -11034,8 +11175,10 @@ export class FleetManager {
         const rawAfterPatches = this.rawFleetDocument.toJS();
         const redundantPaths = collectRedundantInstanceDefaultPaths(rawAfterPatches);
         for (const path of redundantPaths) {
-            if (this.rawFleetDocument.hasIn(path))
+            if (this.rawFleetDocument.hasIn(path)) {
+                this.writingFleetDocument(this.rawFleetDocument, path);
                 this.rawFleetDocument.deleteIn(path);
+            }
             // Avoid leaving empty operational maps such as `terminal: {}` while
             // preserving the instance mapping itself and all surrounding comments.
             for (let depth = path.length - 1; depth > 2; depth--) {
@@ -11043,9 +11186,14 @@ export class FleetManager {
                 const parent = this.rawFleetDocument.getIn(parentPath, true);
                 if (!isMap(parent) || parent.items.length > 0)
                     break;
+                this.writingFleetDocument(this.rawFleetDocument, parentPath);
                 this.rawFleetDocument.deleteIn(parentPath);
             }
         }
+        this.fleetDocumentWrites = null;
+        const stray = changedOutside(fileBefore, this.rawFleetDocument.toJS({ maxAliasCount: -1 }), writes);
+        if (stray)
+            throw new Error(`Refusing to save fleet.yaml: this change would also change ${stray}, which shares a value with what it edits. Give each its own value in fleet.yaml.`);
         noteSettingsWrite(this.configPath, this.savedFleetConfigSnapshot, this.fleetConfig);
         const output = String(this.rawFleetDocument);
         if (redundantPaths.length > 0)
@@ -11156,11 +11304,15 @@ export class FleetManager {
             // Remove from the end so YAML sequence indexes do not shift underneath us.
             for (let i = before.length - 1; i >= after.length; i--) {
                 const itemPath = [...path, i];
-                if (document.hasIn(itemPath))
+                if (document.hasIn(itemPath)) {
+                    this.writingFleetDocument(document, itemPath);
                     document.deleteIn(itemPath);
+                }
             }
-            for (let i = shared; i < after.length; i++)
+            for (let i = shared; i < after.length; i++) {
+                this.writingFleetDocument(document, [...path, i]);
                 document.setIn([...path, i], after[i]);
+            }
             return;
         }
         const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -11176,6 +11328,7 @@ export class FleetManager {
                 if (isMap(fresh)) {
                     const list = document.createNode([]);
                     list.items.push(fresh.clone());
+                    this.writingFleetDocument(document, ["channels"]);
                     document.setIn(["channels"], list);
                 }
             }
@@ -11197,13 +11350,17 @@ export class FleetManager {
             // Effective config contains inherited objects that may not exist in the
             // raw YAML at all. yaml.deleteIn() is not idempotent for a missing nested
             // parent, so guard it explicitly.
-            if (document.hasIn(path))
+            if (document.hasIn(path)) {
+                this.writingFleetDocument(document, path);
                 document.deleteIn(path);
+            }
         }
         else if (path.length === 0) {
+            this.writingFleetDocument(document, path);
             document.contents = document.createNode(after);
         }
         else {
+            this.writingFleetDocument(document, path);
             const currentNode = document.getIn(path, true);
             if (isScalar(currentNode) && (after === null || typeof after !== "object")) {
                 currentNode.value = after;
@@ -11218,6 +11375,15 @@ export class FleetManager {
             }
         }
     }
+    /**
+     * #2208: before every write to the raw document — the place is unshared first (an alias on the way becomes its own
+     * copy; an anchor's other aliases get theirs), so the write changes that place only; and it is recorded for the
+     * save's check that nothing else changed.
+     */
+    writingFleetDocument(document, path) {
+        detachForWrite(document, path);
+        this.fleetDocumentWrites?.push([...path]);
+    }
     getSettingsConfigPath() { return this.configPath; }
     async removeInstance(name, authorization, execution) {
         if (execution)
@@ -20493,7 +20659,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
                 all = false;
                 const message = err?.message ?? String(err);
                 this.adapterState.set(id, { status: "retrying", retryCount: 0, lastError: message });
-                this.scheduleAdapterRetry(id, channel);
+                this.scheduleAdapterRetry(id);
             }
         }
         this.classicChannels?.configureAdapters(this.fleetConfig?.channels ?? (this.fleetConfig?.channel ? [this.fleetConfig.channel] : []));